Table of Contents Chapter 6 Security 6.1 General Security Issues .......................................................................................................... 1170 6.1.1 Security Guidelines ...................................................................................................... 1171 6.1.2 Keeping Passwords Secure .......................................................................................... 1172 6.1.3 Making MySQL Secure Against Attackers ..................................................................... 1175 6.1.4 Security-Related mysqld Options and Variables ............................................................. 1177 6.1.5 How to Run MySQL as a Normal User .......................................................................... 1177 6.1.6 Security Considerations for LOAD DATA LOCAL ........................................................... 1178 6.1.7 Client Programming Security Guidelines ........................................................................ 1182 6.2 Access Control and Account Management ............................................................................... 1184 6.2.1 Account User Names and Passwords ........................................................................... 1185 6.2.2 Privileges Provided by MySQL ...................................................................................... 1186 6.2.3 Grant Tables ................................................................................................................ 1204 6.2.4 Specifying Account Names ........................................................................................... 1214 6.2.5 Specifying Role Names ................................................................................................ 1216 6.2.6 Access Control, Stage 1: Connection Verification ........................................................... 1216 6.2.7 Access Control, Stage 2: Request Verification ............................................................... 1220 6.2.8 Adding Accounts, Assigning Privileges, and Dropping Accounts ...................................... 1222 6.2.9 Reserved Accounts ...................................................................................................... 1225 6.2.10 Using Roles ............................................................................................................... 1226 6.2.11 Account Categories .................................................................................................... 1233 6.2.12 Privilege Restriction Using Partial Revokes .................................................................. 1236 6.2.13 When Privilege Changes Take Effect .......................................................................... 1243 6.2.14 Assigning Account Passwords .................................................................................... 1243 6.2.15 Password Management .............................................................................................. 1245 6.2.16 Server Handling of Expired Passwords ........................................................................ 1256 6.2.17 Pluggable Authentication ............................................................................................ 1258 6.2.18 Proxy Users ............................................................................................................... 1263 6.2.19 Account Locking ......................................................................................................... 1271 6.2.20 Setting Account Resource Limits ................................................................................. 1272 6.2.21 Troubleshooting Problems Connecting to MySQL ......................................................... 1274 6.2.22 SQL-Based Account Activity Auditing .......................................................................... 1279 6.3 Using Encrypted Connections .................................................................................................. 1280 6.3.1 Configuring MySQL to Use Encrypted Connections ........................................................ 1281 6.3.2 Encrypted Connection TLS Protocols and Ciphers ......................................................... 1288 6.3.3 Creating SSL and RSA Certificates and Keys ................................................................ 1296 6.3.4 Connecting to MySQL Remotely from Windows with SSH .............................................. 1305 6.4 Security Components and Plugins ........................................................................................... 1305 6.4.1 Authentication Plugins .................................................................................................. 1306 6.4.2 The Connection-Control Plugins .................................................................................... 1378 6.4.3 The Password Validation Component ............................................................................ 1384 6.4.4 The MySQL Keyring ..................................................................................................... 1397 6.4.5 MySQL Enterprise Audit ............................................................................................... 1465 6.4.6 The Audit Message Component .................................................................................... 1542 6.4.7 MySQL Enterprise Firewall ........................................................................................... 1544 6.5 MySQL Enterprise Data Masking and De-Identification ............................................................. 1574 6.5.1 MySQL Enterprise Data Masking and De-Identification Elements .................................... 1576 6.5.2 Installing or Uninstalling MySQL Enterprise Data Masking and De-Identification ............... 1576 1169