cjh81378066

mysql用户创建、修改、删除及授权操作的总结

总结

1、mysql命令进行连接如果不带-h，表示user@localhost连接本地localhost数据库服务器，-h后面的ip是数据库服务器的IP

2、要让所有ip都能连，create user时用户名后面加@'%'，或不加@(不加@默认就是@'%')

3、mysql执行grant进行授权，权限是追加的，不用担心会覆盖之前的

4、 grant可以同时创建用户、授权、修改密码

5、创建用户建议使用create，因为 create只能创建用户，不能授权， mysql没有类似oracle这样的connect create session权限，mysql只要create了用户就自动拥有了connect create session权限

6、修改密码建议使用alter user比较好，因为alter不会涉及到权限，grant虽然可以修改密码，但是grant命令要带权限选项。

7、如果用户名相同，host对应的网段有相同，哪个用户先生成，就以哪个用户为准

即以下两条，谁先执行，谁先生效，就是说mysql -u test1 -p后面使用谁的密码才能登陆

grant select on test1.* to test123@'192.168.0.0/255.255.0.0' identified by "12345678";

grant select on test1.* to test123@'192.168.10.0/255.255.255.0' identified by "1234567";

8、grant执行的授权，不需要flush privileges就可以生效；update mysql.user表执行的授权，必须要flush privileges才能生效

创建用户

mysql> help create user;

mysql> help grant;

mysql> create user 'user1'@'192.168.10.0/255.255.255.0' identified by '123456';

mysql> grant select,update on db1.* to 'user2'@'192.168.10.0/255.255.255.0' identified by '123456';--创建用户的同时进行了授权

修改密码

mysql> help alter user;

mysql> help grant;

mysql> help set password;

mysql> alter user 'user1'@'192.168.10.0/255.255.255.0' identified by '666666';

mysql> grant select on mysql.user to 'user1'@'192.168.10.0/255.255.255.0' identified by '777777';--修改密码的同时进行了授权

mysql> set password for 'user1'@'192.168.10.0/255.255.255.0'=password('888888');

SET PASSWORD is deprecated as of MySQL 5.7.6 and will be removed in a future MySQL release. ALTER USER is now the preferred statement for assigning passwords.

从MySQL 5.7.6开始，不推荐使用SET PASSWORD，这个用法在未来的MySQL版本中会被抛弃。 ALTER USER现在是首选修改密码的声明。

授权

mysql> help grant;

mysql> grant select,insert,update on *.* to 'user1'@'192.168.10.0/255.255.255.0';--只授权，没有涉及修改密码

删除用户

mysql> help drop user;

mysql> drop user 'user1'@'192.168.10.0/255.255.255.0';

密码相关的参数

mysql> SHOW VARIABLES LIKE '%password%';

mysql> CREATE USER 'mytest'@'192.168.20.0/255.255.255.0' identified by '123456';

ERROR 1819 (HY000): Your password does not satisfy the current policy requirements

mysql> show variables like '%validate_password_policy%';

+--------------------------+--------+

| Variable_name | Value |

+--------------------------+--------+

| validate_password_policy | MEDIUM |

+--------------------------+--------+

1 row in set (0.01 sec)

mysql> set global validate_password_policy=0;

mysql> show variables like '%validate_password_length%';

+--------------------------+-------+

| Variable_name | Value |

+--------------------------+-------+

| validate_password_length | 8 |

+--------------------------+-------+

1 row in set (0.00 sec)

mysql> set global validate_password_length=1;

如下实验，DB服务器ip是192.168.10.101，在服务器本地使用mysql登录不加-h表示使用user@localhost登录，-h后面的必须是DB服务器ip

允许所有ip登录，则create user时后面的用户名不加@或create user时后面的用户名加@'%'

[root@mydb ~]# ifconfig |grep 'inet addr'

inet addr:192.168.10.101 Bcast:192.168.10.255 Mask:255.255.255.0

inet addr:127.0.0.1 Mask:255.0.0.0

inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0

mysql> CREATE USER 'mytest01'@'192.168.20.0/255.255.255.0' identified by '123456';

Query OK, 0 rows affected (0.01 sec)

mysql> CREATE USER 'mytest02'@'192.168.10.0/255.255.255.0' identified by '123456';

Query OK, 0 rows affected (0.00 sec)

mysql> CREATE USER 'mytest03'@'*' identified by '123456';

Query OK, 0 rows affected (0.00 sec)

[root@mydb ~]# mysql -u mytest01 -p123456