[ERROR] Column count of mysql.user is wrong. Expected
49, found 47. The table is probably corrupted
[Warning] ACL table mysql.password_history missing.
Some operations may fail.

Some authentication plugins store account credentials internally to MySQL, in the mysql.user system table:一些身份验证插件将帐户凭据存储在MySQL内部的mysql.user系统表中：

Most discussion in this section applies to such authentication plugins because most password-management capabilities described here are based on internal credentials storage handled by MySQL itself. 本节中的大多数讨论都适用于此类身份验证插件，因为这里描述的大多数密码管理功能都是基于MySQL本身处理的内部凭据存储。Other authentication plugins store account credentials externally to MySQL. 其他身份验证插件将帐户凭据存储在MySQL外部。For accounts that use plugins that perform authentication against an external credentials system, password management must be handled externally against that system as well.对于使用插件对外部凭据系统执行身份验证的帐户，密码管理也必须在外部对该系统进行处理。

The exception is that the options for failed-login tracking and temporary account locking apply to all accounts, not just accounts that use internal credentials storage, because MySQL is able to assess the status of login attempts for any account no matter whether it uses internal or external credentials storage.例外的是，登录跟踪失败和临时帐户锁定的选项适用于所有帐户，而不仅仅是使用内部凭据存储的帐户，因为MySQL能够评估任何帐户的登录尝试状态，无论它是使用内部还是外部凭据存储。

For information about individual authentication plugins, see Section 6.4.1, “Authentication Plugins”.有关单个身份验证插件的信息，请参阅第6.4.1节，“身份验证插件”。

MySQL enables database administrators to expire account passwords manually, and to establish a policy for automatic password expiration. Expiration policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per-account behavior.MySQL使数据库管理员能够手动使帐户密码过期，并建立自动密码过期策略。过期策略可以在全局范围内建立，并且可以将单个帐户设置为遵守全局策略或用特定的每个帐户行为覆盖全局策略。

To expire an account password manually, use the ALTER USER statement:要手动使帐户密码过期，请使用ALTER USER语句：

ALTER USER 'jeffrey'@'localhost' PASSWORD EXPIRE;

This operation marks the password expired in the corresponding row in the mysql.user system table.此操作在mysql.user系统表中的相应行中标记密码已过期。

Password expiration according to policy is automatic and is based on password age, which for a given account is assessed from the date and time of its most recent password change. 根据策略，密码过期是自动的，并且基于密码期限，对于给定的帐户，密码期限从其最近一次密码更改的日期和时间开始评估。The mysql.user system table indicates for each account when its password was last changed, and the server automatically treats the password as expired at client connection time if its age is greater than its permitted lifetime. mysql.user系统表为每个帐户指示其密码上次更改的时间，如果密码的年龄大于其允许的生存期，服务器会自动将密码视为在客户端连接时过期。This works with no explicit manual password expiration.这适用于没有明确手动密码过期的情况。

To establish automatic password-expiration policy globally, use the default_password_lifetime system variable. 要全局建立自动密码过期策略，请使用default_password_lifetime系统变量。Its default value is 0, which disables automatic password expiration. 其默认值为0，表示禁用自动密码过期。If the value of default_password_lifetime is a positive integer N, it indicates the permitted password lifetime, such that passwords must be changed every N days.如果default_password_lifetime的值是正整数N，则表示允许的密码生存期，因此密码必须每N天更改一次。

Examples:示例：

The global password-expiration policy applies to all accounts that have not been set to override it. 全局密码过期策略适用于所有尚未设置为覆盖它的帐户。To establish policy for individual accounts, use the PASSWORD EXPIRE option of the CREATE USER and ALTER USER statements. 要为单个帐户建立策略，请使用CREATE USER和ALTER USER语句的PASSWORD EXPIRE选项。See Section 13.7.1.3, “CREATE USER Statement”, and Section 13.7.1.1, “ALTER USER Statement”.请参阅第13.7.1.3节，“CREATE USER语句”和第13.7.1.1节，“ALTER USER语句”。

