MySQL 8.4设置密码策略

背景

按照等保测评要求，需要修改MySQL密码相关设置。MySQL8.4+版本设置与之前版本不同，记录如下

设置密码策略

在 MySQL 8.4 中，原有的 validate_password 插件已被重新实现为 validate_password 组件。插件已弃用。因此，以下需要安装并使用这个新组件。

INSTALL COMPONENT 'file://component_validate_password';
开启后，默认密码策略支持8位，大小写字母、数字和特殊字符中的三种及以上。

bash 复制代码

Server version: 8.4.10 MySQL Community Server - GPL

Copyright (c) 2000, 2026, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use mysql;
Database changed
mysql> SHOW VARIABLES LIKE 'validate_password%';
Empty set (0.01 sec)

mysql> INSTALL COMPONENT 'file://component_validate_password';
Query OK, 0 rows affected (0.38 sec)

mysql> SHOW VARIABLES LIKE 'validate_password.%';
+-------------------------------------------------+--------+
| Variable_name                                   | Value  |
+-------------------------------------------------+--------+
| validate_password.changed_characters_percentage | 0      |
| validate_password.check_user_name               | ON     |
| validate_password.dictionary_file               |        |
| validate_password.length                        | 8      |
| validate_password.mixed_case_count              | 1      |
| validate_password.number_count                  | 1      |
| validate_password.policy                        | MEDIUM |
| validate_password.special_char_count            | 1      |
+-------------------------------------------------+--------+
8 rows in set (0.00 sec)

mysql>

设置密码过期时间

临时设置

bash 复制代码

mysql> SHOW VARIABLES LIKE '%default_password_lifetime%';
+---------------------------+-------+
| Variable_name             | Value |
+---------------------------+-------+
| default_password_lifetime | 0     |
+---------------------------+-------+
1 row in set (0.01 sec)

mysql> SET GLOBAL default_password_lifetime = 90;
Query OK, 0 rows affected (0.00 sec)

mysql> SHOW VARIABLES LIKE '%default_password_lifetime%';
+---------------------------+-------+
| Variable_name             | Value |
+---------------------------+-------+
| default_password_lifetime | 90    |
+---------------------------+-------+
1 row in set (0.01 sec)

永久设置

bash 复制代码

[root@vm172-16-0-84 ~]# cat /etc/my_3306.cnf

# For advice on how to change settings please see
# http://dev.mysql.com/doc/refman/8.2/en/server-configuration-defaults.html

[mysqld]

......

 #default_authentication_plugin=mysql_native_password
# 密码有效期配置（单位：天）
default_password_lifetime=90

设置登录失败策略

官方文档：https://dev.mysql.com/doc/refman/8.4/en/create-user.html

设置

FAILED_LOGIN_ATTEMPTS 失败次数
PASSWORD_LOCK_TIME 锁定天数（单位是天）

sql 复制代码

-- 针对已存在的用户 'your_user'@'localhost'
ALTER USER 'your_user'@'localhost'
    FAILED_LOGIN_ATTEMPTS 5
    PASSWORD_LOCK_TIME 1;

-- 对于新用户，可以在创建时直接指定
CREATE USER 'new_user'@'localhost' IDENTIFIED BY 'your_password'
    FAILED_LOGIN_ATTEMPTS 5
    PASSWORD_LOCK_TIME 1;

查看效果

bash 复制代码

mysql>  show create user root@'%' ;
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER for root@%                                                                                                                                                                                                                                                                                   |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER `root`@`%` IDENTIFIED WITH 'mysql_native_password' AS '*EA1323248265CD53AE59BE6AF15F0C1028FCEA81' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT FAILED_LOGIN_ATTEMPTS 5 PASSWORD_LOCK_TIME 1 |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

设置登录空闲退出时间

临时设置

bash 复制代码

mysql> SHOW GLOBAL VARIABLES LIKE 'interactive_timeout';
+---------------------+-------+
| Variable_name       | Value |
+---------------------+-------+
| interactive_timeout | 28800 |
+---------------------+-------+
1 row in set (0.01 sec)

mysql>  SET GLOBAL interactive_timeout = 1800;
Query OK, 0 rows affected (0.00 sec)

mysql>  SHOW GLOBAL VARIABLES LIKE 'interactive_timeout';
+---------------------+-------+
| Variable_name       | Value |
+---------------------+-------+
| interactive_timeout | 1800  |
+---------------------+-------+
1 row in set (0.00 sec)

永久设置

bash 复制代码

[root@vm172-16-0-84 ~]# grep -C 2 interactive_timeout /etc/my_3306.cnf

# 设置交互式连接（如MySQL命令行客户端）的超时时间为1800秒
interactive_timeout = 1800