2016.02.27
今天接着学习MySQL，前天安装完了MySQL 5.7.11，在此基础进一步了解新版本MySQL的各项改变。

5.7.11对密码有了更严格的要求，分为LOW，MEDIUM，STRONG三个等级，对应要求如下：
LOW Length >= 8
MEDIUM Length >= 8, numeric, mixed case, and special characters
STRONG Length >= 8, numeric, mixed case, special characters and dictionary file

由于前天安装MySQL的时候，是按照以往的5.6经验流程，所以密码设置都是比较一般，现在开始按照5.7.11的要求设置密码

[root@zhangMySQL5711 bin]# ./mysql_secure_installation //此文件在/usr/local/mysql/bin 目录下
Securing the MySQL server deployment.
Connecting to MySQL server using password in '/root/.mysql_secret' //提示使用安装时，MySQL提供的随机密码
Error: Access denied for user 'root'@'localhost' (using password: YES)
[root@zhangMySQL5711 bin]# more /root/.mysql_secret
# Password set for user 'root@localhost' at 2016-02-24 17:49:00
E>_iG6u+<%dh
[root@zhangMySQL5711 bin]# ./mysql_secure_installation --help //help 查看一下相关的参数选项，这里不多解释每一项，平时用到的也就那么熟悉的几项
./mysql_secure_installation Ver 5.7.11, for Linux on x86_64
Copyright (c) 2013, 2016, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
MySQL Configuration Utility.Usage: ./mysql_secure_installation [OPTIONS]
-?, --help Display this help and exit.
-h, --host=name Connect to host.
-p, --password[=name]
Password to connect to the server. If password is not
given it's asked from the tty.
-P, --port=# Port number to use for connection or 0 for default to, in
order of preference, my.cnf, $MYSQL_TCP_PORT,
/etc/services, built-in default (3306).
--protocol=name The protocol to use for connection (tcp, socket, pipe,
memory).
-S, --socket=name Socket file to be used for connection.
--ssl-mode=name SSL connection mode.
--ssl Deprecated. Use --ssl-mode instead.
(Defaults to on; use --skip-ssl to disable.)
--ssl-verify-server-cert
Deprecated. Use --ssl-mode=VERIFY_IDENTITY instead.
--ssl-ca=name CA file in PEM format.
--ssl-capath=name CA directory.
--ssl-cert=name X509 cert in PEM format.
--ssl-cipher=name SSL cipher to use.
--ssl-key=name X509 key in PEM format.
--ssl-crl=name Certificate revocation list.
--ssl-crlpath=name Certificate revocation list path.
--tls-version=name TLS version to use, permitted values are: TLSv1, TLSv1.1
-u, --user=name User for login if not root.
-D, --use-default Execute with no user interactivity
Default options are read from the following files in the given order:
/etc/my.cnf /etc/mysql/my.cnf /usr/local/mysql/etc/my.cnf ~/.my.cnf
The following groups are read: mysql_secure_installation mysql client
The following options may be given as the first argument:
--print-defaults Print the program argument list and exit.
--no-defaults Don't read default options from any option file,
except for login file.
--defaults-file=# Only read default options from the given file #.
--defaults-extra-file=# Read this file after the global files are read.
--defaults-group-suffix=#
Also read groups with concat(group, suffix)
--login-path=# Read this path from the login file.
Variables (--variable-name=value)
and boolean options {FALSE|TRUE} Value (after reading options)
--------------------------------- ----------------------------------------
host localhost
port 0
socket (No default value)
ssl TRUE
ssl-verify-server-cert FALSE
ssl-ca (No default value)
ssl-capath (No default value)
ssl-cert (No default value)
ssl-cipher (No default value)
ssl-key (No default value)
ssl-crl (No default value)
ssl-crlpath (No default value)
tls-version (No default value)
user root
use-default FALSE
[root@zhangMySQL5711 bin]# ./mysql_secure_installation -uroot -p // 尝试登录，使用安装后我自己的密码：zhangmysql
Enter password:
Securing the MySQL server deployment.
Error: Access denied for user 'root'@'localhost' (using password: YES) //登录失败，说明使用mysql_secure_installation方式登录，原来的密码已经不能使用了
[root@zhangMySQL5711 bin]# ./mysql_secure_installation -uroot -p //再次登录，使用安装是MySQL自己提供的随机密码：E>_iG6u+<%dh 登录成功!
Enter password:
Securing the MySQL server deployment.
VALIDATE PASSWORD PLUGIN can be used to test passwords //密码验证插件，为了提高安全性，需要验证密码
and improve security. It checks the strength of password // 它会检查密码的强度
and allows the users to set only those passwords which are //只允许用户设置足够安全的密码
secure enough. Would you like to setup VALIDATE PASSWORD plugin? //提示安装密码验证插件
Press y|Y for Yes, any other key for No: y
There are three levels of password validation policy: //三个等级的验证策略
LOW Length >= 8 //最小长度大于等于8个字符
MEDIUM Length >= 8, numeric, mixed case, and special characters //数字，字母，特殊字符混合，具体的应该是至少1个数字，1个字母，1个特殊字符，长度不超过32个字符
STRONG Length >= 8, numeric, mixed case, special characters and dictionary file // 最严格，加上了，字典文件
Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 2 //这里我选择2 MEDIUM
Using existing password for root.
Estimated strength of the password: 50 //这里也是密码强度的评级
Change the password for root ? ((Press y|Y for Yes, any other key for No) : y
New password: //我这里输入的是：Zhangmysql57
Re-enter new password:
Estimated strength of the password: 50
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y //提示要使用刚刚输入的密码吗？
... Failed! Error: Your password does not satisfy the current policy requirements //插件验证不通过，不符合当前安全要求级别
New password: //我这里输入的是：Zhangmysql_57
Re-enter new password:
Estimated strength of the password: 100
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y
By default, a MySQL installation has an anonymous user, //默认情况下，MySQL有一个匿名用户，
allowing anyone to log into MySQL without having to have //这个匿名用户，不必有一个用户为他们创建，匿名用户允许任何人登录到MySQL，
a user account created for them. This is intended only for //这只是为了方便测试使用
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production //在正式环境使用的时候，建议你移除它
environment.
Remove anonymous users? (Press y|Y for Yes, any other key for No) : y //提示移除匿名用户
Success.
Normally, root should only be allowed to connect from //一般情况下，root用户只允许使用"localhost"方式登录，
'localhost'. This ensures that someone cannot guess at // 以此确保，不能被某些人通过网络的方式访问
the root password from the network.
Disallow root login remotely? (Press y|Y for Yes, any other key for No) : n //
... skipping.
By default, MySQL comes with a database named 'test' that //默认情况下，MySQL数据库中有一个任何用户都可以访问的test库，
anyone can access. This is also intended only for testing, //这也仅仅是为了测试
and should be removed before moving into a production // 在正式环境下，应该移除掉
environment.
Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
- Dropping test database...
Success.
- Removing privileges on test database...
Success.
Reloading the privilege tables will ensure that all changes //刷新权限表，以确保所有的修改可以立刻生效
made so far will take effect immediately.
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Success.
All done!
[root@zhangMySQL5711 bin]

