Remote encrypted SSL remote mysql server access07.12.13

Anonymous

On a Debian with openssl and mysql installed:

1.
add the following to the /etc/mysql/my.cnf file:

ssl=1
ssl-ca=/etc/mysql-certs/ca-cert.pem
ssl-cert=/etc/mysql-certs/server-cert.pem
ssl-key=/etc/mysql-certs/server-key.pem

2.
create the folder  etc/mysql-certs

mkdir /etc/mysql-certs
cd /etc/mysql-certs

3.
create the server and clients ca cert, cert and key

openssl genrsa 2048 > ca-key.pem
openssl req -new -x509 -nodes -days 3650 -key ca-key.pem > ca-cert.pem

openssl req -newkey rsa:2048 -days 3560 -nodes -keyout server-key.pem > server-req.pem
openssl x509 -req -in server-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem

openssl req -newkey rsa:2048 -days 3650 -nodes -keyout client-key.pem > client-req.pem
openssl x509 -req -in client-req.pem -days 3650 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem

chown -R mysql:mysql /etc/mysql-certs
chmod 500 /etc/mysql-certs
chmod -R 400 /etc/mysql-certs/*

3.
create or change the file /etc/apparmor.d/usr.sbin.mysqld,
so mysql can load those certs(see line  /etc/mysql-certs/*.pem r,)

usr/sbin/mysqld {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>
  #include <abstractions/mysql>

capability dac_override,
  capability setgid,
  capability setuid,

/etc/hosts.allow r,
  /etc/hosts.deny r,

/etc/group              m,
  /etc/passwd             m,

/etc/mysql-certs/*.pem r,
  /etc/mysql-certs/*.crt r,
  /etc/mysql-certs/*.key r,
  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/* r,
  /etc/mysql/my.cnf r,
  /usr/sbin/mysqld mr,
  /usr/share/mysql/** r,
  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,
  /var/log/mysql/ r,
  /var/log/mysql/* rw,
  /var/run/mysqld/mysqld.pid w,
  /var/run/mysqld/mysqld.sock w,
}

4.
restart mysql
etc/init.d/mysql restart

5.
login and check if the ssl files get loaded by

mysql> show variables like '%ssl%';

6.
create a remote mysql in the mysql command prompt

GRANT ALL ON *.* TO 'myuser'@'%' IDENTIFIED BY 'mypassword' REQUIRE X509;
FLUSH PRIVILEGES;

7.
test client access
the client must be able to access the ssl clients files : 
- ca_cert.pem
- client-key.pem
- client-cert.pem

example 
cd /etc/mysql-certs/

mysql -u myuser --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -pmypassword

http://www.thomas-krenn.com/de/wiki/MySQL_Verbindungen_mit_SSL_verschl%C3%BCsseln

http://ubuntuforums.org/showthread.php?t=1121458

07.12.13

http://www.thomas-krenn.com/de/wiki/MySQL_Verbindungen_mit_SSL_verschl%C3%BCsseln

Anonymous

Remote encrypted SSL remote mysql server access07.12.13

Information Epoch 1732484051