From 8ca3a445392bc74297e251301692a946cef97cde Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 12:08:29 +0700 Subject: [PATCH 1/6] docs(features): MariaDB backup tools send a password only over TLS --- features/backup-restore.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index 57a13bf8..c794f018 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,6 +110,8 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, or PAM through `dialog`), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that leaves those two out, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. + ## Unloading on the server Oracle, Snowflake and BigQuery have no client-side dump. Unload to somewhere the server can write by running the engine's own statement in a query tab. It runs with your privileges, so the server's own error comes back when the destination is not writable. @@ -163,6 +165,7 @@ A non-zero exit shows the last 64 KB of the tool's stderr in a scrollable monosp |---|---| | *"… was not found on this system"* followed by an install command | Run that command so the binaries land on `PATH`. The message names the tool and the package for your engine | | An authentication failure | The password goes through the environment or a config file rather than a prompt, so this is the account or the database. Check that the role can log in | +| *"The server asked for the password in plain text …"* | The server signs in through PAM or LDAP, and the session has no TLS. Set SSL Mode to **Required**, or turn TLS on for the server | | *"could not tell whether … is MySQL's client or MariaDB's"* | The tool on `PATH` did not answer `--version`, and the two families take different SSL flags. Reinstall `mysql-client` or `mariadb` | | Objects that conflict with the dump | Restore into a fresh database, or drop the conflicting objects first | | *"a single transaction can only write to a single attached database"* | A DuckDB query tab has an open transaction that has already written. Commit or roll it back, then run the backup again | From 1dfab4054f264ec651fd4b46c2d7da7c23a48029 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 12:25:47 +0700 Subject: [PATCH 2/6] docs(features): name the plugin folder as an allow list --- features/backup-restore.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index c794f018..f7f67420 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,7 +110,7 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. -MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, or PAM through `dialog`), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that leaves those two out, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. ## Unloading on the server From dca346087cd2ec8ffb75e163c07bbbfb2812a936 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 12:40:08 +0700 Subject: [PATCH 3/6] docs(features): a greeting that cannot be read stops the run --- features/backup-restore.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index f7f67420..f4a769e2 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,7 +110,7 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. -MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the greeting cannot be read, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. ## Unloading on the server From 31bcac55ee208c91f025f2a73a67caa7a7f9abcb Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 13:56:21 +0700 Subject: [PATCH 4/6] docs(features): a client with the plugins built in is refused --- features/backup-restore.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index f4a769e2..18c6cf40 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,7 +110,7 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. -MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the greeting cannot be read, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. A build with those plugins compiled in ignores the folder, so TablePro asks the tool first, against a local stand-in server, and refuses one that answers. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the greeting cannot be read, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. ## Unloading on the server From 51a84898056b601d0c74c722e58160a06b78328d Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 14:06:58 +0700 Subject: [PATCH 5/6] docs(features): Preferred asks the session whether the server offers TLS --- features/backup-restore.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index 18c6cf40..bd74c3ac 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,7 +110,7 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. -MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. A build with those plugins compiled in ignores the folder, so TablePro asks the tool first, against a local stand-in server, and refuses one that answers. **Preferred** reads the server's greeting first: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the greeting cannot be read, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. A build with those plugins compiled in ignores the folder, so TablePro asks the tool first, against a local stand-in server, and refuses one that answers. **Preferred** first asks TablePro's own session, which takes TLS whenever the server offers it: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the session cannot answer, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. ## Unloading on the server From 78e2a96babe6d3d842638e6855aa10365afdf186 Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Wed, 21 Oct 2026 14:19:28 +0700 Subject: [PATCH 6/6] docs(features): Preferred reads the server's greeting --- features/backup-restore.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/backup-restore.mdx b/features/backup-restore.mdx index bd74c3ac..bde2f4cf 100644 --- a/features/backup-restore.mdx +++ b/features/backup-restore.mdx @@ -110,7 +110,7 @@ MySQL's clients and MariaDB's no longer take the same flags. MySQL's take `--ssl MariaDB's clients have no flag for encrypting without verifying, so **Required** reaches them as `--ssl --ssl-verify-server-cert`. That refuses a server offering no TLS. With no CA certificate set it checks the encryption rather than the server's identity. -MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. A build with those plugins compiled in ignores the folder, so TablePro asks the tool first, against a local stand-in server, and refuses one that answers. **Preferred** first asks TablePro's own session, which takes TLS whenever the server offers it: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the session cannot answer, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. +MariaDB's clients send the password as typed whenever a server asks for it that way (`mysql_clear_password`, PAM through `dialog`, or a test plugin Homebrew ships), with or without TLS. On **Disabled**, TablePro runs them with a plugin folder that holds only the sign-in plugins that never do, so such a login fails instead. A build with those plugins compiled in ignores the folder, so TablePro asks the tool first, against a local stand-in server, and refuses one that answers. **Preferred** reads the server's greeting first, which sends no credentials: a server offering TLS gets `--ssl --skip-ssl-verify-server-cert`, and one offering none gets `--skip-ssl` and the same folder. When the greeting cannot be read, the backup or restore stops rather than guess. `--ssl` against a server without TLS falls back to plaintext and sends the typed password to `caching_sha2_password`, so it is never used there. A local socket, the Cloud SQL Auth Proxy and an SSH tunnel to the server's socket keep every plugin. ## Unloading on the server