`
LJ你是唯一LT
  • 浏览: 243343 次
社区版块
存档分类
最新评论

mysql权限管理(实例)

阅读更多
mysql权限管理实例

本文并没有很详细的介绍对具体的对象授权,只是简单的限制了大的权限。

1.目前现状:
研发一直使用root用户进行操作。不变修改代码,因此我们采用新建一个超级用户,回收root的部分权限来实现对研发用户的限制

mysql> select user,host from user;
+-----------+---------------+
| user      | host          |
+-----------+---------------+
| mydba     | %             |  ---我新建的超级用户
| root      | %             |  ---安装就自带
| server    | %             |  ---无用用户
| repli     | 192.168.1.3   |  ---我创建的主从复制的用户
| root      | 192.168.1.9   |  ---无用用户
| mysql.sys | localhost     | 
| root      | localhost     |  ---安装就自带
+-----------+---------------+
7 rows in set (0.00 sec)


回收前,先用root进入,创建一个超级用户:
grant all privileges on *.* to mydba@'%' identified by 'tina' with grant option;
grant all privileges on mysql.* to mydba@'%' identified by 'tina' with grant option;


2.删除无用的用户:(上班时先回收所有权限,下班后再删除)
mysql> use mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

mysql> show grants for server;
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for server@%                                                                                                                                                                                                                                                                                                     |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, SUPER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER ON *.* TO 'server'@'%' WITH GRANT OPTION |
| GRANT ALL PRIVILEGES ON `mysql`.* TO 'server'@'%' WITH GRANT OPTION  

mysql> revoke all privileges on *.* from 'server'@'%';
Query OK, 0 rows affected (0.07 sec)

mysql> show grants for server;
+---------------------------------------------------------------------+
| Grants for server@%                                                 |
+---------------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'server'@'%' WITH GRANT OPTION                |
| GRANT ALL PRIVILEGES ON `mysql`.* TO 'server'@'%' WITH GRANT OPTION |
+---------------------------------------------------------------------+
2 rows in set (0.00 sec)

mysql> revoke all privileges on mysql.* from 'server'@'%';    ---操作会同步到从库,因此不需要到从库执行,因为主从同步的库包括mysql库
Query OK, 0 rows affected (0.10 sec)

mysql> show grants for server;
+------------------------------------------------------------+
| Grants for server@%                                        |
+------------------------------------------------------------+
| GRANT USAGE ON *.* TO 'server'@'%' WITH GRANT OPTION       |
| GRANT USAGE ON `mysql`.* TO 'server'@'%' WITH GRANT OPTION |
+------------------------------------------------------------+
2 rows in set (0.00 sec)

删除:delete from mysql.user where user='server' and host='%';
      delete from mysql.user where user='root' and host='192.168.1.9';

3.主从复制用户权限
mysql> show grants for repli@'192.168.1.3';
+--------------------------------------------------------------------------------+
| Grants for repli@192.168.1.3                                                   |
+--------------------------------------------------------------------------------+
| GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repli'@'192.168.1.3'    |             --repli因为是用于主从复制的,因此需要这两个权限。
+--------------------------------------------------------------------------------+
1 row in set (0.01 sec)



4.回收root用户的file,process,super,drop,create 权限,依然可以创建、删除临时表

原始权限:
--------------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@%                                                                                                                                                                                                                                                                                                                                                 |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE ON *.* TO 'root'@'%' WITH GRANT OPTION |
| GRANT ALL PRIVILEGES ON `mysql`.* TO 'root'@'%' WITH GRANT OPTION                                                                                                                                                                                                                                                                                                 |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

| Grants for root@localhost                                                                                                                                                                                                                                                                                                                                                 |
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, RELOAD, SHUTDOWN, PROCESS, FILE, REFERENCES, INDEX, ALTER, SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, REPLICATION SLAVE, REPLICATION CLIENT, CREATE VIEW, SHOW VIEW, CREATE ROUTINE, ALTER ROUTINE, CREATE USER, EVENT, TRIGGER, CREATE TABLESPACE ON *.* TO 'root'@'localhost' WITH GRANT OPTION |
| GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION             

