MySQL 8.4 Release Notes
- 8.1 一般安全问题8.1 General Security Issues
- 8.1.1 安全指南8.1.1 Security Guidelines
- 8.1.2 保持密码安全8.1.2 Keeping Passwords Secure
- 8.1.3 使 MySQL 防止攻击者8.1.3 Making MySQL Secure Against Attackers
- 8.1.4 与安全相关的 mysqld 选项和变量8.1.4 Security-Related mysqld Options and Variables
- 8.1.5 如何以普通用户身份运行 MySQL8.1.5 How to Run MySQL as a Normal User
- 8.1.6 LOAD DATA LOCAL 的安全注意事项8.1.6 Security Considerations for LOAD DATA LOCAL
- 8.1.7 客户端编程安全指南8.1.7 Client Programming Security Guidelines
- 8.2 访问控制和账号管理8.2 Access Control and Account Management
- 8.2.1 账号用户名和密码8.2.1 Account User Names and Passwords
- 8.2.2 MySQL 提供的权限8.2.2 Privileges Provided by MySQL
- 8.2.3 授权表8.2.3 Grant Tables
- 8.2.4 指定账户名称8.2.4 Specifying Account Names
- 8.2.5 指定角色名称8.2.5 Specifying Role Names
- 8.2.6 访问控制，第 1 阶段：连接验证8.2.6 Access Control, Stage 1: Connection Verification
- 8.2.7 访问控制，第 2 阶段：请求验证8.2.7 Access Control, Stage 2: Request Verification
- 8.2.8 添加账户、分配权限和删除账户8.2.8 Adding Accounts, Assigning Privileges, and Dropping Accounts
- 8.2.9 保留账户8.2.9 Reserved Accounts
- 8.2.10 使用角色8.2.10 Using Roles
- 8.2.11 账户类别8.2.11 Account Categories
- 8.2.12 使用部分撤销限制权限8.2.12 Privilege Restriction Using Partial Revokes
- 8.2.13 权限更改生效时间8.2.13 When Privilege Changes Take Effect
- 8.2.14 分配账户密码8.2.14 Assigning Account Passwords
- 8.2.15 密码管理8.2.15 Password Management
- 8.2.16 服务器处理过期密码8.2.16 Server Handling of Expired Passwords
- 8.2.17 可插拔认证8.2.17 Pluggable Authentication
- 8.2.18 多因素认证8.2.18 Multifactor Authentication
- 8.2.19 代理用户8.2.19 Proxy Users
- 8.2.20 账户锁定8.2.20 Account Locking
- 8.2.21 设置账户资源限制8.2.21 Setting Account Resource Limits
- 8.2.22 连接 MySQL 出现问题的故障排除8.2.22 Troubleshooting Problems Connecting to MySQL
- 8.2.23 基于 SQL 的账户活动审计8.2.23 SQL-Based Account Activity Auditing
- 8.3 使用加密连接8.3 Using Encrypted Connections
- 8.3.1 配置 MySQL 使用加密连接8.3.1 Configuring MySQL to Use Encrypted Connections
- 8.3.2 加密连接 TLS 协议和加密套件8.3.2 Encrypted Connection TLS Protocols and Ciphers
- 8.3.3 创建 SSL 和 RSA 证书及密钥8.3.3 Creating SSL and RSA Certificates and Keys
- 8.3.4 使用 SSH 从 Windows 远程连接 MySQL8.3.4 Connecting to MySQL Remotely from Windows with SSH
- 8.3.5 重用 SSL 会话8.3.5 Reusing SSL Sessions
- 8.4 安全组件和插件8.4 Security Components and Plugins
- 8.4.1 认证插件8.4.1 Authentication Plugins
- 8.4.2 连接控制插件8.4.2 Connection Control Plugins
- 8.4.3 密码验证组件8.4.3 The Password Validation Component
- 8.4.4 MySQL 密钥环8.4.4 The MySQL Keyring
- 8.4.5 MySQL 企业审计8.4.5 MySQL Enterprise Audit
- 8.4.6 审计消息组件8.4.6 The Audit Message Component
- 8.4.7 MySQL 企业防火墙8.4.7 MySQL Enterprise Firewall
- 8.5 MySQL 企业数据掩码和去标识化8.5 MySQL Enterprise Data Masking and De-Identification
- 8.6 MySQL 企业加密8.6 MySQL Enterprise Encryption
- 8.6.1 MySQL 企业加密安装与升级8.6.1 MySQL Enterprise Encryption Installation and Upgrading
- 8.6.2 配置 MySQL 企业加密8.6.2 Configuring MySQL Enterprise Encryption
- 8.6.3 MySQL 企业加密的使用和示例8.6.3 MySQL Enterprise Encryption Usage and Examples
- 8.6.4 MySQL 企业加密函数参考8.6.4 MySQL Enterprise Encryption Function Reference
