Keeping Passwords Secure 6.1.2.2 Administrator Guidelines for Password Security 6.1.2.3 Passwords and Logging 1174 Database administrators should use the following guidelines to keep passwords secure. MySQL stores passwords for user accounts in the  mysql.user  system table. Access to this table should never be granted to any nonadministrative accounts. Account passwords can be expired so that users must reset them. See Section 6.2.15, “Password Management” , and Section 6.2.16, “Server Handling of Expired Passwords” . The  validate_password  plugin can be used to enforce a policy on acceptable password. See Section 6.4.3, “The Password Validation Component” . A user who has access to modify the plugin directory (the value of the  plugin_dir  system variable) or the  my.cnf  file that specifies the plugin directory location can replace plugins and modify the capabilities provided by plugins, including authentication plugins. Files such as log files to which passwords might be written should be protected. See Section 6.1.2.3, “Passwords and Logging” . Passwords can be written as plain text in SQL statements such as  CREATE USER ,  GRANT  and  SET PASSWORD . If such statements are logged by the MySQL server as written, passwords in them become visible to anyone with access to the logs. Statement logging avoids writing passwords as cleartext for the following statements: Passwords in those statements are rewritten to not appear literally in statement text written to the general query log, slow query log, and binary log. Rewriting does not apply to other statements. In particular, INSERT  or  UPDATE  statements for the  mysql.user  system table that refer to literal passwords are logged as is, so you should avoid such statements. (Direct modification of grant tables is discouraged, anyway.) For the general query log, password rewriting can be suppressed by starting the server with the  --log- raw  option. For security reasons, this option is not recommended for production use. For diagnostic purposes, it may be useful to see the exact text of statements as received by the server. By default, contents of audit log files produced by the audit log plugin are not encrypted and may contain sensitive information, such as the text of SQL statements. For security reasons, audit log files should be written to a directory accessible only to the MySQL server and to users with a legitimate reason to view the log. See Section 6.4.5.3, “MySQL Enterprise Audit Security Considerations” . Statements received by the server may be rewritten if a query rewrite plugin is installed (see Query Rewrite Plugins). In this case, the  --log-raw  option affects statement logging as follows: •Without  --log-raw , the server logs the statement returned by the query rewrite plugin. This may differ from the statement as received. •With  --log-raw , the server logs the original statement as received. CREATE USER ... IDENTIFIED BY ... ALTER USER ... IDENTIFIED BY ... SET PASSWORD ... START SLAVE ... PASSWORD = ... START REPLICA ... PASSWORD = ... CREATE SERVER ... OPTIONS(... PASSWORD ...) ALTER SERVER ... OPTIONS(... PASSWORD ...)