回收了root远程主机的部分权限:(process权限保留了,因为要用来监控主从同步状态)
revoke file,process,super,drop,create,create view,reload, shutdown,index, alter, replication slave, replication client, create view,create routine,
alter routine, create user,create tablespace on *.* from 'root'@'%';

回收本地root对mysql库的所有权限:
revoke all privileges on mysql.* from 'root'@'localhost'; 

测试一下:
mysql> select * from t1 into outfile '/tmp/a.txt' fields terminated by ',';
ERROR 1045 (28000): Access denied for user 'root'@'%' (using password: YES)    --load的权限被禁用了

mysql> create view v_2 as select id from t2 where id<5;
ERROR 1142 (42000): CREATE VIEW command denied to user 'root'@'192.168.1.4' for table 'v_2';  ---不能创建视图

mysql> create index i_2 on t2(id);
ERROR 1142 (42000): INDEX command denied to user 'root'@'192.168.1.4' for table 't2'  --不能创建索引

mysql> show index from t1;          --可以查看索引
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
| Table | Non_unique | Key_name | Seq_in_index | Column_name | Collation | Cardinality | Sub_part | Packed | Null | Index_type | Comment | Index_comment |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
| t1    |          1 | i_1      |            1 | id          | A         |           0 |     NULL | NULL   | YES  | BTREE      |         |               |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
1 row in set (0.03 sec)

6.刷新权限
flush privileges;


7.回收后:
mysql> select user,host from user;
+-----------+---------------+
| user      | host          |
+-----------+---------------+
| mydba     | %             |
| root      | %             |
| repli     | 192.168.1.4 |
| mysql.sys | localhost     |
| root      | localhost     |
+-----------+---------------+
5 rows in set (0.00 sec)

mysql> show grants for root;
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@%                                                                                                                                                                 |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE, REFERENCES,process ,SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, SHOW VIEW, EVENT, TRIGGER ON *.* TO 'root'@'%' WITH GRANT OPTION |
| GRANT USAGE ON `mysql`.* TO 'root'@'%' WITH GRANT OPTION                                                                                                                          |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

mysql> show grants for root@'localhost';
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for root@localhost                                                                                                                                                                 |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE, REFERENCES,process, SHOW DATABASES, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, SHOW VIEW, EVENT, TRIGGER ON *.* TO 'root'@'localhost' WITH GRANT OPTION |
| GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION                                                                                                                              |
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (0.00 sec)

mysql> show grants for mydba; --超级用户:
+--------------------------------------------------------------------+
| Grants for mydba@%                                                 |
+--------------------------------------------------------------------+
| GRANT ALL PRIVILEGES ON *.* TO 'mydba'@'%' WITH GRANT OPTION       |
| GRANT ALL PRIVILEGES ON `mysql`.* TO 'mydba'@'%' WITH GRANT OPTION |
+--------------------------------------------------------------------+
2 rows in set (0.00 sec)


补充说明:
1.usage权限:可以连接db,可以show databases和tables,但是没有其他权限,select都不行
2.mysql的权限是会叠加的,如果第一次授予了这个用户select权限,第二次授予了全部权限,当你回收所有权限后,会发现还有select权限,必须逐条回收
分享到:
评论

相关推荐

    mysql5.7多实例部署

    5. 创建多实例过程:创建目录并授权→安装 MySQL→配置 MySQL 四、MySQL 5.7 多实例部署的注意事项 * 服务器操作系统:CentOS 6.5_x86_64 * MySQL 版本:mysql-5.7.10-linux-glibc2.5-x86_64.tar.gz * 安装目录...

    mysql8.0.11多实例安装

    3. **权限问题**:确保MySQL用户有足够的权限访问数据文件和日志文件所在的目录。 4. **启动失败**:查看MySQL的错误日志文件(如上述配置中的`/data/mysqldata/3307/mysql-error.log`),以获取更详细的错误信息。 ...

    mysql使用实例book-MySQL

    在《MySQL使用实例book》中,你会学习到如何安装和配置MySQL服务器,设置用户权限,以及创建和管理数据库。例如,创建一个新数据库的SQL命令是`CREATE DATABASE database_name;`,而创建表则使用`CREATE TABLE table...

    MySQL数据库基础实例教程(第2版)(微课版)-教学课件.zip

    MySQL数据库基础实例教程是针对初学者的一套系统性学习资源,尤其适合想要了解数据库管理和开发的人群。本教程分为多个章节,涵盖了从基础到进阶的各个关键领域,旨在通过实例教学来帮助学习者深入理解MySQL的核心...

