mysql-5.7 密碼過時詳解

時間 2019-11-30

標籤 mysql 5.7 密碼過時詳解欄目 MySQL 简体版

原文原文鏈接

1、起源：mysql

　　今天一上班就聽到說error-log裏記錄了大量的sql

　　ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement.session

2、mysql 用戶密碼過時的處理：ide

　　一、從一條簡單的create user 看mysql密碼過時的內在邏輯this

mysql> create user exuser@'%' identified by 'exPass@352';                                                    
Query OK, 0 rows affected (0.01 sec)

mysql> show create user exuser@'%';
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER for exuser@%                                                                                                                                            |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER 'exuser'@'%' IDENTIFIED WITH 'mysql_native_password' AS '*CD089516E876A47FEBF3BB6A9ADD45F02F4BF73B' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

　　二、從上面的show create user 能夠看出 mysql會悄悄的在create user 語句的後面加上一個 password expire defautl 子句；這個spa

　　password expire default 子句就是用來設置mysql 帳號的密碼過時時間的(單位天)。code

　　三、看寫死mysql 帳號密碼的過時時間時mysql是怎麼處理的blog

mysql> create user tt@'%' identified by '123456' password expire interval 30 day;
Query OK, 0 rows affected (0.00 sec)

mysql> show create user tt@'%';                                                                              
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER for tt@%                                                                                                                                                    |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER 'tt'@'%' IDENTIFIED WITH 'mysql_native_password' AS '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' REQUIRE NONE PASSWORD EXPIRE INTERVAL 30 DAY ACCOUNT UNLOCK |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

　　四、也就是說在create user 中寫死過時時間的狀況下，mysql是不會悄悄的加上password expire default 的。io

　　五、password expire default 這裏的default的值是參照default_password_lifetime這個variable的，也就是說能夠經過ast

　　改變default_password_lifetime的值來靈活的控制帳號的過時時間。

3、default_password_lifetime 地默認值：

　　目前 default_password_lifetime 這個參數的默認值是0 ，也就是說默認狀況下 create user xxx@xxx identified by 'xxx' 這樣

　　建立出來的帳號密碼是永不過時的。

4、回答一下起源中的問題：

　　「起源」中提到的密碼過時是由於在mysql-5.7.4 ~ mysql-5.7.10 這些版本中default_password_lifetime的默認值是360，

　　這樣就尷尬了，這樣的設置使得默認狀況下mysql運行個360天就要改一下密碼，這不科學！因而呢在mysql-5.7.11 之後

　　的mysql就把default_password_lifetime這個參數的默認值設置成了0.

5、給你一個環境怎麼纔看出來用戶的密碼有沒有過時

　　對於這裏所提到的密碼過時的斷定不能簡單的看user.password_expired 這個列來區分帳號的密碼有沒有過時，而是要根據mysql帳號過時的

　　內在邏輯來看

　　一、第一步：查看user.assword_last_changed 列來看對應帳號密碼的最近一次的修改時間

mysql> select user,host,password_expired,password_last_changed,password_lifetime from user;                  
+---------------+-----------+------------------+-----------------------+-------------------+
| user          | host      | password_expired | password_last_changed | password_lifetime |
+---------------+-----------+------------------+-----------------------+-------------------+
| root          | localhost | N                | 2017-10-15 10:07:32   |              NULL |
| mysql.session | localhost | N                | 2017-10-04 12:27:10   |              NULL |
| mysql.sys     | localhost | N                | 2017-10-04 12:27:10   |              NULL |
| jianglexing   | localhost | N                | 2017-10-07 09:48:14   |              NULL |
| repl          | %         | N                | 2017-10-07 19:16:44   |              NULL |
| tstuser       | localhost | N                | 2017-10-12 10:04:17   |              NULL |
+---------------+-----------+------------------+-----------------------+-------------------+

　　二、第二步：查看default_password_lifetime這個變量的值是多少

mysql> show global variables like 'default_password_lifetime';                                               
+---------------------------+-------+
| Variable_name             | Value |
+---------------------------+-------+
| default_password_lifetime | 1     |
+---------------------------+-------+
1 row in set (0.00 sec)

　　三、肯定用戶是否是用的mysql全局的密碼過時策略

mysql> show create user tstuser@'localhost';                                                                 
+-------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER for tstuser@localhost                                                                                             |
+-------------------------------------------------------------------------------------------------------------------------------+
| CREATE USER 'tstuser'@'localhost' IDENTIFIED WITH 'mysql_native_password' REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK |
+-------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

　　四、肯定當前的時間

mysql> select now();
+---------------------+
| now()               |
+---------------------+
| 2017-10-15 11:02:36 |
+---------------------+
1 row in set (0.00 sec)