Example account-specific statements:特定账户对账单示例：

When a client successfully connects, the server determines whether the account password has expired:当客户端成功连接时，服务器会确定帐户密码是否已过期：

If the password is expired (whether manually or automatically), the server either disconnects the client or restricts the operations permitted to it (see Section 6.2.16, “Server Handling of Expired Passwords”). 如果密码过期（无论是手动还是自动），服务器要么断开客户端的连接，要么限制允许的操作（参阅第6.2.16节，“服务器处理过期密码”）。Operations performed by a restricted client result in an error until the user establishes a new account password:受限客户端执行的操作会导致错误，直到用户建立新的帐户密码：

mysql> SELECT 1;
ERROR 1820 (HY000): You must reset your password using ALTER USER
statement before executing this statement.

mysql> ALTER USER USER() IDENTIFIED BY 'password';
Query OK, 0 rows affected (0.01 sec)

mysql> SELECT 1;
+---+
| 1 |
+---+
| 1 |
+---+
1 row in set (0.00 sec)

After the client resets the password, the server restores normal access for the session, as well as for subsequent connections that use the account. 客户端重置密码后，服务器将恢复会话以及使用该帐户的后续连接的正常访问。It is also possible for an administrative user to reset the account password, but any existing restricted sessions for that account remain restricted. 管理用户也可以重置帐户密码，但该帐户的任何现有受限会话仍受限制。A client using the account must disconnect and reconnect before statements can be executed successfully.使用该帐户的客户端必须断开连接并重新连接，才能成功执行语句。

MySQL enables restrictions to be placed on reuse of previous passwords. Reuse restrictions can be established based on number of password changes, time elapsed, or both. Reuse policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per-account behavior.MySQL允许对重复使用以前的密码进行限制。可以根据密码更改次数、经过的时间或两者来建立重用限制。可以在全局范围内建立重用策略，并且可以将单个帐户设置为遵守全局策略或用特定的每个帐户行为覆盖全局策略。

The password history for an account consists of passwords it has been assigned in the past. MySQL can restrict new passwords from being chosen from this history:帐户的密码历史记录由过去分配的密码组成。MySQL可以限制从此历史记录中选择新密码：

To establish password-reuse policy globally, use the password_history and password_reuse_interval system variables.要全局建立密码重用策略，请使用password_history和password_reuse_interval系统变量。

Examples:示例：

The global password-reuse policy applies to all accounts that have not been set to override it. 全局密码重用策略适用于所有尚未设置为覆盖它的帐户。To establish policy for individual accounts, use the PASSWORD HISTORY and PASSWORD REUSE INTERVAL options of the CREATE USER and ALTER USER statements. 要为单个帐户建立策略，请使用CREATE USER和ALTER USER语句的PASSWORD HISTORY和PASSWORD REUSE INTERVAL选项。See Section 13.7.1.3, “CREATE USER Statement”, and Section 13.7.1.1, “ALTER USER Statement”.请参阅第13.7.1.3节，“CREATE USER语句”和第13.7.1.1节，“ALTER USER语句”。

Example account-specific statements:特定账户对账单示例：

As of MySQL 8.0.13, it is possible to require that attempts to change an account password be verified by specifying the current password to be replaced. 从MySQL 8.0.13开始，可以要求通过指定要替换的当前密码来验证更改帐户密码的尝试。This enables DBAs to prevent users from changing a password without proving that they know the current password. Such changes could otherwise occur, for example, if one user walks away from a terminal session temporarily without logging out, and a malicious user uses the session to change the original user's MySQL password. This can have unfortunate consequences:这使DBA能够防止用户在没有证明他们知道当前密码的情况下更改密码。否则可能会发生此类更改，例如，如果一个用户在没有注销的情况下暂时退出终端会话，并且恶意用户使用会话更改原始用户的MySQL密码。这可能会产生不幸的后果：

Password-verification policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per-account behavior.密码验证策略可以全局建立，单个帐户可以设置为遵守全局策略或用特定的每个帐户行为覆盖全局策略。

