執行環境：centos7.4+MySQL5.7.15
Payment Card Industry，即支付卡行業，PCI行業表示借記卡、信用卡、預付卡、電子錢包、ATM和POS卡及相關的業務。 
PCI DSS，即PCI資料安全標準（Payment Card Industry Data Security Standard）是由PCI安全標準委員會制定，旨在使國際上採用一致的資料安全措施。
PCI DSS標準要求使用者每隔90天必須更改他們的密碼。
在MySQL版本5.6.6版本起，添加了password_expired功能，它允許設定使用者的過期時間。
從MySQL 5.7.4版開始，使用者的密碼過期時間這個特性得以改進，可以通過一個全域性變數default_password_lifetime來設定密碼過期的策略，此全域性變數可以設定一個全域性的自動密碼過期策略。
MySQL 5.7.6版開始，還可以使用ALTER USER語句修改使用者的密碼。
在MySQL 5.7.8版開始使用者管理方面添加了鎖定/解鎖使用者賬戶的新特性。
在MySQL8.0版本中新增了密碼重用的管理。
密碼管理功能包含：
密碼過期：密碼週期性修改
密碼重用限制：防止舊密碼被再次使用。
密碼強度：需要強壯的密碼。

mysql5.7.10(GA)版本之後預設的密碼是永不過期的(default_password_lifetime=0)。
mysql> select version();
+------------+
| version()  |
+------------+
| 5.7.15-log |
+------------+
1 row in set (0.00 sec)

mysql> show variables like 'default_password_lifetime';
+---------------------------+-------+
| Variable_name             | Value |
+---------------------------+-------+
| default_password_lifetime | 0     |
+---------------------------+-------+
1 row in set (0.00 sec)

mysql> select version();
+-----------+
| version() |
+-----------+
| 8.0.11    |
+-----------+
1 row in set (0.04 sec)

mysql> show variables like 'default_password_lifetime';
+---------------------------+-------+
| Variable_name             | Value |
+---------------------------+-------+
| default_password_lifetime | 0     |
+---------------------------+-------+
1 row in set (0.01 sec)
--為了演示建立2個賬號temp 和backup：
mysql> create user 
 
[email protected]'%' identified by 'temp';
mysql> create user [email protected]'%' identified by 'backup'  PASSWORD EXPIRE INTERVAL 30 DAY; 

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp','backup');
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user   | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp   | *92D3FC821547543FCC854DE4426B7BFD3A0EE2ED | N                | 2018-07-12 10:40:51   |              NULL | N              |
| %    | backup | *1827DC630AAEB1E997DB2B212CC94EFD9C431555 | N                | 2018-07-12 10:40:52   |                30 | N              |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
2 rows in set (0.00 sec)
可以看到建立的使用者password_expired為N表示密碼密碼不過期，password_lifetime表示密碼週期，單位是天，NULL表示使用的預設密碼策略，account_locked表示賬號是否被鎖定。
mysql> alter user 
 
[email protected]'%' PASSWORD EXPIRE NEVER;
Query OK, 0 rows affected (0.01 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp','backup');
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user   | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp   | *92D3FC821547543FCC854DE4426B7BFD3A0EE2ED | N                | 2018-07-12 10:40:51   |              NULL | N              |
| %    | backup | *1827DC630AAEB1E997DB2B212CC94EFD9C431555 | N                | 2018-07-12 10:40:52   |                 0 | N              |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
2 rows in set (0.00 sec)
修改密碼永不過期，password_lifetime=0.
mysql> SET GLOBAL default_password_lifetime = 9;
Query OK, 0 rows affected (0.00 sec)
mysql>  SET GLOBAL default_password_lifetime = 0;
Query OK, 0 rows affected (0.00 sec)
密碼的預設過期時間也可以設定到my.cnf檔案中但是需要重啟mysql。
[mysqld]
default_password_lifetime=90
如果要設定密碼永不過期的全域性策略，可以這樣：（注意這是預設值，配置檔案中可以不寫）
[mysqld]
default_password_lifetime=0


mysql> alter user 
 
[email protected]'%' PASSWORD EXPIRE default;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp','backup');
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user   | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp   | *92D3FC821547543FCC854DE4426B7BFD3A0EE2ED | N                | 2018-07-12 10:40:51   |              NULL | N              |
| %    | backup | *1827DC630AAEB1E997DB2B212CC94EFD9C431555 | N                | 2018-07-12 10:40:52   |              NULL | N              |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
2 rows in set (0.00 sec)
修改預設的密碼策略(可以動態修改)為9天，password_lifetime為NULL。
mysql> alter user [email protected]'%' PASSWORD EXPIRE;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp','backup');
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user   | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp   | *92D3FC821547543FCC854DE4426B7BFD3A0EE2ED | Y                | 2018-07-12 10:40:51   |              NULL | N              |
| %    | backup | *1827DC630AAEB1E997DB2B212CC94EFD9C431555 | N                | 2018-07-12 10:40:52   |              NULL | N              |
+------+--------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
2 rows in set (0.00 sec)

password_expired表示密碼已經過期，下面通過登入驗證密碼是否過期。
# mysql -ptemp -utemp -P3312 -S /tmp/mysql.sock 
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 534343
Server version: 5.7.15-log

Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement.
mysql> select user();
ERROR 1820 (HY000): You must reset your password using ALTER USER statement before executing this statement.
mysql> alter user [email protected]'%' identified by 'xxx';
Query OK, 0 rows affected (0.00 sec)
註釋：temp使用者需要alter許可權否則無法自己修改密碼的。
mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp');
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp | *3D56A309CD04FA2EEF181462E59011F075C89548 | N                | 2018-07-12 10:56:39   |              NULL | N              |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
1 row in set (0.00 sec)
mysql> ALTER USER USER() IDENTIFIED BY 'YYY';
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp');
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp | *6A1F4E06FBADDD79831769EF2B9D785D5A5F6113 | N                | 2018-07-12 10:59:13   |              NULL | N              |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
1 row in set (0.00 sec)

mysql> alter user [email protected]'%' account lock;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp');
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp | *6A1F4E06FBADDD79831769EF2B9D785D5A5F6113 | N                | 2018-07-12 10:59:13   |              NULL | Y              |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
1 row in set (0.01 sec)
此時重新登入則報錯： ERROR 3118 (HY000) Account is locked.
# mysql -utemp -pYYY -P3312 -h 172.16.1.86           
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 3118 (HY000): Access denied for user 'temp'@'172.16.1.86'. Account is locked.

密碼可以給鎖定，也可以解鎖：
mysql> alter user [email protected]'%' account unlock;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp');
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp | *6A1F4E06FBADDD79831769EF2B9D785D5A5F6113 | N                | 2018-07-12 10:59:13   |              NULL | N              |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
1 row in set (0.00 sec)

賬戶鎖定也可以在建立用的時候鎖定：
create user 'test'@'%' identified by 'test' account lock;
mysql> create user 'test'@'%' identified by 'test' account lock;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,authentication_string,password_expired,password_last_changed,password_lifetime,account_locked from mysql.user where user in ('temp','test');
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| host | user | authentication_string                     | password_expired | password_last_changed | password_lifetime | account_locked |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| %    | temp | *6A1F4E06FBADDD79831769EF2B9D785D5A5F6113 | N                | 2018-07-12 10:59:13   |              NULL | N              |
| %    | test | *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 | N                | 2018-07-12 11:07:50   |              NULL | Y              |
+------+------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
2 rows in set (0.00 sec)
此時查詢的account_locked的值為Y。