Database Administrators Asked by Vince Kronlein on January 14, 2021
I’ve set up encryption at rest for MariaDB but I can’t seem to get my key fetching service to fetch the key.
I have the following fetch script and a systemd service set up.
# Fetch the encryption file for MariaDB, restart service, then remove file
/usr/bin/wget -P /etc/mysql https://example.com/my_maria_key.key
/bin/systemctl restart mysql
sleep 10
rm /etc/mysql/my_maria_key.key
touch /tmp/mariadb.started
exit 0
And my systemd service file:
[Unit]
After=network.service
[Service]
ExecStart=/etc/rc.local
[Install]
WantedBy=default.target
I made sure I enabled the service and I can run the service using:
sudo service fetch_key restart
But it doesn’t fetch the key.
What have I done wrong?
ADDING .CNF FOR REFERENCE
[mysqld]
plugin_load_add=file_key_management
file_key_management = ON
file_key_management_filename = /etc/mysql/secretkeyname.enc
file_key_management_filekey = FILE:/etc/mysql/.key
file_key_management_encryption_algorithm=aes_cbc
encrypt_binlog = 1
innodb_encrypt_tables = ON
innodb_encrypt_log = ON
aria_encrypt_tables = ON
encrypt_tmp_disk_tables = ON
innodb_encryption_threads = 8
innodb_encryption_rotate_key_age = 0 # Do not rotate key
ADDING VARIOUS KEY GENERATION RESULTS
when using wget via sudo in the terminal:
644 -rw-r--r-- root root 620 mysecretkey.enc
letting the service download the key:
660 -rw-rw---- root root 620 mysecretkey.enc
generating the key with openssl:
644 -rw-r--r-- root root 336 mysecretkey.enc
Rather than making it its own server, extend the mariadb service:
mkdir /etc/systemd/system/mariadb.service.d
create a file /etc/systemd/system/mariadb.service.d/prefetch.conf
with contents
[Service]
ExecStartPre=/usr/bin/wget -P /etc/mysql https://example.com/my_maria_key.key
ExecStartPost={something to ensure the key is loaded - mysql -e '...' }
ExecStartPost=rm my_maria_key.key
I don't know if this will deleting the key too early. Consider including journalctl -u mariadb.service -n 50
in your question.
Answered by danblack on January 14, 2021
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP