MySQL 8.0授权认证
一.系统权限表
user
存放用户账户信息以及全局级别(所有数据库)权限,决定了来自哪些主机的哪些用户可以访问数据库实例,如果有全局权限则意味着对所有数据库都有此权限
db
存放数据库级别的权限,决定了来自哪些主机的哪些用户可以访问此数据库
tables_priv
存放表级别的权限,决定了来自哪些主机的哪些用户可以访问数据库的这个表
columns_priv
存放列级别的权限,决定了来自哪些主机的哪些用户可以访问数据库表的这个字段
procs_priv
存放存储过程和函数级别的权限
二.创建用户与授权
1.简单的例子
#创建用户
#重点：用户创建完成可以连接,但是没有任何权限
create user hans@localhost identified by '123456';
#授权
#这个就相当于给了一个超级管理员权限
grants all on *.* to 'hans'@'localhost';
#查看用户的权限
show grants for hans@localhost;
#如果权限过大,那就回收权限
revoke all on *.* from 'hans'@'localhost';
2.关于远程用户
#这是配置远程用户和权限
可以用%来表示允许所有的IP进行连接 比如'hans'@'%'
grants all on *.* to 'hans'@'192.168.1.%'
可以用192.168.1.%来表示 192.168.1.0/24这个网段的IP来进行连接 比如 'hans'@'192.168.1.%
grants select on *.* to 'hans'@'192.168.1.%
可以用192.168.1.%来表示 192.168.1.0/24这个网段的IP来进行连接 比如 'hans'@'192.168.1.10%'
grants insert,update,delete on *.* to 'hans'@'192.168.1.10%
#重点 这个带网段的这个权限会是叠加的
3.复杂的例子
案例1
#你的网段可能不是10.0.0.0/8,这不重要,重要的是你可以领会这个权限操作
(1)
来自企业内网10.0.0网段的应用程序app1希望能赋予MySQL数据库实例里的
A1数据库的增删改查权限,
A2数据库里B2表的查询权限,
A3数据库B3表上ID字段的查询权限,
这个数据库用户的创建语句是什么?
(2)
如果要回收该用户在A2数据库里B2表的查询权限,语句怎么写?
create user 'app1'@'10.0.0.%' identified by '123456';
grant select,instert,update,delete on a1.* to 'app1'@'10.0.0.%';
grant select on a2.b2 to 'app1'@'10.0.0.%';
grant select(id) on a3.b3 to 'app1'@'10.0.0.%';
这个复杂的例子就是把MySQL权限认证操作写的更细致,控制的粒度控制到了字段(列)级别
那么如何验证上面的授权语句是否正确呢?
通过查询MySQL的系统权限表，就可以知道对这个用户的权限配置
我一步一步演示上面的这个复杂的案例
先完成(1)
创建3个数据库
mysql> create database a1;
Query OK, 1 row affected (0.11 sec)
mysql> create database a2;
Query OK, 1 row affected (0.04 sec)
mysql> create database a3;
Query OK, 1 row affected (0.05 sec)
创建表
mysql> use a1;
Database changed
mysql> create table t1 (sid int,name varchar(10));
Query OK, 0 rows affected (0.10 sec)
mysql> use a2;
Database changed
mysql> create table b2 (sid int,name varchar(10));
Query OK, 0 rows affected (0.06 sec)
mysql> use a3;
Database changed
mysql> create table b3 (sid int,name varchar(10));
Query OK, 0 rows affected (0.41 sec)
创建app1这个用户
mysql> create user 'app1'@'192.168.91.%' identified by '123456!';
Query OK, 0 rows affected (0.08 sec)
授权
mysql> grant select,insert,update,delete on a1.* to 'app1'@'192.168.91.%';
Query OK, 0 rows affected (0.08 sec)
mysql> grant select on a2.b2 to 'app1'@'192.168.91.%';
Query OK, 0 rows affected (0.09 sec)
mysql> grant select(sid) on a3.b3 to 'app1'@'192.168.91.%';
Query OK, 0 rows affected (0.04 sec)
验证
这个是数据库级别
mysql> select * from mysql.db where user='app1' and host='192.168.91.%'G;
*************************** 1. row ***************************
Host: 192.168.91.%
Db: a1
User: app1
Select_priv: Y
Insert_priv: Y
Update_priv: Y
Delete_priv: Y
Create_priv: N
Drop_priv: N
Grant_priv: N
References_priv: N
Index_priv: N
Alter_priv: N
Create_tmp_table_priv: N
Lock_tables_priv: N
Create_view_priv: N
Show_view_priv: N
Create_routine_priv: N
Alter_routine_priv: N
Execute_priv: N
Event_priv: N
Trigger_priv: N
1 row in set (0.00 sec)
ERROR:
No query specified
这个是表级别
mysql> select * from mysql.tables_priv where user='app1' and host='192.168.91.%'G;
*************************** 1. row ***************************
Host: 192.168.91.%
Db: a2
User: app1
Table_name: b2
Grantor: root@localhost
Timestamp: 0000-00-00 00:00:00
Table_priv: Select
Column_priv:
*************************** 2. row ***************************
Host: 192.168.91.%
Db: a3
User: app1
Table_name: b3
Grantor: root@localhost
Timestamp: 0000-00-00 00:00:00
Table_priv:
Column_priv: Select
2 rows in set (0.00 sec)
ERROR:
No query specified
这个就是字段(列)级别
mysql> select * from mysql.columns_priv where user='app1' and host='192.168.91.%'G;
*************************** 1. row ***************************
Host: 192.168.91.%
Db: a3
User: app1
Table_name: b3
Column_name: sid
Timestamp: 0000-00-00 00:00:00
Column_priv: Select
1 row in set (0.00 sec)
ERROR:
No query specified
换个语句再看下用户的权限
