0

Is it possible for MySQL users to prevent/disable changing their password with just the USAGE option? There are no global permissions allowed. I tried to google, but had no luck.

3
+25

One way to achieve this could be by using pluggable authentication. This way the password is stored externally and therefore can't be changed from within mysql. This allows you to use PAM, LDAP or other authentication services.

For PAM, assuming you have configured PAM already in your OS (assuming Linux below), then in MySQL do:

INSTALL PLUGIN authentication_pam SONAME 'authentication_pam.so';
CREATE USER bob@'%' IDENTIFIED WITH authentication_pam AS 'mysql'; 

... where AS 'mysql' refers to a file /etc/pam.d/mysql.

If the user then tries to set their password (I've tested this only on MariaDB with the unix_socket plugin):

SET PASSWORD = PASSWORD('My_very_clever_password');

... that query will "work", however it gives a warning:

SET PASSWORD has no significance for users authenticating via plugins

1

Recompiling

If you absolutely need this, you should be able to recompile MySQL, setting all instances in sql_authentication.cc changing AUTH_FLAG_USES_INTERNAL_STORAGE to AUTH_FLAG_PRIVILEGED_USER_FOR_PASSWORD_CHANGE. YMMV.

0

I was able to resolve this by setting the read_only parameter on my server. This would take action on every non super-user though, so it may not be ideal for all situations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.