MySQL 8.4 Release Notes
连接到 MySQL 服务器的客户端所需的凭证可以包括密码。本节介绍如何为 MySQL 账户分配密码。Required credentials for clients that connect to the MySQL server can include a password. This section describes how to assign passwords for MySQL accounts.
MySQL 将凭证存储在 mysql 系统数据库中的 user 表中。只有拥有 CREATE USER 权限的用户，或者拥有 mysql 数据库权限的用户（创建新账户需 INSERT 权限，修改现有账户需 UPDATE 权限）才能执行分配或修改密码的操作。如果启用了 read_only 系统变量，使用 CREATE USER 或 ALTER USER 等账户修改语句，还需要额外拥有 CONNECTION_ADMIN 权限（或已弃用的 SUPER 权限）。MySQL stores credentials in the user table in
the mysql system database. Operations that
assign or modify passwords are permitted only to users with the
CREATE USER privilege, or,
alternatively, privileges for the mysql
database (INSERT privilege to
create new accounts, UPDATE
privilege to modify existing accounts). If the
read_only system variable is
enabled, use of account-modification statements such as
CREATE USER or
ALTER USER additionally requires
the CONNECTION_ADMIN privilege (or
the deprecated SUPER privilege).
这里的讨论仅总结了最常见的密码分配语句的语法。有关其他可能性的完整细节，请参见第 15.7.1.3 节，“CREATE USER 语句”、第 15.7.1.1 节，“ALTER USER 语句”，以及第 15.7.1.10 节，“SET PASSWORD 语句”。The discussion here summarizes syntax only for the most common password-assignment statements. For complete details on other possibilities, see Section 15.7.1.3, “CREATE USER Statement”, Section 15.7.1.1, “ALTER USER Statement”, and Section 15.7.1.10, “SET PASSWORD Statement”.
MySQL 使用插件来执行客户端身份验证；参见 第 8.2.17 节，“可插拔身份验证”。在分配密码的语句中，与帐户关联的身份验证插件会对指定的明文密码执行所需的任何哈希操作。这使 MySQL 能够在将密码存储到 mysql.user 系统表之前对其进行混淆。对于此处描述的语句，MySQL 会自动对指定的密码进行哈希。还有 CREATE
USER 和 ALTER USER 的语法允许直接指定哈希值。有关详细信息，请参阅这些语句的描述。MySQL uses plugins to perform client authentication; see
Section 8.2.17, “Pluggable Authentication”. In password-assigning
statements, the authentication plugin associated with an account
performs any hashing required of a cleartext password specified.
This enables MySQL to obfuscate passwords prior to storing them in
the mysql.user system table. For the statements
described here, MySQL automatically hashes the password specified.
There are also syntax for CREATE
USER and ALTER USER that
permits hashed values to be specified literally. For details, see
the descriptions of those statements.
要在创建新账户时分配密码，请使用 CREATE USER 并包含 IDENTIFIED BY 子句：To assign a password when you create a new account, use
CREATE USER and include an
IDENTIFIED BY clause:
CREATE USER 'jeffrey'@'localhost' IDENTIFIED BY 'password';
CREATE USER 还支持指定账户身份验证插件的语法。请参见 第 15.7.1.3 节，“CREATE USER 语句”。CREATE USER also supports syntax
for specifying the account authentication plugin. See
Section 15.7.1.3, “CREATE USER Statement”.
要为现有账户分配或更改密码，请使用带有 IDENTIFIED BY 子句的 ALTER USER 语句：To assign or change a password for an existing account, use the
ALTER USER statement with an
IDENTIFIED BY clause:
ALTER USER 'jeffrey'@'localhost' IDENTIFIED BY 'password';
如果你没有以匿名用户身份连接，你可以在不明确写出自己账户名称的情况下更改自己的密码：If you are not connected as an anonymous user, you can change your own password without naming your own account literally:
ALTER USER USER() IDENTIFIED BY 'password';
要从命令行更改账户密码，请使用 mysqladmin 命令：To change an account password from the command line, use the mysqladmin command:
mysqladmin -uuser_name-hhost_namepassword "password"
此命令设置密码的账户，是指在 mysql.user 系统表中，有一行其 User 列与 user_name 匹配，并且 Host 列为你 连接的客户端。The account for which this command sets the password is the one
with a row in the mysql.user system table that
matches user_name in the
User column and the client host from
which you connect in the Host
column.
Warning
使用 mysqladmin 设置密码应被认为是 不安全的。在某些系统上，您的密码可能会被系统状态程序（如 ps）看到，这些程序可能会被其他用户调用以显示命令行。MySQL 客户端通常在初始化过程中将命令行密码参数覆盖为零。然而，仍然存在一个短暂的时间间隔，在此期间密码值是可见的。此外，在某些系统上，这种覆盖策略无效，密码仍然对 ps 可见。（SystemV Unix 系统以及可能的其他系统都存在此问题。）Setting a password using mysqladmin should be considered insecure. On some systems, your password becomes visible to system status programs such as ps that may be invoked by other users to display command lines. MySQL clients typically overwrite the command-line password argument with zeros during their initialization sequence. However, there is still a brief interval during which the value is visible. Also, on some systems this overwriting strategy is ineffective and the password remains visible to ps. (SystemV Unix systems and perhaps others are subject to this problem.)
如果您使用 MySQL 复制，请注意，副本在 CHANGE REPLICATION
SOURCE TO 中使用的密码实际上长度限制为 32 个字符；如果密码更长，超出的字符将被截断。这并不是 MySQL 服务器通常施加的限制，而是 MySQL 复制特有的问题。If you are using MySQL Replication, be aware that a password used
by a replica as part of CHANGE REPLICATION
SOURCE TO is effectively limited to 32 characters in
length; if the password is longer, any excess characters are
truncated. This is not due to any limit imposed by MySQL Server
generally, but rather is an issue specific to MySQL Replication.