Skip to main content

Search

Welcome to Tibero GTS!

Password Access Failure with Special Characters After Encryption Method Change

Document Type | Troubleshooting

Category | Security

Applicable Product Version | 6FS06

Document Number | TSETS003

 

Issue

In Tibero6 FS06_CS_1806, when changing the encryption method from MD5 to SHA256, passwords containing special characters cannot be used to log in.
 
 
 

Cause

If the database is created using create database instead of tb_newmount, the SHA256 password encryption method is not properly applied. (tb_newmount: creates the database and then runs system.sh)
  • system.sh adds one row per execution to the _shadow_password table for the sys account
 
When changing from MD5 to SHA256, the MD5 password for the sys account remains.
  • When switching from SHA256 to MD5 and then changing the password for accounts used with SHA256, the SHA256 password still remains in shadow_password
  • The .passwd file in $TB_HOME/database/$TB_SID/ is not properly retained
 
 
 

Resolution

Apply a patch to stabilize the SHA256 password encryption function and improve the Patch Task.
(Applied Patch: 209586c)
Note
The patch must be applied through technical support provided by Tmax Tibero.
 

MD5 - SHA256 Change Procedure

1. Check Current Status

select username, password from dba_users;
select * from vt_parameter where name = '_CRYPTO_LEVEL';
 โ†’ _CRYPTO_LEVEL = 0 // md5
      _CRYPTO_LEVEL = 1 // sha256

 

2. Check Existing Users' Passwords

Before changing from MD5 to SHA256, identify the passwords of existing users. After changing to SHA256, users cannot log in with their old passwords, so password reset with alter user is required.

 

3. Execute $TB_HOME/scripts/crypto_system.sql (SYS account)

Run $TB_HOME/scripts/crypto_system.sql from the SYS account.
This script creates the necessary system tables for SHA authentication, and the SYS account password will be reset to the default value. (Default: tibero)
--ex) After executing crypto_system.sql

USERNAME      PASSWORD
----------    ------------------------
md5) SYS      A6sRMebBoEvNcvxfFJIcVw==
sha256) SYS   SHADOW PASSWORD
 
 

4. Add Parameter (tip file)

Add the parameter _CRYPTO_LEVEL=1 to the tip file.

 

5. Change CRYPTO_LEVEL

alter system set _CRYPTO_LEVEL=1;

 

6. Verify sys/tibero Login

 

7. Reset Existing Users' Passwords

--Example
alter user syscat identified by syscat;
Note
When setting passwords, if patch 209586c is not applied, punctuation marks (') cannot be used.

 

 

 
 
 

Related to