mysql的權(quán)限管理
Jun 07, 2016 pm 03:46 PM經(jīng)常遇到有網(wǎng)友在QQ群或者論壇上問(wèn)關(guān)于mysql權(quán)限的問(wèn)題,今天抽空總結(jié)一下關(guān)于這幾年使用MYSQL的時(shí)候關(guān)于MYSQL數(shù)據(jù)庫(kù)的權(quán)限管理的經(jīng)驗(yàn),也希望能對(duì)使用mysql的網(wǎng)友有所幫助! 一、MYSQL權(quán)限簡(jiǎn)介 關(guān)于mysql的權(quán)限簡(jiǎn)單的理解就是mysql允許你做你權(quán)利以內(nèi)的事情,不
經(jīng)常遇到有網(wǎng)友在QQ群或者論壇上問(wèn)關(guān)于mysql權(quán)限的問(wèn)題,今天抽空總結(jié)一下關(guān)于這幾年使用MYSQL的時(shí)候關(guān)于MYSQL數(shù)據(jù)庫(kù)的權(quán)限管理的經(jīng)驗(yàn),也希望能對(duì)使用mysql的網(wǎng)友有所幫助!
一、MYSQL權(quán)限簡(jiǎn)介
關(guān)于mysql的權(quán)限簡(jiǎn)單的理解就是mysql允許你做你權(quán)利以內(nèi)的事情,不可以越界。比如只允許你執(zhí)行select操作,那么你就不能執(zhí)行update操作。只允許你從某臺(tái)機(jī)器上連接mysql,那么你就不能從除那臺(tái)機(jī)器以外的其他機(jī)器連接mysql。
那么MYSQL的權(quán)限是如何實(shí)現(xiàn)的呢?這就要說(shuō)到mysql的兩階段的驗(yàn)證,下面詳細(xì)來(lái)介紹:第一階段:服務(wù)器首先會(huì)檢查你是否允許連接。因?yàn)閯?chuàng)建用戶的時(shí)候會(huì)加上主機(jī)限制,可以限制成本地、某個(gè)IP、某個(gè)IP段、以及任何地方等,只允許你從配置的指定地方登錄。后面在實(shí)戰(zhàn)的時(shí)候會(huì)詳細(xì)說(shuō)關(guān)于主機(jī)的限制。第二階段:如果你能連接,MYSQL會(huì)檢查你發(fā)出的每個(gè)請(qǐng)求,看你是否有足夠的權(quán)限實(shí)施它。比如你要更新某個(gè)表、或者查詢某個(gè)表,MYSQL會(huì)檢查你對(duì)哪個(gè)表或者某個(gè)列是否有權(quán)限。再比如,你要運(yùn)行某個(gè)存儲(chǔ)過(guò)程,MYSQL會(huì)檢查你對(duì)存儲(chǔ)過(guò)程是否有執(zhí)行權(quán)限等。
MYSQL到底都有哪些權(quán)限呢?從官網(wǎng)復(fù)制一個(gè)表來(lái)看看:
權(quán)限 |
權(quán)限級(jí)別 |
權(quán)限說(shuō)明 |
CREATE |
數(shù)據(jù)庫(kù)、表或索引 |
創(chuàng)建數(shù)據(jù)庫(kù)、表或索引權(quán)限 |
DROP |
數(shù)據(jù)庫(kù)或表 |
刪除數(shù)據(jù)庫(kù)或表權(quán)限 |
GRANT OPTION |
數(shù)據(jù)庫(kù)、表或保存的程序 |
賦予權(quán)限選項(xiàng) |
REFERENCES |
數(shù)據(jù)庫(kù)或表 |
? |
ALTER |
表 |
更改表,比如添加字段、索引等 |
DELETE |
表 |
刪除數(shù)據(jù)權(quán)限 |
INDEX |
表 |
索引權(quán)限 |
INSERT |
表 |
插入權(quán)限 |
SELECT |
表 |
