MySQL用户权限控制一例

 

Preface

 

    I supposed we are encountering a situation that there's an anonymous user has connected in our MySQL database with an account which has large privileges.The user is doing some query operations with bad performance.Which may subsequently lead to a high load of our database server.How to solve this issue efficiently and immediately?There's a little trick we can use below.

 

Example

 

Create a test account.

 (root@localhost mysql3306.sock)[(none)]>create user aaron8219@'192.168.1.%' identified by 'zlm';
 Query OK,  rows affected (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>select user,host from mysql.user;
 +---------------+-------------+
 | user          | host        |
 +---------------+-------------+
 | rpl_mgr       | %           |
 | aaron8219     | 192.168..% |
 | repl          | 192.168..% |
 | replica       | 192.168..% |
 | zlm           | 192.168..% |
 | mysql.session | localhost   |
 | mysql.sys     | localhost   |
 | root          | localhost   |
 +---------------+-------------+
  rows in set (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>grant all privileges on *.* to aaron8219@'192.168.1.%'; //Grant the supreme privileges to the user.
 Query OK,  rows affected (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>show grants for aaron8219@'192.168.1.%';
 +----------------------------------------------------------+
 | Grants for aaron8219@192.168..%                         |
 +----------------------------------------------------------+
 | GRANT ALL PRIVILEGES ON *.* TO 'aaron8219'@'192.168.1.%' |
 +----------------------------------------------------------+
  row in set (0.00 sec)

Connect to database with the new account.

 [root@zlm2 :: ~]
 #mysql -uaaron8219 -pzlm -h192.168.1.
 mysql: [Warning] Using a password on the command line interface can be insecure.
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is
 Server version: 5.7.-log MySQL Community Server (GPL)

 Copyright (c) , , Oracle and/or its affiliates. All rights reserved.

 Oracle is a registered trademark of Oracle Corporation and/or its
 affiliates. Other names may be trademarks of their respective
 owners.

 Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

 (aaron8219@192.168.1.101 )[(none)]>show databases; //The user "aaron8219" can see all the databases in the current MySQL instance.
 +--------------------+
 | Database           |
 +--------------------+
 | information_schema |
 | mysql              |
 | performance_schema |
 | sys                |
 | sysbench           |
 | zlm                |
 +--------------------+
  rows in set (0.01 sec)

 (aaron8219@192.168.1.101 )[(none)]>create database aaron8219;
 Query OK,  row affected (0.00 sec)

 (aaron8219@192.168.1.101 )[(none)]>use aaron8219;
 Database changed
 (aaron8219@192.168.1.101 )[aaron8219]>create table t1(
     -> id int,
     -> name char()
     -> ) engine=innodb;
 Query OK,  rows affected (0.02 sec)

Create another precise account which name is equal to the one above and with an intact ip address.

 

 (root@localhost mysql3306.sock)[(none)]>create user aaron8219@'192.168.1.101' identified by 'zlm';
 Query OK,  rows affected (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>select user,host from mysql.user;
 +---------------+---------------+
 | user          | host          |
 +---------------+---------------+
 | rpl_mgr       | %             |
 | aaron8219     | 192.168..%   |
 | repl          | 192.168..%   |
 | replica       | 192.168..%   |
 | zlm           | 192.168..%   |
 | aaron8219     | 192.168.1.101 |
 | mysql.session | localhost     |
 | mysql.sys     | localhost     |
 | root          | localhost     |
 +---------------+---------------+
  rows in set (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>grant all privileges on aaron8219.* to aaron8219@'192.168.1.101'; //Grant the privileges only on "aaron8219" database.
 Query OK,  rows affected (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>show grants for aaron8219@'192.168.1.101';
 +----------------------------------------------------------------------+
 | Grants for aaron8219@192.168.1.101                                   |
 +----------------------------------------------------------------------+
 | GRANT USAGE ON *.* TO 'aaron8219'@'192.168.1.101'                    |
 | GRANT ALL PRIVILEGES ON `aaron8219`.* TO 'aaron8219'@'192.168.1.101' |
 +----------------------------------------------------------------------+
  rows in set (0.00 sec)

Connect to database with the account again.

