詳解 MySQL 5.7 新的許可權與安全問題

阿新 • • 發佈：2022-04-28

1、新版 MySQL 許可權問題：

問題：SQL Error (1130): Host '192.168.1.100' is not allowed to connect to this MySQL server 說明所連線的使用者帳號沒有遠端連線的許可權，只能在本機(localhost)登入。需更改 mysql 資料庫裡的 user表裡的 host項：把localhost改稱% mysql>use mysql; mysql>update user set host = '%' where user ='root'; mysql>flush privileges; mysql>select 'host','user' from user where user='root'; 舊版本 MySQL 可以 IP 授權與修改密碼同時進行： GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION; 注意0：授權可以用上述語句，但是修改密碼新版 MySQL 不能再用 WITH GRANT OPTION 了：Using GRANT statement to modify existing user properties other than privileges is deprecated and will be removed in future release. Use ALTER USER statement for this operation. ALTER USER 'root'@'%' IDENTIFIED BY 'pwd';

注意1：MySQL 使用者許可權標示是 user 和 host 組成的二元組，上述語句需要確保該二元組存在，否則會報錯：

mysql> ALTER USER 'root'@'%' IDENTIFIED BY 'pwd'; ERROR 1396 (HY000): Operation ALTER USER failed for 'root'@'%' mysql> create user 'root'@'%' identified by 'pwd'; Query OK, 0 rows affected (0.00 sec)

mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION; Query OK, 0 rows affected (0.00 sec)

mysql> show grants for current_user(); +---------------------------------------------------------------------+ | Grants for root@localhost | +---------------------------------------------------------------------+ | GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' WITH GRANT OPTION | | GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION | +---------------------------------------------------------------------+ 2 rows in set (0.00 sec) 如果使用 ALTER USER 'root'@'%' IDENTIFIED WITH sha256_password BY 'pwd'; 指定加密方式則可能在客戶端連線時有問題：注意2：ERROR 2059 (HY000): Authentication plugin 'sha256_password' cannot be loaded: No such file or directory update user set plugin='mysql_native_password' where user = 'root' and host = '%'; update mysql.user set password=PASSWORD("pwd") where User='root'; 注意3：ERROR 1054 (42S22): Unknown column 'password' in 'field list' update mysql.user set authentication_string=password("pwd") where user='root'; 注意4：'PASSWORD' is deprecated and will be removed in a future release. password 即將被廢棄，官方不建議用繼續使用了，建議使用第1點中的 ALTER USER 語法去管理使用者屬性。

Access denied for user 'root'@'IP地址' ,是因為相應的主機沒有對應的訪問許可權

--開放許可權如下
use mysql;
update user u set u.host = '%' where u.user = 'root' limit 1;
flush privileges;

--檢視使用者許可權
show grants for current_user();

--mysql不推薦通過修改表的方式修改使用者密碼
INSERT or UPDATE statements for the mysql.user table that refer to literal passwords are logged as is,so you should avoid such statements
--通過客戶端sql修改
MariaDB [mysql]>  UPDATE user SET Password = password('123456') WHERE User = 'root' ;
--此時可在binglog中可以看到明文的密碼
[root@rudy_01 3306]# mysqlbinlog binlog.000006 --start-position=4224 >/tmp/test.sql
[root@rudy_01 3306]# cat /tmp/test.sql 
SET @@session.collation_database=DEFAULT/*!*/;
UPDATE user SET Password = password('123456') WHERE User = 'root'

--在 mysql 5.7 中 password 欄位已經不存在了
mysql> UPDATE user SET Password = password('123456') WHERE User = 'root' ;
ERROR 1054 (42S22): Unknown column 'Password' in 'field list'

mysql> desc user;
+------------------------+-----------------------------------+------+-----+-----------------------+-------+
| Field                  | Type                              | Null | Key | Default               | Extra |
+------------------------+-----------------------------------+------+-----+-----------------------+-------+
| Host                   | char(60)                          | NO   | PRI |                       |       |
| User                   | char(32)                          | NO   | PRI |                       |       |
| Select_priv            | enum('N','Y')                     | NO   |     | N                     |       |

--注意出於安全考慮，alter user 時提示更新的是 0 條資料，但實際 password 已更新
mysql> select host,user,authentication_string,password_last_changed from user where user='root' and host='%';
+------+------+-------------------------------------------+-----------------------+
| host | user | authentication_string                     | password_last_changed |
+------+------+-------------------------------------------+-----------------------+
| %    | root | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | 2016-01-08 15:38:13   |
+------+------+-------------------------------------------+-----------------------+
1 row in set (0.04 sec)

--提示更新0條，使用此方法不需要再 flush privileges
If you modify the grant tables indirectly using account-management statements such as GRANT, REVOKE,SET PASSWORD, or RENAME USER, 
the server notices these changes and loads the grant tables into memory again immediately.
mysql>  alter user 'root'@'%' identified by '12345678';
Query OK, 0 rows affected (0.00 sec)
--實際已更新
mysql>  select host,user,authentication_string,password_last_changed from user where user='root' and host='%';
+------+------+-------------------------------------------+-----------------------+
| host | user | authentication_string                     | password_last_changed |
+------+------+-------------------------------------------+-----------------------+
| %    | root | *84AAC12F54AB666ECFC2A83C676908C8BBC381B1 | 2016-01-08 15:53:09   |
+------+------+-------------------------------------------+-----------------------+
1 row in set (0.00 sec)