查詢權(quán)限 |
UPDATE |
表 |
更新權(quán)限 |
CREATE VIEW |
視圖 |
創(chuàng)建視圖權(quán)限 |
SHOW VIEW |
視圖 |
查看視圖權(quán)限 |
ALTER ROUTINE |
存儲(chǔ)過(guò)程 |
更改存儲(chǔ)過(guò)程權(quán)限 |
CREATE ROUTINE |
存儲(chǔ)過(guò)程 |
創(chuàng)建存儲(chǔ)過(guò)程權(quán)限 |
EXECUTE |
存儲(chǔ)過(guò)程 |
執(zhí)行存儲(chǔ)過(guò)程權(quán)限 |
FILE |
服務(wù)器主機(jī)上的文件訪問(wèn) |
文件訪問(wèn)權(quán)限 |
CREATE TEMPORARY TABLES |
服務(wù)器管理 |
創(chuàng)建臨時(shí)表權(quán)限 |
LOCK TABLES |
服務(wù)器管理 |
鎖表權(quán)限 |
CREATE USER |
服務(wù)器管理 |
創(chuàng)建用戶權(quán)限 |
PROCESS |
服務(wù)器管理 |
查看進(jìn)程權(quán)限 |
RELOAD |
? ? 服務(wù)器管理 |
執(zhí)行flush-hosts, flush-logs, flush-privileges, flush-status, flush-tables, flush-threads, refresh, reload等命令的權(quán)限 |
REPLICATION CLIENT |
服務(wù)器管理 |
復(fù)制權(quán)限 |
REPLICATION SLAVE |
服務(wù)器管理 |
復(fù)制權(quán)限 |
SHOW DATABASES |
服務(wù)器管理 |
查看數(shù)據(jù)庫(kù)權(quán)限 |
SHUTDOWN |
服務(wù)器管理 |
關(guān)閉數(shù)據(jù)庫(kù)權(quán)限 |
SUPER |
服務(wù)器管理 |
執(zhí)行kill線程權(quán)限 |
?
MYSQL的權(quán)限如何分布,就是針對(duì)表可以設(shè)置什么權(quán)限,針對(duì)列可以設(shè)置什么權(quán)限等等,這個(gè)可以從官方文檔中的一個(gè)表來(lái)說(shuō)明:
權(quán)限分布 |
可能的設(shè)置的權(quán)限 |
表權(quán)限 |
'Select', 'Insert', 'Update', 'Delete', 'Create', 'Drop', 'Grant', 'References', 'Index', 'Alter' |
列權(quán)限 |
'Select', 'Insert', 'Update', 'References' |
過(guò)程權(quán)限 |
'Execute', 'Alter Routine', 'Grant' |
針對(duì)權(quán)限這部分,最主要的是要知道MYSQL是如何驗(yàn)證的(兩階段驗(yàn)證),以及mysql各個(gè)權(quán)限是做什么用的,以及那些權(quán)限用在什么地方(表or列?)。如果這些把握了那么MYSQL權(quán)限對(duì)你來(lái)說(shuō)就是小菜一碟了,只要看一下后面的權(quán)限管理就可以融會(huì)貫通了。
????????
二、MYSQL權(quán)限經(jīng)驗(yàn)原則
權(quán)限控制主要是出于安全因素,因此需要遵循一下幾個(gè)經(jīng)驗(yàn)原則:
1.??只授予能滿足需要的最小權(quán)限,防止用戶干壞事。哈哈。比如用戶只是需要查詢,那就只給select權(quán)限就可以了,不要給用戶賦予update、insert或者delete權(quán)限。