- 8.6.5 MySQL 企业加密组件函数说明8.6.5 MySQL Enterprise Encryption Component Function Descriptions
- 8.7 SELinux
- 8.7.1 检查 SELinux 是否启用8.7.1 Check if SELinux is Enabled
- 8.7.2 更改 SELinux 模式8.7.2 Changing the SELinux Mode
- 8.7.3 MySQL 服务器 SELinux 策略8.7.3 MySQL Server SELinux Policies
- 8.7.4 SELinux 文件上下文8.7.4 SELinux File Context
- 8.7.5 SELinux TCP 端口上下文8.7.5 SELinux TCP Port Context
- 8.7.6 SELinux 故障排除8.7.6 Troubleshooting SELinux
- 8.8 FIPS 支持8.8 FIPS Support
在考虑 MySQL 安装中的安全性时，你应当考虑各种可能的主题以及它们如何影响你的 MySQL 服务器和相关应用程序的安全性：When thinking about security within a MySQL installation, you should consider a wide range of possible topics and how they affect the security of your MySQL server and related applications:
影响安全的常规因素。这些因素包括选择强密码、不授予用户不必要的权限、通过防止 SQL 注入和数据损坏来确保应用程序安全等。参见第 8.1 节，“常规安全问题”。General factors that affect security. These include choosing good passwords, not granting unnecessary privileges to users, ensuring application security by preventing SQL injections and data corruption, and others. See Section 8.1, “General Security Issues”.
安装本身的安全性。您的安装中的数据文件、日志文件以及所有应用程序文件都应受到保护，以确保未经授权的人员无法读取或写入。更多信息，请参见第 2.9 节，“安装后设置和测试”。Security of the installation itself. The data files, log files, and the all the application files of your installation should be protected to ensure that they are not readable or writable by unauthorized parties. For more information, see Section 2.9, “Postinstallation Setup and Testing”.
数据库系统内部的访问控制和安全性，包括被授予访问数据库的用户和数据库，以及数据库中使用的视图和存储程序。更多信息，请参见 第 8.2 节，“访问控制与账户管理”。Access control and security within the database system itself, including the users and databases granted with access to the databases, views and stored programs in use within the database. For more information, see Section 8.2, “Access Control and Account Management”.
安全相关插件提供的功能。参见 第 8.4 节，“安全组件与插件”。The features offered by security-related plugins. See Section 8.4, “Security Components and Plugins”.
MySQL 和您的系统的网络安全。安全性与各个用户的权限相关，但您可能还希望限制 MySQL，使其仅在 MySQL 服务器主机上可用，或仅对有限的一组其他主机可用。Network security of MySQL and your system. The security is related to the grants for individual users, but you may also wish to restrict MySQL so that it is available only locally on the MySQL server host, or to a limited set of other hosts.
确保您对数据库文件、配置文件和日志文件有充足且适当的备份。同时确保您有恢复方案，并测试能够成功从备份中恢复信息。请参见 第 9 章，备份与恢复。Ensure that you have adequate and appropriate backups of your database files, configuration and log files. Also be sure that you have a recovery solution in place and test that you are able to successfully recover the information from your backups. See Chapter 9, Backup and Recovery.
Note
本章中的几个主题也在 安全部署指南 中有所涉及，该指南提供了部署 MySQL 企业版服务器通用二进制发行版的程序，并具有管理 MySQL 安装安全性的功能。Several topics in this chapter are also addressed in the Secure Deployment Guide, which provides procedures for deploying a generic binary distribution of MySQL Enterprise Edition Server with features for managing the security of your MySQL installation.