要求所有 MySQL 帐户都必须有密码。客户端程序不一定知道运行它的人的身份。在客户端/服务器应用程序中，用户可以向客户端程序指定任何用户名是很常见的。例如，任何人都可以使用 mysql 程序以其他人的身份连接，只需以 mysql -u other_user db_name 的形式调用它，如果 other_user 没有密码。如果所有帐户都有密码，使用其他用户帐户连接就会变得困难得多。Require all MySQL accounts to have a password. A client program does not necessarily know the identity of the person running it. It is common for client/server applications that the user can specify any user name to the client program. For example, anyone can use the mysql program to connect as any other person simply by invoking it as mysql -u other_user db_name if other_user has no password. If all accounts have a password, connecting using another user's account becomes much more difficult.

有关设置密码的方法的讨论，请参见 第 8.2.14 节，“分配账户密码”。For a discussion of methods for setting passwords, see Section 8.2.14, “Assigning Account Passwords”.

确保数据库目录中唯一具有读写权限的 Unix 用户账户是用于运行 mysqld 的账户。Make sure that the only Unix user account with read or write privileges in the database directories is the account that is used for running mysqld.

切勿以 Unix root 用户身份运行 MySQL 服务器。这是极其危险的，因为任何拥有 FILE 权限的用户都可以让服务器以 root 身份创建文件（例如 ~root/.bashrc）。为防止这种情况，mysqld 拒绝以 root 身份运行，除非明确使用 --user=root 选项指定。Never run the MySQL server as the Unix root user. This is extremely dangerous, because any user with the FILE privilege is able to cause the server to create files as root (for example, ~root/.bashrc). To prevent this, mysqld refuses to run as root unless that is specified explicitly using the --user=root option.

mysqld 可以（并且应该）作为普通的、无特权的用户运行。你可以创建一个名为 mysql 的独立 Unix 账户，使一切更加安全。仅使用此账户来管理 MySQL。要以不同的 Unix 用户启动 mysqld，请在指定服务器选项的 my.cnf 配置文件的 [mysqld] 组中添加一个指定用户名的 user 选项。例如：mysqld can (and should) be run as an ordinary, unprivileged user instead. You can create a separate Unix account named mysql to make everything even more secure. Use this account only for administering MySQL. To start mysqld as a different Unix user, add a user option that specifies the user name in the [mysqld] group of the my.cnf option file where you specify server options. For example:

[mysqld]
user=mysql

这会导致无论您是手动启动还是使用 mysqld_safe 或 mysql.server 启动服务器时，都以指定的用户身份启动。更多详细信息，请参见 第 8.1.5 节，“如何以普通用户身份运行 MySQL”。This causes the server to start as the designated user whether you start it manually or by using mysqld_safe or mysql.server. For more details, see Section 8.1.5, “How to Run MySQL as a Normal User”.

以不是 root 的 Unix 用户身份运行 mysqld 并不意味着你需要在 user 表中更改 root 用户名。MySQL 帐户的用户名与 Unix 帐户的用户名无关。Running mysqld as a Unix user other than root does not mean that you need to change the root user name in the user table. User names for MySQL accounts have nothing to do with user names for Unix accounts.

不要将 FILE 权限授予非管理员用户。任何拥有此权限的用户都可以以 mysqld 守护进程的权限在文件系统的任何位置写入文件。这包括包含实现权限表文件的服务器数据目录。为了使 FILE 权限操作更安全，通过 SELECT ... INTO OUTFILE 生成的文件不会覆盖现有文件，并且对所有人可写。Do not grant the FILE privilege to nonadministrative users. Any user that has this privilege can write a file anywhere in the file system with the privileges of the mysqld daemon. This includes the server's data directory containing the files that implement the privilege tables. To make FILE-privilege operations a bit safer, files generated with SELECT ... INTO OUTFILE do not overwrite existing files and are writable by everyone.

FILE 权限也可用于读取任何对所有人可读或服务器运行的 Unix 用户可以访问的文件。拥有此权限后，您可以将任何文件读取到表中。例如，这可能会被滥用，通过使用 LOAD DATA 将 /etc/passwd 加载到表中，然后可以通过 SELECT 显示。The FILE privilege may also be used to read any file that is world-readable or accessible to the Unix user that the server runs as. With this privilege, you can read any file into a database table. This could be abused, for example, by using LOAD DATA to load /etc/passwd into a table, which then can be displayed with SELECT.

