此程序使您能够通过以下方式提高 MySQL 安装的安全性:This program enables you to improve the security of your MySQL installation in the following ways:
您可以为
root账户设置密码。You can set a password forrootaccounts.您可以移除可以从本地主机外部访问的
root账户。You can removerootaccounts that are accessible from outside the local host.您可以删除匿名用户账户。You can remove anonymous-user accounts.
你可以删除
test数据库(默认情况下,所有用户甚至匿名用户都可以访问),以及允许任何人访问以test_开头命名的数据库的权限。You can remove thetestdatabase (which by default can be accessed by all users, even anonymous users), and privileges that permit anyone to access databases with names that start withtest_.
mysql_secure_installation 可以帮助你实施类似于 第 2.9.4 节,“保护初始 MySQL 账户” 中描述的安全建议。mysql_secure_installation helps you implement security recommendations similar to those described at Section 2.9.4, “Securing the Initial MySQL Account”.
正常使用是连接到本地 MySQL 服务器;不带参数调用 mysql_secure_installation:Normal usage is to connect to the local MySQL server; invoke mysql_secure_installation without arguments:
mysql_secure_installation
执行时,mysql_secure_installation 会提示您确定要执行哪些操作。When executed, mysql_secure_installation prompts you to determine which actions to perform.
validate_password 组件可用于密码强度检查。如果未安装该插件,mysql_secure_installation 会提示用户是否安装它。如果启用该插件,之后输入的任何密码都会使用该插件进行检查。The validate_password component can be used
for password strength checking. If the plugin is not installed,
mysql_secure_installation prompts the user
whether to install it. Any passwords entered later are checked
using the plugin if it is enabled.
大多数常用的 MySQL 客户端选项,例如 --host 和 --port,都可以在命令行和配置文件中使用。例如,要通过端口 3307 连接本地服务器的 IPv6,请使用如下命令:Most of the usual MySQL client options such as
--host and
--port can be
used on the command line and in option files. For example, to
connect to the local server over IPv6 using port 3307, use this
command:
mysql_secure_installation --host=::1 --port=3307
mysql_secure_installation 支持以下选项,这些选项可以在命令行中指定,也可以在选项文件的 [mysql_secure_installation] 和 [client] 组中指定。有关 MySQL 程序使用的选项文件的信息,请参见 第 6.2.2.2 节,“使用选项文件”。mysql_secure_installation supports the
following options, which can be specified on the command line or
in the [mysql_secure_installation] and
[client] groups of an option file. For
information about option files used by MySQL programs, see
Section 6.2.2.2, “Using Option Files”.
表 6.9 mysql_secure_installation 选项Table 6.9 mysql_secure_installation Options
| 选项名称Option Name | 说明Description |
|---|---|
| --额外默认文件--defaults-extra-file | 除了常规选项文件外,读取指定名称的选项文件Read named option file in addition to usual option files |
| --默认文件--defaults-file | 仅读取指定的选项文件Read only named option file |
| --默认组后缀--defaults-group-suffix | 选项组后缀值Option group suffix value |
| --帮助--help | 显示帮助信息并退出Display help message and exit |
| --主机--host | MySQL 服务器所在的主机Host on which MySQL server is located |
| --无默认值--no-defaults | 不读取任何选项文件Read no option files |
| --密码--password | 已接受但总是被忽略。每当调用 mysql_secure_installation 时,无论如何都会提示用户输入密码Accepted but always ignored. Whenever mysql_secure_installation is invoked, the user is prompted for a password, regardless |
| --端口--port | 连接的 TCP/IP 端口号TCP/IP port number for connection |
| --打印默认值--print-defaults | 打印默认选项Print default options |
| --协议--protocol | 要使用的传输协议Transport protocol to use |
| --套接字--socket | 要使用的 Unix 套接字文件或 Windows 命名管道Unix socket file or Windows named pipe to use |
| --ssl-ca | 包含受信任的 SSL 证书颁发机构列表的文件File that contains list of trusted SSL Certificate Authorities |
| --SSL-CA 路径--ssl-capath | 包含受信任的 SSL 证书颁发机构证书文件的目录Directory that contains trusted SSL Certificate Authority certificate files |
| --SSL 证书--ssl-cert | 包含 X.509 证书的文件File that contains X.509 certificate |
| --SSL 加密套件--ssl-cipher | 连接加密的允许密码Permissible ciphers for connection encryption |
