## A.9 MySQL 8.0 FAQ: Security

[]()A.9.1. [ Where can I find documentation that addresses security issues for MySQL? ](faqs-security.html#faq-mysql-where-docs-security)A.9.2. [ What is the default authentication plugin in MySQL 8.0? ](faqs-security.html#faq-mysql-default-authentication-plugin)A.9.3. [ Does MySQL 8.0 have native support for SSL? ](faqs-security.html#faq-mysql-have-native-ssl)A.9.4. [ Is SSL support built into MySQL binaries, or must I recompile the binary myself to enable it? ](faqs-security.html#faq-mysql-is-ssl-available)A.9.5. [ Does MySQL 8.0 have built-in authentication against LDAP directories? ](faqs-security.html#faq-mysql-have-builtin-ldap)A.9.6. [ Does MySQL 8.0 include support for Roles Based Access Control (RBAC)? ](faqs-security.html#faq-mysql-have-builtin-rbac)A.9.7. [ Does MySQL 8.0 support TLS 1.0 and 1.1? ](faqs-security.html#faq-mysql-tls-versions)

|[]()[]()<br/><br/>**A.9.1.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Where can I find documentation that addresses security issues for MySQL?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
|:---------------------------|: |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              The best place to start is [Chapter 6, *Security*](security.html).<br/><br/> Other portions of the MySQL Documentation which you may find useful with regard to specific security concerns include the following:<br/><br/>* [Section 6.1.1, “Security Guidelines”](security-guidelines.html).<br/><br/>* [Section 6.1.3, “Making MySQL Secure Against Attackers”](security-against-attack.html).<br/><br/>* [Section B.3.3.2, “How to Reset the Root Password”](resetting-permissions.html).<br/><br/>* [Section 6.1.5, “How to Run MySQL as a Normal User”](changing-mysql-user.html).<br/><br/>* [Section 6.1.4, “Security-Related mysqld Options and Variables”](security-options.html).<br/><br/>* [Section 6.1.6, “Security Considerations for LOAD DATA LOCAL”](load-data-local-security.html).<br/><br/>* [Section 2.10, “Postinstallation Setup and Testing”](postinstallation.html).<br/><br/>* [Section 6.3, “Using Encrypted Connections”](encrypted-connections.html).<br/><br/>* [Loadable Function Security Precautions](https://dev.mysql.com/doc/extending-mysql/8.0/en/adding-loadable-function.html#loadable-function-security).<br/><br/> There is also the [Secure Deployment Guide](https://dev.mysql.com/doc/mysql-secure-deployment-guide/8.0/en/), which provides procedures for deploying a generic binary distribution of MySQL Enterprise Edition Server with features for managing the security of your MySQL installation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|[]()[]()<br/><br/>**A.9.2.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              What is the default authentication plugin in MySQL 8.0?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                The default authentication plugin in MySQL 8.0 is `caching_sha2_password`. For information about this plugin, see [Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication”](caching-sha2-pluggable-authentication.html).<br/><br/> The `caching_sha2_password` plugin provides more secure password encryption than the `mysql_native_password` plugin (the default plugin in previous MySQL series). For information about the implications of this change of default plugin for server operation and compatibility of the server with clients and connectors, see [caching\_sha2\_password as the Preferred Authentication Plugin](upgrading-from-previous-series.html#upgrade-caching-sha2-password).<br/><br/> For general information about pluggable authentication and other available authentication plugins, see [Section 6.2.17, “Pluggable Authentication”](pluggable-authentication.html), and [Section 6.4.1, “Authentication Plugins”](authentication-plugins.html).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
|[]()[]()<br/><br/>**A.9.3.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Does MySQL 8.0 have native support for SSL?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Most 8.0 binaries have support for SSL connections between the client and server. See [Section 6.3, “Using Encrypted Connections”](encrypted-connections.html).<br/><br/> You can also tunnel a connection using SSH, if (for example) the client application does not support SSL connections. For an example, see [Section 6.3.4, “Connecting to MySQL Remotely from Windows with SSH”](windows-and-ssh.html).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|[]()[]()<br/><br/>**A.9.4.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Is SSL support built into MySQL binaries, or must I recompile the binary myself to enable it?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Most 8.0 binaries have SSL enabled for client/server connections that are secured, authenticated, or both. See [Section 6.3, “Using Encrypted Connections”](encrypted-connections.html).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|[]()[]()<br/><br/>**A.9.5.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Does MySQL 8.0 have built-in authentication against LDAP directories?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              The Enterprise edition includes a [PAM Authentication Plugin](pam-pluggable-authentication.html) that supports authentication against an LDAP directory.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|[]()[]()<br/><br/>**A.9.6.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Does MySQL 8.0 include support for Roles Based Access Control (RBAC)?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 Not at this time.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|[]()[]()<br/><br/>**A.9.7.**|                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Does MySQL 8.0 support TLS 1.0 and 1.1?                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
