注:
Host列指定了允許用戶登錄所使用的IP,比如user=root Host=192.168.1.1。這里的意思就是說root用戶只能通過192.168.1.1的客戶端去訪問。
而%是個通配符,如果Host=192.168.1.%,那么就表示只要是IP地址前綴為“192.168.1.”的客戶端都可以連接。如果Host=%,表示所有IP都有連接權限。、
這也就是為什么在開啟遠程連接的時候,大部分人都直接把Host改成%的緣故,為了省事。
1:新增用戶:
注:MySQL數據庫下user表中,Host和User為兩個主鍵列(primary key),已經各版本下非空未設置默認字段。
登錄后,切換db:
- mysql> use mysql;
- Reading table information for completion of table and column names
- You can turn off this feature to get a quicker startup with -A
- Database changed
新增用戶:
注:限制kaka用戶的登陸ip為10.155.123.55,ip為隨手寫入,如果正確配置為您有效登陸ip,所有ip登陸,則設置Host為 '%'
- mysql> INSERT INTO mysql.user(Host,User,Password) VALUES("10.155.123.55","kaka",PASSWORD("kaka123"));
在版本 5.6.27:
- mysql> INSERT INTO mysql.user(Host,User,Password,ssl_cipher,x509_issuer,x509_subject) VALUES("10.155.123.55","kaka",PASSWORD("kaka123"),"","","");
- Query OK, 1 row affected (0.03 sec)
新增用戶(全sql):
- INSERT INTO `user`(`Host`,`User`,`Password`,`Select_priv`,`Insert_priv`,`Update_priv`,`Delete_priv`,`Create_priv`,`Drop_priv`,`Reload_priv`,`Shutdown_priv`,`Process_priv`,`File_priv`,`Grant_priv`,`References_priv`,`Index_priv`,`Alter_priv`,`Show_db_priv`,`Super_priv`,`Create_tmp_table_priv`,`Lock_tables_priv`,`Execute_priv`,`Repl_slave_priv`,`Repl_client_priv`,`Create_view_priv`,`Show_view_priv`,`Create_routine_priv`,`Alter_routine_priv`,`Create_user_priv`,`Event_priv`,`Trigger_priv`,`Create_tablespace_priv`,`ssl_type`,`ssl_cipher`,`x509_issuer`,`x509_subject`,`max_questions`,`max_updates`,`max_connections`,`max_user_connections`,`plugin`,`authentication_string`,`password_expired`) VALUES ('%','root','*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','Y','','','','',0,0,0,0,'mysql_native_password','','N');
新增用戶完成,刷新mysql的系統權限相關表
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
設置遇到問題,請查看:MySQL配置和設置問題小結
重啟生效:
- [root@Tony_ts_tian bin]# service mysqld restart
- Shutting down MySQL.... SUCCESS!
- Starting MySQL. SUCCESS!
- mysql> SELECT Host,User,Password FROM mysql.user;
- +----------------+------+-------------------------------------------+
- | Host | User | Password |
- +----------------+------+-------------------------------------------+
- | localhost | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | tony\_ts\_tian | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | 127.0.0.1 | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | ::1 | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | 10.155.123.55 | kaka | *90B3D884FB6092549F244125549B77C000A0F9C6 |
- | % | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- +----------------+------+-------------------------------------------+
- 6 rows in set (0.00 sec)
2:修改信息,密碼,類似可修改其他字段。
- mysql> UPDATE `user` SET Password=PASSWORD("123456") WHERE Host='10.155.123.55' AND User='kaka';
- Query OK, 1 row affected (0.02 sec)
- Rows matched: 1 Changed: 1 Warnings: 0
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
- mysql> SELECT Host,User,Password FROM `user`;
- 前:
- | 10.155.123.55 | kaka | *90B3D884FB6092549F244125549B77C000A0F9C6 |
- 后:
- | 10.155.123.55 | kaka | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
3:刪除用戶:
- mysql> DELETE FROM `user` WHERE Host='10.155.123.55' AND User='kaka';
