The following mysqld options affect security:
Table 1.1. Security Option/Variable Summary
|Name||Cmd-Line||Option file||System Var||Status Var||Var Scope||Dynamic|
|- Variable: local_infile|
|- Variable: old_passwords||Yes||Both||Yes|
|- Variable: secure_auth||Yes||Global||Yes|
|- Variable: secure_file_priv||Yes||Global||No|
|- Variable: skip_networking||Yes||Global||No|
|- Variable: skip_show_database||Yes||Global||No|
This option controls whether user-defined functions that have
xxx symbol for the main function
can be loaded. By default, the option is off and only UDFs
that have at least one auxiliary symbol can be loaded; this
prevents attempts at loading functions from shared object
files other than those containing legitimate UDFs. See
User-Defined Function Security Precautions.
If you start the server with
LOAD DATA statements. See
Section 1.5, “Security Issues with
Force the server to generate short (pre-4.1) password hashes for new passwords. This is useful for compatibility when the server must support older client programs. See Section 1.2.3, “Password Hashing in MySQL”.
MySQL Enterprise. The MySQL Enterprise Monitor offers advice on the security implications of using this option. For subscription information, see http://www.mysql.com/products/enterprise/advisors.html.
In previous versions of MySQL, this option caused the
SHOW DATABASES statement to
display the names of only those databases for which the user
had some kind of privilege. In MySQL 5.4, this
option is no longer available as this is now the default
behavior, and there is a
DATABASES privilege that can be used to control
access to database names on a per-account basis. See
If this option is enabled, a user cannot create new MySQL
users by using the
statement unless the user has the
INSERT privilege for the
mysql.user table or any column in the
table. If you want a user to have the ability to create new
users that have those privileges that the user has the right
to grant, you should grant the user the following privilege:
GRANT INSERT(user) ON mysql.user TO '
This ensures that the user cannot change any privilege columns
directly, but has to use the
GRANT statement to give
privileges to other users.
Disallow authentication for accounts that have old (pre-4.1) passwords.
The mysql client also has a
--secure-auth option, which
prevents connections to a server if the server requires a
password in old format for the client account.
This option causes the server not to use the privilege system
at all. This gives anyone with access to the server
unrestricted access to all
databases. You can cause a running server to start
using the grant tables again by executing mysqladmin
flush-privileges or mysqladmin
reload command from a system shell, or by issuing a
PRIVILEGES statement. This option also suppresses
loading of plugins and user-defined functions (UDFs).
Host names are not resolved. All
column values in the grant tables must be IP numbers or
Do not allow TCP/IP connections over the network. All connections to mysqld must be made via Unix socket files.
With this option, the
DATABASES statement is allowed only to users who
privilege, and the statement displays all database names.
Without this option,
DATABASES is allowed to all users, but displays each
database name only if the user has the
SHOW DATABASES privilege or
some privilege for the database. Note that any global
privilege is a privilege for the database.