MYSQLPASSWORDHASH.PY(1)

NAME
mysqlpasswordhash.py - generate MySQL password hashes

SYNOPSIS
mysqlpasswordhash.py --create-user-statement|--set-password-statement|--user-clause|--grant-usage-on= DATABASE [-H HOST] -u USER -p PASSWORD
mysqlpasswordhash.py --create-user-statement|--set-password-statement|--user-clause|--grant-usage-on= DATABASE -d CREDENTIALSFILE
mysqlpasswordhash.py -s SQL_SCRIPT
mysqlpasswordhash.py [-p] PASSWORD
mysqlpasswordhash.py -a
mysqlpasswordhash.py -h
mysqlpasswordhash.py -v

DESCRIPTION
mysqlpasswordhash.py calculates the hash that MySQL uses for passwords since version 4.1. You can use the outcome in a (generated) SQL script or feed it directly to the MySQL command-line client. Using the hash prevents passwords to be logged as plain text in the MySQL query log or to be sent as plain text over a network.

OPTIONS

-a, --ask-password
    Prompts for a password. This is the quickest way to calculate a password hash without the risk of accidentally logging the password in a history file.

--create-user-statement
    Outputs a complete CREATE USER statement.

-d CREDENTIALSFILE, --defaults-file CREDENTIALSFILE, --defaults-extra-file CREDENTIALSFILE
    Reads host, user and password from CREDENTIALSFILE. Such a file is often used to allow non-interactive scripts to connect to MySQL. The file must be an "ini" format configuration file with entries "user", "password" and optionally "host" in section "mysql" or in section "client".

--grant-usage-on DATABASE
    Outputs a GRANT statement for usage of the supplied DATABASE.

-h, --help
    Shows this help message and exit.

-H HOST, --host HOST
    Host name or address. May contain wildcards, like '10.77.77.%'. Defaults to localhost (which is not the same as 127.0.0.1 to MySQL). When a host is given both in a credentials file and as an argument, the argument is used. This allows you to use wildcards.

-p PASSWORD, --password PASSWORD
    supply the password as an argument. BE CAREFUL: command-lines are often logged in a history file if not called from within a script.

-s SQL_SCRIPT, --script SQL_SCRIPT
    Replaces usages of plain-text passwords in SQL_SCRIPT by hashes and outputs the modified SQL script on stdout. Specifically, the clauses "IDENTIFIED BY '...'" and "PASSWORD('...')"are replaced by their hashed counterparts. If you pass a hyphen (-) as a file name, stdin is used.

--set-password-statement
    Outputs a complete SET PASSWORD statement.

-u USER, --user USER
    The username to be used in the generated SQL.

--user-clause
    Outputs a complete user clause in the form of 'USER'@'HOST' IDENTIFIED BY PASSWORD 'HASH'.

-v, --version
    Shows the program's version number and exit.

EXAMPLES

Credential file input
    Given this credentials file: (credentials.cnf:)
    [client]
    host = localhost
    user = build
    password = "Let's do it!" The SQL command to create a user for database SomeDB is given by the following command: mysqlpasswordhash.py -d credentials.cnf --grant-usage-on=SomeDB The output of which you can pipe to an SQL file or directly to the MySQL command-line client. After that, you can add GRANT statements that refer to the same user without providing a password. You could also do it the other way around: create an SQL script with all the GRANT statements for the user, without IDENTIFIED BY clauses, and then add the output of the following command to set the password for this user: mysqlpasswordhash.py -d credentials.cnf --set-password Alternatively, you can use sed(1) to modify the GRANT USAGE statement in the first example to a different GRANT statement. To grant read access on the entire database, use: mysqlpasswordhash.py -d credentials.cnf --grant-usage-on=SomeDB | sed 's/USAGE/SELECT/'

Other file formats or command-line use
    The simplest form will output just the hash: mysqlpasswordhash.py -p "Let's do it!" Be careful though that command-line statements can be logged in history files. One way to prevent this logging is to enter the password interactively with: mysqlpasswordhash.py -a With the help of the grep(1) and the sed(1) command, you can extract the necessary data from other files as well. For example, given this PHP settings file: (settings.php:)
    <?php
    $GLOBALS['DatabaseServer'] = 'localhost';
    $GLOBALS['DatabaseUser'] = 'build';
    $GLOBALS['DatabasePassword'] = 'Let\'s do it!';
    $GLOBALS['DatabaseName'] = 'AppDb';
    ?> And an SQL file containing GRANT statements without an IDENTIFIED BY clause, the full GRANTS file could be generated with a batch file like: #!/bin/bash
    SETTINGSFILE="$1"
    GRANTSFILE="$2"
    function Setting # setting_name
            {
             grep -e "^\$GLOBALS\[.$1.\][ ]*=" $SETTINGSFILE | sed "s/^[^=]*=[ ]*['\"]//" | sed "s/['\"]\?;.*//"
            }
    mysqlpasswordhash.py -H "`Setting DatabaseServer`" -u "`Setting DatabaseUser`" -p "`Setting DatabasePassword`" --grant-usage-on "`Setting DatabaseName`" | cat - "$GRANTSFILE"

usage with SQL scripts:
    mysqlpasswordhash.py -s grants.sql or mysqlpasswordhash.py -s - < grants.sql These invocations scan the script for occurrances of IDENTIFIED BY 'somepassword' and for occurrances of PASSWORD('somepassword'). These occurrances are then translated to versions with hashes.

SEE ALSO
grep(1), mysql(1), sed(1) See http://www.howtoforge.com/node/4833 for repeatable MySQL scripts and for modular SQL.

COPYRIGHT
Both the program mysqlpasswordhash.py and this documentation are in the public domain. There cannot be any restriction in copying, spreading or usage.

AUTHOR
mysqlpasswordhash.py was written by Willem Bogaerts <mysqlpasswordhash@w-p.dds.nl>