- Query OK, 1 row affected (0.00 sec)
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
- mysql> SELECT Host,User,Password FROM `user`;
- +----------------+------+-------------------------------------------+
- | Host | User | Password |
- +----------------+------+-------------------------------------------+
- | localhost | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | tony\_ts\_tian | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | 127.0.0.1 | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | ::1 | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- | % | root | *71ABCA8B06D46066CEF8062A75256E66243D0FC8 |
- +----------------+------+-------------------------------------------+
- 5 rows in set (0.00 sec)
4. 權限分配
- GRANT語法:
- GRANT 權限 ON 數據庫.* TO 用戶名@'登錄主機' IDENTIFIED BY '密碼'
- 權限:
- ALL,ALTER,CREATE,DROP,SELECT,UPDATE,DELETE
- 新增用戶:權限為USAGE,即為:"無權限",想要創建一個沒有權限的用戶時,可以指定USAGE
- 數據庫:
- *.* 表示所有庫的所有表
- mylove.* 表示mylove庫的所有表
- mylove.loves 表示mylove庫的loves表
- 用戶名:
- MySQL的賬戶名
- 登陸主機:
- 允許登陸到MySQL Server的客戶端ip
- '%'表示所有ip
- 'localhost' 表示本機
- '10.155.123.55' 特定IP
- 密碼:
- MySQL的賬戶名對應的登陸密碼
注: IDENTIFIED BY '密碼',可選。
GRANT會覆蓋用戶的部分信息,跟insert 、update執行功能一樣。
給用戶kaka分配test數據庫下user表的查詢select權限:
- mysql> GRANT SELECT ON test.user TO kaka@'10.155.123.55' IDENTIFIED BY '123456';
- Query OK, 0 rows affected (0.00 sec)
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
- mysql> show Grants for 'kaka'@'10.155.123.55';
- +-----------------------------------------------------------------------------------------------------------------+
- | Grants for kaka@10.155.123.55 |
- +-----------------------------------------------------------------------------------------------------------------+
- | GRANT USAGE ON *.* TO 'kaka'@'10.155.123.55' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' |
- | GRANT SELECT ON `test`.`user` TO 'kaka'@'10.155.123.55' |
- +-----------------------------------------------------------------------------------------------------------------+
- 2 rows in set (0.00 sec)
為了快速測試,我要把ip切回%,ip全訪問:
使用和測試:
數據庫和數據表請看: MySQL數據定義語句:CREATE(創建)命令、ALTER(修改)命令、DROP(刪除)
- mysql> use mysql
- Reading table information for completion of table and column names
- You can turn off this feature to get a quicker startup with -A
- Database changed
- 修改權限Host為所有ip登陸:
- mysql> UPDATE `user` SET Host='%' WHERE Host='10.155.123.55' AND User='kaka';
- Query OK, 1 row affected (0.00 sec)
- Rows matched: 1 Changed: 1 Warnings: 0
- 查看kaka的權限:
- mysql> show grants for 'kaka'@'10.155.123.55';
- +-----------------------------------------------------------------------------------------------------------------+
- | Grants for kaka@10.155.123.55 |
- +-----------------------------------------------------------------------------------------------------------------+
- | GRANT USAGE ON *.* TO 'kaka'@'10.155.123.55' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' |
- | GRANT SELECT ON `test`.`user` TO 'kaka'@'10.155.123.55' |
- +-----------------------------------------------------------------------------------------------------------------+
- 2 rows in set (0.00 sec)
- 刷新MySQL的系統權限相關表
