注:
mysql.user表中host为%的含义
host列指定了允许用户登录所使用的ip,比如user=root host=192.168.1.1。这里的意思就是说root用户只能通过192.168.1.1的客户端去访问。 而%是个通配符,如果host=192.168.1.%,那么就表示只要是ip地址前缀为“192.168.1.”的客户端都可以连接。如果host=%,表示所有ip都有连接权限。、 这也就是为什么在开启远程连接的时候,大部分人都直接把host改成%的缘故,为了省事。
1:新增用户:
注:mysql数据库下user表中,host和user为两个主键列(primary key),已经各版本下非空未设置默认字段。
登录后,切换db:
[sql] view plain copy
- mysql> use mysql;
- reading table information for completion of table and column names
- you can turn off this feature to get a quicker startup with -a
- database changed
新增用户:
注:限制kaka用户的登陆ip为10.155.123.55,ip为随手写入,如果正确配置为您有效登陆ip,所有ip登陆,则设置host为 '%'
[sql] view plain copy
- mysql> insert into mysql.user(host,user,password) values("10.155.123.55","kaka",password("kaka123"));
在版本 5.6.27:
[sql] view plain copy
- mysql> insert into mysql.user(host,user,password,ssl_cipher,x509_issuer,x509_subject) values("10.155.123.55","kaka",password("kaka123"),"","","");
- query ok, 1 row affected (0.03 sec)
新增用户(全sql):
[sql] view plain copy
- insert into `user`(`host`,`user`,`password`,`select_priv`,`insert_priv`,`update_priv`,`delete_priv`,`create_priv`,`drop_priv`,`reload_priv`,`shutdown_priv`,`process_priv`,`file_priv`,`grant_priv`,`references_priv`,`index_priv`,`alter_priv`,`show_db_priv`,`super_priv`,`create_tmp_table_priv`,`lock_tables_priv`,`execute_priv`,`repl_slave_priv`,`repl_client_priv`,`create_view_priv`,`show_view_priv`,`create_routine_priv`,`alter_routine_priv`,`create_user_priv`,`event_priv`,`trigger_priv`,`create_tablespace_priv`,`ssl_type`,`ssl_cipher`,`x509_issuer`,`x509_subject`,`max_questions`,`max_updates`,`max_connections`,`max_user_connections`,`plugin`,`authentication_string`,`password_expired`) values ('%','root','*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','y','','','','',0,0,0,0,'mysql_native_password','','n');
新增用户完成,刷新mysql的系统权限相关表
[sql] view plain copy
- mysql> flush privileges;
- query ok, 0 rows affected (0.00 sec)
设置遇到问题,请查看:mysql配置和设置问题小结
重启生效:
[sql] view plain copy
- [root@tony_ts_tian bin]# service mysqld restart
- shutting down mysql.... success!
- starting mysql. success!
