Security in MySQL

Abstract

This is the MySQL Security Guide extract from the MySQL 5.6 Reference Manual.

For legal information, see the Legal Notices.

For help with using MySQL, please visit the MySQL Forums, where you can discuss your issues with other MySQL users.

Document generated on: 2023-02-08 (revision: 74963)

---

Table of Contents

Preface and Legal Notices

1 Security

2 General Security Issues

2.1 Security Guidelines

2.2 Keeping Passwords Secure

2.2.1 End-User Guidelines for Password Security

2.2.2 Administrator Guidelines for Password Security

2.2.3 Passwords and Logging

2.2.4 Password Hashing in MySQL

2.2.5 Implications of Password Hashing Changes in MySQL 4.1 for Application Programs

2.3 Making MySQL Secure Against Attackers

2.4 Security-Related mysqld Options and Variables

2.5 How to Run MySQL as a Normal User

2.6 Security Considerations for LOAD DATA LOCAL

2.7 Client Programming Security Guidelines

3 Postinstallation Setup and Testing

3.1 Initializing the Data Directory

3.1.1 Problems Running mysql_install_db

3.2 Starting the Server

3.2.1 Troubleshooting Problems Starting the MySQL Server

3.3 Testing the Server

3.4 Securing the Initial MySQL Accounts

3.5 Starting and Stopping MySQL Automatically

4 Access Control and Account Management

4.1 Account User Names and Passwords

4.2 Privileges Provided by MySQL

4.3 Grant Tables

4.4 Specifying Account Names

4.5 Access Control, Stage 1: Connection Verification

4.6 Access Control, Stage 2: Request Verification

4.7 Adding Accounts, Assigning Privileges, and Dropping Accounts

4.8 When Privilege Changes Take Effect

4.9 Assigning Account Passwords

4.10 Server Handling of Expired Passwords

4.11 Pluggable Authentication

4.12 Proxy Users

4.13 Setting Account Resource Limits

4.14 Troubleshooting Problems Connecting to MySQL

4.15 SQL-Based Account Activity Auditing

5 Using Encrypted Connections

5.1 Configuring MySQL to Use Encrypted Connections

5.2 Encrypted Connection TLS Protocols and Ciphers

5.3 Creating SSL and RSA Certificates and Keys

5.3.1 Creating SSL Certificates and Keys Using openssl

5.3.2 Creating RSA Keys Using openssl

5.4 SSL Library-Dependent Capabilities

5.5 Connecting to MySQL Remotely from Windows with SSH

6 Security Plugins

6.1 Authentication Plugins

6.1.1 Native Pluggable Authentication

6.1.2 Old Native Pluggable Authentication

6.1.3 Migrating Away from Pre-4.1 Password Hashing and the mysql_old_password Plugin

6.1.4 SHA-256 Pluggable Authentication

6.1.5 Client-Side Cleartext Pluggable Authentication

6.1.6 PAM Pluggable Authentication

6.1.7 Windows Pluggable Authentication

6.1.8 Socket Peer-Credential Pluggable Authentication

6.1.9 Test Pluggable Authentication

6.2 The Connection-Control Plugins

6.2.1 Connection-Control Plugin Installation

6.2.2 Connection-Control System and Status Variables

6.3 The Password Validation Plugin

6.3.1 Password Validation Plugin Installation

6.3.2 Password Validation Plugin Options and Variables

6.4 MySQL Enterprise Audit

6.4.1 Installing MySQL Enterprise Audit

6.4.2 MySQL Enterprise Audit Security Considerations

6.4.3 Audit Log File Formats

6.4.4 Configuring Audit Logging Characteristics

6.4.5 Audit Log Filtering

6.4.6 Audit Log Reference

6.4.7 Audit Log Restrictions

6.5 MySQL Enterprise Firewall

6.5.1 Elements of MySQL Enterprise Firewall

6.5.2 Installing or Uninstalling MySQL Enterprise Firewall

6.5.3 Using MySQL Enterprise Firewall

6.5.4 MySQL Enterprise Firewall Reference

A MySQL 5.6 FAQ: Security