<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="faqs-security">
      </a>
      A.9 MySQL 8.4 FAQ: Security
     </h2>
    </div>
   </div>
  </div>
  <div class="qandaset">
   <a name="idm46045056128208">
   </a>
   <dl>
    <dt>
     A.9.1.
     <a href="faqs-security.html#faq-mysql-where-docs-security">
      Where can I find documentation that addresses security issues
        for MySQL?
     </a>
    </dt>
    <dt>
     A.9.2.
     <a href="faqs-security.html#faq-mysql-default-authentication-plugin">
      What is the default authentication plugin in MySQL
        8.4?
     </a>
    </dt>
    <dt>
     A.9.3.
     <a href="faqs-security.html#faq-mysql-have-native-ssl">
      Does MySQL have native support for SSL?
     </a>
    </dt>
    <dt>
     A.9.4.
     <a href="faqs-security.html#faq-mysql-is-ssl-available">
      Is SSL support built into MySQL binaries, or must I recompile
        the binary myself to enable it?
     </a>
    </dt>
    <dt>
     A.9.5.
     <a href="faqs-security.html#faq-mysql-have-builtin-ldap">
      Does MySQL have built-in authentication against LDAP
        directories?
     </a>
    </dt>
    <dt>
     A.9.6.
     <a href="faqs-security.html#faq-mysql-have-builtin-rbac">
      Does MySQL include support for Roles Based Access Control
        (RBAC)?
     </a>
    </dt>
    <dt>
     A.9.7.
     <a href="faqs-security.html#faq-mysql-tls-versions">
      Does MySQL support TLS 1.0 and 1.1?
     </a>
    </dt>
   </dl>
   <table border="0" style="width: 100%;">
    <colgroup>
     <col align="left" width="1%"/>
     <col/>
    </colgroup>
    <tbody>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-where-docs-security">
       </a>
       <a name="idm46045056127456">
       </a>
       <p>
        <b>
         A.9.1.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Where can I find documentation that addresses security issues
        for MySQL?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        The best place to start is
        <a class="xref" href="security.html" title="Chapter 8 Security">
         Chapter 8,
         <i>
          Security
         </i>
        </a>
        .
       </p>
       <p>
        Other portions of the MySQL Documentation which you may find
        useful with regard to specific security concerns include the
        following:
       </p>
       <div class="itemizedlist">
        <ul class="itemizedlist" style="list-style-type: disc; ">
         <li class="listitem">
          <p>
           <a class="xref" href="security-guidelines.html" title="8.1.1 Security Guidelines">
            Section 8.1.1, “Security Guidelines”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="security-against-attack.html" title="8.1.3 Making MySQL Secure Against Attackers">
            Section 8.1.3, “Making MySQL Secure Against Attackers”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="resetting-permissions.html" title="B.3.3.2 How to Reset the Root Password">
            Section B.3.3.2, “How to Reset the Root Password”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="changing-mysql-user.html" title="8.1.5 How to Run MySQL as a Normal User">
            Section 8.1.5, “How to Run MySQL as a Normal User”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="security-options.html" title="8.1.4 Security-Related mysqld Options and Variables">
            Section 8.1.4, “Security-Related mysqld Options and Variables”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="load-data-local-security.html" title="8.1.6 Security Considerations for LOAD DATA LOCAL">
            Section 8.1.6, “Security Considerations for LOAD DATA LOCAL”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="postinstallation.html" title="2.9 Postinstallation Setup and Testing">
            Section 2.9, “Postinstallation Setup and Testing”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
            Section 8.3, “Using Encrypted Connections”
           </a>
           .
          </p>
         </li>
         <li class="listitem">
          <p>
           <a class="ulink" href="/doc/extending-mysql/8.4/en/adding-loadable-function.html#loadable-function-security" target="_top">
            Loadable Function Security Precautions
           </a>
           .
          </p>
         </li>
        </ul>
       </div>
       <p>
       </p>
       <p>
        There is also the
        <a class="ulink" href="/doc/mysql-secure-deployment-guide/8.0/en/" target="_top">
         Secure
        Deployment Guide
        </a>
        , which provides procedures for
        deploying a generic binary distribution of MySQL Enterprise Edition Server with
        features for managing the security of your MySQL installation.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-default-authentication-plugin">
       </a>
       <a name="idm46045056108544">
       </a>
       <p>
        <b>
         A.9.2.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        What is the default authentication plugin in MySQL
        8.4?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        The default authentication plugin as of MySQL 8.0 is
        <code class="literal">
         caching_sha2_password
        </code>
        . For information about
        this plugin, see
        <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
         Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
        </a>
        .
       </p>
       <p>
        The
        <code class="literal">
         caching_sha2_password
        </code>
        plugin provides
        more secure password encryption than the deprecated
        <code class="literal">
         mysql_native_password
        </code>
        plugin (the default
        plugin in MySQL versions before MySQL 8.0). For information
        about the implications of this change of default plugin for
        server operation and compatibility of the server with clients
        and connectors, see
        <a class="ulink" href="/doc/refman/8.0/en/upgrading-from-previous-series.html#upgrade-caching-sha2-password" target="_top">
         caching_sha2_password as the Preferred Authentication Plugin
        </a>
        .