要限制文件可以被读取和写入的位置，请将 secure_file_priv 系统变量设置为特定目录。请参见 第 7.1.8 节，“服务器系统变量”。To limit the location in which files can be read and written, set the secure_file_priv system to a specific directory. See Section 7.1.8, “Server System Variables”.

加密二进制日志文件和中继日志文件。加密有助于保护这些文件及其中可能包含的敏感数据，防止被外部攻击者滥用，同时也防止存储这些文件的操作系统用户未经授权查看。您可以通过将 MySQL 服务器的 binlog_encryption 系统变量设置为 ON 来启用加密。有关更多信息，请参见 第 19.3.2 节，“加密二进制日志文件和中继日志文件”。Encrypt binary log files and relay log files. Encryption helps to protect these files and the potentially sensitive data contained in them from being misused by outside attackers, and also from unauthorized viewing by users of the operating system where they are stored. You enable encryption on a MySQL server by setting the binlog_encryption system variable to ON. For more information, see Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”.

不要向非管理用户授予PROCESS或SUPER权限。mysqladmin processlist和SHOW PROCESSLIST的输出显示当前正在执行的语句内容，因此任何被允许查看服务器进程列表的用户都可能看到其他用户执行的语句。Do not grant the PROCESS or SUPER privilege to nonadministrative users. The output of mysqladmin processlist and SHOW PROCESSLIST shows the text of any statements currently being executed, so any user who is permitted to see the server process list might be able to see statements issued by other users.

mysqld 为拥有 CONNECTION_ADMIN 或 SUPER 权限的用户保留了一个额外的连接，以便 MySQL root 用户即使在所有普通连接都已使用的情况下，也可以登录并检查服务器活动。mysqld reserves an extra connection for users who have the CONNECTION_ADMIN or SUPER privilege, so that a MySQL root user can log in and check server activity even if all normal connections are in use.

SUPER 权限可用于终止客户端连接，通过更改系统变量的值来改变服务器操作，并控制复制服务器。The SUPER privilege can be used to terminate client connections, change server operation by changing the value of system variables, and control replication servers.

不允许对表使用符号链接。（此功能可以通过 --skip-symbolic-links 选项禁用。）如果你以 root 身份运行 mysqld，这一点尤其重要，因为任何对服务器数据目录有写权限的人都可能删除系统中的任何文件！参见 第 10.12.2.2 节，“在 Unix 上为 MyISAM 表使用符号链接”。Do not permit the use of symlinks to tables. (This capability can be disabled with the --skip-symbolic-links option.) This is especially important if you run mysqld as root, because anyone that has write access to the server's data directory then could delete any file in the system! See Section 10.12.2.2, “Using Symbolic Links for MyISAM Tables on Unix”.

存储程序和视图应按照第 27.6 节，“存储对象访问控制”中讨论的安全指南编写。Stored programs and views should be written using the security guidelines discussed in Section 27.6, “Stored Object Access Control”.

如果您不信任您的 DNS，您应该在授权表中使用 IP 地址而不是主机名。无论如何，对于使用包含通配符的主机名值创建授权表条目，您都应该非常小心。If you do not trust your DNS, you should use IP addresses rather than host names in the grant tables. In any case, you should be very careful about creating grant table entries using host name values that contain wildcards.

如果您想限制单个账户允许的连接数，可以通过在 max_user_connections 变量在 mysqld 中进行设置。CREATE USER 和 ALTER USER 语句也支持资源控制选项，用于限制账户允许使用服务器的范围。请参阅 第 15.7.1.3 节，“CREATE USER 语句”，以及 第 15.7.1.1 节，“ALTER USER 语句”。If you want to restrict the number of connections permitted to a single account, you can do so by setting the max_user_connections variable in mysqld. The CREATE USER and ALTER USER statements also support resource control options for limiting the extent of server use permitted to an account. See Section 15.7.1.3, “CREATE USER Statement”, and Section 15.7.1.1, “ALTER USER Statement”.

如果插件目录可以被服务器写入，用户可能通过 SELECT ... INTO DUMPFILE 将可执行代码写入目录中的文件。可以通过将 plugin_dir 设置为服务器只读，或将 secure_file_priv 设置为 SELECT 可以安全写入的目录来防止此类操作。If the plugin directory is writable by the server, it may be possible for a user to write executable code to a file in the directory using SELECT ... INTO DUMPFILE. This can be prevented by making plugin_dir read only to the server or by setting secure_file_priv to a directory where SELECT writes can be made safely.