查询用户,host,user,password:
[sql] view plain copy
- mysql> select host,user,password from mysql.user;
- ---------------- ------ -------------------------------------------
- | host | user | password |
- ---------------- ------ -------------------------------------------
- | localhost | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | tony\_ts\_tian | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | 127.0.0.1 | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | ::1 | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | 10.155.123.55 | kaka | *90b3d884fb6092549f244125549b77c000a0f9c6 |
- | % | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- ---------------- ------ -------------------------------------------
- 6 rows in set (0.00 sec)
2:修改信息,密码,类似可修改其他字段。
[sql] view plain copy
- mysql> update `user` set password=password("123456") where host='10.155.123.55' and user='kaka';
- query ok, 1 row affected (0.02 sec)
- rows matched: 1 changed: 1 warnings: 0
- mysql> flush privileges;
- query ok, 0 rows affected (0.00 sec)
- mysql> select host,user,password from `user`;
- 前:
- | 10.155.123.55 | kaka | *90b3d884fb6092549f244125549b77c000a0f9c6 |
- 后:
- | 10.155.123.55 | kaka | *6bb4837eb74329105ee4568dda7dc67ed2ca2ad9 |
3:删除用户:
[sql] view plain copy
- mysql> delete from `user` where host='10.155.123.55' and user='kaka';
- query ok, 1 row affected (0.00 sec)
- mysql> flush privileges;
- query ok, 0 rows affected (0.00 sec)
- mysql> select host,user,password from `user`;
- ---------------- ------ -------------------------------------------
- | host | user | password |
- ---------------- ------ -------------------------------------------
- | localhost | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | tony\_ts\_tian | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | 127.0.0.1 | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | ::1 | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- | % | root | *71abca8b06d46066cef8062a75256e66243d0fc8 |
- ---------------- ------ -------------------------------------------
- 5 rows in set (0.00 sec)
4. 权限分配
[plain] view plain copy
- grant语法:
- grant 权限 on 数据库.* to 用户名@'登录主机' identified by '密码'
- 权限:
- all,alter,create,drop,select,update,delete
- 新增用户:权限为usage,即为:"无权限",想要创建一个没有权限的用户时,可以指定usage
- 数据库:
- *.* 表示所有库的所有表
- mylove.* 表示mylove库的所有表
- mylove.loves 表示mylove库的loves表
- 用户名:
- mysql的账户名
- 登陆主机:
- 允许登陆到mysql server的客户端ip
- '%'表示所有ip
- 'localhost' 表示本机
- '10.155.123.55' 特定ip
- 密码:
- mysql的账户名对应的登陆密码
注: identified by '密码',可选。
grant会覆盖用户的部分信息,跟insert 、update执行功能一样。
给用户kaka分配test数据库下user表的查询select权限:
[sql] view plain copy
- mysql> grant select on test.user to kaka@'10.155.123.55' identified by '123456';
- query ok, 0 rows affected (0.00 sec)
- mysql> flush privileges;
- query ok, 0 rows affected (0.00 sec)
- mysql> show grants for 'kaka'@'10.155.123.55';
- -----------------------------------------------------------------------------------------------------------------
- | grants for [email protected] |
- -----------------------------------------------------------------------------------------------------------------
- | grant usage on *.* to 'kaka'@'10.155.123.55' identified by password '*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9' |
- | grant select on `test`.`user` to 'kaka'@'10.155.123.55' |
- -----------------------------------------------------------------------------------------------------------------
- 2 rows in set (0.00 sec)
为了快速测试,我要把ip切回%,ip全访问:
使用和测试:
数据库和数据表请看: mysql数据定义语句:create(创建)命令、alter(修改)命令、drop(删除)
[sql] view plain copy