       </p>
       <p>
        For general information about pluggable authentication and other
        available authentication plugins, see
        <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
         Section 8.2.17, “Pluggable Authentication”
        </a>
        , and
        <a class="xref" href="authentication-plugins.html" title="8.4.1 Authentication Plugins">
         Section 8.4.1, “Authentication Plugins”
        </a>
        .
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-have-native-ssl">
       </a>
       <a name="idm46045056100112">
       </a>
       <p>
        <b>
         A.9.3.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does MySQL have native support for SSL?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Yes, the binaries have support for SSL connections between the
        client and server. See
        <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
         Section 8.3, “Using Encrypted Connections”
        </a>
        .
       </p>
       <p>
        You can also tunnel a connection using SSH, if (for example) the
        client application does not support SSL connections. For an
        example, see
        <a class="xref" href="windows-and-ssh.html" title="8.3.4 Connecting to MySQL Remotely from Windows with SSH">
         Section 8.3.4, “Connecting to MySQL Remotely from Windows with SSH”
        </a>
        .
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-is-ssl-available">
       </a>
       <a name="idm46045056096176">
       </a>
       <p>
        <b>
         A.9.4.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Is SSL support built into MySQL binaries, or must I recompile
        the binary myself to enable it?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Yes, the binaries have SSL enabled for client/server connections
        that are secured, authenticated, or both. See
        <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
         Section 8.3, “Using Encrypted Connections”
        </a>
        .
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-have-builtin-ldap">
       </a>
       <a name="idm46045056093360">
       </a>
       <p>
        <b>
         A.9.5.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does MySQL have built-in authentication against LDAP
        directories?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        The Enterprise edition includes a
        <a class="link" href="pam-pluggable-authentication.html" title="8.4.1.5 PAM Pluggable Authentication">
         PAM Authentication
        Plugin
        </a>
        that supports authentication against an LDAP
        directory.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-have-builtin-rbac">
       </a>
       <a name="idm46045056090448">
       </a>
       <p>
        <b>
         A.9.6.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does MySQL include support for Roles Based Access Control
        (RBAC)?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Not at this time.
       </p>
      </td>
     </tr>
     <tr class="question">
      <td align="left" valign="top">
       <a name="faq-mysql-tls-versions">
       </a>
       <a name="idm46045056088464">
       </a>
       <p>
        <b>
         A.9.7.
        </b>
       </p>
      </td>
      <td align="left" valign="top">
       <p>
        Does MySQL support TLS 1.0 and 1.1?
       </p>
      </td>
     </tr>
     <tr class="answer">
      <td align="left" valign="top">
      </td>
      <td align="left" valign="top">
       <p>
        Support for the TLSv1 and TLSv1.1 connection protocols is
        removed as of MySQL 8.0.28. The protocols were deprecated from
        MySQL 8.0.26. For the consequences of that removal, see
        <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-deprecated-protocols" title="Removal of Support for the TLSv1 and TLSv1.1 Protocols">
         Removal of Support for the TLSv1 and TLSv1.1 Protocols
        </a>
        .
       </p>
       <p>
        Support for TLS versions 1.0 and 1.1 is removed because those
        protocol versions are old, released in 1996 and 2006,
        respectively. The algorithms used are weak and outdated.
       </p>
       <p>
        Unless you are using very old versions of MySQL Server or
        connectors, you are unlikely to have connections using TLS 1.0
        or 1.1. MySQL connectors and clients select the highest TLS
        version available by default.
       </p>
       <p>
        <span class="emphasis">
         <em>
          When was support for TLS 1.2 added to MySQL
        Server?
         </em>
        </span>
        MySQL Community Server added TLS 1.2 support
        when the community server switched to OpenSSL for MySQL 5.6,
        5.7, and 8.0 in 2019. For MySQL Enterprise Edition, OpenSSL added TLS 1.2 support
        in 2015, in MySQL Server 5.7.10.
       </p>
       <p>
        <span class="emphasis">
         <em>
          How can one view which TLS versions are in active
        use?