2.??創(chuàng)建用戶的時(shí)候限制用戶的登錄主機(jī),一般是限制成指定IP或者內(nèi)網(wǎng)IP段。
3.??初始化數(shù)據(jù)庫(kù)的時(shí)候刪除沒(méi)有密碼的用戶。安裝完數(shù)據(jù)庫(kù)的時(shí)候會(huì)自動(dòng)創(chuàng)建一些用戶,這些用戶默認(rèn)沒(méi)有密碼。
4.??為每個(gè)用戶設(shè)置滿足密碼復(fù)雜度的密碼。
5.??定期清理不需要的用戶?;厥諜?quán)限或者刪除用戶。
?
三、MYSQL權(quán)限實(shí)戰(zhàn)
1.??GRANT命令使用說(shuō)明
先來(lái)看一個(gè)例子,創(chuàng)建一個(gè)只允許從本地登錄的超級(jí)用戶feihong,并允許將權(quán)限賦予別的用戶,密碼為test@feihong.111
GRANT ALL PRIVILEGES ON *.* TO feihong@'localhost' IDENTIFIED BY 'test@feihong.111' WITH GRANT OPTION;
GRANT命令說(shuō)明:
ALL PRIVILEGES?是表示所有權(quán)限,你也可以使用select、update等權(quán)限提到的權(quán)限。
ON?用來(lái)指定權(quán)限針對(duì)哪些庫(kù)和表。
*.*?中前面的*號(hào)用來(lái)指定數(shù)據(jù)庫(kù)名,后面的*號(hào)用來(lái)指定表名。
TO?表示將權(quán)限賦予某個(gè)用戶。
feihong@'localhost'?表示feihong用戶,@后面接限制的主機(jī),可以是IP、IP段、域名以及%,%表示任何地方。注意:這里%有的版本不包括本地,以前碰到過(guò)給某個(gè)用戶設(shè)置了%允許任何地方登錄,但是在本地登錄不了,這個(gè)和版本有關(guān)系,遇到這個(gè)問(wèn)題再加一個(gè)localhost的用戶就可以了。
IDENTIFIED BY?指定用戶的登錄密碼。
WITH GRANT OPTION?這個(gè)選項(xiàng)表示該用戶可以將自己擁有的權(quán)限授權(quán)給別人。注意:經(jīng)常有人在創(chuàng)建操作用戶的時(shí)候不指定WITH GRANT OPTION選項(xiàng)導(dǎo)致后來(lái)該用戶不能使用GRANT命令創(chuàng)建用戶或者給其他用戶授權(quán)。
備注:可以使用GRANT重復(fù)給用戶添加權(quán)限,權(quán)限疊加,比如你先給用戶添加了一個(gè)select權(quán)限,然后又給用戶添加了一個(gè)insert權(quán)限,那么該用戶就同時(shí)擁有了select和insert權(quán)限。
2.??創(chuàng)建一個(gè)超級(jí)用戶
創(chuàng)建一個(gè)只允許從本地登錄的超級(jí)用戶feihong,并允許將權(quán)限賦予別的用戶,密碼為test@feihong.111
GRANT ALL PRIVILEGES ON *.* TO feihong@'localhost' IDENTIFIED BY 'test@feihong.111' WITH GRANT OPTION;
3.???創(chuàng)建一個(gè)網(wǎng)站用戶(程序用戶)
創(chuàng)建一個(gè)一般的程序用戶,這個(gè)用戶可能只需要SELECT, INSERT, UPDATE, DELETE, CREATE TEMPORARY TABLES等權(quán)限如果有存儲(chǔ)過(guò)程還需要加上EXECUTE權(quán)限,一般是指定內(nèi)網(wǎng)網(wǎng)段192.168.100網(wǎng)段。
