mysql用戶的管理

mysql用戶的管理

1、查看當前的鏈接賬號信息

1.一、查看當前數據庫的以鏈接的賬號信息

使用命令：show processlist

MySQL [(none)]> show processlist;

+--------+-------------+---------------------+--------+---------+------+----------+------------------+

| Id     | User        | Host                | db     | Command | Time | State    | Info             |

+--------+-------------+---------------------+--------+---------+------+----------+------------------+

| 232091 | zabbix      | 172.17.207.88:558 | zabbix | Sleep   |   20 |          | NULL             |

1.二、查看當前使用的是什麼賬號登陸

使用命令select user()命令進行查看

MySQL [(none)]> select user();

+--------------------+

| user()             |

+--------------------+

| root@172.17.37.88 |

+--------------------+

1 row in set (0.00 sec)

MySQL [(none)]>

2、建立用戶

2.一、新用戶的建立

使用creat user命令建立用戶並建立密碼

列子：create user 'zhang'@'localhost' identified by 'zhang';

• 建立zhang用戶能夠使用任意地址訪問並設置密碼爲zhang

MySQL [(none)]> create user 'zhang'@'%' identified by 'zhang';

Query OK, 0 rows affected (0.01 sec)

MySQL [(none)]>

• 設置完成後查看是否建立成功

MySQL [(none)]> select user,host from mysql.user;

+-------------+----------------+

| user        | host           |

+-------------+----------------+

| jumpserver  | %              |

| root        | %              |

| wordpress   | %              |

| zabbix      | 39.106.3.162 |

| %           | localhost      |

| zhang       | localhost      |

+-------------+----------------+

9 rows in set (0.01 sec)

MySQL [(none)]>

• 使用新建立的用戶zhang進行登陸並查看數據庫

[root@iZ2zegql6fupnhn8aei0bgZ ~]# mysql -uzhang -h120.26.32.14 -p

Enter password:

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MySQL connection id is 1204

Server version: 5.6.35 Source distribution

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

• 查看數據庫

MySQL [(none)]> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| test               |

+--------------------+

2 rows in set (0.02 sec)

MySQL [(none)]>

3、刪除數據庫賬號

使用drop user 命令刪除用戶

MySQL [(none)]> drop user 'zhang'@'localhost';

Query OK, 0 rows affected (0.00 sec)

MySQL [(none)]>

4、重命名用戶

4.一、使用rename user命令進行修改重命名用戶

MySQL [(none)]> rename user 'zhang'@'%c' to 'zhang'@'%' ;

Query OK, 0 rows affected (0.02 sec)

MySQL [(none)]> select user,host from mysql.user;

+-------------+-------------------+

| user        | host              |

+-------------+-------------------+

| root        | %                 |

| user_name   | %                 |

| xuchangming | %                 |

| zhang       | %                 |

| root        | 127.0.0.1         |

| root        | ::1               |

|             | instance-jvfp1b6r |

| root        | instance-jvfp1b6r |

| root        | localhost         |

| xuchangming | localhost         |

+-------------+-------------------+

10 rows in set (0.01 sec)

MySQL [(none)]>

5、受權賬號

5.一、使用grant 命令進行受權賬號

命令格式爲：

grant 權限 privileges on 庫.表 to ‘賬號’@‘ip’ [identified by ‘登陸密碼’]；

庫表權限說明：

on *.*     ：管理員權限，任何數據庫均可以操做

on db_name.* ：指定對某個庫進行操做，只有某個庫的權限

on db_name.tables_name：指定某一個庫中的一個表有操做權限

on db_name.routine_name：指定某個庫的存儲過程或者存儲函數

5.二、使用命令 show grants命令查看權限

SQL [(none)]> show grants;

+--------------------------------------------------------------------------------------------------------------------------------+

| Grants for root@%                                                                                                              |

+--------------------------------------------------------------------------------------------------------------------------------+

| GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY PASSWORD '*0FC3121124C80F34B383F5FCA33F0D68B6AFA1C0' WITH GRANT OPTION |

+--------------------------------------------------------------------------------------------------------------------------------+

1 row in set (0.01 sec)

MySQL [(none)]>

5.三、列子

5.3.一、受權全部權限【管理員權限】給某一個賬號

建立boos用戶並設置登陸密碼爲boss，對全部庫和表受權全部操做並容許全部地址鏈接

MySQL [(none)]> grant all privileges on *.* to 'boos'@'%' identified  by 'boss';

Query OK, 0 rows affected (0.02 sec)

MySQL [(none)]>

登陸查看

[root@iZ2zegql6fupnhn8aei0bgZ ~]# mysql -uboos -h120.76.32.14 -p

Enter password:

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MySQL connection id is 1217

Server version: 5.6.35 Source distribution

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| 測試               |

| ceshi              |

| employees          |

| mysql              |

| performance_schema |

| test               |

+--------------------+

7 rows in set (0.01 sec)

MySQL [(none)]>

MySQL [(none)]> select user();

+---------------------+

| user()              |

+---------------------+

| boos@120.76.32.14 |

+---------------------+

1 row in set (0.02 sec)

MySQL [(none)]>

5.3.二、受權全部權限給某一賬號只針對某一個數據庫

建立賬號zhang並添加密碼zhang，修改權限對 ceshi庫的全部操做

MySQL [(none)]> grant all  privileges on ceshi.* to 'zhang'@'%' identified by 'zhang' ;

Query OK, 0 rows affected (0.02 sec)

