# Password Reuse Check Plugin {% hint style="info" %} `password_reuse_check` is available from [MariaDB 10.7.0](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.7/10.7.0). {% endhint %} ## Description The plugin is used to prevent a user from reusing a password, which can be a requirement in some security policies. The [password\_reuse\_check\_interval](https://mariadb.com/docs/server/reference/plugins/password-validation-plugins/password_reuse_check_interval) system variable determines the retention period, in days, for a password. By default, this is zero, meaning unlimited retention. Old passwords are stored in the [mysql.password\_reuse\_check\_history table](https://mariadb.com/docs/server/reference/system-tables/the-mysql-database-tables/mysqlpassword_reuse_check_history-table). Note that passwords can be directly set as a hash, bypassing the password validation, if the [strict\_password\_validation](https://mariadb.com/docs/server/server-management/variables-and-modes/server-system-variables#strict_password_validation) variable is `OFF` (it is `ON` by default). ### Installing the Plugin Although the plugin's shared library is distributed with MariaDB by default, the plugin is not actually installed by MariaDB by default. You can install the plugin dynamically, without restarting the server, by executing [INSTALL SONAME](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/plugin-sql-statements/install-soname) or [INSTALL PLUGIN](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/plugin-sql-statements/install-plugin): ```sql INSTALL SONAME 'password_reuse_check'; ``` The second method can be used to tell the server to load the plugin when it starts up. The plugin can be installed this way by providing the [--plugin-load](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options) or the [--plugin-load-add](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options) options. This can be specified as a command-line argument to [mysqld](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options) or it can be specified in a relevant server [option group](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/configuring-mariadb/configuring-mariadb-with-option-files#option-groups) in an [option file](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/configuring-mariadb/configuring-mariadb-with-option-files): ```ini [mariadb] ... plugin_load_add = password_reuse_check ``` ### Uninstalling the Plugin You can uninstall the plugin dynamically by executing [UNINSTALL SONAME](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/plugin-sql-statements/uninstall-soname) or [UNINSTALL PLUGIN](https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/plugin-sql-statements/uninstall-plugin): ```sql UNINSTALL SONAME 'password_reuse_check'; ``` If you installed the plugin by providing the [--plugin-load](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options) or the [--plugin-load-add](https://mariadb.com/docs/server/server-management/starting-and-stopping-mariadb/mariadbd-options) options in a relevant server [option group](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/configuring-mariadb/configuring-mariadb-with-option-files#option-groups) in an [option file](https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/configuring-mariadb/configuring-mariadb-with-option-files), then those options should be removed to prevent the plugin from being loaded the next time the server is restarted. ## Example ```sql INSTALL SONAME 'password_reuse_check'; GRANT SELECT ON *.* TO user1@localhost identified by 'pwd1'; Query OK, 0 rows affected (0.038 sec) GRANT SELECT ON *.* TO user1@localhost identified by 'pwd1'; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements GRANT SELECT ON *.* TO user1@localhost identified by 'pwd2'; Query OK, 0 rows affected (0.003 sec) GRANT SELECT ON *.* TO user1@localhost identified by 'pwd1'; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements ``` ## Versions | Version | Status | Introduced | | ------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1.0 | Alpha | [MariaDB 10.7.0](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.7/10.7.0) | | 1.0 | Beta | [MariaDB 10.7.2](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.7/10.7.2) | | 1.0 | Gamma | [MariaDB 10.7.4](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.7/10.7.4) | | 2.0 | Stable | [MariaDB 10.7.7](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.7/10.7.7), [MariaDB 10.8.7](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.8/10.8.7), [MariaDB 10.9.5](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.9/10.9.5), [MariaDB 10.10.2](https://app.gitbook.com/s/aEnK0ZXmUbJzqQrTjFyb/community-server/old-releases/10.10/10.10.2) | {% hint style="warning" %} The bump to version 2.0 required the change of the stored format to mitigate an implementation weakness ([MDEV-28838](https://jira.mariadb.org/browse/MDEV-28838)) and as such the bump from 1.0 to 2.0 will invalidate previously saved password reuse protections. {% endhint %} ## See Also * [Password Validation](https://mariadb.com/docs/server/reference/plugins/password-validation-plugins) * [10.7 preview feature: Password Reuse Check plugin](https://mariadb.org/10-7-preview-feature-password-reuse-check-plugin/) (MariaDB Foundation blog post) *This page is licensed: CC BY-SA / Gnu FDL* {% @marketo/form formId="4316" %}