最好的起点是 第 8 章，安全。The best place to start is Chapter 8, Security.

关于特定安全问题，你可能会发现 MySQL 文档的其他部分也很有用，包括以下内容：Other portions of the MySQL Documentation which you may find useful with regard to specific security concerns include the following:

还有安全部署指南，提供了部署 MySQL 企业版服务器通用二进制分发版的程序，并包含管理 MySQL 安装安全性的功能。There is also the Secure Deployment Guide, which provides procedures for deploying a generic binary distribution of MySQL Enterprise Edition Server with features for managing the security of your MySQL installation.

截至 MySQL 8.0，默认认证插件是 caching_sha2_password。有关此插件的信息，请参见第 8.4.1.2 节，“Caching SHA-2 可插拔认证”。The default authentication plugin as of MySQL 8.0 is caching_sha2_password. For information about this plugin, see Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”.

caching_sha2_password 插件提供比已弃用的 mysql_native_password 插件（MySQL 8.0 之前版本的默认插件）更安全的密码加密。有关更改默认插件对服务器操作以及服务器与客户端和连接器兼容性的影响的信息，请参阅 将 caching_sha2_password 设为首选认证插件。The caching_sha2_password plugin provides more secure password encryption than the deprecated mysql_native_password plugin (the default plugin in MySQL versions before MySQL 8.0). For information about the implications of this change of default plugin for server operation and compatibility of the server with clients and connectors, see caching_sha2_password as the Preferred Authentication Plugin.

有关可插入认证和其他可用认证插件的一般信息，请参见第 8.2.17 节，“可插入认证”，以及第 8.4.1 节，“认证插件”。For general information about pluggable authentication and other available authentication plugins, see Section 8.2.17, “Pluggable Authentication”, and Section 8.4.1, “Authentication Plugins”.

是的，二进制文件支持客户端和服务器之间的 SSL 连接。参见第 8.3 节，“使用加密连接”。Yes, the binaries have support for SSL connections between the client and server. See Section 8.3, “Using Encrypted Connections”.

如果客户端应用程序不支持 SSL 连接，例如，你也可以使用 SSH 隧道连接。有关示例，请参见 第 8.3.4 节，“通过 SSH 从 Windows 远程连接 MySQL”。You can also tunnel a connection using SSH, if (for example) the client application does not support SSL connections. For an example, see Section 8.3.4, “Connecting to MySQL Remotely from Windows with SSH”.

是的，这些二进制文件已启用 SSL，用于安全、经过身份验证或两者兼备的客户端/服务器连接。请参见 第 8.3 节，“使用加密连接”。Yes, the binaries have SSL enabled for client/server connections that are secured, authenticated, or both. See Section 8.3, “Using Encrypted Connections”.

企业版包括一个 PAM 认证插件，支持针对 LDAP 目录的认证。The Enterprise edition includes a PAM Authentication Plugin that supports authentication against an LDAP directory.

目前不支持。Not at this time.

自 MySQL 8.0.28 起，已移除对 TLSv1 和 TLSv1.1 连接协议的支持。这些协议从 MySQL 8.0.26 开始已被弃用。有关移除的后果，请参阅 移除对 TLSv1 和 TLSv1.1 协议的支持。Support for the TLSv1 and TLSv1.1 connection protocols is removed as of MySQL 8.0.28. The protocols were deprecated from MySQL 8.0.26. For the consequences of that removal, see Removal of Support for the TLSv1 and TLSv1.1 Protocols.

由于 TLS 1.0 和 1.1 协议版本较旧，分别于 1996 年和 2006 年发布，其支持已被移除。这些版本使用的算法既弱又过时。Support for TLS versions 1.0 and 1.1 is removed because those protocol versions are old, released in 1996 and 2006, respectively. The algorithms used are weak and outdated.

除非您使用的是非常旧版本的 MySQL Server 或连接器，否则您的连接不太可能使用 TLS 1.0 或 1.1。MySQL 连接器和客户端默认会选择可用的最高 TLS 版本。Unless you are using very old versions of MySQL Server or connectors, you are unlikely to have connections using TLS 1.0 or 1.1. MySQL connectors and clients select the highest TLS version available by default.

