Security in MySQL

Abstract

This is the MySQL Security Guide extract from the MySQL 5.5 Reference Manual.

For legal information, see the Legal Notices.

For help with using MySQL, please visit either the MySQL Forums or MySQL Mailing Lists, where you can discuss your issues with other MySQL users.

For additional documentation on MySQL products, including translations of the documentation into other languages, and downloadable versions in variety of formats, including HTML and PDF formats, see the MySQL Documentation Library.

Licensing information—MySQL 5.5.  This product may include third-party software, used under license. If you are using a Commercial release of MySQL 5.5, see this document for licensing information, including licensing information relating to third-party software that may be included in this Commercial release. If you are using a Community release of MySQL 5.5, see this document for licensing information, including licensing information relating to third-party software that may be included in this Community release.

Licensing information—MySQL Cluster NDB 7.2.  This product may include third-party software, used under license. If you are using a Commercial release of MySQL Cluster NDB 7.2, see this document for licensing information, including licensing information relating to third-party software that may be included in this Commercial release. If you are using a Community release of MySQL Cluster NDB 7.2, see this document for licensing information, including licensing information relating to third-party software that may be included in this Community release.

Document generated on: 2016-11-04 (revision: 49750)


Table of Contents

Preface and Legal Notices
1 Security
2 General Security Issues
2.1 Security Guidelines
2.2 Keeping Passwords Secure
2.2.1 End-User Guidelines for Password Security
2.2.2 Administrator Guidelines for Password Security
2.2.3 Passwords and Logging
2.2.4 Password Hashing in MySQL
2.2.5 Implications of Password Hashing Changes in MySQL 4.1 for Application Programs
2.3 Making MySQL Secure Against Attackers
2.4 Security-Related mysqld Options and Variables
2.5 How to Run MySQL as a Normal User
2.6 Security Issues with LOAD DATA LOCAL
2.7 Client Programming Security Guidelines
3 Postinstallation Setup and Testing
3.1 Initializing the Data Directory
3.1.1 Problems Running mysql_install_db
3.2 Starting the Server
3.2.1 Troubleshooting Problems Starting the MySQL Server
3.3 Testing the Server
3.4 Securing the Initial MySQL Accounts
3.5 Starting and Stopping MySQL Automatically
4 The MySQL Access Privilege System
4.1 Privileges Provided by MySQL
4.2 Grant Tables
4.3 Specifying Account Names
4.4 Access Control, Stage 1: Connection Verification
4.5 Access Control, Stage 2: Request Verification
4.6 When Privilege Changes Take Effect
4.7 Troubleshooting Problems Connecting to MySQL
5 MySQL User Account Management
5.1 User Names and Passwords
5.2 Adding User Accounts
5.3 Removing User Accounts
5.4 Setting Account Resource Limits
5.5 Assigning Account Passwords
5.6 Pluggable Authentication
5.7 Proxy Users
5.8 SQL-Based MySQL Account Activity Auditing
6 Using Secure Connections
6.1 OpenSSL Versus yaSSL
6.2 Building MySQL with Support for Secure Connections
6.3 Secure Connection Protocols and Ciphers
6.4 Configuring MySQL to Use Secure Connections
6.5 Command Options for Secure Connections
6.6 Creating SSL Certificates and Keys Using openssl
6.7 Connecting to MySQL Remotely from Windows with SSH
7 Security Plugins
7.1 Authentication Plugins
7.1.1 The Native Authentication Plugin
7.1.2 The Old Native Authentication Plugin
7.1.3 The PAM Authentication Plugin
7.1.4 The Windows Native Authentication Plugin
7.1.5 The Cleartext Client-Side Authentication Plugin
7.1.6 The Socket Peer-Credential Authentication Plugin
7.1.7 The Test Authentication Plugin
7.2 MySQL Enterprise Audit
7.2.1 Installing MySQL Enterprise Audit
7.2.2 MySQL Enterprise Audit Security Considerations
7.2.3 The Audit Log File
7.2.4 Audit Log Logging Control
7.2.5 Audit Log Filtering
7.2.6 Audit Log Option and Variable Reference
7.2.7 Audit Log Options and System Variables
7.2.8 Audit Log Restrictions
A MySQL 5.5 FAQ: Security