mysql配置SSL证书登录的实现

原作者: [db:作者] 来自: [db:来源] 收藏邀请

前言

国家等级保护三级安全要求，mysql 的 ssl 需要安全证书加密，这里需要研究一下,选几个账户演示下即可。mysql 的版本为 8.0.20

一、Mysql 启用 SSL 配置

1.1 检查是否开启 ssl

mysql> show variables like '%ssl%';
+--------------------+-----------------+
| Variable_name      | Value           |
+--------------------+-----------------+
| have_openssl       | YES             |  
| have_ssl           | YES             |  # 已开启ssl
| mysqlx_ssl_ca      |                 |
| mysqlx_ssl_capath  |                 |
| mysqlx_ssl_cert    |                 |
| mysqlx_ssl_cipher  |                 |
| mysqlx_ssl_crl     |                 |
| mysqlx_ssl_crlpath |                 |
| mysqlx_ssl_key     |                 |
| ssl_ca             | ca.pem          |
| ssl_capath         |                 |
| ssl_cert           | server-cert.pem |
| ssl_cipher         |                 |
| ssl_crl            |                 |
| ssl_crlpath        |                 |
| ssl_fips_mode      | OFF             |
| ssl_key            | server-key.pem  |
+--------------------+-----------------+
17 rows in set (0.56 sec)

1.2 设置用户是否使用 SSL 连接

mysql> select ssl_type from user where user = 'dev_fqr' ;
+----------+
| ssl_type |
+----------+
|          |
+----------+
1 row in set (0.05 sec)

默认用户是没有使用 SSL 登录的。
我们可以强制这个管理用户使用 SSL 登录。

alter user 'xxx'@'%' require ssl;
取消ssl验证:
alter user 'xxx'@'%' require none;

更改后，该账户就无法登录了,查看状态变成下面这种

mysql> select ssl_type from user where user = 'dev_fqr' ;
+----------+
| ssl_type |
+----------+
| ANY      |
+----------+
1 row in set (0.01 sec)

测试登录，本机无法直接登录。

[root@localhost data]# mysql -u dev_fqr -p
Enter password: 
ERROR 2026 (HY000): SSL connection error: SSL is required but the server doesn't support it

远程客户端无法直接登录：

1.3 使用 SSL 登录

要想通过 SSL 登录，就需要用到下面这几个证书，通过 client 证书与 server 端进行校验通过才能登录成功。

1）本机登录

在 data 目录下的三个文件证书登录。

[root@localhost data]# mysql -udev_fqr -pDev@fqr2021 --ssl-ca=ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 55
Server version: 8.0.22 MySQL Community Server - GPL

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

You are enforcing ssl connection via unix socket. Please consider
switching ssl off as it does not make connection via unix socket
any more secure.
mysql>

2）navicate 远程客户端登录

把这三个证书下载下来

配置证书目录，即可远程访问：