MySQL 5.7 makes secure connections easier with streamlined key generation for both MySQL Community and MySQL Enterprise, improves security by expanding support for TLSv1.1 and TLSv1.2, and helps administrators assess whether clients are connecting securely or not with new visibility into connection types. …
5 Older Entries »
Transport Layer Security (TLS, also often referred to as SSL) is an important component of a secure MySQL deployment, but the complexities of properly generating the necessary key material and configuring the server dissuaded many users from completing this task. MySQL Server 5.7 simplifies this task for both Enterprise and Community users. …
With Python you would normally use MySQL Connector/Python or the older MySQLdb to connect from Python to MySQL, but there are more options.
There are also multiple Python implementations: CPython (the main implementation), PyPy, Jython and IronPython. PyPy tries to be faster than CPython by using a Just-in-Time compiler. Jython runs on the JVM and IronPython runs on the .NET CLR.
Connector/Python by default (Without the C Extension) is a pure Python implementation and can work with most if not all implementations. And for MySQLdb there is a drop-in replacement called PyMySQL, which is a pure python implementation.
So there are many options …[Read more]
I've ran a simple test to see the performance impact of TLS on
MySQL connections with MySQL Connector/Python
The test results are in this Jupyter notebook.
- Try to reuse connections if you use TLS
- Establishing TLS connections is expensive (server & client)
- Improved performance might be possible in the future by using TLS Tickets
- Difference between YaSSL and OpenSSL
- Difference between Ciphersuites
- Performance of larger resultsets and queries
MySQL Connector/Java 5.1.38 was released earlier this week, and it includes a notable improvement related to secure connections. Here’s how the change log describes it:
When connecting to a MySQL server 5.7 instance that supports TLS, Connector/J now prefers a TLS over a plain TCP connection.
This mirrors changes made in 5.7 to the behavior of MySQL command-line clients and libmysql client library. Coupled with the streamlined/automatic generation of TLS key material to ensure TLS availability in MySQL Server 5.7 deployments, this is an important step towards providing secure communication in default deployments.
Secure communications is a core component of a robust security policy, and MySQL Server 5.7.10 – the first maintenance release of MySQL Server 5.7 – introduces needed improvements in this area. Support for TLS has been expanded from TLSv1.0 to include TLSv1.1 and TLSv1.2, default ciphers have been updated, and controls have been implemented allowing both server and client-side configuration of acceptable TLS protocol versions. This blog post will describe the changes, the context in which these changes were made, note important differences in capabilities between Community and Enterprise versions, and outline future plans.
SSL (Secure Sockets Layer) was superseded by TLS ( …[Read more]
I’m pleased to announce that MySQL Connector/J 5.1.38 Maintenance Release is now generally available.
MySQL Connector/J can be downloaded from the official distribution channels MySQL Downloads and The Central repository. The commercially licensed version is available for download at My Oracle Support.
As always, we recommend that you check the
file in the download archive and/or the release notes to be aware of changes in
behavior that might affect your application.
MySQL Connector/J 5.1.38, although released shortly after its predecessor, …[Read more]
Recent changes to support better security by increasing strength of Diffie-Hellman cipher suites from 512-bit to 2048-bit were introduced to MySQL Server 5.7. While this change enhances security, it is an aggressive change in that 2048-bit DH ciphers are not universally supported. This has become a problem specifically for Java users, as only Java 8 JRE (currently) supports DH ciphers greater than 1024 bits. Making the problem more acute, this change was back-ported from MySQL Server 5.7 to the recent 5.6.26 and 5.5.45 releases in response to a community bug report. This blog post will identify affected applications, existing workarounds, and our plans to provide a more …[Read more]
Today, oCERT published advisory 2015-003 describing a TLS vulnerability in MySQL and derivative products. The content isn’t exactly news – it is documented legacy behavior and the subject of an earlier blog post describing how MySQL Server 5.7 solves the problem. That said, the efforts of Duo Security are certainly appreciated and welcomed – it provides a meaningful context to discuss how to properly harden existing MySQL 5.5 and 5.6 deployments, as well as frame a discussion on potential changes in these versions to increase security.
The vulnerability described in the advisory relies on the legacy behavior of the client …[Read more]
As noted in an earlier post, MySQL Server 5.7 prefers and
enables SSL/TLS connections by default. That’s great and
useful progress towards secure connections, but we know that not
all SSL/TLS ciphers are created equal – some are older and more
vulnerable. Furthermore, some recent vulnerabilities rely
on the ability to negotiate less-secure ciphers during the
handshake. Monitoring which ciphers are used can help
identify connections using low-grade ciphers, but also to build
an appropriate restricted cipher list. Using
PERFORMANCE_SCHEMA introduced in
5.7, you can now easily do this – and this post will show you
The cipher used for each TLS connection is stored in a …
5 Older Entries »