Authentication Plugins Note PAM Authentication Access to Unix Password Store PAM Authentication Debugging The client-side  mysql_clear_password  authentication plugin leaves the password untouched, so client programs send it to the MySQL server as cleartext. This enables the password to be passed as is to PAM. A cleartext password is necessary to use the server-side PAM library, but may be a security problem in some configurations. These measures minimize the risk: On some systems, Unix authentication uses a password store such as  /etc/shadow , a file that typically has restricted access permissions. This can cause MySQL PAM-based authentication to fail. Unfortunately, the PAM implementation does not permit distinguishing “password could not be checked”  (due, for example, to inability to read  /etc/shadow ) from “password does not match.”  If you are using Unix password store for PAM authentication, you may be able to enable access to it from MySQL using one of the following methods: Adjust the path to  unix_chkpwd  as necessary for your platform. The PAM authentication plugin checks at initialization time whether the  AUTHENTICATION_PAM_LOG environment value is set (the value does not matter). If so, the plugin enables logging of diagnostic messages to the standard output. These messages may be helpful for debugging PAM-related issues that occur when the plugin performs authentication. Some messages include reference to PAM plugin source files and line numbers, which enables plugin actions to be tied more closely to the location in the code where they occur. 1327 •If you are using the  pam_unix  module and the  unix_chkpwd  utility, enable password store access as follows: 4. Restart the MySQL server. 3. Assign  /etc/group  to the  shadow  group and enable the group read permission: 2. Add the  mysql  operating system user to the  shadow  group in  /etc/group . 1. Create a  shadow  group in  /etc/group . •Assuming that the MySQL server is run from the  mysql  operating system account, put that account in the  shadow  group that has  /etc/shadow  access: •To make inadvertent use of the  mysql_clear_password  plugin less likely, MySQL clients must explicitly enable it (for example, with the  --enable- cleartext-plugin  option). See Section 6.4.1.4, “Client-Side Cleartext Pluggable Authentication” . •To avoid password exposure with the  mysql_clear_password  plugin enabled, MySQL clients should connect to the MySQL server using an encrypted connection. See Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . chgrp shadow /etc/shadow chmod g+r /etc/shadow chmod u-s /usr/sbin/unix_chkpwd setcap cap_dac_read_search+ep /usr/sbin/unix_chkpwd