         </em>
        </span>
        For MySQL 5.7 or 8.0, review whether TLS 1.0 or
        1.1 is in use by running this query:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa79741828"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span>
  <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>thread_id<span class="token punctuation">`</span><span class="token punctuation">,</span> <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>ssl_version<span class="token punctuation">`</span><span class="token punctuation">,</span>
  <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>ssl_cipher<span class="token punctuation">`</span><span class="token punctuation">,</span> <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>ssl_sessions_reused<span class="token punctuation">`</span>
<span class="token keyword">FROM</span> <span class="token punctuation">`</span>sys<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span> 
<span class="token keyword">WHERE</span> ssl_version <span class="token operator">NOT</span> <span class="token keyword">IN</span> <span class="token punctuation">(</span><span class="token string">'TLSv1.3'</span><span class="token punctuation">,</span><span class="token string">'TLSv1.2'</span><span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
       </div>
       <p>
        If a thread using TLSv1.0 or TLSv1.1 is listed, you can
        determine where this connection is coming from by running this
        query:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa34070341"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> thd_id<span class="token punctuation">,</span>conn_id<span class="token punctuation">,</span> <span class="token keyword">user</span><span class="token punctuation">,</span> db<span class="token punctuation">,</span> current_statement<span class="token punctuation">,</span> program_name 
<span class="token keyword">FROM</span> sys<span class="token punctuation">.</span><span class="token keyword">processlist</span>
<span class="token keyword">WHERE</span> thd_id <span class="token keyword">IN</span> <span class="token punctuation">(</span>
                  <span class="token keyword">SELECT</span> <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>thread_id<span class="token punctuation">`</span>
                  <span class="token keyword">FROM</span> <span class="token punctuation">`</span>sys<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span> 
                  <span class="token keyword">WHERE</span> ssl_version <span class="token operator">NOT</span> <span class="token keyword">IN</span> <span class="token punctuation">(</span><span class="token string">'TLSv1.3'</span><span class="token punctuation">,</span><span class="token string">'TLSv1.2'</span><span class="token punctuation">)</span>
                <span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
       </div>
       <p>
        Alternatively, you can run this query:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa64272371"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token operator">*</span> 
<span class="token keyword">FROM</span> sys<span class="token punctuation">.</span><span class="token keyword">session</span> 
<span class="token keyword">WHERE</span> thd_id <span class="token keyword">IN</span> <span class="token punctuation">(</span>
                  <span class="token keyword">SELECT</span> <span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>thread_id<span class="token punctuation">`</span>
                  <span class="token keyword">FROM</span> <span class="token punctuation">`</span>sys<span class="token punctuation">`</span><span class="token punctuation">.</span><span class="token punctuation">`</span>session_ssl_status<span class="token punctuation">`</span> 
                  <span class="token keyword">WHERE</span> ssl_version <span class="token operator">NOT</span> <span class="token keyword">IN</span> <span class="token punctuation">(</span><span class="token string">'TLSv1.3'</span><span class="token punctuation">,</span><span class="token string">'TLSv1.2'</span><span class="token punctuation">)</span>
                <span class="token punctuation">)</span><span class="token punctuation">;</span></code></pre>
       </div>
       <p>
        These queries provide details needed to determine which
        application is not supporting TLS 1.2 or 1.3, and target
        upgrades for those.
       </p>
       <p>
        <span class="emphasis">
         <em>
          Are there other options for testing for TLS 1.0 or
        1.1?
         </em>
        </span>
        Yes, you can disable those versions prior to
        upgrading your server to a newer version. Explicitly specify
        which version to use, either in
        <code class="filename">
         mysql.cnf
        </code>
        (or
        <code class="filename">
         mysql.ini
        </code>
        ) or by using
        <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
         <code class="literal">
          SET
        PERSIST
         </code>
        </a>
        , for example:
        <a class="link" href="server-system-variables.html#sysvar_tls_version">
         <code class="literal">
          --tls-version=TLSv12
         </code>
        </a>
        .
       </p>
       <p>
        <span class="emphasis">
         <em>
          Do all MySQL Connectors (5.7 and 8.0) support TLS 1.2
        and higher? What about C and C++ applications using
          <code class="literal">
           libmysql
          </code>
          ?
         </em>
        </span>
        For C and C++
        applications using the community
        <code class="literal">
         libmysqlclient
        </code>
        library, use an OpenSSL-based
        library (that is, do
        <span class="emphasis">
         <em>
          not
         </em>
        </span>
        use YaSSL). Usage
        of OpenSSL was unified in 2018 (in MySQL 8.0.4 and 5.7.28,
        respectively). The same applies for Connector/ODBC and
        Connector/C++. To determine what library dependencies are used,
        run the following commands to see if OpenSSL is listed. On
        Linux, use this command:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa31037388"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">sudo</span> ldd usr/local/mysql/lib/libmysqlclient<span class="token punctuation">.</span>a | grep <span class="token property">-i</span> openssl</code></pre>
       </div>
       <p>
        On MacOS, use this command:
       </p>
       <div class="copytoclipboard-wrapper">
        <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa62976448"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">sudo</span> otool <span class="token property">-l</span> /usr/local/mysql/lib/libmysqlclient<span class="token punctuation">.</span>a | grep <span class="token property">-i</span> openssl</code></pre>
       </div>
       <p>
        Check the documentation for each connector, but they do support
        TLS 1.2 and TLS 1.3.
       </p>
      </td>
     </tr>
    </tbody>
   </table>
  </div>
 </div>
 <br/>
</div>
