2

Whilst launching MariaDB via Docker using MYSQL_ALLOW_EMPTY_PASSWORD I was prompted to run /usr/bin/mysql_secure_installation. This makes sense but (like others) I prefer configuring things non-interactively so started looking into the SQL commands this script runs. One of the comments to this article includes the following SQL:

UPDATE mysql.user SET plugin = 'mysql_native_password' WHERE User = 'root';

Which in turn led me to find MariaDB advises using ed25519 instead of mysql_native_password.

So I added the following to my .cnf which is provided to the Docker container and restarted the container.

[mariadb]
plugin_load_add=auth_ed25519

Then I connected with the mysql client (from apt install mariadb-client) and executed:

MariaDB [(none)]> ALTER USER root IDENTIFIED VIA ed25519 USING PASSWORD('secret');
MariaDB [(none)]> \q

Then I attempted to reconnect and receive the following error:

$ mysql --protocol=tcp --user=root -psecret
ERROR 2059 (HY000): Authentication plugin 'client_ed25519' cannot be loaded: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so: cannot open shared object file: No such file or directory
$ mysql --version
mysql  Ver 15.1 Distrib 10.1.43-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2

Why am I receiving that error and how I can enable ed25519 authentication with the MariaDB client?

1

1 Answer 1

2

The shared library seems to exist within the container (mariadb:10.4), but not in the Ubuntu 18.04 apt package(s) for mariadb-client.

find / -iregex '.*ed25519.so'
/var/lib/docker/overlay2/5607d87792ae2f4989aa5a72188f1c47f86b19ce42a92139b50b697a39ecb798/diff/usr/lib/mysql/plugin/auth_ed25519.so
/var/lib/docker/overlay2/5607d87792ae2f4989aa5a72188f1c47f86b19ce42a92139b50b697a39ecb798/diff/usr/lib/mysql/plugin/client_ed25519.so
/var/lib/docker/overlay2/38451e628c3926f60d07e9852332f751486471b4a008d9a1b1e7f04d30b2eba1/merged/usr/lib/mysql/plugin/auth_ed25519.so
/var/lib/docker/overlay2/38451e628c3926f60d07e9852332f751486471b4a008d9a1b1e7f04d30b2eba1/merged/usr/lib/mysql/plugin/client_ed25519.so

The apt package for mariadb-server does include the auth_ed25519.so, but no sign of its partner in the mariadb-client package (or any of its dependencies).

$ apt-file list mariadb-server-10.1 | grep ed25519.so
mariadb-server-10.1: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/auth_ed25519.so
$ dpkg --listfiles mariadb-client-10.1 mariadb-client-core-10.1 mariadb-common | grep ed25519.so
$ 

The only place I can locate that file is in a package called libmariadbclient18 which only contains libraries.

$ apt-file find client_ed25519.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so
$ apt-file list libmariadbclient18
libmariadbclient18: /usr/lib/x86_64-linux-gnu/libmariadbclient.so.18
libmariadbclient18: /usr/lib/x86_64-linux-gnu/libmariadbclient.so.18.0.0
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/client_ed25519.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/dialog.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/disks.so
libmariadbclient18: /usr/lib/x86_64-linux-gnu/mariadb18/plugin/mysql_clear_password.so
libmariadbclient18: /usr/share/doc/libmariadbclient18/changelog.Debian.gz
libmariadbclient18: /usr/share/doc/libmariadbclient18/copyright

After installing the library, the connection succeeds.

$ apt install libmariadbclient18
$ mysql --protocol=tcp --user=root -psecret
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 17
Server version: 10.4.11-MariaDB-1:10.4.11+maria~bionic mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

I found this not a particularly obvious sequence of problems so thought I would leave this here in case others or my-future-self need it. It probably would be helpful to be named something like mariadb-plugins or at least be Suggested by mariadb-client.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .