<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="password-logging">
      </a>
      8.1.2.3 Passwords and Logging
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045252837232">
  </a>
  <a class="indexterm" name="idm46045252835744">
  </a>
  <p>
   Passwords can be written as plain text in SQL statements such as
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   ,
   <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
    <code class="literal">
     GRANT
    </code>
   </a>
   and
   <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
    <code class="literal">
     SET PASSWORD
    </code>
   </a>
   . If such statements
        are logged by the MySQL server as written, passwords in them
        become visible to anyone with access to the logs.
  </p>
  <p>
   Statement logging avoids writing passwords as cleartext for the
        following statements:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa72115529"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
<span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
<span class="token keyword">SET</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
<span class="token keyword">START</span> <span class="token keyword">REPLICA</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">PASSWORD</span> <span class="token operator">=</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span>
<span class="token keyword">CREATE</span> <span class="token keyword">SERVER</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">OPTIONS</span><span class="token punctuation">(</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">)</span>
<span class="token keyword">ALTER</span> <span class="token keyword">SERVER</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">OPTIONS</span><span class="token punctuation">(</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span> <span class="token keyword">PASSWORD</span> <span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">.</span><span class="token punctuation">)</span></code></pre>
  </div>
  <p>
   Passwords in those statements are rewritten to not appear
        literally in statement text written to the general query log,
        slow query log, and binary log. Rewriting does not apply to
        other statements. In particular,
   <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
    <code class="literal">
     INSERT
    </code>
   </a>
   or
   <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
    <code class="literal">
     UPDATE
    </code>
   </a>
   statements for the
   <code class="literal">
    mysql.user
   </code>
   system table that refer to literal
        passwords are logged as is, so you should avoid such statements.
        (Direct modification of grant tables is discouraged, anyway.)
  </p>
  <p>
   For the general query log, password rewriting can be suppressed
        by starting the server with the
   <a class="link" href="server-options.html#option_mysqld_log-raw">
    <code class="option">
     --log-raw
    </code>
   </a>
   option. For security
        reasons, this option is not recommended for production use. For
        diagnostic purposes, it may be useful to see the exact text of
        statements as received by the server.
  </p>
  <p>
   By default, contents of audit log files produced by the audit
        log plugin are not encrypted and may contain sensitive
        information, such as the text of SQL statements. For security
        reasons, audit log files should be written to a directory
        accessible only to the MySQL server and to users with a
        legitimate reason to view the log. See
   <a class="xref" href="audit-log-security.html" title="8.4.5.3 MySQL Enterprise Audit Security Considerations">
    Section 8.4.5.3, “MySQL Enterprise Audit Security Considerations”
   </a>
   .
  </p>
  <p>
   Statements received by the server may be rewritten if a query
        rewrite plugin is installed (see
   <a class="ulink" href="/doc/extending-mysql/8.4/en/plugin-types.html#query-rewrite-plugin-type" target="_top">
    Query Rewrite Plugins
   </a>
   ). In this case, the
   <a class="link" href="server-options.html#option_mysqld_log-raw">
    <code class="option">
     --log-raw
    </code>
   </a>
   option affects
        statement logging as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Without
      <a class="link" href="server-options.html#option_mysqld_log-raw">
       <code class="option">
        --log-raw
       </code>
      </a>
      , the server
            logs the statement returned by the query rewrite plugin.
            This may differ from the statement as received.
     </p>
    </li>
    <li class="listitem">
     <p>
      With
      <a class="link" href="server-options.html#option_mysqld_log-raw">
       <code class="option">
        --log-raw
       </code>
      </a>
      , the server
            logs the original statement as received.
     </p>
    </li>
   </ul>
  </div>
  <p>
   An implication of password rewriting is that statements that
        cannot be parsed (due, for example, to syntax errors) are not
        written to the general query log because they cannot be known to
        be password free. Use cases that require logging of all
        statements including those with errors should use the
   <a class="link" href="server-options.html#option_mysqld_log-raw">
    <code class="option">
     --log-raw
    </code>
   </a>
   option, bearing in mind
        that this also bypasses password rewriting.
  </p>
  <p>
   Password rewriting occurs only when plain text passwords are
        expected. For statements with syntax that expect a password hash
        value, no rewriting occurs. If a plain text password is supplied
        erroneously for such syntax, the password is logged as given,
        without rewriting.
  </p>
  <p>
   To guard log files against unwarranted exposure, locate them in
        a directory that restricts access to the server and the database
        administrator. If the server logs to tables in the
   <code class="literal">
    mysql
   </code>
   database, grant access to those tables
        only to the database administrator.
  </p>
  <p>
   Replicas store the password for the replication source server in
        their connection metadata repository, which by default is a
        table in the
   <code class="literal">
    mysql
   </code>
   database named
   <code class="literal">
    slave_master_info
   </code>
   . The use of a file in the
        data directory for the connection metadata repository is now
        deprecated, but still possible (see
   <a class="xref" href="replica-logs.html" title="19.2.4 Relay Log and Replication Metadata Repositories">
    Section 19.2.4, “Relay Log and Replication Metadata Repositories”
   </a>
   ). Ensure that the connection
        metadata repository can be accessed only by the database
        administrator. An alternative to storing the password in the
        connection metadata repository is to use the
   <a class="link" href="start-replica.html" title="15.4.2.4 START REPLICA Statement">
    <code class="literal">
     START REPLICA
    </code>
   </a>
   or
   <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
    <code class="literal">
     START GROUP_REPLICATION
    </code>
   </a>
   statement
        to specify credentials for connecting to the source.
  </p>
  <p>
   Use a restricted access mode to protect database backups that
        include log tables or log files containing passwords.
  </p>
 </div>
 <br/>
</div>
