绝不要给任何人（除了 MySQL root 账户）访问 mysql 系统数据库中的 user 表的权限！ 这一点至关重要。Do not ever give anyone (except MySQL root accounts) access to the user table in the mysql system database! This is critical.

了解 MySQL 访问权限系统的工作原理（参见 第 8.2 节，“访问控制和账户管理”）。使用 GRANT 和 REVOKE 语句来控制对 MySQL 的访问。不要授予超过必要的权限。切勿向所有主机授予权限。Learn how the MySQL access privilege system works (see Section 8.2, “Access Control and Account Management”). Use the GRANT and REVOKE statements to control access to MySQL. Do not grant more privileges than necessary. Never grant privileges to all hosts.

清单：Checklist:

不要在数据库中存储明文密码。如果你的计算机被攻破，入侵者可以获取完整的密码列表并使用它们。相反，应使用SHA2()或其他单向哈希函数，并存储哈希值。Do not store cleartext passwords in your database. If your computer becomes compromised, the intruder can take the full list of passwords and use them. Instead, use SHA2() or some other one-way hashing function and store the hash value.

为了防止使用彩虹表进行密码恢复，不要在明文密码上使用这些函数；相反，应选择一个字符串作为盐，并使用 hash(hash(密码) 盐) 的值。To prevent password recovery using rainbow tables, do not use these functions on a plain password; instead, choose some string to be used as a salt, and use hash(hash(password)+salt) values.

假设所有密码都可能受到使用已知密码列表的自动破解尝试，以及基于公开可获得的关于您的信息（例如社交媒体帖子）进行的有针对性猜测。不要选择由容易破解或猜测的内容组成的密码，比如字典词、专有名、运动队名称、首字母缩略词或常见短语，尤其是当它们与您相关时。如果大写字母、数字替代和添加以及特殊字符的使用方式是可预测的，也没有帮助。此外，不要选择您在任何地方见过用作示例的密码，或者其变体，即使它被呈现为强密码示例。Assume that all passwords will be subject to automated cracking attempts using lists of known passwords, and also to targeted guessing using publicly available information about you, such as social media posts. Do not choose passwords that consist of easily cracked or guessed items such as a dictionary word, proper name, sports team name, acronym, or commonly known phrase, particularly if they are relevant to you. The use of upper case letters, number substitutions and additions, and special characters does not help if these are used in predictable ways. Also do not choose any password you have seen used as an example anywhere, or a variation on it, even if it was presented as an example of a strong password.

相反，选择尽可能长且不可预测的密码。这并不意味着组合必须是难以记住和复制的随机字符字符串，尽管如果你拥有能够生成、填充并安全存储此类密码的密码管理软件，这是一个不错的方法。包含多个单词的短语密码容易创建、记住和复制，并且比由单个修改过的单词或可预测字符序列组成的典型用户密码安全得多。要创建安全的短语密码，确保其中的单词和其他元素不是已知的短语或引用，顺序不可预测，并且最好彼此之间没有任何先前关系。Instead, choose passwords that are as long and as unpredictable as possible. That does not mean the combination needs to be a random string of characters that is difficult to remember and reproduce, although this is a good approach if you have, for example, password manager software that can generate and fill such passwords and store them securely. A passphrase containing multiple words is easy to create, remember, and reproduce, and is much more secure than a typical user-selected password consisting of a single modified word or a predictable sequence of characters. To create a secure passphrase, ensure that the words and other items in it are not a known phrase or quotation, do not occur in a predictable order, and preferably have no previous relationship to each other at all.

投资防火墙。这至少可以保护你免受任何软件中 50%的漏洞攻击。将 MySQL 置于防火墙后或放在隔离区（DMZ）中。Invest in a firewall. This protects you from at least 50% of all types of exploits in any software. Put MySQL behind the firewall or in a demilitarized zone (DMZ).

清单：Checklist:

访问 MySQL 的应用程序不应信任用户输入的任何数据，并且应使用适当的防御性编程技术编写。参见 第 8.1.7 节，“客户端编程安全指南”。Applications that access MySQL should not trust any data entered by users, and should be written using proper defensive programming techniques. See Section 8.1.7, “Client Programming Security Guidelines”.

不要通过互联网传输明文（未加密）数据。这些信息可以被所有有时间和能力截取它的人访问，并用于他们自己的目的。相反，应使用加密协议，如 SSL 或 SSH。MySQL 支持内部 SSL 连接。另一种技术是使用 SSH 端口转发来为通信创建加密（且压缩）的通道。Do not transmit plain (unencrypted) data over the Internet. This information is accessible to everyone who has the time and ability to intercept it and use it for their own purposes. Instead, use an encrypted protocol such as SSL or SSH. MySQL supports internal SSL connections. Another technique is to use SSH port-forwarding to create an encrypted (and compressed) tunnel for the communication.

学习使用 tcpdump 和 strings 工具。在大多数情况下，你可以通过发出如下命令来检查 MySQL 数据流是否未加密：Learn to use the tcpdump and strings utilities. In most cases, you can check whether MySQL data streams are unencrypted by issuing a command like the following:

$> tcpdump -l -i eth0 -w - src or dst port 3306 | strings

这在 Linux 下可用，并且在其他系统下进行小的修改后也应该可用。This works under Linux and should work with small modifications under other systems.