详解MySQL8.0 密码过期策略

[root@VM-0-14-centos ~]# /usr/local/mysql-8.0.19-el7-x86_64/bin/mysql -uyeyz -pyeyz -h127.0.0.1 -P4306 -e "select 1"
mysql: [Warning] Using a password on the command line interface can be insecure.
+---+
| 1 |
+---+
| 1 |
+---+

mysql> alter user yeyz@'127.0.0.1' password expire;
Query OK, 0 rows affected (0.01 sec)

[root@VM-0-14-centos ~]# /usr/local/mysql-8.0.19-el7-x86_64/bin/mysql -uyeyz -pyeyz -h127.0.0.1 -P4306 -e "select 1"
mysql: [Warning] Using a password on the command line interface can be insecure.
Please use --connect-expired-password option or invoke mysql in interactive mode.

-- 提示我们通过--connect-expire-password命令来进行连接，我们加上看看

[root@VM-0-14-centos ~]# /usr/local/mysql-8.0.19-el7-x86_64/bin/mysql -uyeyz -pyeyz -h127.0.0.1 -P4306 --connect-expired-password -e "select 1" 
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1820 (HY000) at line 1: You must reset your password using ALTER USER statement before executing this statement.

-- 这里提示我们先执行alter user的语法来修改密码，然后再使用密码。

-- 设置密码永不过期
mysql> create user yeyz1@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz1' password expire never;
Query OK, 0 rows affected (0.01 sec)

-- 设置密码过期天数为指定天数
mysql> create user yeyz2@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz2' password expire interval 90 day; 
Query OK, 0 rows affected (0.01 sec)

mysql> create user yeyz3@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz3' password expire default;
Query OK, 0 rows affected (0.01 sec)

mysql> show variables like '%lifetime%';
+---------------------------+-------+
| Variable_name | Value |
+---------------------------+-------+
| default_password_lifetime | 0 |
+---------------------------+-------+
1 row in set (0.00 sec)

mysql> alter user yeyz@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz';
Query OK, 0 rows affected (0.01 sec)

mysql> 
mysql> show variables like '%password_history%';
+------------------+-------+
| Variable_name | Value |
+------------------+-------+
| password_history | 0 |
+------------------+-------+
1 row in set (0.00 sec)

mysql> set global password_history=2;
Query OK, 0 rows affected (0.00 sec)

-- 第一次修改，成功
mysql> alter user yeyz@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz';
Query OK, 0 rows affected (0.01 sec)

-- 第二次修改，报错
mysql> alter user yeyz@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz';
ERROR 3638 (HY000): Cannot use these credentials for 'yeyz@127.0.0.1' because they contradict the password history policy
mysql> 

-- 设置密码为每间隔5次才可以重复使用
mysql> create user yeyz3@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz3' password history 5;
Query OK, 0 rows affected (0.01 sec)

-- 设置密码为每隔5天才可以重复使用
mysql> create user yeyz4@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz4' password reuse interval 5 day; 
Query OK, 0 rows affected (0.01 sec)

-- 设置密码为每隔5天可以重复使用或者每个5次才可以重复使用，取最严格的那个条件
mysql> create user yeyz5@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz5' password reuse interval 5 day password history 5;
Query OK, 0 rows affected (0.01 sec)

-- 使用默认的全局密码可重复使用策略，也就是password history参数和password reuse interval参数
mysql> create user yeyz6@'127.0.0.1' identified with 'mysql_native_password' by 'yeyz6' password reuse interval default password history default; 
Query OK, 0 rows affected (0.01 sec)