Account Management Statements
1157
If
NO_AUTO_CREATE_USER
[536]
is enabled and the account does not exist,
GRANT
fails and does not
create the account unless the
IDENTIFIED BY
clause is given to provide a nonempty password.
Important
GRANT
may be recorded in server logs or in a history file such as
~/.mysql_history
, which means that cleartext passwords may be read by
anyone having read access to that information. See
Section 6.1.2, “Keeping
Passwords Secure”
.
Other Account Characteristics
The
WITH
clause is used for several purposes:
• To enable a user to grant privileges to other users
• To specify resource limits for a user
• To specify whether and how a user must use secure connections to the server
The
WITH GRANT OPTION
clause gives the user the ability to give to other users any privileges
the user has at the specified privilege level. You should be careful to whom you give the
GRANT
OPTION
[577]
privilege because two users with different privileges may be able to combine privileges!
You cannot grant another user a privilege which you yourself do not have; the
GRANT OPTION
[577]
privilege enables you to assign only those privileges which you yourself possess.
Be aware that when you grant a user the
GRANT OPTION
[577]
privilege at a particular privilege level,
any privileges the user possesses (or may be given in the future) at that level can also be granted by
that user to other users. Suppose that you grant a user the
INSERT
[577]
privilege on a database.
If you then grant the
SELECT
[578]
privilege on the database and specify
WITH GRANT OPTION
,
that user can give to other users not only the
SELECT
[578]
privilege, but also
INSERT
[577]
. If you
then grant the
UPDATE
[578]
privilege to the user on the database, the user can grant
INSERT
[577]
,
SELECT
[578]
, and
UPDATE
[578]
.
For a nonadministrative user, you should not grant the
ALTER
[576]
privilege globally or for the
mysql
database. If you do that, the user can try to subvert the privilege system by renaming tables!
For additional information about security risks associated with particular privileges, see
Section 6.2.1,
“Privileges Provided by MySQL”
.
Several
WITH
clause options specify limits on use of server resources by an account:
• The
MAX_QUERIES_PER_HOUR count
,
MAX_UPDATES_PER_HOUR count
, and
MAX_CONNECTIONS_PER_HOUR count
limits restrict the number of queries, updates, and
connections to the server permitted to this account during any given one-hour period. (Queries for
which results are served from the query cache do not count against the
MAX_QUERIES_PER_HOUR
limit.) If
count
is
0
(the default), this means that there is no limitation for the account.
• The
MAX_USER_CONNECTIONS count
limit, implemented in MySQL 5.0.3, restricts the
maximum number of simultaneous connections to the server by the account. A nonzero
count
specifies the limit for the account explicitly. If
count
is
0
(the default), the server
determines the number of simultaneous connections for the account from the global value of the
max_user_connections
[472]
system variable. If
max_user_connections
[472]
is also zero,
there is no limit for the account.
To specify resource limits for an existing user without affecting existing privileges, use
GRANT USAGE
at the global level (
ON *.*
) and name the limits to be changed. For example:
GRANT USAGE ON *.* TO ...
WITH MAX_QUERIES_PER_HOUR 500 MAX_UPDATES_PER_HOUR 100;
Summary of Contents for 5.0
Page 1: ...MySQL 5 0 Reference Manual ...
Page 18: ...xviii ...
Page 60: ...40 ...
Page 396: ...376 ...
Page 578: ...558 ...
Page 636: ...616 ...
Page 844: ...824 ...
Page 1234: ...1214 ...
Page 1427: ...MySQL Proxy Scripting 1407 ...
Page 1734: ...1714 ...
Page 1752: ...1732 ...
Page 1783: ...Configuring Connector ODBC 1763 ...
Page 1793: ...Connector ODBC Examples 1773 ...
Page 1839: ...Connector Net Installation 1819 2 You must choose the type of installation to perform ...
Page 2850: ...2830 ...
Page 2854: ...2834 ...
Page 2928: ...2908 ...
Page 3000: ...2980 ...
Page 3122: ...3102 ...
Page 3126: ...3106 ...
Page 3174: ...3154 ...
Page 3232: ...3212 ...