MySQL 用户创建与授权最佳实践

SELECT User, Host FROM mysql.user;

CREATE USER 'username'@'host' IDENTIFIED BY 'password';

-- 创建可以从本地连接的用户
CREATE USER 'dev_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';
-- 创建可以从任何主机连接的用户(不推荐，存在安全风险)
CREATE USER 'remote_user'@'%' IDENTIFIED BY 'AnotherStrongPassword!';
-- 创建可以从特定IP段连接的用户
CREATE USER 'app_user'@'192.168.1.%' IDENTIFIED BY 'AppPassword456';

-- 设置密码过期策略
CREATE USER 'temp_user'@'localhost' 
IDENTIFIED BY 'temp_pass' 
PASSWORD EXPIRE INTERVAL 90 DAY;
-- 锁定新创建的用户
CREATE USER 'locked_user'@'localhost' 
IDENTIFIED BY 'locked_pass' 
ACCOUNT LOCK;

GRANT privilege_type ON database_name.table_name TO 'username'@'host';

-- 授予特定数据库的所有权限
GRANT ALL PRIVILEGES ON mydb.* TO 'dev_user'@'localhost';
-- 授予特定表的SELECT, INSERT, UPDATE权限
GRANT SELECT, INSERT, UPDATE ON mydb.customers TO 'app_user'@'192.168.1.%';
-- 授予创建临时表的权限
GRANT CREATE TEMPORARY TABLES ON *.* TO 'report_user'@'localhost';
-- 授予执行存储过程的权限
GRANT EXECUTE ON PROCEDURE mydb.update_stats TO 'proc_user'@'localhost';
-- 授予所有数据库的只读权限
GRANT SELECT ON *.* TO 'readonly_user'@'%';

GRANT ALL PRIVILEGES ON mydb.* 
TO 'admin_user'@'localhost' 
WITH GRANT OPTION;

FLUSH PRIVILEGES;

-- 查看特定用户的权限
SHOW GRANTS FOR 'username'@'host';
-- 例如
SHOW GRANTS FOR 'dev_user'@'localhost';

-- 基本语法
REVOKE privilege_type ON database_name.table_name FROM 'username'@'host';
-- 示例：撤销INSERT权限
REVOKE INSERT ON mydb.* FROM 'app_user'@'192.168.1.%';
-- 撤销所有权限
REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'username'@'host';

RENAME USER 'old_user'@'localhost' TO 'new_user'@'localhost';

-- MySQL 5.7.6及以上版本
ALTER USER 'username'@'host' IDENTIFIED BY 'new_password';
-- 旧版本语法
SET PASSWORD FOR 'username'@'host' = PASSWORD('new_password');

-- 锁定用户
ALTER USER 'username'@'host' ACCOUNT LOCK;
-- 解锁用户
ALTER USER 'username'@'host' ACCOUNT UNLOCK;

DROP USER 'username'@'host';
-- 示例
DROP USER 'old_user'@'localhost';

-- 创建角色
CREATE ROLE 'read_only', 'app_developer';
-- 授予角色权限
GRANT SELECT ON *.* TO 'read_only';
GRANT ALL ON app_db.* TO 'app_developer';
-- 将角色授予用户
GRANT 'read_only' TO 'report_user'@'localhost';
GRANT 'app_developer' TO 'dev_user'@'localhost';
-- 激活角色
SET DEFAULT ROLE ALL TO 'dev_user'@'localhost';

-- 设置全局密码策略
SET GLOBAL validate_password.policy = STRONG;
-- 创建用户时指定密码策略
CREATE USER 'secure_user'@'localhost' 
IDENTIFIED WITH 'mysql_native_password' BY 'Complex@Password123' 
PASSWORD REQUIRE CURRENT;