2

Whilst launching MariaDB via Docker using MYSQL_ALLOW_EMPTY_PASSWORD I was prompted to run /usr/bin/mysql_secure_installation. This makes sense but (like others) I prefer configuring things non-interactively so started looking into the SQL commands this script runs. One of the comments to this article includes the following SQL:

UPDATE mysql.user SET plugin = 'mysql_native_password' WHERE User = 'root';

Which in turn led me to find MariaDB advises using ed25519 instead of mysql_native_password.

So I added the following to my .cnf which is provided to the Docker container and restarted the container.

[mariadb]
plugin_load_add=auth_ed25519

Then I connected with the mysql client (from apt install mariadb-client) and executed:

MariaDB [(none)]> ALTER USER root IDENTIFIED VIA ed25519 USING PASSWORD('secret');
MariaDB [(none)]> \q

Then I attempted to reconnect and receive the following error:

$ mysql --protocol=tcp --user=root -psecret
ERROR 2059 (HY000): Authentication plugin 'client_ed25519' cannot be loaded: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so: cannot open shared object file: No such file or directory
$ mysql --version
mysql  Ver 15.1 Distrib 10.1.43-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

Why am I receiving that error and how I can enable ed25519 authentication with the MariaDB client?

1

1 Answer 1

2

The shared library seems to exist within the container (mariadb:10.4), but not in the Ubuntu 18.04 apt package(s) for mariadb-client.

find / -iregex '.*ed25519.so'
/var/lib/docker/overlay2/5607d87792ae2f4989aa5a72188f1c47f86b19ce42a92139b50b697a39ecb798/diff/usr/lib/mysql/plugin/auth_ed25519.so
/var/lib/docker/overlay2/5607d87792ae2f4989aa5a72188f1c47f86b19ce42a92139b50b697a39ecb798/diff/usr/lib/mysql/plugin/client_ed25519.so
/var/lib/docker/overlay2/38451e628c3926f60d07e9852332f751486471b4a008d9a1b1e7f04d30b2eba1/merged/usr/lib/mysql/plugin/auth_ed25519.so
/var/lib/docker/overlay2/38451e628c3926f60d07e9852332f751486471b4a008d9a1b1e7f04d30b2eba1/merged/usr/lib/mysql/plugin/client_ed25519.so

The apt package for mariadb-server does include the auth_ed25519.so, but no sign of its partner in the mariadb-client package (or any of its dependencies).

$ apt-file list mariadb-server-10.1 | grep ed25519.so
mariadb-server-10.1: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/auth_ed25519.so
$ dpkg --listfiles mariadb-client-10.1 mariadb-client-core-10.1 mariadb-common | grep ed25519.so
$ 

The only place I can locate that file is in a package called libmariadbclient18 which only contains libraries.

$ apt-file find client_ed25519.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so
$ apt-file list libmariadbclient18
libmariadbclient18: /usr/lib/x86_64-linux-gnu/libmariadbclient.so.18
libmariadbclient18: /usr/lib/x86_64-linux-gnu/libmariadbclient.so.18.0.0
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/dialog.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/disks.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/mysql_clear_password.so
libmariadbclient18: /usr/share/doc/libmariadbclient18/changelog.Debian.gz
libmariadbclient18: /usr/share/doc/libmariadbclient18/copyright

After installing the library, the connection succeeds.

$ apt install libmariadbclient18
$ mysql --protocol=tcp --user=root -psecret
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 17
Server version: 10.4.11-MariaDB-1:10.4.11+maria~bionic mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

I found this not a particularly obvious sequence of problems so thought I would leave this here in case others or my-future-self need it. It probably would be helpful to be named something like mariadb-plugins or at least be Suggested by mariadb-client.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.