MySQL使用者與許可權管理
阿新 • • 發佈：2020-08-16
一、使用者與許可權管理
（一）grant
1、help grant
和許可權相關的命令關鍵字grant可通過help檢視其用法：
ysql> help grant; Name: 'GRANT' Description: Syntax: GRANT priv_type [(column_list)] [, priv_type [(column_list)]] ... ON [object_type] priv_level TO user_specification [, user_specification] ... [REQUIRE {NONE| ssl_option [[AND] ssl_option] ...}] [WITH with_option ...] ... CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'mypass'; GRANT ALL ON db1.* TO 'jeffrey'@'localhost'; GRANT SELECT ON db2.invoice TO 'jeffrey'@'localhost'; GRANT USAGE ON *.* TO 'jeffrey'@'localhost' WITH MAX_QUERIES_PER_HOUR 90; ...
2、grant授權
對於上述：
GRANT ALL ON db1.* TO 'jeffrey'@'localhost';
它實際包含了兩條命令，先是建立使用者jeffrey，然後才是對這個使用者進行授權。如下：
mysql> create user 'jeffrey'@'localhost' identified by 'mypass'; mysql> grant all on db1.* to 'jeffrey'@'localhost' identified by 'mypass';
對於授權語句的一些關鍵字解釋如下：
|
grant |
all privileges |
on dbname.* |
to username@localhost |
Identified by ‘mypass’ |
|
授權命令 |
對應許可權 |
目標：庫和表 |
使用者名稱和客戶端主機 |
使用者密碼 |
3、實戰練習
- 檢視當前資料庫使用者情況
mysql> select user,host from mysql.user; +--------+---------------+ | user | host | +--------+---------------+ | root | 127.0.0.1 | | root | ::1 | | root | hadoop-slave1 | | root | localhost | | system | localhost | +--------+---------------+ 5 rows in set (0.00 sec)
- 建立使用者並授權
mysql> grant all privileges on test.* to 'admin'@'localhost' identified by 'admin123'; Query OK, 0 rows affected (0.01 sec)
- 檢視授權情況
mysql> select user,host from mysql.user; +--------+---------------+ | user | host | +--------+---------------+ | root | 127.0.0.1 | | root | ::1 | | root | hadoop-slave1 | | admin | localhost | | root | localhost | | system | localhost | +--------+---------------+ 6 rows in set (0.00 sec)
- 檢視admin具體許可權
mysql> show grants for 'admin'@'localhost'; +--------------------------------------------------------------------------------------------------------------+ | Grants for admin@localhost | +--------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'admin'@'localhost' IDENTIFIED BY PASSWORD '*01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C' | | GRANT ALL PRIVILEGES ON `test`.* TO 'admin'@'localhost' | +--------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)
（二）create和grant配合使用
1、使用步驟
- 建立使用者username、主機localhost、密碼passwd
mysql> create user 'username'@'localhost' identified by 'passwd';
- 授權建立的使用者管理dbname資料庫許可權（無需密碼）
mysql> grant all privileges to dbname.* to 'username'@'localhost';
2、實戰練習
- 檢視當前資料庫使用者情況
mysql> select user,host from mysql.user; +--------+---------------+ | user | host | +--------+---------------+ | root | 127.0.0.1 | | root | ::1 | | root | hadoop-slave1 | | admin | localhost | | root | localhost | | system | localhost | +--------+---------------+ 6 rows in set (0.02 sec)
- 建立使用者
mysql> create user 'admin1'@'localhost' identified by 'admin123456'; Query OK, 0 rows affected (0.02 sec)
注意的是這一步並沒有授權，僅僅是建立一個普通使用者。
- 檢視使用者情況
mysql> select user,host from mysql.user; +--------+---------------+ | user | host | +--------+---------------+ | root | 127.0.0.1 | | root | ::1 | | root | hadoop-slave1 | | admin | localhost | | admin1 | localhost | | root | localhost | | system | localhost | +--------+---------------+ 7 rows in set (0.00 sec)
如果對admin1進行授權就參照步使用步驟的第二步完成。
（三）使用者授權的許可權有什麼
1、檢視使用者許可權
在上面授權過程中可以看出來，使用的基本都是全部許可權：
grant all privileges to dbname.* to 'username'@'localhost';
然後檢視使用者的許可權後是這樣的：
mysql> show grants for 'admin'@'localhost'; +--------------------------------------------------------------------------------------------------------------+ | Grants for admin@localhost | +--------------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'admin'@'localhost' IDENTIFIED BY PASSWORD
'*01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C' | | GRANT ALL PRIVILEGES ON `test`.* TO 'admin'@'localhost' | +--------------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)
有時候並不需要給使用者給這麼多許可權，那麼怎麼收回呢？
2、回收使用者許可權（revoke）
mysql> revoke insert on test.* from 'admin'@'localhost'; #一定要指定在那個資料庫上的許可權 Query OK, 0 rows affected (0.00 sec)
可以再次檢視該使用者的許可權：
mysql> show grants for 'admin'@'localhos +---------------------------------------------------------------------------------------------------------+ | Grants for admin@localhost | +---------------------------------------------------------------------------------------------------------+ | GRANT USAGE ON *.* TO 'admin'@'localhost' IDENTIFIED BY PASSWORD
'*01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C' | | GRANT SELECT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER,
CREATE TEMPORARY TABLES,LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, EVENT,
TRIGGER ON `test`.* TO 'admin'@'localhost' | +----------------------------------------------------------------------------------------------------------+ 2 rows in set (0.00 sec)
可以看到使用者在test資料庫上除了insert許可權外的許可權它都有了。
也就是說資料庫的all priveleges包含下面的許可權：
INSERT,
SELECT,
UPDATE,
DELETE,
CREATE,
DROP,
REFERENCES,
INDEX,
ALTER,
CREATE TEMPORARY TABLES,
LOCK TABLES,
EXECUTE,
CREATE VIEW,
SHOW VIEW,
CREATE ROUTINE,
ALTER ROUTINE,
EVENT,
TRIGGER
所以我們在授權時儘量採用最小化的授權原則，比如：
mysql> grant select,insert,update,delete,create,drop on crm.* to 'admin'@'10.0.0.%' identified by '123456';
當admin使用者建立表後記得收回create許可權：
mysql> revoke create on crm.* from 'admin'@'10.0.0.0.%';
注意：可通過help revoke檢視用法
二、遠端連線
通過上面的授權，比如：...'admin1'@'localhost'..中的localhost是授權的主機，也就是說什麼樣的機器有許可權連線MySQL伺服器。 localhost可以用域名、IP地址、IP端來代替。
（一）匹配方式
1、百分號匹配法
mysql> grant all 0n dbname.* to 'admin1'@'10.0.0.%' identified by '123456';
mysql> flush privileges;
2、子網掩碼配置法
mysql> grant all 0n dbname.* to 'admin1'@'10.0.0.0、255.255.255.0' identified by '123456'; mysql>flush privileges;
（二）客戶端連線
客戶端本地連線與遠端連線是不一樣的，如果遠端連線首先應該賦予遠端連線的許可權：
mysql> grant all 0n dbname.* to 'admin1'@'10.0.0.%' identified by '123456';
其次，再進行遠端連線：
mysql> mysql -uadmin1 -p123456 -h 10.0.0.0.3