validate_password plugin serves to test
passwords and improve security. The plugin exposes a set of system
variables that enable you to define password policy.
validate_password plugin implements these
In SQL statements that assign a password supplied as a cleartext value, the plugin checks the password against the current password policy and rejects the password if it is weak (the statement returns an
ER_NOT_VALID_PASSWORDerror). This applies to the
SET PASSWORDstatements, and passwords given as arguments to the
VALIDATE_PASSWORD_STRENGTH()SQL function assesses the strength of potential passwords. The function takes a password argument and returns an integer from 0 (weak) to 100 (strong).
validate_password checks the
cleartext password in the following statement. Under the default
password policy, which requires passwords to be at least 8
characters long, the password is weak and the statement produces
mysql> ALTER USER USER() IDENTIFIED BY 'abc'; ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
Passwords specified as hashed values are not checked because the original password value is not available for checking:
mysql> ALTER USER 'jeffrey'@'localhost' IDENTIFIED WITH mysql_native_password AS '*0D3CED9BEC10A777AEC23CCC353A8C08A633045E'; Query OK, 0 rows affected (0.01 sec)
To configure password checking, modify the system variables having
names of the form
these are the parameters that control password policy. See
Section 6.3.2, “Password Validation Plugin Options and Variables”.
validate_password is not installed, the
system variables are not available, passwords in statements are
not checked, and the
function always returns 0. For example, without the plugin
installed, accounts can be assigned passwords shorter than 8
validate_password is installed,
it implements three levels of password checking:
STRONG. The default is
MEDIUM; to change this, modify the value of
policies implement increasingly strict password tests. The
following descriptions refer to default parameter values, which
can be modified by changing the appropriate system variables.
LOWpolicy tests password length only. Passwords must be at least 8 characters long. To change this length, modify
MEDIUMpolicy adds the conditions that passwords must contain at least 1 numeric character, 1 lowercase character, 1 uppercase character, and 1 special (nonalphanumeric) character. To change these values, modify
STRONGpolicy adds the condition that password substrings of length 4 or longer must not match words in the dictionary file, if one has been specified. To specify the dictionary file, modify
In addition, as of MySQL 5.7.15,
validate_password supports the capability of
rejecting passwords that match the user name part of the effective
user account for the current session, either forward or in
reverse. To provide control over this capability,
validate_password exposes a
system variable, which is enabled by default.