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
- 查看kaka的權限:
- mysql> show grants for 'kaka'@'%';
- +-----------------------------------------------------------------------------------------------------+
- | Grants for kaka@% |
- +-----------------------------------------------------------------------------------------------------+
- | GRANT USAGE ON *.* TO 'kaka'@'%' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' |
- +-----------------------------------------------------------------------------------------------------+
- 1 row in set (0.00 sec)
- 給用戶kaka分配weloveshare數據庫下user表的查詢select權限:
- mysql> GRANT SELECT ON `weloveshare`.`user` TO kaka@'%';
- Query OK, 0 rows affected (0.00 sec)
- 查看kaka的權限:
- mysql> show grants for 'kaka'@'%';
- +-----------------------------------------------------------------------------------------------------+
- | Grants for kaka@% |
- +-----------------------------------------------------------------------------------------------------+
- | GRANT USAGE ON *.* TO 'kaka'@'%' IDENTIFIED BY PASSWORD '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9' |
- | GRANT SELECT ON `weloveshare`.`user` TO 'kaka'@'%' |
- +-----------------------------------------------------------------------------------------------------+
- 2 rows in set (0.00 sec)
- 查看weloveshare數據庫下user表的數據:
- mysql> use weloveshare
- Reading table information for completion of table and column names
- You can turn off this feature to get a quicker startup with -A
- Database changed
- mysql> select * from user;
- Empty set (0.00 sec)
- 退出當前用戶:
- mysql> exit;
- Bye
- 切換用戶kaka:
- [root@Tony_ts_tian ~]# mysql -u kaka -p
- Enter password:
- 登錄成功。
- 切換數據庫,查看user表數據:
- mysql> use weloveshare
- Reading table information for completion of table and column names
- You can turn off this feature to get a quicker startup with -A
- Database changed
- mysql> select * from user;
- Empty set (0.00 sec)
- 插入數據:
- mysql> INSERT INTO `weloveshare`.`user`(uname,upass,ustatus) VALUES('kaka','kaka123','0');
- ERROR 1142 (42000): INSERT command denied to user 'kaka'@'localhost' for table 'user'
- 提示:INSERT被拒絕。配置成功。
- 注:`weloveshare`.`user`數據庫名.數據表名,kaka用戶名,%為Host,ip可限制或不 localhost,%,192.168.10.%
- grant創建、修改、刪除、更新、查詢MySQL數據表結構權限:
- GRANT CREATE ON `weloveshare`.`user` TO kaka@'%';
- GRANT ALTER ON `weloveshare`.`user` TO kaka@'%';
- GRANT DROP ON `weloveshare`.`user` TO kaka@'%';
- GRANT UPDATE ON `weloveshare`.`user` TO kaka@'%';
- GRANT SELECT ON `weloveshare`.`user` TO kaka@'%';
- grant操作MySQL外鍵權限:
- GRANT REFERENCES ON `weloveshare`.`user` TO kaka@'%';
- grant操作MySQL 臨時表權限:
- GRANT CREATE TEMPORARY TABLES ON `weloveshare`.`user` TO kaka@'%';
- grant操作MySQL索引權限
- GRANT INDEX ON `weloveshare`.`user` TO kaka@'%';
- grant操作MySQL視圖、查看視圖源代碼權限:
- GRANT CREATE VIEW ON `weloveshare`.`user` TO kaka@'%';
- GRANT SHOW VIEW ON `weloveshare`.`user` TO kaka@'%';
- grant操作MySQL存儲過程(查看狀態,刪除修改)、函數權限。
- GRANT CREATE ROUTINE ON `weloveshare`.`user` TO kaka@'%';
- GRANT CREATE ROUTINE ON `weloveshare`.`user` TO kaka@'%';
- GRANT EXECUTE ON `weloveshare`.`user` TO kaka@'%';
注:其他的詳細權限,請查看,備注附件(最后)。
5:查看數據庫登陸所有用戶:
- mysql> SELECT DISTINCT CONCAT('User: ''',user,'''@''',host,''';') AS QUERY FROM mysql.user;