For each account, its mysql.user row indicates whether there is an account-specific setting requiring verification of the current password for password change attempts. 对于每个帐户，其mysql.user行指示是否存在特定于帐户的设置，要求验证密码更改尝试的当前密码。The setting is established by the PASSWORD REQUIRE option of the CREATE USER and ALTER USER statements:该设置由CREATE USER和ALTER USER语句的PASSWORD REQUIRE选项建立：

In other words, if the account setting is not PASSWORD REQUIRE CURRENT DEFAULT, the account setting takes precedence over the global policy established by the password_require_current system variable. 换句话说，如果帐户设置不是PASSWORD REQUIRE CURRENT DEFAULT，则帐户设置优先于password_require_current系统变量建立的全局策略。Otherwise, the account defers to the password_require_current setting.否则，帐户将遵循password_require_current设置。

By default, password verification is optional: password_require_current is disabled and accounts created with no PASSWORD REQUIRE option default to PASSWORD REQUIRE CURRENT DEFAULT.默认情况下，密码验证是可选的：禁用password_require_current，创建的没有PASSWORD REQUIRE选项的帐户默认为PASSWORD REQUIRE CURRENT DEFAULT。

The following table shows how per-account settings interact with password_require_current system variable values to determine account password verification-required policy.下表显示了每个帐户设置如何与password_require_current系统变量值交互，以确定帐户密码验证所需的策略。

To establish password-verification policy globally, use the password_require_current system variable. Its default value is OFF, so it is not required that account password changes specify the current password.要全局建立密码验证策略，请使用password_require_current系统变量。其默认值为OFF，因此不需要帐户密码更改指定当前密码。

Examples:示例：

The global password verification-required policy applies to all accounts that have not been set to override it. 全局密码验证要求策略适用于所有尚未设置为覆盖它的帐户。To establish policy for individual accounts, use the PASSWORD REQUIRE options of the CREATE USER and ALTER USER statements. 要为单个帐户建立策略，请使用CREATE USER和ALTER USER语句的PASSWORD REQUIRE选项。See Section 13.7.1.3, “CREATE USER Statement”, and Section 13.7.1.1, “ALTER USER Statement”.请参阅第13.7.1.3节，“CREATE USER语句”和第13.7.1.1节，“ALTER USER语句”。

Example account-specific statements:特定账户对账单示例：

Verification of the current password comes into play when a user changes a password using the ALTER USER or SET PASSWORD statement. 当用户使用ALTER USER或SET PASSWORD语句更改密码时，会对当前密码进行验证。The examples use ALTER USER, which is preferred over SET PASSWORD, but the principles described here are the same for both statements.这些示例使用ALTER USER，它比SET PASSWORD更可取，但这里描述的原理对于这两个语句是相同的。

In password-change statements, a REPLACE clause specifies the current password to be replaced. Examples:在密码更改语句中，REPLACE子句指定要替换的当前密码。示例：

The REPLACE clause works like this:REPLACE子句的工作原理如下：

As of MySQL 8.0.14, user accounts are permitted to have dual passwords, designated as primary and secondary passwords. Dual-password capability makes it possible to seamlessly perform credential changes in scenarios like this:从MySQL 8.0.14开始，允许用户帐户使用双密码，指定为主密码和次密码。双密码功能使得在以下场景中无缝执行凭据更改成为可能：

Consider how a credential change must be performed in the preceding type of scenario when an account is permitted only a single password. 考虑在前一种情况下，当一个帐户只允许使用一个密码时，必须如何执行凭据更改。In this case, there must be close cooperation in the timing of when the account password change is made and propagated throughout all servers, and when all applications that use the account are updated to use the new password. 在这种情况下，在更改帐户密码并将其传播到所有服务器的时间，以及使用该帐户的所有应用程序更新为使用新密码的时间方面，必须密切合作。This process may involve downtime during which servers or applications are unavailable.此过程可能涉及服务器或应用程序不可用的停机时间。

With dual passwords, credential changes can be made more easily, in phases, without requiring close cooperation, and without downtime:使用双密码，可以更容易地分阶段更改凭据，而不需要密切合作，也不需要停机：

MySQL implements dual-password capability with syntax that saves and discards secondary passwords:MySQL实现了双密码功能，其语法可以保存和丢弃辅助密码：

