<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="password-security-user">
      </a>
      8.1.2.1 End-User Guidelines for Password Security
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045252899392">
  </a>
  <p>
   MySQL users should use the following guidelines to keep
        passwords secure.
  </p>
  <p>
   When you run a client program to connect to the MySQL server, it
        is inadvisable to specify your password in a way that exposes it
        to discovery by other users. The methods you can use to specify
        your password when you run client programs are listed here,
        along with an assessment of the risks of each method. In short,
        the safest methods are to have the client program prompt for the
        password or to specify the password in a properly protected
        option file.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Use the
      <a class="link" href="mysql-config-editor.html" title="6.6.7 mysql_config_editor — MySQL Configuration Utility">
       <span class="command">
        <strong>
         mysql_config_editor
        </strong>
       </span>
      </a>
      utility,
            which enables you to store authentication credentials in an
            encrypted login path file named
      <code class="filename">
       .mylogin.cnf
      </code>
      . The file can be read
            later by MySQL client programs to obtain authentication
            credentials for connecting to MySQL Server. See
      <a class="xref" href="mysql-config-editor.html" title="6.6.7 mysql_config_editor — MySQL Configuration Utility">
       Section 6.6.7, “mysql_config_editor — MySQL Configuration Utility”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="indexterm" name="idm46045252892048">
      </a>
      <a class="indexterm" name="idm46045252890976">
      </a>
      Use a
      <code class="option">
       --password=
       <em class="replaceable">
        <code>
         password
        </code>
       </em>
      </code>
      or
      <code class="option">
       -p
       <em class="replaceable">
        <code>
         password
        </code>
       </em>
      </code>
      option on the command line. For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa36429482"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> francis <span class="token property">-pfrank</span> <em class="replaceable">db_name</em></code></pre>
     </div>
     <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Warning
      </div>
      <p>
       This is convenient
       <span class="emphasis">
        <em>
         but insecure
        </em>
       </span>
       . On
              some systems, your password becomes visible to system
              status programs such as
       <span class="command">
        <strong>
         ps
        </strong>
       </span>
       that may be
              invoked by other users to display command lines. MySQL
              clients typically overwrite the command-line password
              argument with zeros during their initialization sequence.
              However, there is still a brief interval during which the
              value is visible. Also, on some systems this overwriting
              strategy is ineffective and the password remains visible
              to
       <span class="command">
        <strong>
         ps
        </strong>
       </span>
       . (SystemV Unix systems and
              perhaps others are subject to this problem.)
      </p>
     </div>
     <p>
      If your operating environment is set up to display your
            current command in the title bar of your terminal window,
            the password remains visible as long as the command is
            running, even if the command has scrolled out of view in the
            window content area.
     </p>
    </li>
    <li class="listitem">
     <p>
      Use the
      <a class="link" href="connection-options.html#option_general_password">
       <code class="option">
        --password
       </code>
      </a>
      or
      <code class="option">
       -p
      </code>
      option on the command line with no
            password value specified. In this case, the client program
            solicits the password interactively:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa65622640"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token property">-u</span> francis <span class="token property">-p</span> <em class="replaceable">db_name</em>
Enter password<span class="token punctuation">:</span> ********</code></pre>
     </div>
     <p>
      The
      <code class="literal">
       *
      </code>
      characters indicate where you enter
            your password. The password is not displayed as you enter
            it.
     </p>
     <p>
      It is more secure to enter your password this way than to
            specify it on the command line because it is not visible to
            other users. However, this method of entering a password is
            suitable only for programs that you run interactively. If
            you want to invoke a client from a script that runs
            noninteractively, there is no opportunity to enter the
            password from the keyboard. On some systems, you may even
            find that the first line of your script is read and
            interpreted (incorrectly) as your password.
     </p>
    </li>
    <li class="listitem">
     <p>
      Store your password in an option file. For example, on Unix,
            you can list your password in the
      <code class="literal">
       [client]
      </code>
      section of the
      <code class="filename">
       .my.cnf
      </code>
      file in your home directory:
     </p>
     <a class="indexterm" name="idm46045252873376">
     </a>
     <a class="indexterm" name="idm46045252872304">
     </a>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa11164331"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[client]</span>
<span class="token constant">password</span><span class="token attr-value"><span class="token punctuation">=</span><em class="replaceable">password</em></span></code></pre>
     </div>
     <p>
      To keep the password safe, the file should not be accessible
            to anyone but yourself. To ensure this, set the file access
            mode to
      <code class="literal">
       400
      </code>
      or
      <code class="literal">
       600
      </code>
      .
            For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa6131574"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">chmod</span> 600 <span class="token punctuation">.</span>my<span class="token punctuation">.</span>cnf</code></pre>
     </div>
     <p>
      To name from the command line a specific option file
            containing the password, use the
      <a class="link" href="option-file-options.html#option_general_defaults-file">
       <code class="option">
        --defaults-file=
        <em class="replaceable">
         <code>
          file_name
         </code>
        </em>
       </code>
      </a>
      option, where
      <code class="filename">
       file_name
      </code>
      is the full
            path name to the file. For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa68688795"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">mysql</span> <span class="token constant">--defaults-file</span><span class="token attr-value"><span class="token punctuation">=</span>/home/francis/mysql-opts</span></code></pre>
     </div>
     <p>
      <a class="xref" href="option-files.html" title="6.2.2.2 Using Option Files">
       Section 6.2.2.2, “Using Option Files”
      </a>
      , discusses option files in
            more detail.
     </p>
    </li>
   </ul>
  </div>
  <a class="indexterm" name="idm46045252860208">
  </a>
  <p>
   On Unix, the
   <a class="link" href="mysql.html" title="6.5.1 mysql — The MySQL Command-Line Client">
    <span class="command">
     <strong>
      mysql
     </strong>
    </span>
   </a>
   client writes a record of
        executed statements to a history file (see
   <a class="xref" href="mysql-logging.html" title="6.5.1.3 mysql Client Logging">
    Section 6.5.1.3, “mysql Client Logging”
   </a>
   ). By default, this file is named
   <code class="filename">
    .mysql_history
   </code>
   and is created in your home
        directory. Passwords can be written as plain text in SQL
        statements such as
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   and
   <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
    <code class="literal">
     ALTER USER
    </code>
   </a>
   , so if you use
        these statements, they are logged in the history file. To keep
        this file safe, use a restrictive access mode, the same way as
        described earlier for the
   <code class="filename">
    .my.cnf
   </code>
   file.
  </p>
  <p>
   If your command interpreter maintains a history, any file in
        which the commands are saved contains MySQL passwords entered on
        the command line. For example,
   <span class="command">
    <strong>
     bash
    </strong>
   </span>
   uses
   <code class="filename">
    ~/.bash_history
   </code>
   . Any such file should have
        a restrictive access mode.
  </p>
 </div>
 <br/>
</div>