|                            | Support for the TLSv1 and TLSv1.1 connection protocols is removed as of MySQL 8.0.28. The protocols were deprecated from MySQL 8.0.26. For the consequences of that removal, see [Removal of Support for the TLSv1 and TLSv1.1 Protocols](encrypted-connection-protocols-ciphers.html#encrypted-connection-deprecated-protocols).<br/><br/> Support for TLS versions 1.0 and 1.1 is removed because those protocol versions are old, released in 1996 and 2006, respectively. The algorithms used are weak and outdated.<br/><br/> Unless you are using very old versions of MySQL Server or connectors, you are unlikely to have connections using TLS 1.0 or 1.1. MySQL connectors and clients select the highest TLS version available by default.<br/><br/>*When was support for TLS 1.2 added to MySQL Server?* MySQL Community Server added TLS 1.2 support when the community server switched to OpenSSL for MySQL 5.6, 5.7, and 8.0 in 2019. For MySQL Enterprise Edition, OpenSSL added TLS 1.2 support in 2015, in MySQL Server 5.7.10.<br/><br/>*How can one view which TLS versions are in active use?* For MySQL 5.7 or 8.0, review whether TLS 1.0 or 1.1 is in use by running this query:<br/><br/>```<br/>SELECT<br/>  `session_ssl_status`.`thread_id`, `session_ssl_status`.`ssl_version`,<br/>  `session_ssl_status`.`ssl_cipher`, `session_ssl_status`.`ssl_sessions_reused`<br/>FROM `sys`.`session_ssl_status`<br/>WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2');<br/>```<br/><br/> If a thread using TLSv1.0 or TLSv1.1 is listed, you can determine where this connection is coming from by running this query:<br/><br/>```<br/>SELECT thd_id,conn_id, user, db, current_statement, program_name<br/>FROM sys.processlist<br/>WHERE thd_id IN (<br/>                  SELECT `session_ssl_status`.`thread_id`<br/>                  FROM `sys`.`session_ssl_status`<br/>                  WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2')<br/>                );<br/>```<br/><br/> Alternatively, you can run this query:<br/><br/>```<br/>SELECT *<br/>FROM sys.session<br/>WHERE thd_id IN (<br/>                  SELECT `session_ssl_status`.`thread_id`<br/>                  FROM `sys`.`session_ssl_status`<br/>                  WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2')<br/>                );<br/>```<br/><br/> These queries provide details needed to determine which application is not supporting TLS 1.2 or 1.3, and target upgrades for those.<br/><br/>*Are there other options for testing for TLS 1.0 or 1.1?* Yes, you can disable those versions prior to upgrading your server to a newer version. Explicitly specify which version to use, either in `mysql.cnf` (or `mysql.ini`) or by using [`SET PERSIST`](set-variable.html), for example: [`--tls-version=TLSv12`](server-system-variables.html#sysvar_tls_version).<br/><br/>*Do all MySQL Connectors (5.7 and 8.0) support TLS 1.2 and higher? What about C and C++ applications using `libmysql`?* For C and C++ applications using the community `libmysqlclient` library, use an OpenSSL-based library (that is, do *not* use YaSSL). Usage of OpenSSL was unified in 2018 (in MySQL 8.0.4 and 5.7.28, respectively). The same applies for Connector/ODBC and Connector/C++. To determine what library dependencies are used, run the following commands to see if OpenSSL is listed. On Linux, use this command:<br/><br/>```<br/>$> sudo ldd usr/local/mysql/lib/libmysqlclient.a | grep -i openssl<br/>```<br/><br/> On MacOS, use this command:<br/><br/>```<br/>$> sudo otool -l /usr/local/mysql/lib/libmysqlclient.a | grep -i openssl<br/>```<br/><br/>*What about Connector/J?* Java 8 moved to TLS 1.2 as the default in January 2014; TLS 1.2 was supported prior to that, so unless you are running a very old version of Connector/J, you have TLS 1.2 support.<br/><br/>*What about Connector/NET?* For .NET applications, Microsoft stopped support of TLS 1.0 and 1.1 at the end of 2020. Support for TLS 1.2 was added in 2012. You would need to have a very old version of Connector/NET not to have support for TLS 1.2.<br/><br/>*What about Connector/Python?* It depends on what version of Python you are running. The SSL module in Python 2.6 supports TLS up to version 1.0 only. In that case, you will need to upgrade to Python 2.7.9 or higher, or Python 3.x, both of which support newer versions of TLS. For details, see [Connector/Python Versions](https://dev.mysql.com/doc/connector-python/en/connector-python-versions.html) and [https://www.calazan.com/how-to-check-if-your-python-app-supports-tls-12/](https://www.calazan.com/how-to-check-if-your-python-app-supports-tls-12/).<br/><br/>*What about Connector/Node.js or Node MySQL2?* TLS comes with `nodejs`, and all supported versions of Node.js use OpenSSL v1.1.1 (as of April 2020), which again supports TLS 1.2 and higher.<br/><br/>*What about PHP?* [These versions of PHP](https://www.php.net/supported-versions.php) support TLS 1.2 and higher.|

