8.4 中文镜像

MySQL 8.4 参考手册 · 中文镜像

正文为中文,英文原文默认隐藏。点击任意中文段落即可展开 / 收起对应英文原文。

打开官方英文原文 ↗

译文由机器翻译生成,仅供理解参考;有疑问请以官方英文原文为准。

中文点击中文段落可显示 / 隐藏英文原文本页译文覆盖 100%

2.9.4 保护初始 MySQL 帐户2.9.4 Securing the Initial MySQL Account

MySQL 的安装过程涉及初始化数据目录,包括在mysql系统模式中的授权表,这些表定义了 MySQL 账户。有关详细信息,请参见第 2.9.1 节,“初始化数据目录”.The MySQL installation process involves initializing the data directory, including the grant tables in the mysql system schema that define MySQL accounts. For details, see Section 2.9.1, “Initializing the Data Directory”.

本节介绍如何为在 MySQL 安装过程中创建的初始 root 帐户分配密码(如果您尚未这样做)。This section describes how to assign a password to the initial root account created during the MySQL installation procedure, if you have not already done so.

Note

执行该过程的其他方法本节描述:Alternative means for performing the process described in this section:

在这些情况下,可能已为初始帐户分配了密码:A password may already be assigned to the initial account under these circumstances:

  • 在 Windows 上,使用 MSI 安装程序和 MySQL 配置器执行的安装可以让您选择分配密码。On Windows, installations performed using the MSI installer and MySQL Configurator give you the option of assigning a password.

  • 使用 macOS 进行安装安装程序会生成一个初始随机密码,安装程序会在对话框中向用户显示该密码。Installation using the macOS installer generates an initial random password, which the installer displays to the user in a dialog box.

  • 使用 RPM 软件包的安装会生成一个初始随机密码,该密码会写入服务器错误日志。Installation using RPM packages generates an initial random password, which is written to the server error log.

  • 使用 Debian 软件包的安装会提供分配密码的选项。Installations using Debian packages give you the option of assigning a password.

  • 对于使用 mysqld --initialize,mysqld 生成初始随机密码,将其标记为过期,并将其写入服务器错误日志。请参阅第 2.9.1 节“初始化数据目录”。For data directory initialization performed manually using mysqld --initialize, mysqld generates an initial random password, marks it expired, and writes it to the server error log. See Section 2.9.1, “Initializing the Data Directory”.

mysql.user 授权表定义初始 MySQL 用户帐户及其访问权限。 MySQL 的安装仅创建一个拥有所有权限并可以执行任何操作的 'root'@'localhost' 超级用户帐户。如果 root 帐户的密码为空,则您的 MySQL 安装不受保护:任何人都可以以 root 身份无需密码连接到 MySQL 服务器,并被授予所有权限。The mysql.user grant table defines the initial MySQL user account and its access privileges. Installation of MySQL creates only a 'root'@'localhost' superuser account that has all privileges and can do anything. If the root account has an empty password, your MySQL installation is unprotected: Anyone can connect to the MySQL server as root without a password and be granted all privileges.

'root'@'localhost' 帐户在 mysql.proxies_priv 表,用于为 ''@''(即所有用户和所有主机)授予 PROXY 权限。这使得 root 能够设置代理用户,以及将设置代理用户的权限委托给其他帐户。请参阅第 8.2.19 节“代理用户”。The 'root'@'localhost' account also has a row in the mysql.proxies_priv table that enables granting the PROXY privilege for ''@'', that is, for all users and all hosts. This enables root to set up proxy users, as well as to delegate to other accounts the authority to set up proxy users. See Section 8.2.19, “Proxy Users”.

要为初始 MySQL root 帐户分配密码,请使用以下过程。将示例中的 root-password 替换为您要使用的密码。To assign a password for the initial MySQL root account, use the following procedure. Replace root-password in the examples with the password that you want to use.

如果服务器未运行,则启动服务器。有关说明,请参阅第 2.9.2 节“启动服务器”。Start the server if it is not running. For instructions, see Section 2.9.2, “Starting the Server”.

初始root 帐户可能有密码,也可能没有密码。选择以下适用的过程:The initial root account may or may not have a password. Choose whichever of the following procedures applies:

  • 如果 root 帐户的初始随机密码已过期,请使用该密码以 root 身份连接到服务器,然后选择一个新密码。如果使用 mysqld --initialize 手动或使用在安装操作期间不提供指定密码选项的安装程序初始化数据目录,就会出现这种情况。由于密码存在,您必须使用它来连接到服务器。但由于密码已过期,除了选择新密码外,您无法将该帐户用于任何目的,除非您选择了一个。If the root account exists with an initial random password that has been expired, connect to the server as root using that password, then choose a new password. This is the case if the data directory was initialized using mysqld --initialize, either manually or using an installer that does not give you the option of specifying a password during the install operation. Because the password exists, you must use it to connect to the server. But because the password is expired, you cannot use the account for any purpose other than to choose a new password, until you do choose one.

    1. 如果您不知道初始随机密码,请查看服务器错误日志。If you do not know the initial random password, look in the server error log.

    2. 使用密码以 root 身份连接到服务器:Connect to the server as root using the password:

      $> mysql -u root -p
      Enter password: (enter the random root password here)
      
    3. 选择一个新密码来替换随机密码:Choose a new password to replace the random password:

      mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'root-password';
      
  • 如果 root 帐户存在但没有密码,请以 root 身份不使用密码连接到服务器,然后分配密码。如果您使用 mysqld --initialize-insecure 初始化数据目录,就会出现这种情况。If the root account exists but has no password, connect to the server as root using no password, then assign a password. This is the case if you initialized the data directory using mysqld --initialize-insecure.

    1. 不使用密码以 root 身份连接到服务器:Connect to the server as root using no password:

      $> mysql -u root --skip-password
      
    2. 分配密码:Assign a password:

      mysql> ALTER USER 'root'@'localhost' IDENTIFIED BY 'root-password';
      

之后为 root 帐户分配密码后,每当使用该帐户连接到服务器时都必须提供该密码。例如,要使用 mysql 客户端连接到服务器,请使用以下命令:After assigning the root account a password, you must supply that password whenever you connect to the server using the account. For example, to connect to the server using the mysql client, use this command:

$> mysql -u root -p
Enter password: (enter root password here)

要使用 mysqladmin,使用以下命令:To shut down the server with mysqladmin, use this command:

$> mysqladmin -u root -p shutdown
Enter password: (enter root password here)
Note

有关设置密码的更多信息,请参阅第 8.2.14 节“分配帐户密码”。如果您在设置后忘记了 root 密码,请参阅第 B.3.3.2 节“如何重置 Root 密码”。For additional information about setting passwords, see Section 8.2.14, “Assigning Account Passwords”. If you forget your root password after setting it, see Section B.3.3.2, “How to Reset the Root Password”.

要设置其他帐户,请参阅第 8.2.8 节“添加帐户、分配权限和删除帐户”。To set up additional accounts, see Section 8.2.8, “Adding Accounts, Assigning Privileges, and Dropping Accounts”.