Often databases contain data that needs to be proven as valid and authentic. We want to ensure that a known person or other sender (e.g. a trusted app) of the information can’t deny content, nor that the content can change without that person (senders) consent.…
10 Older Entries »
In conversations about SSL/TLS people often say that they either
don't need TLS because they trust their network or they say it is
too slow to be used in production.
With TLS the client and server has to do additional work, so some overhead is expected. But the price of this overhead also gives you something in return: more secure communication and more authentication options (client certificates).
SSL and TLS have existed for quite a long time. First they were only used for online banking and during authentication on web sites. But slowly many websites went to full-on SSL/TLS. And with the introduction of Let's encrypt many small websites are now using SSL/TLS. And many non-HTTP protocols either add encryption or move to a HTTP based protocol.
So TLS performance is very important for day-to-day usage. Many people and companies have put a lot of effort …
In this blog post, we’ll look at a feature that recently added to Percona XtraDB Cluster 5.7.16, that makes it easier to configure Percona XtraDB Cluster SSL for all related communications. It uses mode “encrypt=4”, and configures SSL for both IST/Galera communications and SST communications using the same SSL files. “encrypt=4” is a new encryption mode added in Percona XtraDB Cluster 5.7.16 (we’ll cover it in a later blog post).
If this option is used, this will override all other Galera/SST SSL-related file options. This is to ensure that a consistent configuration is applied. Using this option also means that the Galera/SST communications are …[Read more]
After securing application-to-database and replication traffic, you should also do the same for backup traffic.
If you use Percona XtraBackup with streaming than you should use SSH to send your backup to a secure location. The same is true for MySQL Enterprise Backup. Also both have options to encrypt the backup itself. If you send your backup to a cloud service this is something you should really do, especially if it is not sent via SSH or HTTPS.
And mysqldump and mysqlbinlog both support SSL. And you could use GnuPG, OpenSSL, WinZIP or any other tool to encrypt it.
You could try to force the client to send credentials elsewhere. This can be done if you can control the parameters to the mysql client. It reads the config from /etc/my.cnf, ~/.my.cnf and ~/.mylogin.conf but if you for example specify a login-path and a hostname.. it connects to that host, but with the …[Read more]
mysql_sha256_password doesn't use the nonce
system which is used for
instead forces the use of RSA or SSL.
This is how that works:
- The client connects
- The server changes authentication to sha256 password (or default?)
- The server sends the RSA public key.
- The client encrypts the password with the RSA public key and sends it to the server.
- The server decrypts the password with the private key and validates it.
The problem is that the client trusts public key of the server.
It is possible to use
But then you need to take care of secure public key distribution
So if we put a proxy between the client and the …[Read more]
In my previous blogs I told you to enable SSL/TLS and configure it to check the CA. So I followed my advice and did all that. Great!
--ssl-mode setting was used a few times as a
solution. And it has a setting we didn't use yet:
VERIFY_IDENTITY. In older MySQL versions you can use
--ssl-verify-server-cert. Both turn on hostname
Get any certificate which is trusted by the configured CA, this can for example be a certificate from a development machine. And use that with a man-in-the-middle proxy.
Then the client:
- Checks if SSL is uses (
- Verify if the certificate is signed by a trusted CA
Both checks succeed. But the certificate might be for testhost01.example.com and the database server might be prod-websitedb-123.example.com. …[Read more]
In my previous blogs I told you to enable SSL/TLS and force the connection to be secured. So I followed my advice and did forced SSL. Great!
So now everything is 100% secure isn't it?
No it isn't and I would never claim anything to be 100% secure.
There are important differences in the SSL/TLS implementations of browers and the implementation in MySQL. One of these differences is that your browser has a trust store with a large set of trusted certificate authorities. If the website you visit has SSL enabled then your browser will check if the certificate it presents is signed by a trusted CA. MySQL doesn't use a list of trusted CA's, and this makes sense for many setups.
The key difference is that a website has clients (browsers) which are not managed by the same organization. And for MySQL connections the set of clients is often much smaller are more or less managed by one organization. Adding a CA for a set of …[Read more]
In my previous blog post I told you to use SSL/TLS to secure your MySQL network connections. So I followed my advice and did enable SSL. Great!
So first let's quickly verify that everything is working.
So you enabled SSL with
mysql_ssl_rsa_setup, used a
OpenSSL based build or put
ssl-ca in the mysqld
section of your /etc/my.cnf and now
show global variables
like 'have_SSL'; returns 'YES'.
And you have configured the client with
show global status
like 'Ssl_cipher'; indicates the session is indeed
You could also dump traffic and it looks 'encrypted' (i.e. not readable)...
With SSL enabled everything should be safe isn't it?
The handshake …[Read more]
In a set of blog posts I will explain to you how different attacks on the network traffic of MySQL look like and what you can do to secure your systems againt these kinds of attacks.
How to gain access
To gain access to MySQL network traffic you can use tcpdump, dumpcap, snoop or whatever the tool to capture network packets on your OS is. This can be on any device which is part of the connnection: the server, the client, routers, switches, etc.
Besides application-to-database traffic this attack can also be done on replication traffic.
This allows you to extract queries and result sets.
The default password hash type
uses a nonce to protect against password sniffing. But when you
change a password this will be sent accross the wire by default.
Note that MySQL 5.6 and newer has …
Using Vault with MySQL
In my previous post I discussed using GPG to secure your database credentials. This relies on a local copy of your MySQL client config, but what if you want to keep the credentials stored safely along with other super secret information? Sure, GPG could still be used, but there must be an easier way to do this.
This post will look at a way to use Vault to store your credentials in a central location and use them to access your database. For those of you that have not yet come across Vault, it is a great way to manage your secrets – securing, storing and tightly controlling access. It has the added benefits of being able to handle leasing, key revocation, key rolling and auditing.
During this blog post we’ll accomplish the following …[Read more]
10 Older Entries »