MySQL Password Security Enhancement Plugin

The validate_password plugin enforces password complexity rules in MySQL, available in versions 5.5 and later. By default, this plugin is not enabled in standard installations, allowing simple passwords with only warnings.

Enabling the Plugin

Add the following configuration to your my.cnf file:

[mysqld]
plugin-load-add = validate_password.so
validate_password = FORCE_PLUS_PERMANENT
validate_password_policy = STRONG

Configuration Parameters

View current settings with:

SHOW VARIABLES LIKE 'validate_password%';

Key Configuration Options:

• validate_password_policy: Defines password strength requirements
  • LOW (0): Only length requirement
  • MEDIUM (1): Requires digits, lowercase, upercase, and special characters
  • STRONG (2): MEDIUM requirements plus dictionary check
• validate_password_dictionary_file: Path to dictionary file for STRONG policy
• validate_password_length: Minimum password length (default: 8)
• validate_password_mixed_case_count: Minimum mixed case characters (default: 1)
• validate_password_number_count: Minimum numeric characters (default: 1)
• validate_password_special_char_count: Minimum special characters (default: 1)

Validation Examples

The plugin will reject passwords that: - Don't meet minimum length requirements - Lack required character types (uppercase, lowercase, digits, special characters) - Appear in the configured dictionary (for STRONG policy)

Enabling this plugin significantly improves database security by enforcing strong password policies.