MySQL [(none)]>

[root@iZ2zegql6fupnhn8aei0bgZ ~]# mysql -uzhang -h120.76.32.14 -p

Enter password:

Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MySQL connection id is 1458

Server version: 5.6.35 Source distribution

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| ceshi              |

| test               |

+--------------------+

3 rows in set (0.02 sec)

MySQL [(none)]> show grants;

+-------------------------------------------------------------------+

| Grants for zhang@%                                                |

+-------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'zhang'@'%' IDENTIFIED BY PASSWORD <secret> |

| GRANT ALL PRIVILEGES ON `ceshi`.* TO 'zhang'@'%'                  |

+-------------------------------------------------------------------+

2 rows in set (0.01 sec)

MySQL [(none)]> use test;

Database changed

MySQL [test]> show tables;

Empty set (0.02 sec)

5.3.三、受權某一個權限給某一個賬號，只針對有一個數據庫進行操做

建立賬號zhang並運行全部ip地址鏈接並建立密碼zhang，設置權限爲只對ceshi數據庫進行select查詢

MySQL [(none)]> grant select  on ceshi.* to 'zhang'@'%' identified by 'zhang';

Query OK, 0 rows affected (0.02 sec)

MySQL [(none)]>

MySQL [(none)]> show grants;

+-------------------------------------------------------------------+

| Grants for zhang@%                                                |

+-------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'zhang'@'%' IDENTIFIED BY PASSWORD <secret> |

| GRANT SELECT ON `ceshi`.* TO 'zhang'@'%'                          |

+-------------------------------------------------------------------+

2 rows in set (0.02 sec)

MySQL [(none)]>

使用create 建立表進行測試，是否有權限建立，以下顯示則沒有建立成功，表示沒有權限

MySQL [ceshi]> create table t1;

ERROR 1142 (42000): CREATE command denied to user 'zhang'@'120.76.32.14' for table 't1'

MySQL [ceshi]>

在zhang賬號中添加create建立權限

MySQL [(none)]> grant create  on ceshi.* to 'zhang'@'%' identified by 'zhang';

Query OK, 0 rows affected (0.02 sec)

查看此賬號權限

MySQL [(none)]> show grants for 'zhang'@'%';

+------------------------------------------------------------------------------------------------------+

| Grants for zhang@%                                                                                   |

+------------------------------------------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'zhang'@'%' IDENTIFIED BY PASSWORD '*5D83A6402DF44A7D8EC2B8861B19F8A2F4F3EA2F' |

| GRANT SELECT, CREATE ON `ceshi`.* TO 'zhang'@'%'                                                     |

+------------------------------------------------------------------------------------------------------+

2 rows in set (0.01 sec)

MySQL [(none)]>

5.3.四、受權某一列

MySQL [ceshi]> grant select(table_name,engine) on test.t to 'zhang'@'localhost';

6、撤銷權限

格式命令：revoke 權限 on 庫.表 from 'user'@'host';

查看zhang用戶目前的權限列表

MySQL [ceshi]> show grants for  'zhang'@'%';

+------------------------------------------------------------------------------------------------------+

| Grants for zhang@%                                                                                   |

+------------------------------------------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'zhang'@'%' IDENTIFIED BY PASSWORD '*5D83A6402DF44A7D8EC2B8861B19F8A2F4F3EA2F' |

| GRANT SELECT, CREATE ON `ceshi`.* TO 'zhang'@'%'                                                     |

+------------------------------------------------------------------------------------------------------+

2 rows in set (0.02 sec)

MySQL [ceshi]>

把zhang用戶的create的權限刪掉，使其不能使用create建立

MySQL [ceshi]> revoke create on ceshi.* from 'zhang'@'%';

Query OK, 0 rows affected (0.02 sec)

MySQL [ceshi]> show grants for  'zhang'@'%';

+------------------------------------------------------------------------------------------------------+

| Grants for zhang@%                                                                                   |

+------------------------------------------------------------------------------------------------------+

| GRANT USAGE ON *.* TO 'zhang'@'%' IDENTIFIED BY PASSWORD '*5D83A6402DF44A7D8EC2B8861B19F8A2F4F3EA2F' |

| GRANT SELECT ON `ceshi`.* TO 'zhang'@'%'                                                             |

+------------------------------------------------------------------------------------------------------+

2 rows in set (0.01 sec)

MySQL [ceshi]>

7、修改賬號的密碼

格式命令：set password for 'user'@'host' = password('NEW-password');

MySQL [ceshi]> set password for 'zhang'@'%' = password('boss');

Query OK, 0 rows affected (0.02 sec)

8、如何對一個賬號進行資源限制

資源能夠包括爲：

resource_option: {

| MAX_QUERIES_PER_HOUR count

| MAX_UPDATES_PER_HOUR count

| MAX_CONNECTIONS_PER_HOUR count

| MAX_USER_CONNECTIONS count

每個小時的連接次數

每個賬號每個小時的查詢多少次

每個賬號每個小時更新多少次

每個賬號每個小時併發連接多少次

8.一、每個小時不能超過2次查詢

MySQL [ceshi]> grant all privileges on *.* to 'boss'@'%' with  MAX_QUERIES_PER_HOUR 2;

Query OK, 0 rows affected (0.02 sec)

MySQL [ceshi]>

9、找回密碼

[root@iZ2ze2rrr9fg73mstmet9tZ ~]# /usr/local/mysql/bin/mysqld_safe --skip-grant-tables &

[root@iZ2ze2rrr9fg73mstmet9tZ ~]#mysql

清空root密碼

MySQL [ceshi]> update user set password='' where user='root' and host='localhost'