server:/usr/src# apt-get build-dep mysql-server server:/usr/src# apt-get install libssl-dev server:/usr/src# apt-get source mysql-server server:/usr/src# cd mysql-dfsg-4.0.23 (or whatever version you're building) server:/usr/src/mysql-dfsg-4.0.23# vi debian/rules
Change --without-ssl to --with-ssl.
server:/usr/src/mysql-dfsg-4.0.23# vi debian/changelog
Add an entry to the top of the changelog.
mysql-dfsg (4.0.23-4-zerolag-1) unstable; urgency=low * Compile with OpenSSL support -- Christian Warden
Fri, 25 Feb 2005 12:32:05 -0800
Then build and install the packages.
server:/usr/src/mysql-dfsg-4.0.23# ./debian/rules binary server:/usr/src/mysql-dfsg-4.0.23# dpkg -i ../*mysql*.deb
If you already an SSL certificate that you're using with mod_ssl, you can use that. Otherwise,
generate a new key and certificate. See
/usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz for information
on how to generate a self-signed certificate.
Add the key and certificate to /etc/mysql/my.cnf.
[mysqld] ... ssl-key=/etc/mysql/server.key ssl-cert=/etc/mysql/cert.key
Create a user in MySQL that requires SSL encryption.
mysql> GRANT ALL on db.* to firstname.lastname@example.org IDENTIFIED BY 'password' REQUIRE SSL;
Now, you should be able to connect over SSL. Remember that the client must
have been compiled with SSL support too. In order to use SSL, the client
must use the
--ssl-ca option, either on the command-line or in
[mysql] section of /etc/mysql/my.cnf).
client:~$ mysql --ssl-ca=/dev/null -h server -u user -p
As far as I can tell, there's no way to actually force the client to validate the servers certificate so it doesn't matter what value you set for ssl-ca. It doesn't even have to exist. This, of course, means that while the connection is encrypted, it's vulnerable to man-in-the-middle attacks.
/usr/share/doc/mysql-server/SSL-MINI-HOWTO.txt.gz if you want to use client
certificates to authenticate clients rather than, or in addition to, passwords.
Update: I originally forgot to note that you should update the changelog before building the packages.
The state is that great fiction by which everyone tries to live at the expense of everyone else. - Frederic Bastiat