Update user password in Mysql 5.7

问题

I wrote an installation script to change the root password with this SQL command:

UPDATE user SET password='*C563415623144561...' WHERE user='root';

This doesn't work on Mysql 5.7: http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-6.html#mysqld-5-7-6-account-management

My question is: how to change this command with another one compatible with 5.6 and 5.7 version of Mysql? I would like to update the password with a hashed string and not with a clear password.

回答1:

This is no more password field in the user table as of mysql 5.7. It's now called authentication_string. You can change or set the password like this:

set password for 'jeff'@'localhost' = PASSWORD('mypass'); // this automatically hashes the password

If you you want to use your query , just change password to authentication_string,and it will work.

UPDATE user SET authentication_string='*C563415623144561...' WHERE user='root@localhost';

Hope this help.

回答2:

I've used this command to reset to empty password in Mysql 5.7.22

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '';

回答3:

Given that 'SET PASSWORD FOR = PASSWORD('')' is deprecated as on mysql 5.7. If not done correctly you could even end up with below error in syslog.

The plugin 'auth_socket' used to authenticate user 'root'@'localhost' is not loaded. Nobody can currently login using this account.

I suggest to use below command.

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'mypass';

https://www.percona.com/blog/2016/03/16/change-user-password-in-mysql-5-7-with-plugin-auth_socket/

回答4:

First of all look your specified mysql version security policies.

show variables like '%validate_password%';

you can change this policy if you like with

set variable_name=new_value;

Changing appropriate user password.

MySQL 5.7.5 and earlier version:

SET PASSWORD FOR 'user_name' = PASSWORD('new_password');

MySQL 5.7.6 and later version:

alter user 'user_name' identified by 'new_password';

回答5:

For Server version: 5.7.25 - MySQL Community Server (GPL). Use below query as password is no more valid and replaced by authentication_string

UPDATE user SET authentication_string = PASSWORD('yourpassword'), password_last_changed = NULL
WHERE user.Host = 'localhost' AND user.User = 'username';

回答6:

I'm no MySQL authority, but based on MySQL's current 5.7 documentation, the suggestions in the currently accepted and most upvoted answer strike me as inadvisable. (This is likely due to the passage of time -- the question and @mdamia's answer were both posted in 2015.)

The MySQL 5.7.6 (2015-03-09, Milestone 16) release notes linked by @Tobia's question say "ALTER USER is now the preferred statement for assigning passwords."

The question did ask if a single command could be used for both MySQL 5.6 and 5.7, but given that the ALTER USER syntax implemented by MySQL >= 5.7.6 offers a security enhancement, I would use the newer syntax when it is available. If I still had to operate a MySQL < 5.7.6 installation, I would limit my use of older and deprecated/discouraged password-updating syntax to those circumstances.

The ALTER USER statements suggested by @Carlos Alberto García Guardia and @Venkat Kotra in their answers thus seem to me like the right syntax to use for MySQL >= 5.7.6. Two examples (adapted from their answers and the ALTER USER documentation for MySQL 5.7): :

ALTER USER '<username>'@'localhost'
  IDENTIFIED BY '<new_cleartext_password>';

ALTER USER '<username>'@'localhost'
  IDENTIFIED WITH <auth_plugin>
  BY '<new_cleartext_password>';

The second example above contains an optional WITH clause to specify an authentication plugin. The plugin specified gets written to the "plugin" field of the mysql.user table. For background on the history and future of MySQL authentication plugins, I found these MySQL Server Team blog posts helpful:

1. "Protecting MySQL Passwords With the sha256_password Plugin"

2. "New Default Authentication Plugin: caching_sha2_password"

In answer to @Tobia's question how to pass the new password to MySQL in hashed format rather than cleartext, the MySQL ALTER USER documentation indicates that this is done by using AS in place of BY in the ALTER USER statement:

ALTER USER '<username>'@'localhost'
  IDENTIFIED WITH <auth_plugin>
  AS '<new_hashed_password_value>';

When using AS instead of BY, the ALTER USER documentation says, the password string "is assumed to be already in the format the authentication plugin requires, and is stored as is in the mysql.user table." If a plugin requires a hashed value, "the value must be hashed in a format appropriate for the plugin. Otherwise, the value is not usable by the plugin and correct authentication of client connections will not occur." Id.

---

The currently accepted answer suggests using either a SET PASSWORD ... PASSWORD() statement or an UPDATE statement (the former for passing the new password in cleartext and the latter for passing it in hashed format):

SET PASSWORD 
  FOR '<username>'@'localhost' = 
  PASSWORD('<mypass_in_cleartext>');

or

UPDATE mysql.user
  SET authentication_string='<mypass_as_hash>'
  WHERE User='<username>';

These statements are deprecated and/or discouraged in relation to the currently preferred ALTER USER statement.

SET PASSWORD ... = PASSWORD(<cleartext>) "is deprecated as of MySQL 5.7.6 and will be removed in a future MySQL release", according to the SET PASSWORD documentation.

The SET PASSWORD ... = 'auth_string' syntax (i.e., leaving out the PASSWORD(str) encryption function) "is not deprecated, but ALTER USER is the preferred statement for account alterations, including assigning passwords." Id. See also Removal and Deprecation in MySQL 5.7:

We have deprecated the SET PASSWORD syntax and the PASSWORD() function. The existing ALTER USER statement is modified to cover the deprecated functionality. The PASSWORD() function was originally introduced as a way to manually update the mysql.user table. This is generally a bad idea and we want to leave the task of managing user authentication properties exclusively to using the ALTER USER statement which automatically determines which authentication plugin should be used and then adjusts the password algorithm accordingly.

As described by the manual, it also appears that UPDATE is less secure than ALTER PASSWORD with respect to logging. The manual indicates that UPDATE statements are written to logs as is, becoming visible to anyone with read access to the logs.[1] In contrast, the manual indicates, when MySQL writes ALTER USER ... IDENTIFIED BY ... statements (and also SET PASSWORD statements) to logs, it rewrites the contained passwords so they do "not appear literally".[1]

At least in most circumstances. The documentation for SET PASSWORD and ALTER USER warns that these statements too can be logged with visible passwords "under some circumstances",[2] although presumably not in all circumstances as apparently is the case with UPDATE.

1: See MySQL 5.7 manual on password logging ("In particular, INSERT or UPDATE statements for the mysql.user system table that refer to literal passwords are logged as is, so you should avoid such statements. (Direct modification of grant tables is discouraged, anyway.)")

2: See MySQL 5.7 SET PASSWORD documentation and MySQL 5.7 ALTER USER documentation

---

Disclaimer: I'm just sharing my interpretation upon reading the MySQL manual today. I haven't tested MySQL's behavior with respect to what password-altering statements it logs where in what format.

来源：https://stackoverflow.com/questions/32208000/update-user-password-in-mysql-5-7