Account User Names and Passwords There are some things that you cannot do with the MySQL privilege system: •You cannot explicitly specify that a given user should be denied access. That is, you cannot explicitly match a user and then refuse the connection. •You cannot specify that a user has privileges to create or drop tables in a database but not to create or drop the database itself. •A password applies globally to an account. You cannot associate a password with a specific object such as a database, table, or routine. 6.2.1 Account User Names and Passwords MySQL stores accounts in the  user  table of the  mysql  system database. An account is defined in terms of a user name and the client host or hosts from which the user can connect to the server. For information about account representation in the  user  table, see Section 6.2.3, “Grant Tables” . An account may also have authentication credentials such as a password. The credentials are handled by the account authentication plugin. MySQL supports multiple authentication plugins. Some of them use built-in authentication methods, whereas others enable authentication using external authentication methods. See Section 6.2.17, “Pluggable Authentication” . There are several distinctions between the way user names and passwords are used by MySQL and your operating system: The MySQL user name length limit is hardcoded in MySQL servers and clients, and trying to circumvent it by modifying the definitions of the tables in the  mysql database  does not work . You should never alter the structure of tables in the  mysql  database in any manner whatsoever except by means of the procedure that is described in Section 2.11, “Upgrading MySQL” . Attempting to redefine MySQL’s system tables in any other fashion results in undefined and unsupported behavior. The server is free to ignore rows that become malformed as a result of such modifications. If the server authenticates a client using some other plugin, the authentication method that the plugin implements may or may not use a password stored in the  user  table. In this case, it is possible that an external password is also used to authenticate to the MySQL server. 1185 Warning •To authenticate client connections for accounts that use built-in authentication methods, the server uses passwords stored in the  user  table. These passwords are distinct from passwords for logging in to your operating system. There is no necessary connection between the “external”  password you use to log in to a Windows or Unix machine and the password you use to access the MySQL server on that machine. •MySQL user names are up to 32 characters long. Operating system user names may have a different maximum length. •User names, as used by MySQL for authentication purposes, have nothing to do with user names (login names) as used by Windows or Unix. On Unix, most MySQL clients by default try to log in using the current Unix user name as the MySQL user name, but that is for convenience only. The default can be overridden easily, because client programs permit any user name to be specified with a  -u  or  -- user  option. This means that anyone can attempt to connect to the server using any user name, so you cannot make a database secure in any way unless all MySQL accounts have passwords. Anyone who specifies a user name for an account that has no password can connect successfully to the server.