| --SSL 证书撤销列表--ssl-crl | 包含证书吊销列表的文件File that contains certificate revocation lists |
| --SSL 证书撤销列表路径--ssl-crlpath | 包含证书吊销列表文件的目录Directory that contains certificate revocation-list files |
| --ssl-fips 模式--ssl-fips-mode | 是否在客户端启用 FIPS 模式Whether to enable FIPS mode on client side |
| --ssl 密钥--ssl-key | 包含 X.509 密钥的文件File that contains X.509 key |
| --ssl 模式--ssl-mode | 与服务器连接的期望安全状态Desired security state of connection to server |
| --ssl 会话数据--ssl-session-data | 包含 SSL 会话数据的文件File that contains SSL session data |
| --ssl 会话数据-在复用失败时继续--ssl-session-data-continue-on-failed-reuse | 如果会话重用失败,是否建立连接Whether to establish connections if session reuse fails |
| --tls 加密套件--tls-ciphersuites | 允许的用于加密连接的 TLSv1.3 加密套件Permissible TLSv1.3 ciphersuites for encrypted connections |
| --tls SNI 服务器名--tls-sni-servername | 由客户端提供的服务器名称Server name supplied by the client |
| --TLS 版本--tls-version | 允许用于加密连接的 TLS 协议Permissible TLS protocols for encrypted connections |
| --使用默认--use-default | 无需用户交互即可执行Execute with no user interactivity |
| --用户--user | 连接服务器时使用的 MySQL 用户名MySQL user name to use when connecting to server |
命令行格式Command-Line Format --help--help显示帮助信息并退出。Display a help message and exit.
--defaults-extra-file=file_name--defaults-extra-file=file_name命令行格式Command-Line Format --defaults-extra-file=file_name--defaults-extra-file=file_name类型Type 文件名File name 在全局选项文件之后读取此选项文件,但(在 Unix 系统上)在用户选项文件之前。如果该文件不存在或无法访问,将发生错误。如果
file_name不是绝对路径名,则相对于当前目录解释。Read this option file after the global option file but (on Unix) before the user option file. If the file does not exist or is otherwise inaccessible, an error occurs. Iffile_nameis not an absolute path name, it is interpreted relative to the current directory.有关此选项文件选项及其他选项文件选项的更多信息,请参见 第 6.2.2.3 节,“影响选项文件处理的命令行选项”。For additional information about this and other option-file options, see Section 6.2.2.3, “Command-Line Options that Affect Option-File Handling”.
--defaults-file=file_name--defaults-file=file_name命令行格式Command-Line Format --defaults-file=file_name--defaults-file=file_name类型Type 文件名File name 仅使用指定的选项文件。如果文件不存在或无法访问,将会发生错误。如果
file_name不是绝对路径名,则将其相对于当前目录解释。Use only the given option file. If the file does not exist or is otherwise inaccessible, an error occurs. Iffile_nameis not an absolute path name, it is interpreted relative to the current directory.有关此选项文件选项及其他选项文件选项的更多信息,请参见 第 6.2.2.3 节,“影响选项文件处理的命令行选项”。For additional information about this and other option-file options, see Section 6.2.2.3, “Command-Line Options that Affect Option-File Handling”.
--defaults-group-suffix=str--defaults-group-suffix=str命令行格式Command-Line Format --defaults-group-suffix=str--defaults-group-suffix=str类型Type 字符串String 不仅要读取常规的选项组,还要读取带有常规名称并加上
str后缀的组。例如,mysql_secure_installation 通常会读取[client]和[mysql_secure_installation]组。如果此选项被指定为--defaults-group-suffix=_other,mysql_secure_installation 也会读取[client_other]和[mysql_secure_installation_other]组。Read not only the usual option groups, but also groups with the usual names and a suffix ofstr. For example, mysql_secure_installation normally reads the[client]and[mysql_secure_installation]groups. If this option is given as--defaults-group-suffix=_other, mysql_secure_installation also reads the[client_other]and[mysql_secure_installation_other]groups.有关此选项文件选项及其他选项文件选项的更多信息,请参见 第 6.2.2.3 节,“影响选项文件处理的命令行选项”。For additional information about this and other option-file options, see Section 6.2.2.3, “Command-Line Options that Affect Option-File Handling”.
--host=host_name,-h host_name--host=,host_name-hhost_name命令行格式Command-Line Format --host--host连接到给定主机上的 MySQL 服务器。Connect to the MySQL server on the given host.