--在binlog中查出的sql如下
[root@rudy mysql]# cat /tmp/test.sql
SET @@session.collation_database=DEFAULT/*!*/;
ALTER USER 'root'@'%' IDENTIFIED WITH 'mysql_native_password' AS '*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9'


--mysql對於密碼有3種檢驗策略，預設validate_password_policy為MEDIUM
? LOW policy tests password length only. Passwords must be at least 8 characters long.
? MEDIUM policy adds the conditions that passwords must contain at least 1 numeric character, 1 lowercase and uppercase character, and 1 special (nonalphanumeric) character.
? STRONG policy adds the condition that password substrings of length 4 or longer must not match words

--注意validate_password預設是沒有安裝的
If the validate_password plugin is not installed, the validate_password_xxx system variables are not available, 
passwords in statements are not checked, and VALIDATE_PASSWORD_STRENGTH() always returns 0.
 
 
--檢驗密碼複雜度 
mysql> select VALIDATE_PASSWORD_STRENGTH('abc1235jeme');
+-------------------------------------------+
| VALIDATE_PASSWORD_STRENGTH('abc1235jeme') |
+-------------------------------------------+
|                                         0 |
+-------------------------------------------+
1 row in set (0.00 sec)
--查詢安裝的外掛，發現找不到validate_password
mysql> show plugins;
--手動安裝
mysql> INSTALL PLUGIN validate_password SONAME 'validate_password.so';
mysql> show plugins;
+----------------------------+----------+--------------------+----------------------+---------+
| Name                       | Status   | Type               | Library              | License |
+----------------------------+----------+--------------------+----------------------+---------+
| validate_password          | ACTIVE   | VALIDATE PASSWORD  | validate_password.so | GPL     |
+----------------------------+----------+--------------------+----------------------+---------+
45 rows in set (0.04 sec)
--再次檢驗密碼複雜度 
mysql> select VALIDATE_PASSWORD_STRENGTH('abc1235jeme');
+-------------------------------------------+
| VALIDATE_PASSWORD_STRENGTH('abc1235jeme') |
+-------------------------------------------+
|                                        50 |
+-------------------------------------------+

--安裝validate_password外掛後，就必需符合validate_password_policy的要求，否則語句執行出錯
mysql> alter user 'root'@'%' identified by '123456';
ERROR 1819 (HY000): Your password does not satisfy the current policy requirements

2、主從複製遇到的許可權及異常問題

1、主從均需重啟mysql服務
/etc/init.d/mysqld restart
或者：
sudo service mysqld restart 

2、主配置：增加從機複製賬戶並授權，以便從機遠端登入過來複制 binlog
create user 'replicationUsername'@'%' identified by 'Passwd';
GRANT REPLICATION SLAVE,RELOAD,SUPER ON *.* TO 'name'@'%'  WITH GRANT OPTION;
show master status;

3、從配置：
stop slave;
CHANGE MASTER TO
  MASTER_HOST='110.126.103.126',
  MASTER_USER='replicationUsername',
  MASTER_PASSWORD='Passwd',
  MASTER_PORT=3306,
  MASTER_LOG_FILE='mysql-bin.000001',
  MASTER_LOG_POS=154,
  MASTER_CONNECT_RETRY=10;
start slave;
show slave statusG

4、Slave_SQL_Running: No
    1.程式可能在slave上進行了寫操作
    2.也可能是slave機器重起後，事務回滾造成的.
    3.也可能遇到各種SQL錯誤導致 SQL 執行緒中斷退出。
    解決方法:
stop slave;
set global sql_slave_skip_counter = 1 ;
start slave;
    之後Slave會和Master去同步 主要看:
從機：show slave statusG
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Seconds_Behind_Master是否為0，0就是已經同步了
主機：show processlistG
如果出現Command: Binlog Dump,則說明配置成功.

5、測試：
create database db_test_slave;  
use db_test_slave;  
create table tb_test(id int(3), name varchar(50));  
insert into tb_test values(1,'hello slave');  
show databases;  

6、slave 從零開始同步 master 所有資料庫：
（1）master操作:
RESET MASTER;
FLUSH TABLES WITH READ LOCK;
SHOW MASTER STATUS;

candidates=$(echo "show databases" | mysql -uroot -pPASSWD| grep -Ev "^(Database|sys|mysql|performance_schema|information_schema)$")
mysqldump -uroot -pPASSWD --databases ${candidates} --single-transaction > mysqldump.sql
UNLOCK TABLES;

（2）slave操作:
nc -l 12345 < <(cat mysqldump.sql) ##主
nc -n 10.48.186.32 12345 > mysqldump.sql 

STOP SLAVE;
mysql -uroot -pPASSWD < mysqldump.sql

show master status; --主

CHANGE MASTER TO
  MASTER_HOST='10.48.186.32',
  MASTER_USER='birepl',
  MASTER_PASSWORD='PASSWD',
  MASTER_PORT=3306,
  MASTER_LOG_FILE='mysql-bin.000001',
  MASTER_LOG_POS=398062,
  MASTER_CONNECT_RETRY=10;
RESET SLAVE;
start slave;
SHOW SLAVE STATUSG