Percona-Tookit工具包之pt-show-grants

 

Preface

 

    User privileges regulation is pretty important in DBAs routine job.As we all know,it's the less the better to reduce risks when someone who has no privileges manipulates data by malevolence.On the other hand,when we implement HA,replication or the other tools,it's significant and efficient to grant proper privileges to specific users.

 

Introduce

 

    pt-show-grants is the right tool which can directly provide an overview of grants to all users on connected MySQL db server what is rather convenient for us.There're also several advartages of using it.At first,you can dump user grants from one server to another one simply. Secondly,you can organize version control by placing the user grants with it since it will sort the grant statements in order what "show grants;" may not do.Thirdly,now that it provide a normalized format than "show grants;" does,you can distinguish the different user grants between two servers efficiently.

 

Procedure

 

Usage

 pt-show-grants [OPTIONS] [DSN]

Parameters

 //Regular parameters.
 --drop //Add "DROP USER" before each user of output,which can be used to get a ddl of droping user.
 --flush //Add "FLUSH PRIVILEGES" after output(version ahead 4.1.1 need).
 --ignore //Speicify the ignore user.
 --only //on the contrary of "--ignore" does,specify the only user you want.
 --include-unused-roles //This options merely for MySQL 8.0 + version which support roles.
 --seperate //List the grant and revoke statement respectively.
 
 //Dump hearder relevant.
 --no-header //Don't print head information of dump.
 --no-timestamp //Don't add timestam to the head of dump.

Examples

 

Execute without  any parameters.(it will read connection options in defatul my.cnf )

 [root@zlm1 :: ~]
 #pt-show-grants
 -- Grants dumped by pt-show-grants
 -- Dumped from server Localhost via UNIX socket, MySQL 5.7.-log at -- ::
 -- Grants for 'bkuser'@'localhost'
 CREATE USER IF NOT EXISTS 'bkuser'@'localhost';
 ALTER USER 'bkuser'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*3DE5D9E4FBC1E464DA1B1172D6333CE89FDE5C61' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT LOCK TABLES, PROCESS, RELOAD, REPLICATION CLIENT ON *.* TO 'bkuser'@'localhost';
 -- Grants for 'mysql.session'@'localhost'
 CREATE USER IF NOT EXISTS 'mysql.session'@'localhost';
 ALTER USER 'mysql.session'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT LOCK;
 GRANT SELECT ON `mysql`.`user` TO 'mysql.session'@'localhost';
 GRANT SELECT ON `performance_schema`.* TO 'mysql.session'@'localhost';
 GRANT SUPER ON *.* TO 'mysql.session'@'localhost';
 -- Grants for 'mysql.sys'@'localhost'
 CREATE USER IF NOT EXISTS 'mysql.sys'@'localhost';
 ALTER USER 'mysql.sys'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT LOCK;
 GRANT SELECT ON `sys`.`sys_config` TO 'mysql.sys'@'localhost';
 GRANT TRIGGER ON `sys`.* TO 'mysql.sys'@'localhost';
 GRANT USAGE ON *.* TO 'mysql.sys'@'localhost';
 -- Grants for 'repl'@'192.168.56.%'
 CREATE USER IF NOT EXISTS 'repl'@'192.168.56.%';
 ALTER USER 'repl'@'192.168.56.%' IDENTIFIED WITH 'mysql_native_password' AS '*872ECE72A7EBAC6A183C90D7043D5F359BD85A9E' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'repl'@'192.168.56.%';
 -- Grants for 'root'@'localhost'
 CREATE USER IF NOT EXISTS 'root'@'localhost';
 ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*DDFB542AA0BD1D251995D81AEBEB96DEEAD1132F' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
 GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION;

Specify the only user "root".

 [root@zlm1 :: ~]
 #pt-show-grants -hlocalhost -P3306 -uroot -pPassw0rd --only=root
 -- Grants dumped by pt-show-grants
 -- Dumped from server Localhost via UNIX socket, MySQL 5.7.-log at -- ::
 -- Grants for 'root'@'localhost'
 CREATE USER IF NOT EXISTS 'root'@'localhost';
 ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*DDFB542AA0BD1D251995D81AEBEB96DEEAD1132F' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
 GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION;

Specify the only user "root" with revoke statement separated with grant statement.

 [root@zlm1 :: ~]
 #pt-show-grants -hlocalhost -P3306 -uroot -pPassw0rd --only=root --separate --revoke
 -- Grants dumped by pt-show-grants
 -- Dumped from server Localhost via UNIX socket, MySQL 5.7.-log at -- ::
 -- Revoke statements for 'root'@'localhost'
 REVOKE ALL PRIVILEGES ON *.* FROM 'root'@'localhost';
 REVOKE GRANT OPTION ON *.* FROM 'root'@'localhost';
 REVOKE PROXY ON ''@'' FROM 'root'@'localhost';
 REVOKE GRANT OPTION ON *.* FROM 'root'@'localhost';
 -- Grants for 'root'@'localhost'
 CREATE USER IF NOT EXISTS 'root'@'localhost';
 ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*DDFB542AA0BD1D251995D81AEBEB96DEEAD1132F' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
 GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION;

Specify the only user "root" with drop statement.

 [root@zlm1 :: ~]
 # pt-show-grants -hlocalhost -P3306 -uroot -pPassw0rd --only=root --drop
 -- Grants dumped by pt-show-grants
 -- Dumped from server Localhost via UNIX socket, MySQL 5.7.-log at -- ::
 DROP USER 'root'@'localhost';
 DELETE FROM `mysql`.`user` WHERE `User`='root' AND `Host`='localhost';
 -- Grants for 'root'@'localhost'
 CREATE USER IF NOT EXISTS 'root'@'localhost';
 ALTER USER 'root'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '*DDFB542AA0BD1D251995D81AEBEB96DEEAD1132F' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION;
 GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION;

Specify the only user "repl" with no timestamp.