mysql> show grants for 'app1'@'192.168.91.%'G;
*************************** 1. row ***************************
Grants for app1@192.168.91.%: GRANT USAGE ON *.* TO `app1`@`192.168.91.%`
*************************** 2. row ***************************
Grants for app1@192.168.91.%: GRANT SELECT, INSERT, UPDATE, DELETE ON `a1`.* TO `app1`@`192.168.91.%`
*************************** 3. row ***************************
Grants for app1@192.168.91.%: GRANT SELECT ON `a2`.`b2` TO `app1`@`192.168.91.%`
*************************** 4. row ***************************
Grants for app1@192.168.91.%: GRANT SELECT (`sid`) ON `a3`.`b3` TO `app1`@`192.168.91.%`
4 rows in set (0.00 sec)
ERROR:
No query specified
客户端验证
#我这里再找1台1同网段的虚拟机安装mysql客户端做测试,这里安装的是mariadb的客户端,远程连接数据库服务器
#这里数据库a1我就不做测试了,直接从a2开始
[root@localhost ~]# mysql -u app1 -h192.168.91.128 -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or g.
Your MySQL connection id is 19
Server version: 8.0.13 MySQL Community Server - GPL
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.
MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| a1 |
| a2 |
| a3 |
| information_schema |
+--------------------+
4 rows in set (0.00 sec)
MySQL [(none)]> use a2;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MySQL [a2]> insert into a2 (sid,name) values (1,'xjp');
ERROR 1142 (42000): INSERT command denied to user 'app1'@'192.168.91.129' for table 'a2'
#这里就说明了没有insert权限
#测试a3,我们需要用root用户插入数据,我们再用app1用户做测试
mysql> use a3;
Database changed
mysql> show tables;
+--------------+
| Tables_in_a3 |
+--------------+
| b3 |
+--------------+
1 row in set (0.00 sec)
mysql> insert into b3 (sid,name) values (1,'xjp');
Query OK, 1 row affected (0.07 sec)
mysql> insert into b3 (sid,name) values (2,'mzd');
Query OK, 1 row affected (0.01 sec)
mysql> select * from b3;
+------+------+
| sid | name |
+------+------+
| 1 | xjp |
| 2 | mzd |
+------+------+
2 rows in set (0.00 sec)
#OK,这里我们插入了2条数据,这里的需求是a3数据库b3表上sid字段的查询权限,那我们就做如下的测试
用客户端登录
MySQL [(none)]> use a3;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MySQL [a3]> show tables;
+--------------+
| Tables_in_a3 |
+--------------+
| b3 |
+--------------+
1 row in set (0.00 sec)
MySQL [a3]> select * from b3;
ERROR 1142 (42000): SELECT command denied to user 'app1'@'192.168.91.129' for table 'b3'
MySQL [a3]> select name from b3;
ERROR 1143 (42000): SELECT command denied to user 'app1'@'192.168.91.129' for column 'name' in table 'b3'
看到了吧!不给查,被拒绝了,那我们只查sid再试一次
MySQL [a3]> select sid from b3;
+------+
| sid |
+------+
| 1 |
| 2 |
+------+
2 rows in set (0.00 sec)
看到了吧!奇迹出现了!
(2)如果要回收该用户在a2数据库里b2表的查询权限,语句怎么写?
mysql> revoke select on a2.b2 from 'app1'@'192.168.91.%';
Query OK, 0 rows affected (0.07 sec)
那我们再看下权限
mysql> show grants for 'app1'@'192.168.91.%'G;
*************************** 1. row ***************************
Grants for app1@192.168.91.%: GRANT USAGE ON *.* TO `app1`@`192.168.91.%`
*************************** 2. row ***************************
Grants for app1@192.168.91.%: GRANT SELECT, INSERT, UPDATE, DELETE ON `a1`.* TO `app1`@`192.168.91.%`
*************************** 3. row ***************************
Grants for app1@192.168.91.%: GRANT SELECT (`sid`) ON `a3`.`b3` TO `app1`@`192.168.91.%`
3 rows in set (0.00 sec)
ERROR:
No query specified
我们发现a2.b2没有读的权限了
我们用客户端验证下
[root@localhost ~]# mysql -u app1 -h192.168.91.128 -p
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or g.
Your MySQL connection id is 21
Server version: 8.0.13 MySQL Community Server - GPL
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.
MySQL [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| a1 |
| a3 |
| information_schema |
+--------------------+
3 rows in set (0.00 sec)
是的,你没看错,a2连看都看不到了
我强制试试
MySQL [(none)]> use a2;
ERROR 1044 (42000): Access denied for user 'app1'@'192.168.91.%' to database 'a2'
看到了吧,权限直接拒绝了