- +--------------------------------+
- | QUERY |
- +--------------------------------+
- | User: 'kaka'@'%'; |
- | User: 'root'@'%'; |
- | User: 'root'@'127.0.0.1'; |
- | User: 'root'@'::1'; |
- | User: 'root'@'localhost'; |
- | User: 'root'@'tony\_ts\_tian'; |
- +--------------------------------+
- 6 rows in set (0.00 sec)
查看某個用戶的具體權限,比如root:
- mysql> show grants for 'root'@'%';
- +--------------------------------------------------------------------------------------------------------------------------------+
- | Grants for root@% |
- +--------------------------------------------------------------------------------------------------------------------------------+
- | GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY PASSWORD '*71ABCA8B06D46066CEF8062A75256E66243D0FC8' WITH GRANT OPTION |
- +--------------------------------------------------------------------------------------------------------------------------------+
- 1 row in set (0.00 sec)
或
- mysql> select * from mysql.user where user='root' \G
備注附件:
查看MySQL數據中user表的表結構:
- mysql> DESC mysql.user;
- +------------------------+-------------------+------+-----+-----------+-------+
- | Field | Type | Null | Key | Default | Extra |
- +------------------------+-------------------+------+-----+-----------+-------+
- | Host | char(60) | NO | PRI | | |
- | User | char(16) | NO | PRI | | |
- | Password | char(41) | NO | | | |
- | Select_priv | enum('N','Y') | NO | | N | |
- | Insert_priv | enum('N','Y') | NO | | N | |
- | Update_priv | enum('N','Y') | NO | | N | |
- | Delete_priv | enum('N','Y') | NO | | N | |
- | Create_priv | enum('N','Y') | NO | | N | |
- | Drop_priv | enum('N','Y') | NO | | N | |
- | Reload_priv | enum('N','Y') | NO | | N | |
- | Shutdown_priv | enum('N','Y') | NO | | N | |
- | Process_priv | enum('N','Y') | NO | | N | |
- | File_priv | enum('N','Y') | NO | | N | |
- | Grant_priv | enum('N','Y') | NO | | N | |
- | References_priv | enum('N','Y') | NO | | N | |
- | Index_priv | enum('N','Y') | NO | | N | |
- | Alter_priv | enum('N','Y') | NO | | N | |
- | Show_db_priv | enum('N','Y') | NO | | N | |
- | Super_priv | enum('N','Y') | NO | | N | |
- | Create_tmp_table_priv | enum('N','Y') | NO | | N | |
- | Lock_tables_priv | enum('N','Y') | NO | | N | |
- | Execute_priv | enum('N','Y') | NO | | N | |
- | Repl_slave_priv | enum('N','Y') | NO | | N | |
- | Repl_client_priv | enum('N','Y') | NO | | N | |
- | Create_view_priv | enum('N','Y') | NO | | N | |
- | Show_view_priv | enum('N','Y') | NO | | N | |
- | Create_routine_priv | enum('N','Y') | NO | | N | |
- | Alter_routine_priv | enum('N','Y') | NO | | N | |
- | Create_user_priv | enum('N','Y') | NO | | N | |
- | Event_priv | enum('N','Y') | NO | | N | |
- | Trigger_priv | enum('N','Y') | NO | | N | |
- | Create_tablespace_priv | enum('N','Y') | NO | | N | |
- | ssl_type | enum('','ANY','X509','SPECIFIED') | NO || | |
- | ssl_cipher | blob | NO | | NULL | |
- | x509_issuer | blob | NO | | NULL | |
- | x509_subject | blob | NO | | NULL | |
- | max_questions | int(11) unsigned | NO | | 0 | |
- | max_updates | int(11) unsigned | NO | | 0 | |
