[MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

案例描述

一套MySQL 8.0.39数据库的错误日志突然出现大量下面错误,导致短时间内收到大量告警

2026-09-14T03:53:17.269079Z 336775 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:17.986942Z 336776 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:18.283417Z 336777 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:18.974973Z 336778 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:19.660872Z 336779 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:19.851500Z 336780 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:20.763498Z 336781 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:21.614799Z 336782 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:24.160650Z 336783 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'
2026-09-14T03:53:24.283238Z 336784 [Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

案例分析

从错误日志中的错误信息看,无法定位是哪一个具体账号,本来打算通过临时开启通用查询日志,捕获这些账号的具体信息,具体操作如下所示:

-- 开通一般日志：
show variables like 'general_log';
set global general_log=on;
show variables like 'general_log';
-- 查看一般日志路径：
show variables like 'general_log_file';

但是后续一直没有出现这类告警信息,数据库也不存在基于sha256_password认证的账号用户,因为之前收到安全组同事关于安全扫描的邮件,后续确认就是安全扫描引起的.其实重现这个错误也很简单,用一个数据库不存在的账号尝试访问数据库,那么就会在MySQL的错误日志中发现下面这类错误信息(前提条件:错误日志参数log_error_verbosity设置为2或以上, 数据库版本为MySQL 8.0.x)

mysql -h xxx.xxx.xxx.xxx -u test -P 3306 -p

错误日志

[Warning] [MY-013360] [Server] Plugin sha256_password reported: ''sha256_password' is deprecated and will be removed in a future release. Please use caching_sha2_password instead'

根据参考资料中详细描述,有些MySQL版本,当使用不存在的用户登录数据库时，MySQL会随机选择用户的密码认证插件,在当前的版本中,有1/3的概率会选择到PLUGIN_SHA256_PASSWORD 插件。选择该插件后，在后续的认证逻辑将会触发警告日志生成。更多详细分析,建议参考原文.此处就不赘述了.

解决方案

1. 可以在mysql数据库中通过参数将该告警过滤，避免该告警信息输入到错误日志文件。相关配置如下：

show variables like 'log_error_suppression_list';
set global log_error_suppression_list='MY-013360;
show variables like 'log_error_suppression_list';

此方案属于临时屏蔽日志，不解决根源，适合生产日志降噪. 此处案例中,如果屏蔽这些日志反而不知道数据库被人扫描或嗅探. 反而不妥.

2. 升级数据库版本

MySQL 8.0.x的sha256_password是内置插件，无法 uninstall，MySQL 8.4起正式弃用sha256_password.

另外,如果MySQL升级到8.4的版本,建议将系统变量log_error_verbosity设置为3, 测试验证,只有在log_error_verbosity=3的情况下,错误日志才会记录这些尝试登陆的信息.好处是此处的提示信息很明确清晰.

2026-09-15T09:39:32.268862+08:00 50 [Note] [MY-010926] [Server] Access denied for user 'test'@'192.168.9.xx' (using password: YES)

参考资料

https://cloud.tencent.cn/developer/article/2261902