Introduction
Some time ago, I studied how to improve database security, such as prohibiting the execution of unconditional update operations, so I thought of enabling the sql_safe_updates parameter, which is not enabled by Mysql by default and cannot be added to the my.cnf configuration. So I thought of using the init_connect parameter and put sql_safe_updates=1 in the init_connect parameter, so that when each user session connects, the sql_safe_updates parameter will be enabled.
But after using a normal connection to the database, after using a certain library, an error will be reported
mysql> use information_schema;
No connection. Trying to reconnect...
Connection id: 16
Current database: *** NONE ***
ERROR 1184 (08S01): Aborted connection 16 to db: 'unconnected' user: 'jim' host: 'localhost' (init_connect command failed)
Error analysis
Before analyzing the error, please review the operation steps
1. Create a normal user
mysql> create user 'jim'@'%' identified by 'jim';
Query OK, 0 rows affected (0.01 sec)
mysql> select user,host from mysql.user;
+------------------+-----------+
| user | host |
+------------------+-----------+
| jim | % |
| repl | % |
| root | % |
| tony | % |
| mysql.infoschema | localhost |
| mysql.session | localhost |
| mysql.sys | localhost |
| root | localhost |
+------------------+-----------+
8 rows in set (0.10 sec)
2. Use the root user to log in to the database and set the init_connect parameters
mysql> set global init_connect='sql_safe_updates=1';
Query OK, 0 rows affected (0.00 sec)
mysql> show variables like 'init_connect';
+---------------+--------------------+
| Variable_name | Value |
+---------------+--------------------+
| init_connect | sql_safe_updates=1 |
+---------------+--------------------+
1 row in set (0.00 sec)
3. Use ordinary user Jim to connect and test
root@18374a493e56:~# mysql -ujim -pjim
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 18
Server version: 8.0.21
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use information_schema
No connection. Trying to reconnect...
Connection id: 19
Current database: *** NONE ***
ERROR 1184 (08S01): Aborted connection 19 to db: 'unconnected' user: 'jim' host: 'localhost' (init_connect command failed)
4. Use root user connection test
root@18374a493e56:~# mysql -uroot -proot
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 20
Server version: 8.0.21 MySQL Community Server - GPL
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use information_schema;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
From the above error message, it can also be quickly judged that it is caused by the unreasonable init_connect setting, but what is strange here is that ordinary users will report errors, and root user operations will not report errors. I don't know why, so I went to the official document to see how the official document describes it.
init_connect parameter description
For users that have the CONNECTION_ADMIN privilege (or the deprecated SUPER privilege), the content of init_connect is not executed. This is done so that an erroneous value for init_connect does not prevent all clients from connecting. For example, the value might contain a statement that has a syntax error, thus causing client connections to fail. Not executing init_connect for users that have the CONNECTION_ADMIN or SUPER privilege enables them to open a connection and fix the init_connect value.
The general meaning of this passage is that when a user with CONNECTION_ADMIN and SUPER permissions logs in, the content of the init_connect parameter does not need to be executed. When a user without these permissions logs in, the content of the init_connect parameter needs to be executed. When the init_connect parameter is set When there is a problem with the content statement, an error will be reported, which explains why the root user has no problem, while the ordinary user has a problem.
After understanding the cause of the error, you need to modify the content of init_connect, and copy the content in init_connect. If there is no problem executing in the mysql command command line, it is fine.
5. Reset the init_connect parameter value
mysql> show variables like 'init_connect';
+---------------+--------------------+
| Variable_name | Value |
+---------------+--------------------+
| init_connect | sql_safe_updates=1 |
+---------------+--------------------+
1 row in set (0.01 sec)
mysql> set session sql_safe_updates=1;
Query OK, 0 rows affected (0.00 sec)
mysql> set global init_connect='set session sql_safe_updates=1';
Query OK, 0 rows affected (0.00 sec)
mysql> show variables like 'init_connect';
+---------------+--------------------------------+
| Variable_name | Value |
+---------------+--------------------------------+
| init_connect | set session sql_safe_updates=1 |
+---------------+--------------------------------+
1 row in set (0.00 sec)
6. Use ordinary user jim to connect again to test
root@18374a493e56:~# mysql -ujim -pjim
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 21
Server version: 8.0.21 MySQL Community Server - GPL
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> use information_schema;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql>
mysql> show variables like 'sql_safe_updates';
+------------------+-------+
| Variable_name | Value |
+------------------+-------+
| sql_safe_updates | ON |
+------------------+-------+
1 row in set (0.01 sec)
From the test results, we can see that the Mysql database can be used normally, and the parameter sql_safe_updates is also set correctly.
to sum up
In short, there is nothing trivial about the production operation. When you perform any operation on the production, you must fully verify the test environment and understand the scope of influence before you can go online. If the operation is in the text, it is likely to cause an online failure.
https://mp.weixin.qq.com/s/LAcSlcWPzGipZv6dgldOxw