- | max_connections | int(11) unsigned | NO | | 0 | |
- | max_user_connections | int(11) unsigned | NO | | 0 | |
- | plugin | char(64) | YES || mysql_native_password ||
- | authentication_string | text | YES | | NULL | |
- | password_expired | enum('N','Y') | NO | | N | |
- +------------------------+-------------------+------+-----+-----------+-------+
- 43 rows in set (0.00 sec)
查看root用戶的所有具體權限:
- Host: %
- User: root
- Password: *71ABCA8B06D46066CEF8062A75256E66243D0FC8
- Select_priv: Y
- Insert_priv: Y
- Update_priv: Y
- Delete_priv: Y
- Create_priv: Y
- Drop_priv: Y
- Reload_priv: Y
- Shutdown_priv: Y
- Process_priv: Y
- File_priv: Y
- Grant_priv: Y
- References_priv: Y
- Index_priv: Y
- Alter_priv: Y
- Show_db_priv: Y
- Super_priv: Y
- eate_tmp_table_priv: Y
- Lock_tables_priv: Y
- Execute_priv: Y
- Repl_slave_priv: Y
- Repl_client_priv: Y
- Create_view_priv: Y
- Show_view_priv: Y
- Create_routine_priv: Y
- Alter_routine_priv: Y
- Create_user_priv: Y
- Event_priv: Y
- Trigger_priv: Y
- ate_tablespace_priv: Y
- ssl_type:
- ssl_cipher:
- x509_issuer:
- x509_subject:
- max_questions: 0
- max_updates: 0
- max_connections: 0
- ax_user_connections: 0
- plugin: mysql_native_password
- thentication_string:
- password_expired: N
參數說明:
- Select_priv:用戶可以通過SELECT命令選擇數據。
- Insert_priv:用戶可以通過INSERT命令插入數據;
- Update_priv:用戶可以通過UPDATE命令修改現有數據;
- Delete_priv:用戶可以通過DELETE命令刪除現有數據;
- Create_priv:用戶可以創建新的數據庫和表;
- Drop_priv:用戶可以刪除現有數據庫和表;
- Reload_priv:用戶可以執行刷新和重新加載MySQL所用各種內部緩存的特定命令,包括日志、權限、主機、查詢和表;重新加載權限表;
- Shutdown_priv:用戶可以關閉MySQL服務器;在將此權限提供給root賬戶之外的任何用戶時,都應當非常謹慎;
- Process_priv:用戶可以通過SHOW PROCESSLIST命令查看其他用戶的進程;服務器管理;
- File_priv:用戶可以執行SELECT INTO OUTFILE和LOAD DATA INFILE命令;加載服務器上的文件;
- Grant_priv:用戶可以將已經授予給該用戶自己的權限再授予其他用戶(任何用戶賦予全部已有權限);
- References_priv;目前只是某些未來功能的占位符;現在沒有作用;
- Index_priv:用戶可以創建和刪除表索引;用索引查詢表;
- Alter_priv:用戶可以重命名和修改表結構;
- Show_db_priv:用戶可以查看服務器上所有數據庫的名字,包括用戶擁有足夠訪問權限的數據庫;可以考慮對所有用戶禁用這個權限,除非有特別不可抗拒的原因;
- Super_priv:用戶可以執行某些強大的管理功能,例如通過KILL命令刪除用戶進程,使用SET GLOBAL修改全局MySQL變量,執行關於復制和日志的各種命令;超級權限;
- Create_tmp_table_priv:用戶可以創建臨時表;
- Lock_tables_priv:用戶可以使用LOCK TABLES命令阻止對表的訪問/修改;
- Execute_priv:用戶可以執行存儲過程;此權限只在MySQL 5.0及更高版本中有意義;
- Repl_slave_priv:用戶可以讀取用於維護復制數據庫環境的二進制日志文件;此用戶位於主系統中,有利於主機和客戶機之間的通信;主服務器管理;
- Repl_client_priv:用戶可以確定復制從服務器和主服務器的位置;從服務器管理;
- Create_view_priv:用戶可以創建視圖;此權限只在MySQL 5.0及更高版本中有意義;
- Show_view_priv:用戶可以查看視圖或了解視圖如何執行;此權限只在MySQL 5.0及更高版本中有意義;
- Create_routine_priv:用戶可以更改或放棄存儲過程和函數;此權限是在MySQL 5.0中引入的;
- Alter_routine_priv:用戶可以修改或刪除存儲函數及函數;此權限是在MySQL 5.0中引入的;
- Create_user_priv:用戶可以執行CREATE USER命令,這個命令用於創建新的MySQL賬戶;
- Event_priv:用戶能否創建、修改和刪除事件;這個權限是MySQL 5.1.6新增的;
- Trigger_priv:用戶能否創建和刪除觸發器,這個權限是MySQL 5.1.6新增的;
- Create_tablespace_priv:創建表空間
- ssl_type:支持ssl標准加密安全字段
- ssl_cipher:支持ssl標准加密安全字段
- x509_issuer:支持x509標准字段
- x509_subject:支持x509標准字段
- max_questions:0 每小時允許執行多少次查詢
- max_updates:0 每小時可以執行多少次更新 :0表示無限制
- max_connections:0 每小時可以建立的多少次連接:0表示無限制
- max_user_connections:0 單用戶可以同時具有的連接數:0表示無限制
- plugin:5.5.7開始,mysql引入plugins以進行用戶連接時的密碼驗證,plugin創建外部/代理用戶
- authentication_string:通過authentication_string可以控制兩者的映射關系,(PAM plugin等,PAM可以支持多個服務名)尤其是在使用代理用戶時,並須聲明這一點
- password_expired:密碼過期 Y,說明該用戶密碼已過期 N相反