In this post, I am sharing one T-SQL Script to find SQL Server USER LOGIN Information.

As a DBA, we should check the USER LOGIN Information to make sure about the user expiration, password expiration.
Using password expiration information, you can also notify the user before its password expires.

SELECT 
	SL.name AS LoginName 
	,LOGINPROPERTY (SL.name, 'PasswordLastSetTime') AS PasswordLastSetTime 
	,LOGINPROPERTY (SL.name, 'DaysUntilExpiration') AS DaysUntilExpiration 
	,DATEADD(dd, CONVERT(int, LOGINPROPERTY (SL.name, 'DaysUntilExpiration')) 
				, CONVERT(datetime, LOGINPROPERTY (SL.name, 'PasswordLastSetTime'))) AS PasswordExpiration 
	,SL.is_policy_checked AS IsPolicyChecked 
	,LOGINPROPERTY (SL.name, 'IsExpired') AS IsExpired 
	,LOGINPROPERTY (SL.name, 'IsMustChange') AS IsMustChange 
	,LOGINPROPERTY (SL.name, 'IsLocked') AS IsLocked 
	,LOGINPROPERTY (SL.name, 'LockoutTime') AS LockoutTime 
	,LOGINPROPERTY (SL.name, 'BadPasswordCount') AS BadPasswordCount 
	,LOGINPROPERTY (SL.name, 'BadPasswordTime') AS BadPasswordTime 
	,LOGINPROPERTY (SL.name, 'HistoryLength') AS HistoryLength 
FROM sys.sql_logins AS SL 
WHERE is_expiration_checked = 1 
ORDER BY LOGINPROPERTY (SL.name, 'PasswordLastSetTime') DESC

When you install the MySQL, the root user is a default, and even most of the people also set the password ‘root’.

For MySQL, username and password like root-root is a very common so hackers can easily try this combination and can attack in your database system.

After the installation of MySQL Server, please don’t forget to rename the name of the root user.
In this post, I am sharing required steps for changing the name of the root user.

Connect MySQL and check the list of users:

mysql> select user,host from mysql.user;
+------------------+-----------+
| user             | host      |
+------------------+-----------+
| debian-sys-maint | localhost |
| mysql.sys        | localhost |
| root             | localhost |
+------------------+-----------+

Rename the ‘root’ user to ‘anvesh’:

rename user 'root'@'localhost' to 'anvesh'@'localhost';

Confirm the new user name:

mysql> select user,host from mysql.user;
+------------------+-----------+
| user             | host      |
+------------------+-----------+
| anvesh           | localhost |
| debian-sys-maint | localhost |
| mysql.sys        | localhost |
+------------------+-----------+

Now, flush the privileges to make these changes happen:

FLUSH PRIVILEGES;

Now, connect with new user name:

mysql -u anvesh -p

In this post, I am showing MEDIAPASSWORD option to set a password to your database backup file in SQL Server.
We should not take a risk with our backup media file, especially when we are taking backup of sensitive data like the banking system.

You can set a password using MEDIAPASSWORD option while taking a backup, and you cannot restore that backup file without specifying a password.

You can set MEDIAPASSWORD in plain text, so again you have to take care of your backup/restore scripts. So again you have to take care of your backup/restore scripts.

Once you set a password, it applies to all types of restore option like RESTORE FILELISTONLY, RESTORE HEADERONLY, RESTORE LABELONLY, RESTORE VERIFYONLY, and you must require a password for all these options.

Beginning with SQL Server 2012 the PASSWORD and MEDIAPASSWORD options are discontinued for creating backups. It is still possible to restore backups created with passwords.

Let me demonstrate this,

T-SQL Script to take a backup with MEDIAPASSWORD:
I set password ‘dbrnd.com’ for my dbrnd database backup.

