文章目录
- [13. MySQL用户管理](#13. MySQL用户管理)
-
- [13.1 用户管理](#13.1 用户管理)
-
- [13.1.1 用户信息](#13.1.1 用户信息)
- [13.1.2 创建用户](#13.1.2 创建用户)
- [13.1.3 删除用户](#13.1.3 删除用户)
- [13.1.4 修改用户密码](#13.1.4 修改用户密码)
- [13.2 数据库权限管理](#13.2 数据库权限管理)
-
- MySQL权限列表
- [13.2.1 授权](#13.2.1 授权)
- [13.2.2 回收权限](#13.2.2 回收权限)
13. MySQL用户管理
如果我们只能使用root用户，这样存在安全隐患。这时，就需要使用MySQL的用户管理。
13.1 用户管理
13.1.1 用户信息
MySQL用户存储在系统库 mysql 的 user 表中：
sql
mysql> use mysql;
Database changed
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *EDD1889F47EEB2C9DDB1855642E57BBEFFC2158F |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *sTHISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
+---------------+-----------+-------------------------------------------+
-- 可以通过desc user初步查看一下表结构字段说明：
host：登录主机（localhost表示仅本机登录）user：用户名authentication_string：加密后的密码*_priv：权限字段
13.1.2 创建用户
语法：
sql
CREATE USER '用户名'@'登录主机/IP' IDENTIFIED BY '密码';示例：
sql
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
+---------------+-----------+-------------------------------------------+
3 rows in set (0.00 sec)
mysql> create user 'lll'@'localhost' identified by '123456';
Query OK, 0 rows affected (0.00 sec)
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| lll | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
+---------------+-----------+-------------------------------------------+
4 rows in set (0.00 sec)
-- 此时便可以使用新账号新密码进行登陆啦
-- 备注：可能实际在设置密码的时候，因为mysql本身的认证等级比较高，一些简单的密码无法设置，会爆出如下报错：
-- ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
-- 解决方案：https://blog.csdn.net/zhanaolu4821/article/details/93622812
-- 查看密码设置相关要求：SHOW VARIABLES LIKE 'validate_password%';
-- 这个大家下来自己玩玩
-- 关于新增用户这里，需要大家注意，不要轻易添加一个可以从任意地方登陆的user。13.1.3 删除用户
语法：
sql
drop user '用户名'@'主机名'示例：
sql
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| lll | localhost | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
+---------------+-----------+-------------------------------------------+
4 rows in set (0.00 sec)
mysql> drop user 'lll'@'localhost';
Query OK, 0 rows affected (0.01 sec)
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
+---------------+-----------+-------------------------------------------+
3 rows in set (0.00 sec)13.1.4 修改用户密码
修改自己的密码：
sql
SET PASSWORD = PASSWORD('新密码');Root修改其他用户密码：
sql
SET PASSWORD FOR '用户名'@'主机名' = PASSWORD('新密码');示例：
sql
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| lll | % | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
+---------------+-----------+-------------------------------------------+
4 rows in set (0.00 sec)
mysql> set password for 'lll'@'%'=password('654321');
Query OK, 0 rows affected, 1 warning (0.00 sec)
mysql> select USER,HOST,authentication_string from user;
+---------------+-----------+-------------------------------------------+
| USER | HOST | authentication_string |
+---------------+-----------+-------------------------------------------+
| root | localhost | *23AE809DDACAF96AF0FD78ED04B6A265E05AA257 |
| mysql.session | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| mysql.sys | localhost | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE |
| lll | % | *2A032F7C5BA932872F0F045E0CF6B53CF702F2C5 |
+---------------+-----------+-------------------------------------------+
4 rows in set (0.00 sec)13.2 数据库权限管理
MySQL权限列表
13.2.1 授权
语法：
sql
GRANT 权限列表 ON 库.对象 TO '用户'@'登录位置' [IDENTIFIED BY '密码'];关键符号：
- 权限列表，多个权限用逗号分开
.: 代表本系统中的所有数据库的所有对象（表，视图，存储过程等）库.*: 表示某个数据库中的所有数据对象(表，视图，存储过程等)- identified by可选。 如果用户存在，赋予权限的同时修改密码,如果该用户不存在，就是创建用户
示例：
sql
-- 使用root账号
-- 终端A
mysql> create database rootdb;
Query OK, 1 row affected (0.00 sec)
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| bit_index |
| index_db |
| mysql |
| performance_schema |
| rootdb |
| scott |
| sys |
| test_db |
+--------------------+
9 rows in set (0.00 sec)
mysql> use rootdb;
Database changed
mysql> create table user(id int primary key,name varchar(20));
Query OK, 0 rows affected (0.01 sec)
mysql> insert into user values (1,'张三');
Query OK, 1 row affected (0.00 sec)
mysql> show tables;
+------------------+
| Tables_in_rootdb |
+------------------+
| user |
+------------------+
1 row in set (0.00 sec)
-- 给用户lll赋予rootdb数据库下所有文件的select权限
mysql> grant select on rootdb.* to 'lll'@'%';
Query OK, 0 rows affected (0.00 sec)
mysql> show grants for 'lll'@'%';
+-----------------------------------------+
| Grants for lll@% |
+-----------------------------------------+
| GRANT USAGE ON *.* TO 'lll'@'%' |
| GRANT SELECT ON `rootdb`.* TO 'lll'@'%' |
+-----------------------------------------+
2 rows in set (0.00 sec)
-- 使用lll账号
-- 终端B
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.00 sec)
-- 暂停等root用户给lll赋完权之后，在查看
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| rootdb |
+--------------------+
2 rows in set (0.00 sec)
mysql> use rootdb;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> select*from user;
+----+--------+
| id | name |
+----+--------+
| 1 | 张三 |
+----+--------+
1 row in set (0.00 sec)
-- 没有删除权限
mysql> delete from user;
ERROR 1142 (42000): DELETE command denied to user 'lll'@'localhost' for table 'user'
备注：特定用户现有查看权限
mysql> show grants for 'whb'@'%';
mysql> show grants for 'lll'@'%';
+-----------------------------------------+
| Grants for lll@% |
+-----------------------------------------+
| GRANT USAGE ON *.* TO 'lll'@'%' |
| GRANT SELECT ON `rootdb`.* TO 'lll'@'%' |
+-----------------------------------------+
2 rows in set (0.00 sec)
mysql> show grants for 'root'@'localhost';
+---------------------------------------------------------------------+
| Grants for root@localhost |
+---------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION |
| GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION |
+---------------------------------------------------------------------+
2 rows in set (0.00 sec)注意：如果发现赋权限后，没有生效，执行如下指令：
sql
flush privileges;13.2.2 回收权限
语法：
sql
REVOKE 权限列表 ON 库.对象 FROM '用户'@'登录位置';示例：
sql
-- 回收whb对test数据库的所有权限
-- root身份，终端A
mysql> show grants for 'lll'@'%';
+-----------------------------------------+
| Grants for lll@% |
+-----------------------------------------+
| GRANT USAGE ON *.* TO 'lll'@'%' |
| GRANT SELECT ON `rootdb`.* TO 'lll'@'%' |
+-----------------------------------------+
2 rows in set (0.00 sec)
mysql> revoke select on rootdb.* from 'lll'@'%';
Query OK, 0 rows affected (0.00 sec)
mysql> show grants for 'lll'@'%';
+---------------------------------+
| Grants for lll@% |
+---------------------------------+
| GRANT USAGE ON *.* TO 'lll'@'%' |
+---------------------------------+
1 row in set (0.00 sec)
-- 终端B
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
+--------------------+
1 row in set (0.00 sec)