Date: Thu, 08 Oct 2009 08:45:28 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: Olivier Nicole <Olivier.Nicole@cs.ait.ac.th> Cc: freebsd-questions@freebsd.org Subject: Re: MySQL + SSL Message-ID: <4ACD9898.7000701@infracaninophile.co.uk> In-Reply-To: <200910080332.n983WTW3018483@banyan.cs.ait.ac.th> References: <200910080332.n983WTW3018483@banyan.cs.ait.ac.th>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigE9D1DDEEF235241AE05CC4C4
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Olivier Nicole wrote:
> Hi,
>=20
> I have been strugling to find the correct syntax for the mysql(1)
> command to connect with SSL.
>=20
> My server is accepting SSL connections:
>=20
> db2<root>: mysql -u root -p
> Enter password:=20
> Welcome to the MySQL monitor. Commands end with ; or \g.
> Your MySQL connection id is 1
> Server version: 5.4.2-beta FreeBSD port: mysql-server-5.4.2
> =20
> Type 'help;' or '\h' for help. Type '\c' to clear the current input s=
tatement.
> =20
> mysql> SHOW VARIABLES LIKE '%ssl%';
> +---------------+-------------------------------------------+
> | Variable_name | Value |
> +---------------+-------------------------------------------+
> | have_openssl | YES |
> | have_ssl | YES |
> | ssl_ca | /usr/local/ssl/ca/ait-itserv.crt |
> | ssl_capath | |
> | ssl_cert | /usr/local/ssl/crt/db2.cs.ait.ac.th.crt |
> | ssl_cipher | DHE-RSA-AES256-SHA:AES128-SHA |
> | ssl_key | /database/mysql/database.cs.ait.ac.th.key |
> +---------------+-------------------------------------------+
> 7 rows in set (0.00 sec)
> =20
> mysql> quit
> Bye
> db2<root>:
This is a question more suited to one of the various MySQL fora really.
Anyhow, the standard take on using SSL to encrypt MySQL connections is:
don't do it. MySQL is apparently pretty ropey when in comes to doing
crypto.
Instead, you should use ipsec, ssh, stunnel or the like to provide an
encrypted transport layer that you access MySQL through. It's also
generally the case that the overhead of doing encryption between the DB
and the client application tends to destroy performance. Design your=20
network so that the DB is close to the application servers and has a
protected private network between the two, where you can send plaintext
traffic without fear of snooping. If you need to work with systems
distributed over a number of sites, then replicating the DB so there is
an instance at each location is a good design choice, despite the
difficulties this introduces with Insert/Update/Delete on replica
DBs. Then just encrypt the transport layer the inter-site replication
traffic uses.
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enigE9D1DDEEF235241AE05CC4C4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.13 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAkrNmKAACgkQ8Mjk52CukIwKpACfXa2c5ZHgx+j3FHZhmDoVZbBK
zxEAniaqCW+5F4QAQQ2o7RjDWLZn2N2S
=xFPG
-----END PGP SIGNATURE-----
--------------enigE9D1DDEEF235241AE05CC4C4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4ACD9898.7000701>