BACKUP DATABASE dbrnd
TO DISK = 'C:\MyBackups\dbrnd.bak'
WITH COMPRESSION,
MEDIAPASSWORD='dbrnd.com'
GO

RESTORE DATABASE dbrnd
FROM DISK = 'C:\MyBackups\dbrnd.bak'
GO

Msg 3279, Level 16, State 6, Line 1
Access is denied due to a password failure
Msg 3013, Level 16, State 1, Line 1
RESTORE DATABASE is terminating abnormally.

RESTORE HEADERONLY
FROM DISK = 'C:\MyBackups\dbrnd.bak'

Msg 3279, Level 16, State 6, Line 1
Access is denied due to a password failure
Msg 3013, Level 16, State 1, Line 1
RESTORE HEADERONLY is terminating abnormally.

RESTORE DATABASE dbrnd
FROM DISK = 'C:\MyBackups\dbrnd.bak'
MEDIAPASSWORD = 'dbrnd.com',
RECOVERY
GO

Recently, I have installed PostgreSQL 9.6 in Ubuntu 16.4.
You can access the previous article and can find full detail installation steps.

I was testing execution for one of my shell scripts. I have tried to connect PostgreSQL database and got this error. ” psql FATAL: error Peer authentication failed for user ”

During at database call, I was supplying the username and password. I check pg_hba.conf file and replace peer with a password.

In pg_hba.conf, change this line from value peer to password:

local   all             all                        peer

to:

local   all             all                        password

If you do not know about the role of pg_hba.conf file, visit the below link.

PostgreSQL: How to Allow Remote Connection to Connect Database

PostgreSQL also has a one more file related user access permission and that is pg_ident.conf.
PostgreSQL provides Ident-based authentication and It works by obtaining the client’s operating system user name and using it as the allowed database user name with an optional user name mapping.

When we are using an external authentication system, system username might not be the same as database username.

To allow external authentication, We should map the system username with database username and we can also set a map name to hide the system username and database username related detail.

For example,

Go to the PostgreSQL data directory and Open pg_ident.conf file.
You can find below lines:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME

You can add value to map system username and database username:

# Put your actual configuration here
# ----------------------------------
# MAPNAME       SYSTEM-USERNAME         PG-USERNAME
User123         LinuxUser               PGUser

Once you map your system user and database user in pg_ident.conf file, you can use map name in pg_hba.conf file to allow external authentication.

Go to your PostgreSQL data directory and open a pg_hba.conf file.

You can add the map name of system user and database user in METHOD column.
For Example,

# TYPE  DATABASE        USER            ADDRESS                 METHOD
host    all             all             120.172.0.0/16          ident map=User123

In this post, I am sharing basic commands to change the PostgreSQL database user password in Linux.

I would like to share this kind commands and scripts because this is very common and day to day exercise for a Database Administrator.

In the PostgreSQL, we have also one pg_hba.conf file.
pg_hba.conf is a configuration file which is controlled Client Authentication.
This file automatically installed when the data directory is initialized.

If you want to login without password, you can put “peer” or “trust” instead of md5 in this file.
like,

local      all     postgres     peer

But for the security purpose, we should put md5.

Change database password using ALTER:

First login:

sudo -u user_name psql database_name

ALTER Command:

ALTER USER user_name WITH PASSWORD 'MyNew_Password';

Change database password using \password:

First login:

root=# sudo -u user_name psql database_name

Using \password:

root=# \password user_name

Enter new password: ***
Enter it again: ***

I have configured one of my PostgreSQL Test Server in windows operating system.

I just open psql command line tool and it opened without asking a any password.

I just surprised, when I logged in psql without any password. This should not happen in any situation.

I was finding a solution of this problem and came to know about pgpass.conf file for Windows OS and .pgpass file for Unix OS.

This file exists on client location and contain information about login authentication.

For windows, you can find this file here: %APPDATA%\postgresql\pgpass.conf

The format of this file:

hostname:port:database:username:password

I have opened this file in windows and found that password written in plain text.
Whenever I open psql, it takes default postgres user password from this file.

I just removed this plain text password from pgpass.conf file and now psql prompts to enter a specific password for login.

This is going to be one of most important article for the MySQL community because I am going to share, what should be our best practice to store encrypted passwords into MySQL Database Server.