 [root@zlm2 :: ~]
 #mysql -uaaron8219 -pzlm -h192.168.1.
 mysql: [Warning] Using a password on the command line interface can be insecure.
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is
 Server version: 5.7.-log MySQL Community Server (GPL)

 Copyright (c) , , Oracle and/or its affiliates. All rights reserved.

 Oracle is a registered trademark of Oracle Corporation and/or its
 affiliates. Other names may be trademarks of their respective
 owners.

 Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

 (aaron8219@192.168.1.101 )[(none)]>show databases; //Only the "aaron8219" database can be list.
 +--------------------+
 | Database           |
 +--------------------+
 | information_schema |
 | aaron8219          |
 +--------------------+
  rows in set (0.00 sec)

 (aaron8219@192.168.1.101 )[(none)]>show grants for aaron8219@'192.168.1.101';
 +----------------------------------------------------------------------+
 | Grants for aaron8219@192.168.1.101                                   |
 +----------------------------------------------------------------------+
 | GRANT USAGE ON *.* TO 'aaron8219'@'192.168.1.101'                    |
 | GRANT ALL PRIVILEGES ON `aaron8219`.* TO 'aaron8219'@'192.168.1.101' |
 +----------------------------------------------------------------------+
  rows in set (0.00 sec)

 (aaron8219@192.168.1.101 )[(none)]>use aaron8219;
 Reading table information for completion of table and column names
 You can turn off this feature to get a quicker startup with -A

 Database changed
 (aaron8219@192.168.1.101 )[aaron8219]>show tables;
 +---------------------+
 | Tables_in_aaron8219 |
 +---------------------+
 | t1                  |
 +---------------------+
  row in set (0.00 sec)

 (aaron8219@192.168.1.101 )[aaron8219]>insert into t1 values(,'abc');
 Query OK,  row affected (0.00 sec)

 (aaron8219@192.168.1.101 )[aaron8219]>select * from t1;
 +------+------+
 | id   | name |
 +------+------+
 |     | abc  |
 +------+------+
  row in set (0.00 sec)

 //Eventrually,the privileges of account aaron8219@'192.168.1.%' has been restricted merely on database "aaron8219".
 //Further more,we can revoke all the privileges on it either.

Revoke the all privileges of the account.

 (root@localhost mysql3306.sock)[(none)]>revoke all privileges on aaron8219.* from aaron8219@'192.168.1.101';
 Query OK,  rows affected (0.00 sec)

 (root@localhost mysql3306.sock)[(none)]>show grants for aaron8219@'192.168.1.101';
 +---------------------------------------------------+
 | Grants for aaron8219@192.168.1.101                |
 +---------------------------------------------------+
 | GRANT USAGE ON *.* TO 'aaron8219'@'192.168.1.101' |
 +---------------------------------------------------+
  row in set (0.00 sec)

Connect to database with the account third times.

 [root@zlm2 :: ~]
 #mysql -uaaron8219 -pzlm -h192.168.1.
 mysql: [Warning] Using a password on the command line interface can be insecure.
 Welcome to the MySQL monitor.  Commands end with ; or \g.
 Your MySQL connection id is
 Server version: 5.7.-log MySQL Community Server (GPL)

 Copyright (c) , , Oracle and/or its affiliates. All rights reserved.

 Oracle is a registered trademark of Oracle Corporation and/or its
 affiliates. Other names may be trademarks of their respective
 owners.

 Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

 (aaron8219@192.168.1.101 )[(none)]>show databases;
 +--------------------+
 | Database           |
 +--------------------+
 | information_schema |
 +--------------------+
  row in set (0.00 sec)

 (aaron8219@192.168.1.101 )[(none)]>create database test;
 ERROR  (): Access denied for user 'aaron8219'@'192.168.1.101' to database 'test'

 //This time,the account of aaron8219 login with ip "192.168.1.101" can do nothing in the target instance.