![启用 MariaDB SSL](https://linux22.com/image/882309/%E5%90%AF%E7%94%A8%20MariaDB%20SSL.png)
我必须让我的 MariaDB 身份验证比默认身份验证更安全一些。我尝试为此设置 SSL 支持,但只在这里找到了一个旧的操作方法:
我遵循了它,但检查后我得到了这个:
MariaDB [(none)]> show variables like "%ssl%";
+---------------+----------------------------+
| Variable_name | Value |
+---------------+----------------------------+
| have_openssl | NO |
| have_ssl | DISABLED |
| ssl_ca | /etc/mysql/ca-cert.pem |
| ssl_capath | |
| ssl_cert | /etc/mysql/server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /etc/mysql/server-key.pem |
+---------------+----------------------------+
9 rows in set (0.00 sec)
MariaDB [(none)]> \s
...
SSL: not in use
...
此源代码写于 2011 年。可能已经过时,或者我在某个地方犯了错误。生成时.pems
没有错误。我的/var/log/mysql/error.log
文件是空的。
你有什么想法?
答案1
要在 mariadb 中启用 ssl,你的版本需要使用 ssl () 进行编译have_ssl | DISABLED
,并且你需要在 mysql 配置中启用它:
# grep -Ri ssl /etc/mysql/my.cnf
ssl = true
ssl-ca = /etc/mysql/cacert.pem
ssl-cert = /etc/mysql/server-cert.pem
ssl-key = /etc/mysql/server-key.pem
重新启动或 mysql 进程后 ssl 应该被启用。
边注
这个答案来自另一个问题帮助我摆脱了这个错误:
ERROR 2026 (HY000): SSL connection error: tlsv1 alert unknown ca
答案2
我创建了一个 Ubuntu 18.04.3 证书颁发机构。已验证有关它的一切。根、证书、钥匙串均有效。
MariaDB [(none)]>
MariaDB [(none)]>
MariaDB [(none)]>
MariaDB [(none)]> SHOW VARIABLES LIKE '%ssl%';
+---------------------+---------------------------------+
| Variable_name | Value |
+---------------------+---------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /etc/mysql/ssl/ca-cert.pem |
| ssl_capath | |
| ssl_cert | /etc/mysql/ssl/mariadb-cert.pem |
| ssl_cipher | DHE-RSA-AES256-SHA |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /etc/mysql/ssl/mariadb-key.pem |
| version_ssl_library | OpenSSL 1.1.1c 28 May 2019 |
+---------------------+---------------------------------+
mysql Ver 15.1 Distrib 10.4.8-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2
Connection id: 37
Current database:
Current user: sa@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server: MariaDB
Server version: 10.4.8-MariaDB-1:10.4.8+maria~bionic mariadb.org binary distribution
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /var/run/mysqld/mysqld.sock
Uptime: 19 hours 5 min 57 sec
Threads: 7 Questions: 66 Slow queries: 0 Opens: 31 Flush tables: 1 Open tables: 25 Queries per second avg: 0.000
--------------
MariaDB [(none)]>
我按照在线流程办理了 CA 并创建了 MariaDB SSL 密钥。
我已my.cnf
完成操作以使密钥显示在上面。/etc/mysql/mariadb.cnf
密钥就在里面。我已安装 Mariadb 存储库以进行更新。
这是my.cnf
:
[mysqld]
ssl = true
ssl-ca = /etc/mysql/ssl/ca-cert.pem
ssl-cert = /etc/mysql/ssl/mariadb-cert.pem
ssl-key = /etc/mysql/ssl/mariadb-key.pem
log_error=/var/log/mysql/mysql_error.log
ssl-cipher=DHE-RSA-AES256-SHA
grep -Ri ssl /etc/mysql/my.cnf
ssl = true
ssl-ca = /etc/mysql/ssl/ca-cert.pem
ssl-cert = /etc/mysql/ssl/mariadb-cert.pem
ssl-key = /etc/mysql/ssl/mariadb-key.pem
ssl-cipher=DHE-RSA-AES256-SHA
ssl-cipher entry can be removed.