- mysql> use mysql
- reading table information for completion of table and column names
- you can turn off this feature to get a quicker startup with -a
- database changed
- 修改权限host为所有ip登陆:
- mysql> update `user` set host='%' where host='10.155.123.55' and user='kaka';
- query ok, 1 row affected (0.00 sec)
- rows matched: 1 changed: 1 warnings: 0
- 查看kaka的权限:
- mysql> show grants for 'kaka'@'10.155.123.55';
- -----------------------------------------------------------------------------------------------------------------
- | grants for [email protected] |
- -----------------------------------------------------------------------------------------------------------------
- | grant usage on *.* to 'kaka'@'10.155.123.55' identified by password '*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9' |
- | grant select on `test`.`user` to 'kaka'@'10.155.123.55' |
- -----------------------------------------------------------------------------------------------------------------
- 2 rows in set (0.00 sec)
- 刷新mysql的系统权限相关表
- mysql> flush privileges;
- query ok, 0 rows affected (0.00 sec)
- 查看kaka的权限:
- mysql> show grants for 'kaka'@'%';
- -----------------------------------------------------------------------------------------------------
- | grants for kaka@% |
- -----------------------------------------------------------------------------------------------------
- | grant usage on *.* to 'kaka'@'%' identified by password '*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9' |
- -----------------------------------------------------------------------------------------------------
- 1 row in set (0.00 sec)
- 给用户kaka分配weloveshare数据库下user表的查询select权限:
- mysql> grant select on `weloveshare`.`user` to kaka@'%';
- query ok, 0 rows affected (0.00 sec)
- 查看kaka的权限:
- mysql> show grants for 'kaka'@'%';
- -----------------------------------------------------------------------------------------------------
- | grants for kaka@% |
- -----------------------------------------------------------------------------------------------------
- | grant usage on *.* to 'kaka'@'%' identified by password '*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9' |
- | grant select on `weloveshare`.`user` to 'kaka'@'%' |
- -----------------------------------------------------------------------------------------------------
- 2 rows in set (0.00 sec)
- 查看weloveshare数据库下user表的数据:
- mysql> use weloveshare
- reading table information for completion of table and column names
- you can turn off this feature to get a quicker startup with -a
- database changed
- mysql> select * from user;
- empty set (0.00 sec)
- 退出当前用户:
- mysql> exit;
- bye
- 切换用户kaka:
- [root@tony_ts_tian ~]# mysql -u kaka -p
- enter password:
- 登录成功。
- 切换数据库,查看user表数据:
- mysql> use weloveshare
- reading table information for completion of table and column names
- you can turn off this feature to get a quicker startup with -a
- database changed
- mysql> select * from user;
- empty set (0.00 sec)
- 插入数据:
- mysql> insert into `weloveshare`.`user`(uname,upass,ustatus) values('kaka','kaka123','0');
- error 1142 (42000): insert command denied to user 'kaka'@'localhost' for table 'user'
- 提示:insert被拒绝。配置成功。
[sql] view plain copy
- 注:`weloveshare`.`user`数据库名.数据表名,kaka用户名,%为host,ip可限制或不 localhost,%,192.168.10.%
- grant创建、修改、删除、更新、查询mysql数据表结构权限:
- grant create on `weloveshare`.`user` to kaka@'%';
- grant alter on `weloveshare`.`user` to kaka@'%';
- grant drop on `weloveshare`.`user` to kaka@'%';
- grant update on `weloveshare`.`user` to kaka@'%';
- grant select on `weloveshare`.`user` to kaka@'%';
