Tue, 01 Mar 2005
Due to licensing issues, the Debian packages
for MySQL are not built with OpenSSL support. In order to enable SSL, the
packages must be recompiled.
server:/usr/src# apt-get build-dep mysql-server
server:/usr/src# apt-get install libssl-dev
server:/usr/src# apt-get source mysql-server
server:/usr/src# cd mysql-dfsg-4.0.23 (or whatever version you're building)
server:/usr/src/mysql-dfsg-4.0.23# vi debian/rules
Change --without-ssl to --with-ssl.
server:/usr/src/mysql-dfsg-4.0.23# vi debian/changelog
Add an entry to the top of the changelog.
mysql-dfsg (4.0.23-4-zerolag-1) unstable; urgency=low
* Compile with OpenSSL support
-- Christian Warden Fri, 25 Feb 2005 12:32:05 -0800
Then build and install the packages.
server:/usr/src/mysql-dfsg-4.0.23# ./debian/rules binary
server:/usr/src/mysql-dfsg-4.0.23# dpkg -i ../*mysql*.deb
If you already an SSL certificate that you're using with mod_ssl, you can use that. Otherwise,
generate a new key and certificate. See
/usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz for information
on how to generate a self-signed certificate.
Add the key and certificate to /etc/mysql/my.cnf.
[mysqld]
...
ssl-key=/etc/mysql/server.key
ssl-cert=/etc/mysql/cert.key
Create a user in MySQL that requires SSL encryption.
mysql> GRANT ALL on db.* to user@10.0.0.10 IDENTIFIED BY 'password' REQUIRE SSL;
Now, you should be able to connect over SSL. Remember that the client must
have been compiled with SSL support too. In order to use SSL, the client
must use the --ssl-ca option, either on the command-line or in
~/.my.cnf (or [mysql] section of /etc/mysql/my.cnf).
client:~$ mysql --ssl-ca=/dev/null -h server -u user -p
As far as I can tell, there's no way to actually force the client to validate
the servers certificate so it doesn't matter what value you set for ssl-ca. It
doesn't even have to exist. This, of course, means that while the connection
is encrypted, it's vulnerable to man-in-the-middle attacks.
See /usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz if you want to use client
certificates to authenticate clients rather than, or in addition to, passwords.
Update: I originally forgot to note that you should update the changelog before building the packages.
tech | Permanent Link