命令行格式Command-Line Format --no-defaults--no-defaults不读取任何选项文件。如果程序启动因从选项文件中读取未知选项而失败,可以使用
--no-defaults来防止读取它们。Do not read any option files. If program startup fails due to reading unknown options from an option file,--no-defaultscan be used to prevent them from being read.例外情况是,无论如何都会读取
.mylogin.cnf文件,如果它存在的话。这允许即使使用--no-defaults时,也能以比命令行更安全的方式指定密码。要创建.mylogin.cnf,请使用 mysql_config_editor 工具。参见 第 6.6.7 节,“mysql_config_editor — MySQL 配置工具”。The exception is that the.mylogin.cnffile is read in all cases, if it exists. This permits passwords to be specified in a safer way than on the command line even when--no-defaultsis used. To create.mylogin.cnf, use the mysql_config_editor utility. See Section 6.6.7, “mysql_config_editor — MySQL Configuration Utility”.有关此选项文件选项及其他选项文件选项的更多信息,请参见 第 6.2.2.3 节,“影响选项文件处理的命令行选项”。For additional information about this and other option-file options, see Section 6.2.2.3, “Command-Line Options that Affect Option-File Handling”.
--password=password,-p password--password=,password-ppassword命令行格式Command-Line Format --password=password--password=password类型Type 字符串String 默认值Default Value [none][none]此选项被接受但会被忽略。无论是否使用此选项,mysql_secure_installation 总是会提示用户输入密码。This option is accepted but ignored. Whether or not this option is used, mysql_secure_installation always prompts the user for a password.
--port=port_num,-P port_num--port=,port_num-Pport_num命令行格式Command-Line Format --port=port_num--port=port_num类型Type 数字Numeric 默认值Default Value 3306对于 TCP/IP 连接,要使用的端口号。For TCP/IP connections, the port number to use.
--print-defaults--print-defaults命令行格式Command-Line Format --print-defaults打印程序名称以及它从选项文件中获取的所有选项。Print the program name and all options that it gets from option files.
有关此选项文件选项及其他选项文件选项的更多信息,请参见 第 6.2.2.3 节,“影响选项文件处理的命令行选项”。For additional information about this and other option-file options, see Section 6.2.2.3, “Command-Line Options that Affect Option-File Handling”.
--protocol={TCP|SOCKET|PIPE|MEMORY}命令行格式Command-Line Format --protocol=type--protocol=type类型Type 字符串String 默认值Default Value [see text][see text]有效值Valid Values TCPSOCKETSOCKETPIPEPIPEMEMORYMEMORY用于连接服务器的传输协议。当其他连接参数通常导致使用的协议不是您想要的协议时,这很有用。有关允许值的详细信息,请参阅第 6.2.7 节,“连接传输协议”。The transport protocol to use for connecting to the server. It is useful when the other connection parameters normally result in use of a protocol other than the one you want. For details on the permissible values, see Section 6.2.7, “Connection Transport Protocols”.
--socket=path,-S path--socket=,path-Spath命令行格式Command-Line Format --socket={file_name|pipe_name}--socket={file_name|pipe_name}类型Type 字符串String 用于连接
localhost时,使用的 Unix 套接字文件,或者在 Windows 上使用的命名管道的名称。For connections tolocalhost, the Unix socket file to use, or, on Windows, the name of the named pipe to use.在 Windows 上,只有在服务器启动时启用了
named_pipe系统变量以支持命名管道连接时,此选项才适用。此外,连接必须是由named_pipe_full_access_group系统变量指定的 Windows 组成员。On Windows, this option applies only if the server was started with thenamed_pipesystem variable enabled to support named-pipe connections. In addition, the connection must be a member of the Windows group specified by thenamed_pipe_full_access_groupsystem variable.以
--ssl开头的选项指定是否使用加密连接到服务器,并指示在哪里可以找到 SSL 密钥和证书。请参阅 加密连接的命令选项。Options that begin with--sslspecify whether to connect to the server using encryption and indicate where to find SSL keys and certificates. See Command Options for Encrypted Connections.--ssl-fips-mode={OFF|ON|STRICT}命令行格式Command-Line Format --ssl-fips-mode={OFF|ON|STRICT}--ssl-fips-mode={OFF|ON|STRICT}已弃用Deprecated 是Yes 类型Type 枚举Enumeration 默认值Default Value OFFOFF有效值Valid Values OFFOFFONONSTRICTSTRICT控制是否在客户端启用 FIPS 模式。
--ssl-fips-mode选项不同于其他--ssl-选项,它不是用于建立加密连接,而是用于影响允许的加密操作。请参见 第 8.8 节,“FIPS 支持”。Controls whether to enable FIPS mode on the client side. Thexxx--ssl-fips-modeoption differs from other--ssl-options in that it is not used to establish encrypted connections, but rather to affect which cryptographic operations to permit. See Section 8.8, “FIPS Support”.xxx这些
--ssl-fips-mode值是允许的:These--ssl-fips-modevalues are permitted:OFF:禁用 FIPS 模式。OFF: Disable FIPS mode.ON:启用 FIPS 模式。ON: Enable FIPS mode.STRICT:启用“严格” FIPS 模式。STRICT: Enable “strict” FIPS mode.