- grant操作mysql外键权限:
- grant references on `weloveshare`.`user` to kaka@'%';
- grant操作mysql 临时表权限:
- grant create temporary tables on `weloveshare`.`user` to kaka@'%';
- grant操作mysql索引权限
- grant index on `weloveshare`.`user` to kaka@'%';
- grant操作mysql视图、查看视图源代码权限:
- grant create view on `weloveshare`.`user` to kaka@'%';
- grant show view on `weloveshare`.`user` to kaka@'%';
- grant操作mysql存储过程(查看状态,删除修改)、函数权限。
- grant create routine on `weloveshare`.`user` to kaka@'%';
- grant create routine on `weloveshare`.`user` to kaka@'%';
- grant execute on `weloveshare`.`user` to kaka@'%';
注:其他的详细权限,请查看,备注附件(最后)。
5:查看数据库登陆所有用户:
[sql] view plain copy
- mysql> select distinct concat('user: ''',user,'''@''',host,''';') as query from mysql.user;
- --------------------------------
- | query |
- --------------------------------
- | user: 'kaka'@'%'; |
- | user: 'root'@'%'; |
- | user: 'root'@'127.0.0.1'; |
- | user: 'root'@'::1'; |
- | user: 'root'@'localhost'; |
- | user: 'root'@'tony\_ts\_tian'; |
- --------------------------------
- 6 rows in set (0.00 sec)
查看某个用户的具体权限,比如root:
[sql] view plain copy
- mysql> show grants for 'root'@'%';
- --------------------------------------------------------------------------------------------------------------------------------
- | grants for root@% |
- --------------------------------------------------------------------------------------------------------------------------------
- | grant all privileges on *.* to 'root'@'%' identified by password '*71abca8b06d46066cef8062a75256e66243d0fc8' with grant option |
- --------------------------------------------------------------------------------------------------------------------------------
- 1 row in set (0.00 sec)
或
[sql] view plain copy
- mysql> select * from mysql.user where user='root' \g
注:\g为按列显示数据。
备注附件:
查看mysql数据中user表的表结构:
[sql] view plain copy
- mysql> desc mysql.user;
- ------------------------ ------------------- ------ ----- ----------- -------
- | field | type | null | key | default | extra |
- ------------------------ ------------------- ------ ----- ----------- -------
- | host | char(60) | no | pri | | |
- | user | char(16) | no | pri | | |
- | password | char(41) | no | | | |
- | select_priv | enum('n','y') | no | | n | |
- | insert_priv | enum('n','y') | no | | n | |
- | update_priv | enum('n','y') | no | | n | |
- | delete_priv | enum('n','y') | no | | n | |
- | create_priv | enum('n','y') | no | | n | |
- | drop_priv | enum('n','y') | no | | n | |
- | reload_priv | enum('n','y') | no | | n | |
- | shutdown_priv | enum('n','y') | no | | n | |
- | process_priv | enum('n','y') | no | | n | |
- | file_priv | enum('n','y') | no | | n | |
- | grant_priv | enum('n','y') | no | | n | |
- | references_priv | enum('n','y') | no | | n | |
- | index_priv | enum('n','y') | no | | n | |
- | alter_priv | enum('n','y') | no | | n | |
- | show_db_priv | enum('n','y') | no | | n | |
- | super_priv | enum('n','y') | no | | n | |
- | create_tmp_table_priv | enum('n','y') | no | | n | |
- | lock_tables_priv | enum('n','y') | no | | n | |
- | execute_priv | enum('n','y') | no | | n | |
- | repl_slave_priv | enum('n','y') | no | | n | |
- | repl_client_priv | enum('n','y') | no | | n | |
- | create_view_priv | enum('n','y') | no | | n | |
- | show_view_priv | enum('n','y') | no | | n | |
- | create_routine_priv | enum('n','y') | no | | n | |
- | alter_routine_priv | enum('n','y') | no | | n | |
- | create_user_priv | enum('n','y') | no | | n | |
- | event_priv | enum('n','y') | no | | n | |
- | trigger_priv | enum('n','y') | no | | n | |
