6.4.1.4 Client-Side Cleartext Pluggable Authentication客户端明文可插入身份验证

A client-side authentication plugin is available that enables clients to send passwords to the server as cleartext, without hashing or encryption. This plugin is built into the MySQL client library.客户端身份验证插件可用,使客户端能够以明文形式向服务器发送密码,而无需哈希或加密。此插件内置于MySQL客户端库中。

The following table shows the plugin name.下表显示了插件名称。

Table 6.15 Plugin and Library Names for Cleartext Authentication明文身份验证的插件和库名称

Plugin or File插件或文件Plugin or File Name插件或文件名
Server-side plugin服务器端插件None, see discussion无,请参阅讨论
Client-side plugin客户端插件mysql_clear_password
Library file库文件None (plugin is built in)无(插件内置)

Many client-side authentication plugins perform hashing or encryption of a password before the client sends it to the server. This enables clients to avoid sending passwords as cleartext.许多客户端身份验证插件在客户端将密码发送到服务器之前对密码进行哈希或加密。这使客户端能够避免以明文形式发送密码。

Hashing or encryption cannot be done for authentication schemes that require the server to receive the password as entered on the client side. 对于要求服务器接收在客户端输入的密码的身份验证方案,无法进行哈希或加密。In such cases, the client-side mysql_clear_password plugin is used, which enables the client to send the password to the server as cleartext. 在这种情况下,使用客户端mysql_clear_password插件,它使客户端能够以明文形式将密码发送到服务器。There is no corresponding server-side plugin. Rather, mysql_clear_password can be used on the client side in concert with any server-side plugin that needs a cleartext password. 没有相应的服务器端插件。相反,mysql_clear_password可以在客户端与任何需要明文密码的服务器端插件配合使用。(Examples are the PAM and simple LDAP authentication plugins; see Section 6.4.1.5, “PAM Pluggable Authentication”, and Section 6.4.1.7, “LDAP Pluggable Authentication”.)(例如PAM和简单的LDAP身份验证插件;请参阅第6.4.1.5节,“PAM可插拔身份验证”第6.4.1.7节,“LDAP可插拔身份认证”。)

The following discussion provides usage information specific to cleartext pluggable authentication. For general information about pluggable authentication in MySQL, see Section 6.2.17, “Pluggable Authentication”.以下讨论提供了特定于明文可插拔身份验证的使用信息。有关MySQL中可插拔身份验证的一般信息,请参阅第6.2.17节,“可插拔身份认证”

Note注意

Sending passwords as cleartext may be a security problem in some configurations. To avoid problems if there is any possibility that the password would be intercepted, clients should connect to MySQL Server using a method that protects the password. 在某些配置中,以明文形式发送密码可能是一个安全问题。为了避免密码被拦截的可能性,客户端应使用保护密码的方法连接到MySQL服务器。Possibilities include SSL (see Section 6.3, “Using Encrypted Connections”), IPsec, or a private network.可能性包括SSL(参阅第6.3节,“使用加密连接”)、IPsec或专用网络。

To make inadvertent use of the mysql_clear_password plugin less likely, MySQL clients must explicitly enable it. This can be done in several ways:为了减少无意中使用mysql_clear_password插件的可能性,mysql客户端必须显式启用它。这可以通过多种方式实现: