Maraidb showing passwords in the log files - mysql

Question

Looking at the mariadb logs, I am seeing all the passwords logged in as clear text like IDENTIFIED BY . Is there any option or way yo suppress this. This is a huge security risk.
Any help is appreciated.
MariaDB [(none)]> SHOW VARIABLES LIKE "%version%";
+-------------------------+-----------------------------------+
| Variable_name | Value |
+-------------------------+-----------------------------------+
| innodb_version | 5.5.41-MariaDB-37.0 |
| protocol_version | 10 |
| slave_type_conversions | |
| version | 5.5.42-MariaDB-wsrep |
| version_comment | MariaDB Server, wsrep_25.11.r4026 |
| version_compile_machine | x86_64 |
| version_compile_os | Linux |
+-------------------------+-----------------------------------+

Answer 1

If you use audit plug-in v1.2 or newer, then mariadb masks the passwords in certain queries. Specifically:
Since version 1.2.0, passwords have been replaced by asterisks in the logs for certain queries, including:
GRANT, CREATE USER, CREATE MASTER, CREATE SERVER, ALTER SERVER
Passwords given with the PASSWORD() and OLD_PASSWORD() functions in
DML statements will still be logged as plain text in queries, as will
key strings used with encrypt functions such as ENCODE() and
AES_ENCRYPT().
Furthermore, you can protect the log files via traditional means by restricting access rights, using file system level encryption. Really, only DBAs should have access to server logs and they can pretty much do anything in the db anyway.

Answer 2

The clear text password is not only logged in the MariaDB logs but it might be also logged in the .mysql_history file of the user that connected to MariaDB and performed some
CREATE/GRANT/etc.. IDENTIFIED BY 'some_cleartext_password'
You can find .mysql_history in /home/username or in /root if you connected as root.
Best way to avoid such things to happen is to replace the syntax
CREATE/GRANT/etc.. IDENTIFIED BY 'some_cleartext_password'
with
CREATE/GRANT/etc.. IDENTIFIED BY PASSWORD 'hashed_password'
You can calculate the hashed password either in your application that is calling MariaDB or by using the PASSWORD() function of MariaDB. For example:
SELECT PASSWORD('some_cleartext_password')
Do the above select on another MariaDB/MySQL server if you don't want the above query to be logged, in which case you will end-up with the same problem. :-)