Is it possible for MySQL users to prevent/disable changing their password with just the USAGE option? There are no global permissions allowed. I tried to google, but had no luck.
One way to achieve this could be by using pluggable authentication. This way the password is stored externally and therefore can't be changed from within mysql. This allows you to use PAM, LDAP or other authentication services.
For PAM, assuming you have configured PAM already in your OS (assuming Linux below), then in MySQL do:
INSTALL PLUGIN authentication_pam SONAME 'authentication_pam.so'; CREATE USER bob@'%' IDENTIFIED WITH authentication_pam AS 'mysql';
AS 'mysql' refers to a file
If the user then tries to set their password (I've tested this only on MariaDB with the unix_socket plugin):
SET PASSWORD = PASSWORD('My_very_clever_password');
... that query will "work", however it gives a warning:
SET PASSWORD has no significance for users authenticating via plugins
If you absolutely need this, you should be able to recompile MySQL, setting all instances in
I was able to resolve this by setting the
read_only parameter on my server. This would take action on every non super-user though, so it may not be ideal for all situations.