    MYSQL连接数据库实例

    MySQL是世界上最受欢迎的关系型数据库管理系统之一,用于存储和管理数据。在本文中,我们将深入探讨如何连接到MySQL数据库,提供实例教程,以便更好地理解和实践。 首先,了解MySQL连接的基础知识至关重要。连接到...

    mysql多实例

    MySQL多实例是指在同一台服务器上运行多个独立的MySQL服务,每个服务都拥有自己的配置、数据文件和日志,可以独立管理。这样的设置在资源充足且需要隔离不同业务场景或者提高数据库服务可用性的环境中非常常见。以下...

    mysql多实例.docx

    在一台服务器上部署多个MySQL实例能够提高资源利用率,并且方便进行隔离管理和维护。以下将详细介绍如何在同一台虚拟机上配置MySQL数据库多实例。 ##### 1. 建立目录结构 为了清晰地区分各个实例,首先需要创建...

    php5+mysql网站开发实例精讲

    在本课程“php5+mysql网站开发实例精讲”中,我们将深入探讨如何利用PHP5和MySQL技术构建高效、安全的动态网站。这个教程旨在帮助初学者和中级开发者提升技能,通过实例学习来掌握这两项关键技术的结合使用。 首先...

    mysql多实例详细配置

    在IT领域,尤其是数据库管理中,**MySQL多实例配置**是一项高级而实用的技术,它允许在同一台服务器上运行多个独立的MySQL数据库实例,从而提高资源利用效率并满足不同的业务需求。以下是对这一技术的深入解析。 ##...

    mysql实例sql文件

    综上所述,`mysql实例sql文件`如`create.sql`和`populate.sql`是MySQL数据库管理的关键组成部分,它们帮助我们构建和维护数据库结构,填充数据,以及进行日常的数据操作。了解和熟练使用这些文件对于任何在IT行业...

    MySQL存储过程实例教程

    5. **安全机制强化:**系统管理员可控制存储过程的执行权限,进而限制数据访问,确保数据安全。 #### MySQL存储过程发展历程与应用 早期版本的MySQL(5.0前)并未支持存储过程,这一缺失限制了其在复杂应用领域的...

    php5+mysql网站开发实例精解.zip

    通过学习书中的实例,你可以掌握如何创建数据库、设计表结构、执行SQL语句以及管理数据库用户权限等基础知识。 在实际的网站开发中,PHP5和MySQL的结合使用通常涉及以下几个方面: 1. **网页动态生成**:PHP脚本...

    PHP5+MySQL网站开发实例精讲

    4. **安全性**:提供用户权限管理,确保数据安全。 5. **复制和分区**:支持数据库复制,实现数据冗余和故障恢复;分区功能可以提高查询效率。 在《PHP5+MySQL网站开发实例精讲》中,你可能会学到如何: 1. **创建...

    java+mysql权限管理系统

    【标题】:“java+mysql权限管理系统”是一种基于Java技术和MySQL数据库,结合了Spring、Struts和Hibernate(简称S2SH)三大框架构建的高效、实用的权限管理解决方案。这个系统设计的目标是为组织或企业提供安全、...

    Mysql 权限提权实例教程.doc

    Mysql权限提取实例教程, 利用mysql提权的前提就是,服务器安装了mysql,mysql的服务没有降权,(降权也可以提,没降权的话就最好了),是默认安装以系统权限继承的(system权限). 并且获得了root的账号密码

    mySql的一些实例

    4. **安全性**:MySQL提供了强大的安全机制,包括用户权限管理、数据加密等,能够有效保护数据的安全性和完整性。 5. **易于使用和管理**:MySQL拥有图形化管理工具,如phpMyAdmin,使得数据库的管理和操作变得直观...

    mysql经典教程带目录-实例教程

    MySQL数据库的管理和优化包括创建和撤销用户权限、备份和恢复数据、维护数据库性能。MySQL提供了一系列工具和命令行指令来执行这些任务,如GRANT、REVOKE用于管理权限,mysqldump用于备份,以及EXPLAIN分析查询性能...

Global site tag (gtag.js) - Google Analytics