 [root@zlm1 :: ~]
 #pt-show-grants -h192.168.56. -P3306 -urepl -prepl4slave --only repl --no-timestamp
 -- Grants dumped by pt-show-grants
 -- Dumped from server 192.168.56.100 via TCP/IP, MySQL 5.7.-log
 -- Grants for 'repl'@'192.168.56.%'
 CREATE USER IF NOT EXISTS 'repl'@'192.168.56.%';
 ALTER USER 'repl'@'192.168.56.%' IDENTIFIED WITH 'mysql_native_password' AS '*872ECE72A7EBAC6A183C90D7043D5F359BD85A9E' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'repl'@'192.168.56.%';

Specify the only user "repl" with no header.

 [root@zlm1 :: ~]
 #pt-show-grants -h192.168.56. -P3306 -urepl -prepl4slave --only repl --no-header
 -- Grants for 'repl'@'192.168.56.%' //Only message of annotation this time.
 CREATE USER IF NOT EXISTS 'repl'@'192.168.56.%';
 ALTER USER 'repl'@'192.168.56.%' IDENTIFIED WITH 'mysql_native_password' AS '*872ECE72A7EBAC6A183C90D7043D5F359BD85A9E' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK;
 GRANT ALL PRIVILEGES ON *.* TO 'repl'@'192.168.56.%';

Distinguish the difference of user privileges between zlm1 & zlm2 and make it be same.

 //Dump the user grans into a file on server zlm1
 [root@zlm1 :: ~]
 #pt-show-grants -h192.168.56. -P3306 -urepl -prepl4slave --only repl > repl_grants.sql 
 
 //Copy the file to zlm2.
 [root@zlm1 :: ~]
 #scp repl_grants.sql 192.168.56.101:~
 repl_grants.sql                                                                                                    %       .4KB/s   :    
 
 [root@zlm1 :: ~]
 
 //Show user infomation on zlm2.
 root@localhost:mysql.sock [(none)]>select user,host from mysql.user;
 +---------------+--------------+
 | user          | host         |
 +---------------+--------------+
 | repl          | 192.168..% |
 | bkuser        | localhost    |
 | mysql.session | localhost    |
 | mysql.sys     | localhost    |
 | root          | localhost    |
 +---------------+--------------+
  rows in set (0.00 sec)
 
 //Show user grants infomation.
 root@localhost:mysql.sock [(none)]>show grants for repl@'192.168.56.%';
 +---------------------------------------------------------+
 | Grants for repl@192.168..%                            |
 +---------------------------------------------------------+
 | GRANT REPLICATION SLAVE ON *.* TO 'repl'@'192.168.56.%' |
 +---------------------------------------------------------+
  row in set (0.00 sec)
 
 //Revoke the privileges from repl user to mimic difference.
 root@localhost:mysql.sock [(none)]>revoke all on *.* from repl@'192.168.56.%';
 Query OK,  rows affected (0.00 sec)
 
 root@localhost:mysql.sock [(none)]>show grants for repl@'192.168.56.%';
 +---------------------------------------------+
 | Grants for repl@192.168..%                |
 +---------------------------------------------+
 | GRANT USAGE ON *.* TO 'repl'@'192.168.56.%' |
 +---------------------------------------------+
  row in set (0.00 sec)
 
 //Check difference with zlm1.
 [root@zlm2 :: ~]
 #pt-show-grants -hlocalhost -P3306 -uroot -pPassw0rd --only repl | diff repl_grants.sql -
 2c2
 < -- Dumped from server 192.168.56.100 via TCP/IP, MySQL 5.7.-log at -- ::
 ---
 > -- Dumped from server Localhost via UNIX socket, MySQL 5.7.-log at -- ::
 6c6
 < GRANT ALL PRIVILEGES ON *.* TO 'repl'@'192.168.56.%'; //User privileges in dump file.
 ---
 > GRANT USAGE ON *.* TO 'repl'@'192.168.56.%'; //User privileges in local server.
 
 [root@zlm2 :: ~]
 #mysql -hlocalhost -S /var/lib/mysql/mysql.sock -uroot -pPassw0rd < repl_grants.sql >/dev/null //Import the user grants from dump file.
 
 //Check the privileges of user repl again.
 [root@zlm2 :: ~]
 #mysql
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is
 Server version: 5.7.-log MySQL Community Server (GPL)
 
 Copyright (c) , , Oracle and/or its affiliates. All rights reserved.
 
 Oracle is a registered trademark of Oracle Corporation and/or its
 affiliates. Other names may be trademarks of their respective
 owners.
 
 Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
 root@localhost:mysql.sock [(none)]>show grants for repl@'192.168.56.%';
 +------------------------------------------------------+
 | Grants for repl@192.168..%                         |
 +------------------------------------------------------+
 | GRANT ALL PRIVILEGES ON *.* TO 'repl'@'192.168.56.%' | //The privileges are same with zlm1 now.
 +------------------------------------------------------+
  row in set (0.00 sec)

Summary

• pt-show-grants helps us dba to manager user privileges better than MySQL command line "show grant for ... ;" does.
• pt-show-grants is convenient to use even with any options specified.
• pt-show-grants can be used to check the difference of user privileges between the servers.
• pt-show-grants is not a intrusive tool like pt-pmp,you can run it at any time you need.