Security in MySQL
		Next

Security in MySQL

Abstract

This is the MySQL Security Guide extract from the MySQL 5.7 Reference Manual.

For legal information, see the Legal Notices.

For help with using MySQL, please visit either the MySQL Forums or MySQL Mailing Lists, where you can discuss your issues with other MySQL users.

For additional documentation on MySQL products, including translations of the documentation into other languages, and downloadable versions in variety of formats, including HTML and PDF formats, see the MySQL Documentation Library.

Licensing information—MySQL 5.7. This product may include third-party software, used under license. If you are using a Commercial release of MySQL 5.7, see this document for licensing information, including licensing information relating to third-party software that may be included in this Commercial release. If you are using a Community release of MySQL 5.7, see this document for licensing information, including licensing information relating to third-party software that may be included in this Community release.

Licensing information—MySQL Cluster. This product may include third-party software, used under license. If you are using a Community release of MySQL Cluster NDB 7.5, see this document for licensing information, including licensing information relating to third-party software that may be included in this Community release.

Document generated on: 2016-06-03 (revision: 47906)

Table of Contents

Preface and Legal Notices

2 General Security Issues

2.1 Security Guidelines

2.2 Keeping Passwords Secure

2.2.1 End-User Guidelines for Password Security
2.2.2 Administrator Guidelines for Password Security
2.2.3 Passwords and Logging
2.2.4 Password Hashing in MySQL

2.3 Making MySQL Secure Against Attackers

2.4 Security-Related mysqld Options and Variables

2.5 How to Run MySQL as a Normal User

2.6 Security Issues with LOAD DATA LOCAL

2.7 Client Programming Security Guidelines

3 Postinstallation Setup and Testing

3.1 Initializing the Data Directory

3.1.1 Initializing the Data Directory Manually Using mysqld
3.1.2 Initializing the Data Directory Manually Using mysql_install_db
3.1.3 Problems Running mysql_install_db

3.2 Starting the Server

3.2.1 Troubleshooting Problems Starting the MySQL Server

3.3 Testing the Server

3.4 Securing the Initial MySQL Accounts

3.5 Starting and Stopping MySQL Automatically

4 The MySQL Access Privilege System

4.1 Privileges Provided by MySQL
4.2 Grant Tables
4.3 Specifying Account Names
4.4 Access Control, Stage 1: Connection Verification
4.5 Access Control, Stage 2: Request Verification
4.6 When Privilege Changes Take Effect
4.7 Troubleshooting Problems Connecting to MySQL

5 MySQL User Account Management

5.1 User Names and Passwords

5.2 Adding User Accounts

5.3 Removing User Accounts

5.4 Setting Account Resource Limits

5.5 Assigning Account Passwords

5.6 Password Expiration Policy

5.7 Password Expiration and Sandbox Mode

5.8 Pluggable Authentication

5.9 Proxy Users

5.10 User Account Locking

5.11 Using Secure Connections

5.11.1 OpenSSL Versus yaSSL
5.11.2 Building MySQL with Support for Secure Connections
5.11.3 Secure Connection Protocols and Ciphers
5.11.4 Configuring MySQL to Use Secure Connections
5.11.5 Command Options for Secure Connections

5.12 Creating SSL and RSA Certificates and Keys

5.12.1 Creating SSL and RSA Certificates and Keys using MySQL
5.12.2 Creating SSL Certificates and Keys Using openssl
5.12.3 Creating RSA Keys Using openssl

5.13 Connecting to MySQL Remotely from Windows with SSH

5.14 SQL-Based MySQL Account Activity Auditing

6 Security Plugins

6.1 Authentication Plugins

6.1.1 The Native Authentication Plugin
6.1.2 The Old Native Authentication Plugin
6.1.3 Migrating Away from Pre-4.1 Password Hashing and the mysql_old_password Plugin
6.1.4 The SHA-256 Authentication Plugin
6.1.5 The PAM Authentication Plugin
6.1.6 The Windows Native Authentication Plugin
6.1.7 The No-Login Authentication Plugin
6.1.8 The Cleartext Client-Side Authentication Plugin
6.1.9 The Socket Peer-Credential Authentication Plugin
6.1.10 The Test Authentication Plugin

6.2 The Password Validation Plugin

6.2.1 Password Validation Plugin Installation
6.2.2 Password Validation Plugin Options and Variables

6.3 The MySQL Keyring

6.3.1 Keyring Plugin Installation
6.3.2 Configuring the keyring_file File-Based Plugin
6.3.3 Configuring the keyring_okv Oracle Key Vault Plugin
6.3.4 Keyring Key Management Functions

6.4 MySQL Enterprise Audit

6.4.1 Audit Log Components
6.4.2 Installing or Uninstalling MySQL Enterprise Audit
6.4.3 MySQL Enterprise Audit Security Considerations
6.4.4 The Audit Log File
6.4.5 Audit Log Logging Control
6.4.6 Audit Log Filtering
6.4.7 Audit Log Filtering (Legacy Mode)
6.4.8 Audit Log Reference
6.4.9 Audit Log Restrictions

6.5 MySQL Enterprise Firewall

6.5.1 MySQL Enterprise Firewall Components
6.5.2 Installing or Uninstalling MySQL Enterprise Firewall
6.5.3 Using MySQL Enterprise Firewall
6.5.4 MySQL Enterprise Firewall Reference

A MySQL 5.7 FAQ: Security

	Up	Next
	Home	Preface and Legal Notices