ApsaraDB RDS:Custom password policy

Features

ApsaraDB RDS for MySQL supports the validate_password plugin, which lets you define fine-grained password complexity requirements for database accounts. You can control the following rules:

• Whether a password can be the same as the database account name

• Minimum password length

• Minimum number of uppercase and lowercase letters

• Minimum number of digits

• Minimum number of special characters

• Password strength validation policy

Usage notes

Billing

The custom password policy feature is free of charge.

Step 1: Install the validate_password plugin

1. Use a privileged account to connect to the ApsaraDB RDS for MySQL instance.

2. Run the following SQL command to install the validate_password plugin.

   INSTALL PLUGIN validate_password SONAME 'validate_password.so';

3. Run the following SQL command to verify that the plugin is installed.

   SHOW GLOBAL VARIABLES LIKE 'validate_password%';

   Output similar to the following indicates that the plugin is installed successfully.

   Variable_name                          Value
   validate_password_dictionary_file      
   validate_password_length               8
   validate_password_mixed_case_count     1
   validate_password_number_count         1
   validate_password_policy               MEDIUM
   validate_password_special_char_count   1

Step 2: Modify password policy parameters

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Parameters.

3. Search for and modify the parameters that start with loose_validate_password. For more information, see Modify the parameters of an ApsaraDB RDS for MySQL instance.

   Note

   • Before you modify the parameters, make sure you have installed the validate_password plugin. Otherwise, your changes will not take effect.

   • Before you modify the parameters, review the core parameter constraints described in the Usage notes section. For more information about password policies, see the official MySQL documentation.

   Parameter	DB versions	Description	Example (MySQL 5.7)
   loose_validate_password_check_user_name	5.7	Specifies whether the password can be the same as the account name. Valid values: ON (default): The password can be the same as the account name. OFF: The password cannot be the same as the account name.	OFF: Prohibits the password from being the same as the account name.
   loose_validate_password_policy	8.0/5.7	Specifies the password strength policy. Valid values: 0 (LOW): Checks only the password length. 1 (MEDIUM, default value): Checks password length, number of digits, letter case, and special characters. 2 (STRONG): Checks the password length, the number of digits, uppercase and lowercase letters, and special characters, and for matches in a dictionary file. Note Because ApsaraDB RDS does not support a custom dictionary file, this policy level is equivalent to MEDIUM.	1: Checks the password length, and the number of digits, uppercase and lowercase letters, and special characters.
   loose_validate_password_length	8.0/5.7	The minimum password length. MySQL 5.7: Valid values: 0 to 256. The default value is 8. MySQL 8.0: Valid values: 1 to 12. The default value is 8.	10: Sets the minimum password length to 10 characters (meeting the requirement: 10 >= 2 + (2 * 2) + 1 = 7).
   loose_validate_password_number_count	5.7	The minimum number of digits in a password. Valid values: 0 to 256. The default value is 1.	2: The password must contain at least 2 digits.
   loose_validate_password_mixed_case_count	5.7	Specifies the minimum number of both uppercase and lowercase letters required in a password. For example, a value of 1 requires at least one uppercase and one lowercase letter. Valid values: 0 to 256. The default value is 1.	2: Requires the password to contain at least 2 uppercase and 2 lowercase letters.
   loose_validate_password_special_char_count	5.7	The minimum number of special characters in a password. Valid values: 0 to 256. The default value is 1.	1: The password must contain at least 1 special character.

Related topics

• You can set a password for a database account using the ApsaraDB RDS console (Create a database account or Reset the password of a database account) or calling an API operation (CreateAccount or ResetAccountPassword).

• To restrict the permissions of a database account, see Modify account permissions, Allow an account to access the database from specific IP addresses, and Allow an account to access only specific tables, views, or columns.