Unknown authentication protocol: `sha256_password`

[lukasradek]

Hello,

I am on a

RPi5 with Raspbian (Linux pi5 6.6.62+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.6.62-1+rpt1 (2024-11-25) aarch64 GNU/Linux)
latest official mysql docker containier (9.2)
and I am using this crate (tried v 25.0.0 and 26.0.0) in my Rust project to connect to the database.

I am using Pool::new method to create a DB connection and I am getting this error

Pool: Could not connect to MySQL db!: DriverError { Unknown authentication protocol: sha256_password }

I have already checked what auth plugin is set in the mysql.users table inside the DB and it is caching_sha2_password, so I am not really sure where is the sha256_password comming from.

Thanks

[John-Nagle]

I got that too. I'm trying to connect to Dreamhost's shared hosting MySQL server.

Here are my Opts:, from my logging. Censored a bit.

22:03:46 [INFO] Opts: OptsBuilder { opts: Opts(InnerOpts { ip_or_hostname: Domain("XXXXXXX.XXX"), 
tcp_port: 3306, socket: None, user: Some("terrainuploader"), pass: Some("XXXXXXXX"), 
db_name: Some("terrain"), read_timeout: None, write_timeout: None, prefer_socket: true,
tcp_nodelay: true, tcp_keepalive_time: None, tcp_keepalive_probe_interval_secs: None, tcp_keepalive_probe_count: None,
tcp_user_timeout: None, init: [], ssl_opts: None, pool_opts: PoolOpts { constraints: PoolConstraints { min: 10, max: 100 },
reset_connection: true, check_health: true }, local_infile_handler: None, tcp_connect_timeout: None, bind_address: None, 
stmt_cache_size: 32, compress: None, 
additional_capabilities: CapabilityFlags(0x0), connect_attrs: Some({}), secure_auth: false, enable_cleartext_plugin: true }) }
22:03:46 [ERROR] Upload server failed: DriverError { Unknown authentication protocol: `sha256_password` }

Connect code:

let opts = mysql::OptsBuilder::new()
    .enable_cleartext_plugin(true)
    .secure_auth(false)
    .ip_or_hostname(creds.get("DB_HOST"))
    .tcp_port(portnum)
    .user(creds.get("DB_USER"))   
    .pass(creds.get("DB_PASS"))  
    .db_name(creds.get("DB_NAME"));
drop(creds);
log::info!("Opts: {:?}", opts);
let pool = Pool::new(opts)?;
log::info!("Connected to database.");

[blackbeam]

@luka, @John-Nagle, hi.

I believe I faced this issue earlier that ends up being an improper server setup, but I might be wrong.

It might be problematic to reproduce, so could you please build against a local copy of the crate and debug-log the handshake packet here and the auth_switch_request in this function?

[John-Nagle]

Ref: https://users.rust-lang.org/t/trouble-connecting-to-mysql-server/133479/2

Rust's mysql crate doesn't support deprecated authentication methods, which is reasonable enough. At the Dreamhost end, they set MySQL 8 authentication to a deprecated method on purpose, apparently so that ancient versions of Wordpress can still work. I'm talking to Dreamhost support about changing the authentication method for my userids, which is something they can do with ALTER USER. I can't do it from my end, this being shared hosting.

I looked at the Rust code. It looks at the server version as part of the authentication handshake. It may be unwilling to play with a MySQL 8 that refuses to use "caching_sha2_password".

Dreamhost support is being cooperative. This may be fixable without digging into the auth handshake code.

lukasradek above had control over his MySQL installation, claimed he set this to "caching_sha2_password", and still had problems. Puzzled by that. "caching_sha2_password" is the normal case.

[John-Nagle]

Found the problem.

In the Rust "mysql" documentation:

pub fn secure_auth(self, secure_auth: bool) -> Self

Disables mysql_old_password plugin (defaults to true).

Ref: https://docs.rs/mysql/26.0.1/mysql/struct.OptsBuilder.html#method.secure_auth

As is standard for Rust, the most secure mode is the default. Set that to false for legacy Dreamhost servers.
Have to explicitly turn off secure_auth to allow the old mysql_native_password, which is known to be vulnerable. With secure_auth turned on, negotiation fails because there's no overlap between what Dreamhost uses for IDENTFIED BY and what Rust considers secure.

How it got to sha256_password, which neither end supports, I don't know. Probably both ends were trying to negotiate some auth mode that would work that would work and that message cane from the final failed try, leading to a confusing error message.