MySQL Server 何时增加对 TLS 1.2 的支持？ 当 MySQL 社区服务器在 2019 年切换到 MySQL 5.6、5.7 和 8.0 的 OpenSSL 时，MySQL Community Server 增加了对 TLS 1.2 的支持。对于 MySQL Enterprise Edition，OpenSSL 在 2015 年即 MySQL Server 5.7.10 中增加了对 TLS 1.2 的支持。When was support for TLS 1.2 added to MySQL Server? MySQL Community Server added TLS 1.2 support when the community server switched to OpenSSL for MySQL 5.6, 5.7, and 8.0 in 2019. For MySQL Enterprise Edition, OpenSSL added TLS 1.2 support in 2015, in MySQL Server 5.7.10.

如何查看哪些 TLS 版本正在使用中？ 对于 MySQL 5.7 或 8.0，可以通过运行此查询来检查是否使用 TLS 1.0 或 1.1：How can one view which TLS versions are in active use? For MySQL 5.7 or 8.0, review whether TLS 1.0 or 1.1 is in use by running this query:

        
SELECT
  `session_ssl_status`.`thread_id`, `session_ssl_status`.`ssl_version`,
  `session_ssl_status`.`ssl_cipher`, `session_ssl_status`.`ssl_sessions_reused`
FROM `sys`.`session_ssl_status` 
WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2');

如果列出了使用 TLSv1.0 或 TLSv1.1 的线程，您可以通过运行此查询来确定该连接的来源：If a thread using TLSv1.0 or TLSv1.1 is listed, you can determine where this connection is coming from by running this query:

        
SELECT thd_id,conn_id, user, db, current_statement, program_name 
FROM sys.processlist
WHERE thd_id IN (
                  SELECT `session_ssl_status`.`thread_id`
                  FROM `sys`.`session_ssl_status` 
                  WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2')
                );

或者，您可以运行此查询：Alternatively, you can run this query:

SELECT * 
FROM sys.session 
WHERE thd_id IN (
                  SELECT `session_ssl_status`.`thread_id`
                  FROM `sys`.`session_ssl_status` 
                  WHERE ssl_version NOT IN ('TLSv1.3','TLSv1.2')
                );

这些查询提供了确定哪个应用程序不支持 TLS 1.2 或 1.3 所需的详细信息，并针对这些应用程序进行升级。These queries provide details needed to determine which application is not supporting TLS 1.2 or 1.3, and target upgrades for those.

还有其他测试 TLS 1.0 或 1.1 的选项吗？ 有，您可以在将服务器升级到新版本之前禁用这些版本。明确指定要使用的版本，可以在 mysql.cnf（或 mysql.ini）中，或使用 SET PERSIST，例如：--tls-version=TLSv12。Are there other options for testing for TLS 1.0 or 1.1? Yes, you can disable those versions prior to upgrading your server to a newer version. Explicitly specify which version to use, either in mysql.cnf (or mysql.ini) or by using SET PERSIST, for example: --tls-version=TLSv12.

所有 MySQL 连接器（5.7 和 8.0）都支持 TLS 1.2 及更高版本吗？使用 libmysql 的 C 和 C++ 应用程序呢？ 对于使用社区版 libmysqlclient 库的 C 和 C++ 应用程序，请使用基于 OpenSSL 的库（即 不要 使用 YaSSL）。OpenSSL 的使用在 2018 年统一（分别在 MySQL 8.0.4 和 5.7.28 中）。Connector/ODBC 和 Connector/C++ 也适用相同规则。要确定使用了什么库依赖项，可运行以下命令查看是否列出 OpenSSL。在 Linux 上，使用此命令：Do all MySQL Connectors (5.7 and 8.0) support TLS 1.2 and higher? What about C and C++ applications using libmysql? For C and C++ applications using the community libmysqlclient library, use an OpenSSL-based library (that is, do not use YaSSL). Usage of OpenSSL was unified in 2018 (in MySQL 8.0.4 and 5.7.28, respectively). The same applies for Connector/ODBC and Connector/C++. To determine what library dependencies are used, run the following commands to see if OpenSSL is listed. On Linux, use this command:

$> sudo ldd usr/local/mysql/lib/libmysqlclient.a | grep -i openssl

在 MacOS 上，使用此命令：On MacOS, use this command:

$> sudo otool -l /usr/local/mysql/lib/libmysqlclient.a | grep -i openssl

请查阅每个连接器的文档，但它们确实支持 TLS 1.2 和 TLS 1.3。Check the documentation for each connector, but they do support TLS 1.2 and TLS 1.3.