0

Is there a query that a MySQL user that does not have admin rights can run to determine if they are using the old (pre-4.1) hash or the new (4.1-and-later) hash? This user was explicitly granted access only to their own database and not to any of the system tables (such as mysql.user).

This is on a MySQL 5.5 system.

2 Answers 2

1

No, a user would need SELECT on mysql.user to be able to read the password column, or the SUPER privilege to be able to see the password in the output of SHOW GRANTS. I think both of those would be classed as "admin rights".

0
mysql> SHOW VARIABLES LIKE 'old_passwords';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| old_passwords | 0     |
+---------------+-------+

ysql> SHOW GRANTS;
------------------------------------------------------------------------------------------------------------+
 Grants for try@localhost                                                                                   |
------------------------------------------------------------------------------------------------------------+
 GRANT USAGE ON *.* TO 'try'@'localhost' IDENTIFIED BY PASSWORD '*01E3DDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
 GRANT ALL PRIVILEGES ON `try`.* TO 'try'@'localhost'                                                       |
------------------------------------------------------------------------------------------------------------+

The first query says whether old passwords are allow (0=no).

The second shows my encrypted password; it is a "new" password. If had been something like BY PASSWORD '012346789ABCDEF', it would be "old".

Old: 16 hex; New: '*' plus lots of hex.

Try it on yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.