Access Control, Stage 1: Connection Verification
586
Nonblank
Password
values in the
user
table represent encrypted passwords. MySQL does not
store passwords in plaintext form for anyone to see. Rather, the password supplied by a user who is
attempting to connect is encrypted (using the
PASSWORD()
[956]
function). The encrypted password
then is used during the connection process when checking whether the password is correct. This is
done without the encrypted password ever traveling over the connection. See
Section 6.3.1, “User
Names and Passwords”
.
From MySQL's point of view, the encrypted password is the real password, so you should never give
anyone access to it. In particular, do not give nonadministrative users read access to tables in the
mysql
database.
The following table shows how various combinations of
Host
and
User
values in the
user
table apply
to incoming connections.
Host
Value
User
Value
Permissible Connections
'thomas.loc.gov'
'fred'
fred
, connecting from
thomas.loc.gov
'thomas.loc.gov'
''
Any user, connecting from
thomas.loc.gov
'%'
'fred'
fred
, connecting from any host
'%'
''
Any user, connecting from any host
'%.loc.gov'
'fred'
fred
, connecting from any host in the
loc.gov
domain
'x.y.%'
'fred'
fred
, connecting from
x.y.net
,
x.y.com
,
x.y.edu
, and so on; this is probably not useful
'144.155.166.177'
'fred'
fred
, connecting from the host with IP address
144.155.166.177
'144.155.166.%'
'fred'
fred
, connecting from any host in the
144.155.166
class C subnet
'144.155.166.0/255.255.255.0'
'fred'
Same as previous example
It is possible for the client host name and user name of an incoming connection to match more than
one row in the
user
table. The preceding set of examples demonstrates this: Several of the entries
shown match a connection from
thomas.loc.gov
by
fred
.
When multiple matches are possible, the server must determine which of them to use. It resolves this
issue as follows:
• Whenever the server reads the
user
table into memory, it sorts the rows.
• When a client attempts to connect, the server looks through the rows in sorted order.
• The server uses the first row that matches the client host name and user name.
The server uses sorting rules that order rows with the most-specific
Host
values first. Literal host
names and IP addresses are the most specific. (The specificity of a literal IP address is not affected by
whether it has a netmask, so
192.168.1.13
and
192.168.1.0/255.255.255.0
are considered
equally specific.) The pattern
'%'
means “any host” and is least specific. The empty string
''
also
means “any host” but sorts after
'%'
. Rows with the same
Host
value are ordered with the most-
specific
User
values first (a blank
User
value means “any user” and is least specific).
To see how this works, suppose that the
user
table looks like this:
+-----------+----------+-
| Host | User | ...
+-----------+----------+-
| % | root | ...
| % | jeffrey | ...
| localhost | root | ...
| localhost | | ...
+-----------+----------+-
Summary of Contents for 5.0
Page 1: ...MySQL 5 0 Reference Manual ...
Page 18: ...xviii ...
Page 60: ...40 ...
Page 396: ...376 ...
Page 578: ...558 ...
Page 636: ...616 ...
Page 844: ...824 ...
Page 1234: ...1214 ...
Page 1427: ...MySQL Proxy Scripting 1407 ...
Page 1734: ...1714 ...
Page 1752: ...1732 ...
Page 1783: ...Configuring Connector ODBC 1763 ...
Page 1793: ...Connector ODBC Examples 1773 ...
Page 1839: ...Connector Net Installation 1819 2 You must choose the type of installation to perform ...
Page 2850: ...2830 ...
Page 2854: ...2834 ...
Page 2928: ...2908 ...
Page 3000: ...2980 ...
Page 3122: ...3102 ...
Page 3126: ...3106 ...
Page 3174: ...3154 ...
Page 3232: ...3212 ...
