PAM-CF-0001 when launching MySQL command line through a TCP/UDP service.

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When attempting to launch a MySQL command-line connection via a PAM TCP/UDP service on a Windows machine, the connection fails. The PAM client logs or Tomcat catalina.out may show the following error: PAM-CF-0001: The Custom Connector server is inaccessible or its configuration is invalid. java.net.ConnectException: Connection refused (Connection refused)

The configuration typically involves a command similar to: Cmd /c start C:\####\bin\mysql.exe -h <Local IP> -u <User> -p<Password> -P <Local Port>

Environment

PAM Client on Windows

Cause

When passing credentials directly, some special characters in passwords can cause mysql.exe command line to fail when passed through the PAM service. In Windows cmd.exe and scripts, escape &, |, <, >, (, ), %, !, {, }, and ^ characters with a preceding caret (^) to include them literally in a password or string like a password field. Including any of these characters in a password stored in CA PAM will cause the TCP/UDP services command line operation to fail. These characters cannot be escaped by simply putting quotes or double quotes around the TCP/UDP command string in the same manner in some Linux or Unix command line strings. 

Resolution

This is not a limitation in Windows command line that CA PAM can work around in the TCP/UDP Service at this time. If you cannot exclude these characters from your passwords the TCP/UDP service will fail with any of these characters   &, |, <, >, (, ), %, !, {, }, ^