近期等保测评发现mysql存在不满足项，未设置登录失败限制策略

查看mysql版本，本次设置对mysql版本有要求必须大于5.7以上

Connection id:          20
Current database:
Current user:           root@localhost
SSL:                    Not in use
Current pager:          stdout
Using outfile:          ''
Using delimiter:        ;
Server version:         5.7.41 MySQL Community Server (GPL)
Protocol version:       10
Connection:             Localhost via UNIX socket
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    utf8
Conn.  characterset:    utf8
UNIX socket:            /var/lib/mysql/mysql.sock
Uptime:                 1 hour 47 min 24 sec

1、登录mysql查看是否设置策略

show variables like "connection_control%"; （结果未显示）

 2、安装connect_control.so

INSTALL PLUGIN CONNECTION_CONTROL SONAME 'connection_control.so';
Query OK, 0 rows affected (0.02 sec)
INSTALL PLUGIN CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS SONAME 'connection_control.so';
Query OK, 0 rows affected (0.00 sec)

3、再次执行show variables like "connection_control%

connection_control_failed_connections_threshold | 3       （mysql账户连续输入错误3次则锁定账户）   |
| connection_control_max_connection_delay         | 2147483647 （登录失败再次登录最大上限时间）
| connection_control_min_connection_delay         | 1000    （登录失败再次登录最小上限时）

4、设置数据库登录失败和时长设置

mysql> set global connection_control_failed_connections_threshold=5;
Query OK, 0 rows affected (0.00 sec)

mysql> set global connection_control_min_connection_delay=30000;
Query OK, 0 rows affected (0.00 sec)

mysql> show variables like "connection_control%";
+-------------------------------------------------+------------+
| Variable_name                                   | Value      |
+-------------------------------------------------+------------+
| connection_control_failed_connections_threshold | 5          |
| connection_control_max_connection_delay         | 2147483647 |
| connection_control_min_connection_delay         | 30000      |
+-------------------------------------------------+------------+
3 rows in set (0.00 sec)

 查看和卸载

上述配置完成后，即可实现用户登录mysql密码错误一定次数之后，再次输入错误密码，该连接将会被挂起无响应。此外，可以通过如下SQL查看受限用户清单，包括来源用户、IP和登录失败次数

mysql> use information_schema;  
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> select * from connection_control_failed_login_attempts;
Empty set (0.00 sec)

#以下指令为卸载该插件的操作
mysql> UNINSTALL PLUGIN CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS;
mysql> UNINSTALL PLUGIN CONNECTION_CONTROL;