Tue, 01 Mar 2005

MySQL with SSL on Debian

Due to licensing issues, the Debian packages for MySQL are not built with OpenSSL support. In order to enable SSL, the packages must be recompiled.

server:/usr/src# apt-get build-dep mysql-server
server:/usr/src# apt-get install libssl-dev
server:/usr/src# apt-get source mysql-server
server:/usr/src# cd mysql-dfsg-4.0.23 (or whatever version you're building)
server:/usr/src/mysql-dfsg-4.0.23# vi debian/rules

Change --without-ssl to --with-ssl.

server:/usr/src/mysql-dfsg-4.0.23# vi debian/changelog

Add an entry to the top of the changelog.

mysql-dfsg (4.0.23-4-zerolag-1) unstable; urgency=low

  * Compile with OpenSSL support

 -- Christian Warden   Fri, 25 Feb 2005 12:32:05 -0800

Then build and install the packages.

server:/usr/src/mysql-dfsg-4.0.23# ./debian/rules binary
server:/usr/src/mysql-dfsg-4.0.23# dpkg -i ../*mysql*.deb

If you already an SSL certificate that you're using with mod_ssl, you can use that. Otherwise, generate a new key and certificate. See /usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz for information on how to generate a self-signed certificate. Add the key and certificate to /etc/mysql/my.cnf.


Create a user in MySQL that requires SSL encryption.

mysql> GRANT ALL on db.* to user@ IDENTIFIED BY 'password' REQUIRE SSL;

Now, you should be able to connect over SSL. Remember that the client must have been compiled with SSL support too. In order to use SSL, the client must use the --ssl-ca option, either on the command-line or in ~/.my.cnf (or [mysql] section of /etc/mysql/my.cnf).

client:~$ mysql --ssl-ca=/dev/null -h server -u user -p 

As far as I can tell, there's no way to actually force the client to validate the servers certificate so it doesn't matter what value you set for ssl-ca. It doesn't even have to exist. This, of course, means that while the connection is encrypted, it's vulnerable to man-in-the-middle attacks.

See /usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz if you want to use client certificates to authenticate clients rather than, or in addition to, passwords.

Update: I originally forgot to note that you should update the changelog before building the packages.

tech | Comments | Permanent Link

The state is that great fiction by which everyone tries to live at the expense of everyone else. - Frederic Bastiat