<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="cleartext-pluggable-authentication">
      </a>
      8.4.1.4 Client-Side Cleartext Pluggable Authentication
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045245966048">
  </a>
  <a class="indexterm" name="idm46045245964944">
  </a>
  <p>
   A client-side authentication plugin is available that enables
        clients to send passwords to the server as cleartext, without
        hashing or encryption. This plugin is built into the MySQL
        client library.
  </p>
  <p>
   The following table shows the plugin name.
  </p>
  <div class="table">
   <a name="idm46045245962352">
   </a>
   <p class="title">
    <b>
     Table 8.17 Plugin and Library Names for Cleartext Authentication
    </b>
   </p>
   <div class="table-contents">
    <table summary="Names for the plugins and library file used for cleartext password authentication.">
     <colgroup>
      <col style="width: 30%"/>
      <col style="width: 70%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Plugin or File
       </th>
       <th>
        Plugin or File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Server-side plugin
       </td>
       <td>
        None, see discussion
       </td>
      </tr>
      <tr>
       <td>
        Client-side plugin
       </td>
       <td>
        <code class="literal">
         mysql_clear_password
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Library file
       </td>
       <td>
        None (plugin is built in)
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   Many client-side authentication plugins perform hashing or
        encryption of a password before the client sends it to the
        server. This enables clients to avoid sending passwords as
        cleartext.
  </p>
  <p>
   Hashing or encryption cannot be done for authentication schemes
        that require the server to receive the password as entered on
        the client side. In such cases, the client-side
   <code class="literal">
    mysql_clear_password
   </code>
   plugin is used, which
        enables the client to send the password to the server as
        cleartext. There is no corresponding server-side plugin. Rather,
   <code class="literal">
    mysql_clear_password
   </code>
   can be used on the
        client side in concert with any server-side plugin that needs a
        cleartext password. (Examples are the PAM and simple LDAP
        authentication plugins; see
   <a class="xref" href="pam-pluggable-authentication.html" title="8.4.1.5 PAM Pluggable Authentication">
    Section 8.4.1.5, “PAM Pluggable Authentication”
   </a>
   , and
   <a class="xref" href="ldap-pluggable-authentication.html" title="8.4.1.7 LDAP Pluggable Authentication">
    Section 8.4.1.7, “LDAP Pluggable Authentication”
   </a>
   .)
  </p>
  <p>
   The following discussion provides usage information specific to
        cleartext pluggable authentication. For general information
        about pluggable authentication in MySQL, see
   <a class="xref" href="pluggable-authentication.html" title="8.2.17 Pluggable Authentication">
    Section 8.2.17, “Pluggable Authentication”
   </a>
   .
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    Sending passwords as cleartext may be a security problem in
          some configurations. To avoid problems if there is any
          possibility that the password would be intercepted, clients
          should connect to MySQL Server using a method that protects
          the password. Possibilities include SSL (see
    <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
     Section 8.3, “Using Encrypted Connections”
    </a>
    ), IPsec, or a private
          network.
   </p>
  </div>
  <p>
   To make inadvertent use of the
   <code class="literal">
    mysql_clear_password
   </code>
   plugin less likely,
        MySQL clients must explicitly enable it. This can be done in
        several ways:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Set the
      <code class="literal">
       LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN
      </code>
      environment variable to a value that begins with
      <code class="literal">
       1
      </code>
      ,
      <code class="literal">
       Y
      </code>
      , or
      <code class="literal">
       y
      </code>
      . This enables the plugin for all client
            connections.
     </p>
    </li>
    <li class="listitem">
     <p>
      The
      <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
       <span class="command">
        <strong>
         mysql
        </strong>
       </span>
      </a>
      ,
      <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
       <span class="command">
        <strong>
         mysqladmin
        </strong>
       </span>
      </a>
      ,
      <a class="link" href="mysqlcheck.html" title="6.5.3 mysqlcheck — A Table Maintenance Program">
       <span class="command">
        <strong>
         mysqlcheck
        </strong>
       </span>
      </a>
      ,
      <a class="link" href="mysqldump.html" title="6.5.4 mysqldump — A Database Backup Program">
       <span class="command">
        <strong>
         mysqldump
        </strong>
       </span>
      </a>
      ,
      <a class="link" href="mysqlshow.html" title="6.5.6 mysqlshow — Display Database, Table, and Column Information">
       <span class="command">
        <strong>
         mysqlshow
        </strong>
       </span>
      </a>
      , and
      <a class="link" href="mysqlslap.html" title="6.5.7 mysqlslap — A Load Emulation Client">
       <span class="command">
        <strong>
         mysqlslap
        </strong>
       </span>
      </a>
      client programs support an
      <code class="option">
       --enable-cleartext-plugin
      </code>
      option that
            enables the plugin on a per-invocation basis.
     </p>
    </li>
    <li class="listitem">
     <p>
      The
      <a class="ulink" href="/doc/c-api/8.4/en/mysql-options.html" target="_top">
       <code class="literal">
        mysql_options()
       </code>
      </a>
      C API
            function supports a
      <code class="literal">
       MYSQL_ENABLE_CLEARTEXT_PLUGIN
      </code>
      option that
            enables the plugin on a per-connection basis. Also, any
            program that uses
      <code class="literal">
       libmysqlclient
      </code>
      and
            reads option files can enable the plugin by including an
      <code class="literal">
       enable-cleartext-plugin
      </code>
      option in an
            option group read by the client library.
     </p>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
