<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="password-security-admin">
      </a>
      8.1.2.2 Administrator Guidelines for Password Security
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045252849264">
  </a>
  <p>
   Database administrators should use the following guidelines to
        keep passwords secure.
  </p>
  <p>
   MySQL stores passwords for user accounts in the
   <code class="literal">
    mysql.user
   </code>
   system table. Access to this table
        should never be granted to any nonadministrative accounts.
  </p>
  <p>
   Account passwords can be expired so that users must reset them.
        See
   <a class="xref" href="password-management.html" title="8.2.15 Password Management">
    Section 8.2.15, “Password Management”
   </a>
   , and
   <a class="xref" href="expired-password-handling.html" title="8.2.16 Server Handling of Expired Passwords">
    Section 8.2.16, “Server Handling of Expired Passwords”
   </a>
   .
  </p>
  <p>
   The
   <code class="literal">
    validate_password
   </code>
   plugin can be used to
        enforce a policy on acceptable password. See
   <a class="xref" href="validate-password.html" title="8.4.3 The Password Validation Component">
    Section 8.4.3, “The Password Validation Component”
   </a>
   .
  </p>
  <p>
   A user who has access to modify the plugin directory (the value
        of the
   <a class="link" href="server-system-variables.html#sysvar_plugin_dir">
    <code class="literal">
     plugin_dir
    </code>
   </a>
   system
        variable) or the
   <code class="filename">
    my.cnf
   </code>
   file that specifies
        the plugin directory location can replace plugins and modify the
        capabilities provided by plugins, including authentication
        plugins.
  </p>
  <p>
   Files such as log files to which passwords might be written
        should be protected. See
   <a class="xref" href="password-logging.html" title="8.1.2.3 Passwords and Logging">
    Section 8.1.2.3, “Passwords and Logging”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