- | create_tablespace_priv | enum('n','y') | no | | n | |
- | ssl_type | enum('','any','x509','specified') | no || | |
- | ssl_cipher | blob | no | | null | |
- | x509_issuer | blob | no | | null | |
- | x509_subject | blob | no | | null | |
- | max_questions | int(11) unsigned | no | | 0 | |
- | max_updates | int(11) unsigned | no | | 0 | |
- | max_connections | int(11) unsigned | no | | 0 | |
- | max_user_connections | int(11) unsigned | no | | 0 | |
- | plugin | char(64) | yes || mysql_native_password ||
- | authentication_string | text | yes | | null | |
- | password_expired | enum('n','y') | no | | n | |
- ------------------------ ------------------- ------ ----- ----------- -------
- 43 rows in set (0.00 sec)
查看root用户的所有具体权限:
[sql] view plain copy
- host: %
- user: root
- password: *71abca8b06d46066cef8062a75256e66243d0fc8
- select_priv: y
- insert_priv: y
- update_priv: y
- delete_priv: y
- create_priv: y
- drop_priv: y
- reload_priv: y
- shutdown_priv: y
- process_priv: y
- file_priv: y
- grant_priv: y
- references_priv: y
- index_priv: y
- alter_priv: y
- show_db_priv: y
- super_priv: y
- eate_tmp_table_priv: y
- lock_tables_priv: y
- execute_priv: y
- repl_slave_priv: y
- repl_client_priv: y
- create_view_priv: y
- show_view_priv: y
- create_routine_priv: y
- alter_routine_priv: y
- create_user_priv: y
- event_priv: y
- trigger_priv: y
- ate_tablespace_priv: y
- ssl_type:
- ssl_cipher:
- x509_issuer:
- x509_subject:
- max_questions: 0
- max_updates: 0
- max_connections: 0
- ax_user_connections: 0
- plugin: mysql_native_password
- thentication_string:
- password_expired: n
参数说明:
[sql] view plain copy
- select_priv:用户可以通过select命令选择数据。
- insert_priv:用户可以通过insert命令插入数据;
- update_priv:用户可以通过update命令修改现有数据;
- delete_priv:用户可以通过delete命令删除现有数据;
- create_priv:用户可以创建新的数据库和表;
- drop_priv:用户可以删除现有数据库和表;
- reload_priv:用户可以执行刷新和重新加载mysql所用各种内部缓存的特定命令,包括日志、权限、主机、查询和表;重新加载权限表;
- shutdown_priv:用户可以关闭mysql服务器;在将此权限提供给root账户之外的任何用户时,都应当非常谨慎;
- process_priv:用户可以通过show processlist命令查看其他用户的进程;服务器管理;
- file_priv:用户可以执行select into outfile和load data infile命令;加载服务器上的文件;
- grant_priv:用户可以将已经授予给该用户自己的权限再授予其他用户(任何用户赋予全部已有权限);
- references_priv;目前只是某些未来功能的占位符;现在没有作用;
- index_priv:用户可以创建和删除表索引;用索引查询表;
- alter_priv:用户可以重命名和修改表结构;
- show_db_priv:用户可以查看服务器上所有数据库的名字,包括用户拥有足够访问权限的数据库;可以考虑对所有用户禁用这个权限,除非有特别不可抗拒的原因;
- super_priv:用户可以执行某些强大的管理功能,例如通过kill命令删除用户进程,使用set global修改全局mysql变量,执行关于复制和日志的各种命令;超级权限;
- create_tmp_table_priv:用户可以创建临时表;
- lock_tables_priv:用户可以使用lock tables命令阻止对表的访问/修改;
- execute_priv:用户可以执行存储过程;此权限只在mysql 5.0及更高版本中有意义;
- repl_slave_priv:用户可以读取用于维护复制数据库环境的二进制日志文件;此用户位于主系统中,有利于主机和客户机之间的通信;主服务器管理;
- repl_client_priv:用户可以确定复制从服务器和主服务器的位置;从服务器管理;
- create_view_priv:用户可以创建视图;此权限只在mysql 5.0及更高版本中有意义;
- show_view_priv:用户可以查看视图或了解视图如何执行;此权限只在mysql 5.0及更高版本中有意义;
- create_routine_priv:用户可以更改或放弃存储过程和函数;此权限是在mysql 5.0中引入的;
- alter_routine_priv:用户可以修改或删除存储函数及函数;此权限是在mysql 5.0中引入的;
- create_user_priv:用户可以执行create user命令,这个命令用于创建新的mysql账户;
- event_priv:用户能否创建、修改和删除事件;这个权限是mysql 5.1.6新增的;
- trigger_priv:用户能否创建和删除触发器,这个权限是mysql 5.1.6新增的;
- create_tablespace_priv:创建表空间
- ssl_type:支持ssl标准加密安全字段
- ssl_cipher:支持ssl标准加密安全字段
- x509_issuer:支持x509标准字段
- x509_subject:支持x509标准字段
- max_questions:0 每小时允许执行多少次查询
- max_updates:0 每小时可以执行多少次更新 :0表示无限制
- max_connections:0 每小时可以建立的多少次连接:0表示无限制
- max_user_connections:0 单用户可以同时具有的连接数:0表示无限制
- plugin:5.5.7开始,mysql引入plugins以进行用户连接时的密码验证,plugin创建外部/代理用户
- authentication_string:通过authentication_string可以控制两者的映射关系,(pam plugin等,pam可以支持多个服务名)尤其是在使用代理用户时,并须声明这一点
- password_expired:密码过期 y,说明该用户密码已过期 n相反