The MySQL provides different algorithm and function to encrypt and decrypt password data or any other sensitive information so that no one can access it in plain text format.

For different Encryption and Compression functions you can visit this MySQL Developer official site.

Generally, people are using MD5 and SHA algorithm for password encryption, but both are easy to break and vulnerable, so we should not use this in our general practice.

We should also not use PASSWORD() function because it is used by the authentication system in MySQL Server.

Advanced Encryption Standard Algorithm (AES):

This is one of the important encryption algorithm and it is highly secure because it encrypts the string using the encryption key string and returns an encrypted binary string output.

MySQL provides AES_ENCRYPT() to encrypt the string in binary format and AES_DECRYPT() to decrypt the string in plain text.

The only one problem is, we should hide the key value for security purpose by setting object level permission or we can create a view to hide the encryption key value.

You can create BINARY or BLOB data type to store AES encrypted password.

Below is a small demonstration on this:

The syntax:

AES_ENCRYPT(str,key_str)
AES_DECRYPT(crypt_str,key_str)

First, create a table with sample data:

CREATE TABLE tbl_AESPassword
(
    ID INTEGER
    ,UserPassword BLOB
);

INSERT INTO tbl_AESPassword 
VALUES 
(1,AES_ENCRYPT('Anvesh','8'))
,(2,AES_ENCRYPT('Patel','88'));

SELECT first row by comparing password using defined encryption key:

SELECT *	
FROM tbl_AESPassword
WHERE UserPassword = AES_ENCRYPT('Anvesh','8')

-- Result: Returned only first record. 
ID      |  UserPassword
---------------------------
1       | BLOB

To DECRYPT the password into plain text:

mysql> SELECT AES_DECRYPT(AES_ENCRYPT('Anvesh','8'),'8');

+--------------------------------------------+
| AES_DECRYPT(AES_ENCRYPT('Anvesh','8'),'8') |
+--------------------------------------------+
| Anvesh                                     |
+--------------------------------------------+
1 row in set (0.00 sec)

Last week, I was creating my first database User and Role, but I got the below error in Cassandra – InvalidRequest: code=2200 [Invalid query] message=”org.apache.cassandra.auth.CassandraRoleManager doesn’t support PASSWORD”.

For me, this is very important to resolve this problem because the application requires different database users for each process.

I tried many options to solve this error and I have found that cassandra.yaml file require to edit.
It has an authenticator parameter which has by default allow all types of authentication.

You can find this parameter and can change as mentioned below steps.

Old value:

authenticator: AllowAllAuthenticator

Change with this new value:

authenticator: PasswordAuthenticator

Restart your Cassandra service:

$ sudo service cassandra restart

Login with default admin Cassandra user:

$ cqlsh -u cassandra -p cassandra

Additionally, you can also check role manager parameter is exists or not. If below mention parameter does not exist in cassandra.yaml, you can add it.

role_manager: CassandraRoleManager

Hello Friends,

Recently, I got a request for resetting the MySQL root password.

One of my colleges tried many solutions from different blog and website, but he failed and the question came to me.

As I am always ready for new research and problem solving, so I started my work to reset the MySQL root password.

On the internet, you can find many similar solutions and I have also tired from these solutions, but I was failed to reset root/admin password.

After some exercise, I got success on this.

Below are the final steps:

Step 1:
Stop MySQL Service.

sudo stop mysql

Step 2:
Kill all running mysqld.

sudo killall -9 mysqld

Step 3:
Starting mysqld in Safe mode.

sudo mysqld_safe --skip-grant-tables --skip-networking &

Step 4:
Start mysql client

mysql -u root

Step 5:
After successful login, please execute this command to change any password.
Here you can visit more about MySQL Flush Command:

FLUSH PRIVILEGES;

Step 6:
You can update mysql root password .

UPDATE mysql.user SET Password=PASSWORD('newpwd') WHERE User='root';

Step 7:
Please execute this command.

FLUSH PRIVILEGES;