Prevent MySQL login with empty password

Question

I created a new user with:

CREATE USER 'foobar'@'%';

...and I was rather disturbed to find that this user was allowed to log in, using an empty password!

> select host, user, authentication_string from mysql.user where user = 'foobar';
+------+--------+-----------------------+
| host | user   | authentication_string |
+------+--------+-----------------------+
| %    | foobar |                       |
+------+--------+-----------------------+

• How can I prevent users logging in with empty passwords?
• Alternatively, is there a way to create a user with some sort of invalid password so they cannot login until their password is updated?

Answer 1

Use

CREATE USER 'username'@'hostname' IDENTIFIED BY 'new_password' PASSWORD EXPIRE;

Which will create a password that can only be used once and will require the user to choose a new password at login.

Suggest if you are creating and issuing passwords you use a random generator to create an initial random password and then share it securely.