Keeping Passwords Secure
562
• Use the
-p
or
--password
option on the command line with no password value specified. In this
case, the client program solicits the password interactively:
shell>
mysql -u francis -p db_name
Enter password: ********
The “
*
” characters indicate where you enter your password. The password is not displayed as you
enter it.
It is more secure to enter your password this way than to specify it on the command line because it is
not visible to other users. However, this method of entering a password is suitable only for programs
that you run interactively. If you want to invoke a client from a script that runs noninteractively, there
is no opportunity to enter the password from the keyboard. On some systems, you may even find
that the first line of your script is read and interpreted (incorrectly) as your password.
• Store your password in an option file. For example, on Unix, you can list your password in the
[client]
section of the
.my.cnf
file in your home directory:
[client]
password=your_pass
To keep the password safe, the file should not be accessible to anyone but yourself. To ensure this,
set the file access mode to
400
or
600
. For example:
shell>
chmod 600 .my.cnf
To name from the command line a specific option file containing the password, use the
--
defaults-file=file_name
[240]
option, where
file_name
is the full path name to the file. For
example:
shell>
mysql --defaults-file=/home/francis/mysql-opts
Section 4.2.3.3, “Using Option Files”
, discusses option files in more detail.
• Store your password in the
MYSQL_PWD
environment variable. See
Section 2.21, “Environment
Variables”
.
This method of specifying your MySQL password must be considered extremely insecure and should
not be used. Some versions of
ps
include an option to display the environment of running processes.
On some systems, if you set
MYSQL_PWD
, your password is exposed to any other user who runs
ps
. Even on systems without such a version of
ps
, it is unwise to assume that there are no other
methods by which users can examine process environments.
On Unix, the
mysql
client writes a record of executed statements to a history file (see
Section 4.5.1.3,
“
mysql
Logging”
). By default, this file is named
.mysql_history
and is created in your home
directory. Passwords can be written as plain text in SQL statements such as
CREATE USER
,
GRANT
,
and
SET PASSWORD
, so if you use these statements, they are logged in the history file. To keep this file
safe, use a restrictive access mode, the same way as described earlier for the
.my.cnf
file.
If your command interpreter is configured to maintain a history, any file in which the commands
are saved will contain MySQL passwords entered on the command line. For example,
bash
uses
~/.bash_history
. Any such file should have a restrictive access mode.
6.1.2.2. Administrator Guidelines for Password Security
Database administrators should use the following guidelines to keep passwords secure.
MySQL stores passwords for user accounts in the
mysql.user
table. Access to this table should
never be granted to any nonadministrative accounts.
Summary of Contents for 5.0
Page 1: ...MySQL 5 0 Reference Manual ...
Page 18: ...xviii ...
Page 60: ...40 ...
Page 396: ...376 ...
Page 578: ...558 ...
Page 636: ...616 ...
Page 844: ...824 ...
Page 1234: ...1214 ...
Page 1427: ...MySQL Proxy Scripting 1407 ...
Page 1734: ...1714 ...
Page 1752: ...1732 ...
Page 1783: ...Configuring Connector ODBC 1763 ...
Page 1793: ...Connector ODBC Examples 1773 ...
Page 1839: ...Connector Net Installation 1819 2 You must choose the type of installation to perform ...
Page 2850: ...2830 ...
Page 2854: ...2834 ...
Page 2928: ...2908 ...
Page 3000: ...2980 ...
Page 3122: ...3102 ...
Page 3126: ...3106 ...
Page 3174: ...3154 ...
Page 3232: ...3212 ...