Suppose that, for the previously described credential-change scenario, an account named 'appuser1'@'host1.example.com' is used by applications to connect to servers, and that the account password is to be changed from 'password_a' to 'password_b'.假设，对于前面描述的凭据更改场景，应用程序使用名为'appuser1'@'host1.example.com'的帐户连接到服务器，并且帐户密码将从'password_a'更改为'password_b'。

To perform this change of credentials, use ALTER USER as follows:要执行此凭据更改，请按如下方式使用ALTER USER：

The RETAIN CURRENT PASSWORD and DISCARD OLD PASSWORD clauses have the following effects:RETAIN CURRENT PASSWORD（保留当前密码）和DISCARD OLD PASSWORD（放弃旧密码）子句具有以下效力：

Statements that modify secondary passwords require these privileges:修改辅助密码的语句需要以下权限：

As of MySQL 8.0.18, the CREATE USER, ALTER USER, and SET PASSWORD statements have the capability of generating random passwords for user accounts, as an alternative to requiring explicit administrator-specified literal passwords. 从MySQL 8.0.18开始，CREATE USER、ALTER USER和SET PASSWORD语句能够为用户帐户生成随机密码，作为要求管理员明确指定文字密码的替代方案。See the description of each statement for details about the syntax. This section describes the characteristics common to generated random passwords.有关语法的详细信息，请参阅每个语句的描述。本节描述了生成的随机密码的共同特征。

By default, generated random passwords have a length of 20 characters. 默认情况下，生成的随机密码长度为20个字符。This length is controlled by the generated_random_password_length system variable, which has a range from 5 to 255.该长度由generated_random_password_length系统变量控制，其范围为5到255。

For each account for which a statement generates a random password, the statement stores the password in the mysql.user system table, hashed appropriately for the account authentication plugin. 对于每个由语句生成随机密码的帐户，该语句将密码存储在mysql.user系统表中，并针对帐户身份验证插件进行适当的哈希处理。The statement also returns the cleartext password in a row of a result set to make it available to the user or application executing the statement. 该语句还在结果集的一行中返回明文密码，以便执行该语句的用户或应用程序可以使用。The result set columns are named user, host, and generated password, indicating the user name and host name values that identify the affected row in the mysql.user system table, and the cleartext generated password.结果集列分别命名为user、host和generated password，表示标识mysql.user系统表中受影响行的用户名和主机名值，以及明文生成的密码。

mysql> CREATE USER
'u1'@'localhost' IDENTIFIED BY RANDOM PASSWORD,
'u2'@'%.example.com' IDENTIFIED BY RANDOM PASSWORD,
'u3'@'%.org' IDENTIFIED BY RANDOM PASSWORD;
+------+---------------+----------------------+
| user | host          | generated password   |
+------+---------------+----------------------+
| u1   | localhost     | BA;42VpXqQ@i+y{&TDFF |
| u2   | %.example.com | YX5>XRAJRP@>sn9azmD4 |
| u3   | %.org         | ;GfD44l,)C}PI/6)4TwZ |
+------+---------------+----------------------+
mysql> ALTER USER
'u1'@'localhost' IDENTIFIED BY RANDOM PASSWORD,
'u2'@'%.example.com' IDENTIFIED BY RANDOM PASSWORD;
+------+---------------+----------------------+
| user | host          | generated password   |
+------+---------------+----------------------+
| u1   | localhost     | yhXBrBp.;Y6abB)e_UWr |
| u2   | %.example.com | >M-vmjp9DTY6}hkp,RcC |
+------+---------------+----------------------+
mysql> SET PASSWORD FOR 'u3'@'%.org' TO RANDOM;
+------+-------+----------------------+
| user | host  | generated password   |
+------+-------+----------------------+
| u3   | %.org | o(._oNn)d;FC<vJIDg9M |
+------+-------+----------------------+