到此，密码修改完成了，现在去尝试登录，看是否是如此。

[root@zhangMySQL5711 ~]# mysql -uroot -p //使用第一次安装时候的密码：zhangmysql
Enter password:
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
[root@zhangMySQL5711 ~]# mysql -uroot -p //使用安装MySQL要求设置的密码：Zhangmysql_57
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 17
Server version: 5.7.11 Source distribution
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases; //显示没有了test库
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| sys |
+--------------------+
4 rows in set (0.00 sec)
mysql> select user ,host from mysql.user; //root用户只有"localhost"
+-----------+-----------+
| user | host |
+-----------+-----------+
| zhang | % |
| mysql.sys | localhost |
| root | localhost |
| zhang | localhost |
+-----------+-----------+
4 rows in set (0.00 sec)
mysql> GRANT ALL PRIVILEGES ON *.* TO root@"%" ;
ERROR 1819 (HY000): Your password does not satisfy the current policy requirements
mysql> GRANT ALL PRIVILEGES ON *.* TO root@"%" IDENTIFIED BY "Zhangmysql_57";
Query OK, 0 rows affected, 1 warning (0.00 sec)

可以确定，上面的步骤全部生效了，其实说白了，就是要把密码设置的复杂一些，就这！

ITPub博客

MySQL5.7.11 -- 严格的密码要求

最新文章