GRANT??USAGE,SELECT, INSERT, UPDATE, DELETE, SHOW VIEW ,CREATE TEMPORARY TABLES,EXECUTE ON `test`.* TO webuser@'192.168.100.%' IDENTIFIED BY??'test@feihong.111';
4.??創(chuàng)建一個(gè)普通用戶(僅有查詢權(quán)限)
GRANT USAGE,SELECT ON `test`.* TO public@'192.168.100.%' IDENTIFIED BY??'public@feihong.111';
5.??刷新權(quán)限
使用這個(gè)命令使權(quán)限生效,尤其是你對(duì)那些權(quán)限表user、db、host等做了update或者delete更新的時(shí)候。以前遇到過(guò)使用grant后權(quán)限沒(méi)有更新的情況,大家可以養(yǎng)成習(xí)慣,只要對(duì)權(quán)限做了更改就使用FLUSH PRIVILEGES命令來(lái)刷新權(quán)限。
FLUSH PRIVILEGES;
6.??查看權(quán)限
使用如下命令可以方便的查看到某個(gè)用戶的權(quán)限:
SHOW GRANTS FOR 'webuser'@'192.168.100.%';
7.??回收權(quán)限
將前面創(chuàng)建的webuser用戶的DELETE權(quán)限回收,使用如下命令
REVOKE DELETE ON test.* FROM 'webuser'@'192.168.100.%';
8.??刪除用戶
注意刪除用戶不要使用DELETE直接刪除,因?yàn)槭褂肈ELETE刪除后用戶的權(quán)限并未刪除,新建同名用戶后又會(huì)繼承以前的權(quán)限。正確的做法是使用DROP USER命令刪除用戶,比如要?jiǎng)h除'webuser'@'192.168.100.%'用戶采用如下命令:
DROP USER 'webuser'@'192.168.100.%';
????????
大家可以采用percona-toolkit工具中的pt-show-grants工具來(lái)輔助管理mysql權(quán)限。具體使用見(jiàn)博文http://blog.chinaunix.net/uid-20639775-id-3207926.html
下面是http://zhidao.baidu.com/link?url=jivv0yTsgYfrAbvXs6EiLhg5pGgttEgY28eJn-PRfXzmhcjP-SkHUmNM-OTcAujSWHkof9HkszMVmCrbU0f4I_對(duì)usage的解釋
官方對(duì)usage的解釋: USAGE “無(wú)權(quán)限”的同義詞 當(dāng)您想要?jiǎng)?chuàng)建一個(gè)沒(méi)有權(quán)限的用戶時(shí),可以指定USAGE。 要看自己有哪些權(quán)限,執(zhí)行SQL: SHOW GRANTS 在我的數(shù)據(jù)庫(kù)下有一下幾行: GRANT ALL PRIVILEGES ON `everalan`.* TO 'everalan'@'%' WITH GRANT OPTION 可以看出,不知USAGE一種權(quán)限,所以,你才會(huì)正常的執(zhí)行查刪等操作 usage的字面意思就是用法,其實(shí)就是讓你這個(gè)用戶可以像個(gè)用戶似的登錄,但是除了能看到有那寫(xiě)數(shù)據(jù)庫(kù)外,什么權(quán)限也沒(méi)有

