MySQL 8.0用户及安全管理

用户的功能

登录数据库
管理数据库对象

用户的组成

用户名@'白名单'

白名单：

%
10.0.0.10
10.0..%
10.0.0.5%
10.0.0.0/255.255.254.0
oldguo.com
db01
127.0.0.1
localhost   ----> socket

用户的管理

创建用户

sha2 : .0新的特性
create user test@'localhost' identified by '123456';

native: 兼容老版本
create user test@'10.0.0.%' identified with mysql_native_password by '123456';

mysql> select user,host,authentication_string,plugin from mysql.user where user='test';
+------+-----------+------------------------------------------------------------------------+-----------------------+
| user | host      | authentication_string                                                  | plugin                |
+------+-----------+------------------------------------------------------------------------+-----------------------+
| test | 10.0..%  | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              | mysql_native_password |
| test | localhost | $A$$N]i!&l5mc<\]LLWHVU6M3YoRDkeSbKtTpDAary4WGFMtmapVJxyNwnd0 | caching_sha2_password |
+------+-----------+------------------------------------------------------------------------+-----------------------+
 rows in set (0.01 sec)

删除用户

mysql> drop user test@'10.0.0.%';
Query OK,  rows affected (0.00 sec)

修改用户

mysql> alter user test@'localhost' identified with mysql_native_password by '';
Query OK,  rows affected (0.00 sec)

由于加密插件导致无法登录

1. 主从复制
2. 高可用
3. 老版本开发工具

mysql>  create user test1@'%' identified  by '';
Query OK,  rows affected (0.00 sec)

用户资源管理

密码过期时间

mysql> select @@default_password_lifetime;
+-----------------------------+
| @@default_password_lifetime |
+-----------------------------+
|                            |             默认：密码永不过期
+-----------------------------+
 row in set (0.00 sec)

设置密码时效

# 设置密码有效期为180天
mysql> SET PERSIST default_password_lifetime = ;
Query OK,  rows affected (0.00 sec)

mysql> select @@default_password_lifetime;
+-----------------------------+
| @@default_password_lifetime |
+-----------------------------+
|                          |
+-----------------------------+
 row in set (0.00 sec)

CREATE USER 'test'@'localhost' PASSWORD EXPIRE INTERVAL  DAY;
ALTER USER test@'localhost' PASSWORD EXPIRE INTERVAL  DAY;
CREATE USER 'test'@'localhost' PASSWORD EXPIRE NEVER;
ALTER USER 'test'@'localhost' PASSWORD EXPIRE NEVER;

密码重用

默认随意重复使用

password_history=             # 6次之内不能重复使用此密码
password_reuse_interval=     # 365天之内不能重复使用此密码

用户的锁定与解锁

ALTER USER 'app_dev'@'localhost' ACCOUNT LOCK;
ALTER USER 'app_dev'@'localhost' ACCOUNT UNLOCK;

权限管理

权限列表

mysql> show privileges;
常用权限：
Alter
Alter routine
Create
Create routine
Create role
Create temporary tables
Create view
Create user
Delete
Drop
Drop role
Event
Execute
File
Grant option
Index
Insert
Lock tables
Process
Proxy
References
Reload
Replication client
Replication slave
Select
Show databases
Show view
Shutdown
Super
Trigger
Create tablespace
Update                  

授权

8.0版本不能授权和设置密码一起写，多次授权同一用户是叠加权限而不是覆盖

mysql> grant all on *.* to zh@'localhost';

查看权限

mysql> show grants for zh@'localhost' ;
+----------------------------------------+
| Grants for zh@localhost                |
+----------------------------------------+
| GRANT USAGE ON *.* TO `zh`@`localhost` |         ##Usage表示只有连接库权限
+----------------------------------------+
 row in set (0.00 sec)

对某一列授权

回收权限

mysql> revoke delete on *.* from zh@'localhost';
Query OK,  rows affected (0.01 sec)

mysql> revoke select(id) on test.account from user1@'10.0.0.%';
Query OK,  rows affected (0.00 sec)

基于role的创建和授权

查看所有role

生产中的用户类型权限规范

管理员 : ALL
开发   : Create ,Create routine,Create temporary tables,Create view,Delete ,Event ,Execute,Insert ,References,Select,Show databases ,Show view ,Trigger,Update
监控  : select , replication slave , client  supper
备份  : ALL
主从  : replication slave
业务  : insert , update , delete ,select