Note如果 OpenSSL FIPS 对象模块不可用,则
--ssl-fips-mode唯一允许的值是OFF。在这种情况下,将--ssl-fips-mode设置为ON或STRICT会导致客户端在启动时产生警告,并以非 FIPS 模式运行。If the OpenSSL FIPS Object Module is not available, the only permitted value for--ssl-fips-modeisOFF. In this case, setting--ssl-fips-modetoONorSTRICTcauses the client to produce a warning at startup and to operate in non-FIPS mode.此选项已弃用。预计将在未来的 MySQL 版本中移除。This option is deprecated. Expect it to be removed in a future version of MySQL.
--tls-ciphersuites=ciphersuite_list--tls-ciphersuites=ciphersuite_list命令行格式Command-Line Format --tls-ciphersuites=ciphersuite_list--tls-ciphersuites=ciphersuite_list类型Type 字符串String 用于 TLSv1.3 加密连接的允许密码套件。该值是一个或多个用冒号分隔的密码套件名称的列表。此选项可指定的密码套件取决于用于编译 MySQL 的 SSL 库。有关详细信息,请参见 第 8.3.2 节,“加密连接的 TLS 协议和密码”。The permissible ciphersuites for encrypted connections that use TLSv1.3. The value is a list of one or more colon-separated ciphersuite names. The ciphersuites that can be named for this option depend on the SSL library used to compile MySQL. For details, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.
--tls-sni-servername=server_name--tls-sni-servername=server_name命令行格式Command-Line Format --tls-sni-servername=server_name--tls-sni-servername=server_name类型Type 字符串String 如果指定了名称,该名称将通过
mysql_options()的MYSQL_OPT_TLS_SNI_SERVERNAME选项传递给libmysqlclientC API 库。服务器名称不区分大小写。要显示客户端为当前会话指定的服务器名称(如果有),请检查Tls_sni_server_name状态变量。When specified, the name is passed to thelibmysqlclientC API library using theMYSQL_OPT_TLS_SNI_SERVERNAMEoption ofmysql_options(). The server name is not case-sensitive. To show which server name the client specified for the current session, if any, check theTls_sni_server_namestatus variable.服务器名称指示(SNI)是 TLS 协议的一个扩展(必须使用支持 TLS 扩展的 OpenSSL 编译此选项才能生效)。MySQL 对 SNI 的实现仅代表客户端。Server Name Indication (SNI) is an extension to the TLS protocol (OpenSSL must be compiled using TLS extensions for this option to function). The MySQL implementation of SNI represents the client-side only.
--tls-version=protocol_list--tls-version=protocol_list命令行格式Command-Line Format --tls-version=protocol_list--tls-version=protocol_list类型Type 字符串String 默认值Default Value TLSv1,TLSv1.1,TLSv1.2,TLSv1.3(OpenSSL 1.1.1 或更高版本)TLSv1,TLSv1.1,TLSv1.2,TLSv1.3(OpenSSL 1.1.1 or higher)TLSv1,TLSv1.1,TLSv1.2(否则)TLSv1,TLSv1.1,TLSv1.2(otherwise)用于加密连接的允许 TLS 协议。值是一个或多个以逗号分隔的协议名称列表。此选项可指定的协议取决于用于编译 MySQL 的 SSL 库。详情请参见 第 8.3.2 节,“加密连接 TLS 协议和密码”。The permissible TLS protocols for encrypted connections. The value is a list of one or more comma-separated protocol names. The protocols that can be named for this option depend on the SSL library used to compile MySQL. For details, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.
命令行格式Command-Line Format --use-default类型Type 布尔Boolean 非交互式执行。此选项可用于无人值守的安装操作。Execute noninteractively. This option can be used for unattended installation operations.
--user=user_name,-u user_name--user=,user_name-uuser_name命令行格式Command-Line Format --user=user_name--user=user_name类型Type 字符串String 用于连接服务器的 MySQL 帐户用户名。The user name of the MySQL account to use for connecting to the server.