validate_password plugin serves to test
passwords and improve security. The plugin exposes a set of system
variables that enable you to define password policy.
This plugin implements two capabilities:
In statements that assign a password supplied as a cleartext value, the plugin checks the password against the current password policy and rejects the password if it is weak (the statement returns an
ER_NOT_VALID_PASSWORDerror). This applies to the
SET PASSWORDstatements, and passwords given as arguments to the
VALIDATE_PASSWORD_STRENGTH()SQL function assesses the strength of potential passwords. The function takes a password argument and returns an integer from 0 (weak) to 100 (strong).
For example, the cleartext password in the following statement is
checked. Under the default password policy implemented by
validate_password, which requires passwords to
be at least 8 characters long, the password is weak and the
statement produces an error:
mysql> SET PASSWORD = PASSWORD('abc'); ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
Passwords specified as hashed values are not checked because the original password value is not available for checking:
mysql> SET PASSWORD = '*0D3CED9BEC10A777AEC23CCC353A8C08A633045E'; Query OK, 0 rows affected (0.01 sec)
System variables having names of the form
represent the parameters that control password policy. To
configure password checking, modify these variables; see
Section 188.8.131.52, “Password Validation Plugin Options and Variables”.
validate_password is not installed, the
system variables are not available, passwords in statements are
not checked, and the
function always returns 0. For example, without the plugin
installed, accounts can be assigned passwords shorter than 8
validate_password is installed,
it implements three levels of password checking:
STRONG. The default is
MEDIUM; to change this, modify the value of
policies implement increasingly strict password tests. The
following descriptions refer to default parameter values, which
can be modified by changing the appropriate system variables.
LOWpolicy tests password length only. Passwords must be at least 8 characters long.
MEDIUMpolicy adds the conditions that passwords must contain at least 1 numeric character, 1 lowercase character, 1 uppercase character, and 1 special (nonalphanumeric) character.
STRONGpolicy adds the condition that password substrings of length 4 or longer must not match words in the dictionary file, if one has been specified.