content_image/661188.jpg
•Incorrect-password failed-login tracking options: You can cause the server to track failed login attempts and temporarily lock accounts for which too many consecutive incorrect passwords are given. The required number of failures and the lock time are configurable. 

This section describes the syntax for password-management options. For information about establishing policy for password management, see Section 6.2.15, “Password Management” . 

If multiple password-management options of a given type are specified, the last one takes precedence. For example, PASSWORD EXPIRE DEFAULT PASSWORD EXPIRE NEVER  is the same as PASSWORD EXPIRE NEVER . 

<img src='content_image/661188.jpg'>

## Note 

Except for the options that pertain to failed-login tracking, password-management options apply only to accounts that use an authentication plugin that stores credentials internally to MySQL. For accounts that use a plugin that performs authentication against a credentials system that is external to MySQL, password management must be handled externally against that system as well. For more information about internal credentials storage, see Section 6.2.15, “Password Management” . 

A client has an expired password if the account password was expired manually or the password age is considered greater than its permitted lifetime per the automatic expiration policy. In this case, the server either disconnects the client or restricts the operations permitted to it (see Section 6.2.16, “Server Handling of Expired Passwords” ). Operations performed by a restricted client result in an error until the user establishes a new account password. 

CREATE USER  permits these password_option  values for controlling password expiration: 

• PASSWORD EXPIRE 

Immediately marks the password expired for all accounts named by the statement. 

CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE; 

• PASSWORD EXPIRE DEFAULT 

Sets all accounts named by the statement so that the global expiration policy applies, as specified by the default_password_lifetime  system variable. 

CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE DEFAULT; 

• PASSWORD EXPIRE NEVER 

This expiration option overrides the global policy for all accounts named by the statement. For each, it disables password expiration so that the password never expires. 

CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE NEVER; 

• PASSWORD EXPIRE INTERVAL N  DAY 

This expiration option overrides the global policy for all accounts named by the statement. For each, it sets the password lifetime to N  days. The following statement requires the password to be changed every 180 days: 

CREATE USER ’jeffrey’@’localhost’ PASSWORD EXPIRE INTERVAL 180 DAY; 

CREATE USER  permits these password_option  values for controlling reuse of previous passwords based on required minimum number of password changes: 

