Creating new mysql user errored with message: ER_NOT_VALID_PASSWORD: Your password does not satisfy the current policy requirements

[avinzheng]

Welcome to Ghost-CLI's GitHub repo! 👋🎉

Do you need help or have a question? Please come chat in Slack: https://slack.ghost.org/ 👫.

This issue is a

• Bug Report
• Feature Request

Summary

It seems the random password for MySQL user is too simple.

[root@web blog]# ghost setup mysql
✖ Setting up "ghost" mysql user
A SystemError occurred.

Message: Creating new mysql user errored with message: ER_NOT_VALID_PASSWORD: Your > password does not satisfy the current policy requirements

Debug Information:
Node Version: v6.11.5
Ghost-CLI Version: 1.1.3
Environment: production
Command: 'ghost setup mysql'

Please refer to https://docs.ghost.org/v1/docs/troubleshooting#section-cli-errors for troubleshooting.
[root@web blog]# mysqld -V
mysqld Ver 5.7.20 for Linux on x86_64 (MySQL Community Server (GPL))

[allthedrones]

I also encountered this issue, with the MySQL Password Validation Plugin (which MySQL now prompts for when running the included hardening routine mysql_secure_installation), configured to the MEDIUM or STRONG settings.

Most likely RC is password shorter than 8 chars or not meeting complexity requirements (mixed case, 1+ numerals, 1+ special char).

Failing password config on MySQL:

mysql> SHOW VARIABLES LIKE 'validate_password%';
+--------------------------------------+--------+
| Variable_name                        | Value  |
+--------------------------------------+--------+
| validate_password_check_user_name    | OFF    |
| validate_password_dictionary_file    |        |
| validate_password_length             | 8      |
| validate_password_mixed_case_count   | 1      |
| validate_password_number_count       | 1      |
| validate_password_policy             | MEDIUM |
| validate_password_special_char_count | 1      |
+--------------------------------------+--------+

[acburdine]

@imzhengfei this should I think be a fairly small/easy fix - so if you want to create a PR for it feel free :) Otherwise I'll get to this when I have some time.

[avinzheng]

@acburdine I know little about node, I will try. Hope I can do it. :)

[gompa]

a good effort in my opinion(for what its worth) but according to this:
Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security

[avinzheng]

@gompa thx for your advice, I'll try to find another way.

[avinzheng]

@gompa Thx for your reminding me of that problem, I've rewrite the RAMDOM method with Linear Congruential Generator in stead of Math.random().