Bug #6108 Ability to force password change after x number of days

• Submitted: 14 Oct 2004 21:03
• Modified: 12 Jun 2014 18:27
• Reporter: Jeremy Tinley
• Status: Closed
• Category: MySQL Server: Security: Privileges
• Severity: S4 (Feature request)
• OS: Any
• CPU Architecture: Any

[14 Oct 2004 21:03] Jeremy Tinley

Description:
Add the ablity to control how many days a user can login before requiring a password change.

How to repeat:
n/a

Suggested fix:
Add a place to control the number of days a user may log in without having a password change (in mysql.user, I would assume).  The value is in days, 0 is no forced expiration.

Add ability to track login statistics by user.  Would only need to keep days since last password change initially but can probably add a ton of good stats here too like total logins, last login date, etc.  On login, check the number of days vs password expiration days for that user. 

Add a new server variable, pw_expiration_warning_days, default to 7.  If the difference between the two is <= pw_expiration_warning_days, display a warning at logon.

Once the account expires, they have to contact the admin to change their password.

[6 Feb 2006 10:25] Valeriy Kravchuk

Thank you for a useful feature request. As MySQL server uses and manages its own user accounts, some way to force password-related security policy (similar to OS level one) is really needed.

[31 Mar 2008 20:11] Jeremy Tinley

This was especially important when relating to Sarbanes-Oxley restrictions in the US.  I recall one of the requirements was to force password changes on a repeating cycle.

[30 Nov 2009 19:47] Chris Calender

Also, it would be very nice if, when implemented, this could enforce password strength (such as minimum 8 characters in length, and containing both numbers and letters).

[9 Dec 2009 5:14] MySQL Verification Team

See also bugs 6100, 21040, 49549

[9 Dec 2009 5:19] Valeriy Kravchuk

Bug #21040 was marked as a duplicate of this one.

[23 Jun 2010 19:03] Jacob Bogie

Any updates on this at all?

[14 Sep 2010 21:10] Arathi Krishnaiyengar

Hello,

Is this feature implemented ?

Thanks
Arathi

[18 Jul 2011 14:27] Anupam Karmarkar

Any updates on password policy

[29 Sep 2012 6:07] Sheeri Cabral

Probably the password expiration in MySQL 5.6 is what you want:

http://dev.mysql.com/doc/refman/5.6/en/alter-user.html

[12 Jun 2014 18:27] Jeremy Tinley

This is now closed. 5.6 added the requested feature for password expiration.