A CREATE USER, ALTER USER, or SET PASSWORD statement that generates a random password for an account is written to the binary log as a CREATE USER or ALTER USER statement with an IDENTIFIED WITH auth_plugin AS 'auth_string', clause, where auth_plugin is the account authentication plugin and 'auth_string' is the account hashed password value.为帐户生成随机密码的CREATE USER、ALTER USER或SET PASSWORD语句将作为CREATE USER或ALTER USER语句写入二进制日志，并带有IDENTIFIED WITH auth_plugin AS 'auth_string'子句，其中auth_plugin是帐户身份验证插件，'auth_string'是帐户哈希密码值。

If the validate_password component is installed, the policy that it implements has no effect on generated passwords. 如果安装了validate_password组件，则它实现的策略对生成的密码没有影响。(The purpose of password validation is to help humans create better passwords.)（密码验证的目的是帮助人类创建更好的密码。）

As of MySQL 8.0.19, administrators can configure user accounts such that too many consecutive login failures cause temporary account locking.从MySQL 8.0.19开始，管理员可以配置用户帐户，这样连续登录失败次数过多会导致临时帐户锁定。

“Login failure” in this context means failure of the client to provide a correct password during a connection attempt. It does not include failure to connect for reasons such as unknown user or network issues. 在此上下文中，“登录失败”是指客户端在连接尝试期间未能提供正确的密码。它不包括因未知用户或网络问题等原因导致的连接失败。For accounts that have dual passwords (see Dual Password Support), either account password counts as correct.对于具有双密码的帐户（请参阅双密码支持），任何帐户密码都视为正确。

The required number of login failures and the lock time are configurable per account, using the FAILED_LOGIN_ATTEMPTS and PASSWORD_LOCK_TIME options of the CREATE USER and ALTER USER statements. 使用CREATE USER和ALTER USER语句的FAILED_LOGIN_ATTEMPTS和PASSWORD_LOCK_TIME选项，可以为每个帐户配置所需的登录失败次数和锁定时间。Examples:示例：

CREATE USER 'u1'@'localhost' IDENTIFIED BY 'password'
  FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 3;

ALTER USER 'u2'@'localhost'
  FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME UNBOUNDED;

When too many consecutive login failures occur, the client receives an error that looks like this:当连续发生太多登录失败时，客户端会收到一个如下所示的错误：

ERROR 3957 (HY000): Access denied for user user. Account is blocked for D day(s) (R day(s) remaining)
due to N consecutive failed logins.

Use the options as follows:使用以下选项：

Permitted values of N for each option are in the range from 0 to 32767. A value of 0 disables the option.每个选项的N允许值在0到32767的范围内。值为0时禁用该选项。

Failed-login tracking and temporary account locking have these characteristics:登录跟踪失败和临时帐户锁定具有以下特征：

When the server reads the grant tables, it initializes state information for each account regarding whether failed-login tracking is enabled, whether the account is currently temporarily locked and when locking began if so, and the number of failures before temporary locking occurs if the account is not locked.当服务器读取授权表时，它会初始化每个帐户的状态信息，包括是否启用了失败的登录跟踪、帐户当前是否被临时锁定以及锁定开始的时间（如果是），以及如果帐户未被锁定，在临时锁定发生之前的失败次数。

An account's state information can be reset, which means that failed-login counting is reset, and the account is unlocked if currently temporarily locked. Account resets can be global for all accounts or per account:帐户的状态信息可以重置，这意味着登录失败计数将重置，如果当前临时锁定，则帐户将解锁。帐户重置可以是所有帐户的全局重置，也可以是每个帐户的重置：

Failed-login tracking is tied to the login account that is used to check credentials. 失败的登录跟踪与用于检查凭据的登录帐户相关联。If user proxying is in use, tracking occurs for the proxy user, not the proxied user. 如果正在使用用户代理，则会对代理用户而不是被代理的用户进行跟踪。That is, tracking is tied to the account indicated by USER(), not the account indicated by CURRENT_USER(). 也就是说，跟踪与USER()指示的帐户相关联，而不是与CURRENT_USER()所指示的帐户相关。For information about the distinction between proxy and proxied users, see Section 6.2.18, “Proxy Users”.有关代理和被代理用户之间区别的信息，请参阅第6.2.18节，“代理用户”。