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

1. The first choice for the Laravel MySQL Vue/React combination in the PHP development question and answer community is the first choice for Laravel MySQL Vue/React combination, due to its maturity in the ecosystem and high development efficiency; 2. High performance requires dependence on cache (Redis), database optimization, CDN and asynchronous queues; 3. Security must be done with input filtering, CSRF protection, HTTPS, password encryption and permission control; 4. Money optional advertising, member subscription, rewards, commissions, knowledge payment and other models, the core is to match community tone and user needs.

There are three ways to connect Excel to MySQL database: 1. Use PowerQuery: After installing the MySQLODBC driver, establish connections and import data through Excel's built-in PowerQuery function, and support timed refresh; 2. Use MySQLforExcel plug-in: The official plug-in provides a friendly interface, supports two-way synchronization and table import back to MySQL, and pay attention to version compatibility; 3. Use VBA ADO programming: suitable for advanced users, and achieve flexible connections and queries by writing macro code. Choose the appropriate method according to your needs and technical level. PowerQuery or MySQLforExcel is recommended for daily use, and VBA is better for automated processing.

To achieve MySQL deployment automation, the key is to use Terraform to define resources, Ansible management configuration, Git for version control, and strengthen security and permission management. 1. Use Terraform to define MySQL instances, such as the version, type, access control and other resource attributes of AWSRDS; 2. Use AnsiblePlaybook to realize detailed configurations such as database user creation, permission settings, etc.; 3. All configuration files are included in Git management, support change tracking and collaborative development; 4. Avoid hard-coded sensitive information, use Vault or AnsibleVault to manage passwords, and set access control and minimum permission principles.

There are three main ways to set environment variables in PHP: 1. Global configuration through php.ini; 2. Passed through a web server (such as SetEnv of Apache or fastcgi_param of Nginx); 3. Use putenv() function in PHP scripts. Among them, php.ini is suitable for global and infrequently changing configurations, web server configuration is suitable for scenarios that need to be isolated, and putenv() is suitable for temporary variables. Persistence policies include configuration files (such as php.ini or web server configuration), .env files are loaded with dotenv library, and dynamic injection of variables in CI/CD processes. Security management sensitive information should be avoided hard-coded, and it is recommended to use.en

To collect user behavior data, you need to record browsing, search, purchase and other information into the database through PHP, and clean and analyze it to explore interest preferences; 2. The selection of recommendation algorithms should be determined based on data characteristics: based on content, collaborative filtering, rules or mixed recommendations; 3. Collaborative filtering can be implemented in PHP to calculate user cosine similarity, select K nearest neighbors, weighted prediction scores and recommend high-scoring products; 4. Performance evaluation uses accuracy, recall, F1 value and CTR, conversion rate and verify the effect through A/B tests; 5. Cold start problems can be alleviated through product attributes, user registration information, popular recommendations and expert evaluations; 6. Performance optimization methods include cached recommendation results, asynchronous processing, distributed computing and SQL query optimization, thereby improving recommendation efficiency and user experience.

PHP plays the role of connector and brain center in intelligent customer service, responsible for connecting front-end input, database storage and external AI services; 2. When implementing it, it is necessary to build a multi-layer architecture: the front-end receives user messages, the PHP back-end preprocesses and routes requests, first matches the local knowledge base, and misses, call external AI services such as OpenAI or Dialogflow to obtain intelligent reply; 3. Session management is written to MySQL and other databases by PHP to ensure context continuity; 4. Integrated AI services need to use Guzzle to send HTTP requests, safely store APIKeys, and do a good job of error handling and response analysis; 5. Database design must include sessions, messages, knowledge bases, and user tables, reasonably build indexes, ensure security and performance, and support robot memory

To enable PHP containers to support automatic construction, the core lies in configuring the continuous integration (CI) process. 1. Use Dockerfile to define the PHP environment, including basic image, extension installation, dependency management and permission settings; 2. Configure CI/CD tools such as GitLabCI, and define the build, test and deployment stages through the .gitlab-ci.yml file to achieve automatic construction, testing and deployment; 3. Integrate test frameworks such as PHPUnit to ensure that tests are automatically run after code changes; 4. Use automated deployment strategies such as Kubernetes to define deployment configuration through the deployment.yaml file; 5. Optimize Dockerfile and adopt multi-stage construction

To recycle MySQL user permissions using REVOKE, you need to specify the permission type, database, and user by format. 1. Use REVOKEALLPRIVILEGES, GRANTOPTIONFROM'username'@'hostname'; 2. Use REVOKEALLPRIVILEGESONmydb.FROM'username'@'hostname'; 3. Use REVOKEALLPRIVILEGESONmydb.FROM'username'@'hostname'; 3. Use REVOKE permission type ON.*FROM'username'@'hostname'; Note that after execution, it is recommended to refresh the permissions. The scope of the permissions must be consistent with the authorization time, and non-existent permissions cannot be recycled.
