Mysql使用mysqldump备份权限整理

1、创建一个用于备份数据库的用户

mysql> create user 'backup'@'localhost' identified by '123456';

1）创建test测试库

mysql> create database test;

2、添加权限

1）备份test库

[root@localhost ~]# mysqldump -u'backup' -p123456 -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Got error: 1044: Access denied for user 'backup'@'localhost' to database 'test' when selecting the database

2）添加SELECT权限

根据报错，'backup'用户缺少select权限

mysql> GRANT SELECT ON test.* TO 'backup'@'localhost';

3）添加LOCK TABLES权限

[root@localhost ~]# mysqldump -u'backup' -p123456 -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Got error: 1044: Access denied for user 'backup'@'localhost' to database 'test' when using LOCK TABLES

根据报错，'backup'用户缺少lock tables权限

mysql> GRANT lock tables ON *.* TO 'backup'@'localhost';

注意：如果备份时加入--single-transaction选项，则可不需要LOCK TABLES权限

4）添加SHOW VIEW权限

当数据库中存在view（视图）的时候，使用mysqldump备份数据库，需要有SHOW VIEW权限

给test库添加一个view

mysql> use test;

mysql> CREATE VIEW view AS SELECT 1 AS Number;

使用mysqldump备份，会提示缺少SHOW VIEW权限

[root@localhost ~]# mysqldump -u'backup' -p123456 -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Couldn't execute 'show create table `view`': SHOW VIEW command denied to user 'backup'@'localhost' for table 'view' (1142)

给用户'backup'添加SHOW VIEW权限

mysql> GRANT SHOW VIEW ON *.* TO 'backup'@'localhost';

5）添加RELOAD权限

加入--master-data选项后，备份需要RELOAD权限

[root@localhost ~]# mysqldump -u'backup' -p123456 --master-data=2 -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Couldn't execute 'FLUSH /*!40101 LOCAL */ TABLES': Access denied; you need (at least one of) the RELOAD privilege(s) for this operation (1227)

给'backup'用户添加RELOAD权限

mysql> GRANT reload ON *.* TO 'backup'@'localhost';

6）添加REPLICATION CLIENT权限

根据备份的报错提示，需要REPLICATION CLIENT权限

[root@localhost ~]# mysqldump -u'backup' -p123456 --master-data=2 -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Couldn't execute 'SHOW MASTER STATUS': Access denied; you need (at least one of) the SUPER, REPLICATION CLIENT privilege(s) for this operation (1227)

给'backup'用户添加REPLICATION CLIENT权限

mysql> GRANT REPLICATION CLIENT ON *.* TO 'backup'@'localhost';

7）添加EVEN权限

备份时若需要备份事件，即使用--events选项，则需要EVENT权限

[root@localhost ~]# mysqldump -u'backup' -p123456 --single-transaction --master-data=2 --events -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure.

mysqldump: Couldn't execute 'show events': Access denied for user ''backup''@'localhost' to database 'test' (1044)

给'backup'用户添加EVENT权限

mysql> GRANT EVENT ON *.* TO 'backup'@'localhost';

8）添加TRIGGER权限

mysql> GRANT TRIGGER ON *.* TO 'backup'@'localhost';

9）添加PROCESS权限

在Mysql-5.7上执行备份操作时，出现以下错误

[root@localhost ~]# mysqldump -u'backup' -p123456 --single-transaction --master-data=2 --events --triggers -R -B test > test.sql

mysqldump: [Warning] Using a password on the command line interface can be insecure. 

mysqldump: Error: 'Access denied; you need (at least one of) the PROCESS privilege(s) for this operation' when trying to dump tablespaces

给'backup'用户添加PROCESS权限

mysql> GRANT PROCESS ON *.* TO 'backup'@'localhost';

3、查看'backup'用户的所有权限

mysql> show grants for 'backup'@'localhost'\G

*************************** 1. row ***************************

Grants for 'backup'@localhost: GRANT SELECT, RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT, SHOW VIEW, EVENT ON *.* TO ''backup''@'localhost'

总结：一个Mysql的备份用户需要以下权限：SELECT, RELOAD, LOCK TABLES, REPLICATION CLIENT, SHOW VIEW, EVENT, TRIGGER, PROCESS。

最终授权命令可以综合成一条：

mysql> GRANT SELECT,RELOAD,LOCK TABLES,REPLICATION CLIENT,SHOW VIEW,EVENT,TRIGGER,PROCESS ON *.* TO 'backup'@'localhost' identified BY '123456';