1 理論部分
1.1 SSL的理解
1.1.1 基本概念
SSL即Secure Socket Layer- 安全套接字層(由Netscape提出)
1.1.2 SSL的作用
SSL - 實現客戶端和服務器之間的安全通訊(加密和完整性校驗)
1.1.3 協議組成
1) SSL Record Protocol(記錄協議)
- 建立於TCP之上
- 爲高層提供數據封裝、壓縮、加密等基本功能
2) SSL Handshake Protocol(握手協議)
- 建立於Record Protocol協議之上
- 用戶數據傳輸前的雙方身份認證、協商加密算法、交換機密祕鑰等
1.1.4 ISO層次
SSL工作於網絡層和應用層之間
1.2 MySQL SSL
與包括MySQL 5.6版本在內的舊版本相比，5.7.x增加了連接加密功能，防止通訊過程中數據庫信息被竊取
2 實踐部分
2.1 環境配置
2.1.1 基本信息
OS=CentOS 7.3 x86_64
IP Address=10.168.0.2[4-5]
HostName=hd0[1-2].cmdschool.org
注：以上隱含名稱解析服務
2.1.2 防火牆配置
firewall-cmd --permanent --add-service mysql firewall-cmd --reload firewall-cmd --list-all
2.1.3 配置安裝源
In hd0[1-2]
yum install -y https://dev.mysql.com/get/mysql57-community-release-el7-10.noarch.rpm
2.1.4 配置安裝包
In hd01
yum install -y mysql-community-server mysql-community-devel mysql-community-client
In hd02
yum install -y mysql-community-client
2.1.5 啓動數據庫
In hd01
systemctl start mysqld systemctl enable mysqld
2.1.6 初始化數據庫
In hd01
獲取臨時密碼：
cat /var/log/mysqld.log | grep 'A temporary password'
顯示如下：
2017-04-22T07:10:18.747550Z 1 [Note] A temporary password is generated for root@localhost: ufqLq&R6tgl%
初始化數據庫：
mysql_secure_installation
嚮導如下：
[...] Enter password for user root:ufqLq&R6tgl% [...] New password:******* Re-enter new password:******* [...] Change the password for root ? ((Press y|Y for Yes, any other key for No) : y New password:******* Re-enter new password:******* [...] Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y [...] Remove anonymous users? (Press y|Y for Yes, any other key for No) : y [...] Disallow root login remotely? (Press y|Y for Yes, any other key for No) : [...] Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y [...] Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y [...]
2.1.7 關閉密碼複雜度要求
In hd01
cp /etc/my.cnf /etc/my.cnf.default vim /etc/my.cnf
加入如下配置
[mysqld] # Disable password validaion plugin validate-password=off
重啓數據庫服務
systemctl restart mysqld
注：此操作方便後面配置用戶權限，降低MySQL服務對密碼複雜度的要求，這也是5.7的新特徵，說真的筆者認同MySQL官方的安全主張，但不喜歡（麻煩）。
驗證插件的禁用
show plugins;
顯示如下：
+----------------------------+----------+--------------------+----------------------+---------+ | Name | Status | Type | Library | License | +----------------------------+----------+--------------------+----------------------+---------+ | validate_password | DISABLED | VALIDATE PASSWORD | validate_password.so | GPL | +----------------------------+----------+--------------------+----------------------+---------+ 45 rows in set (0.00 sec)
2.2 配置MySQL SSL
2.2.1 確保本機安裝SSL
In hd0[1-2]
查詢MySQL是基於那種SSL
mysql -uroot -p show status like 'rsa_public_key';
返回如下提示：
Empty set (0.00 sec)
以上表明官方的編譯基於yaSSL，如果是基於openSSL，以下命令查看openSSL的版本
openssl version
2.2.2 生成所需的證書
In hd01
mysql_ssl_rsa_setup ls -l /var/lib/mysql/*.pem
會看到如下證書
-rw------- 1 mysql mysql 1679 Apr 22 10:38 /var/lib/mysql/ca-key.pem -rw-r--r-- 1 mysql mysql 1074 Apr 22 10:38 /var/lib/mysql/ca.pem -rw-r--r-- 1 mysql mysql 1078 Apr 22 10:38 /var/lib/mysql/client-cert.pem -rw------- 1 mysql mysql 1679 Apr 22 10:38 /var/lib/mysql/client-key.pem -rw------- 1 mysql mysql 1675 Apr 22 10:38 /var/lib/mysql/private_key.pem -rw-r--r-- 1 mysql mysql 451 Apr 22 10:38 /var/lib/mysql/public_key.pem -rw-r--r-- 1 mysql mysql 1078 Apr 22 10:38 /var/lib/mysql/server-cert.pem -rw------- 1 mysql mysql 1679 Apr 22 10:38 /var/lib/mysql/server-key.pem
2.2.3 MySQL配置文件中開啓SSL
In hd01
vim /etc/my.cnf
加入如下配置
[mysqld] ssl-ca = /var/lib/mysql/ca.pem ssl-cert = /var/lib/mysql/server-cert.pem ssl-key = /var/lib/mysql/server-key.pem
重啓服務
systemctl restart mysqld
2.2.4 確認是否開啓SSL
In hd01
mysql -uroot -p show global variables like 'have_%ssl';
顯示如下：
+---------------+-------+ | Variable_name | Value | +---------------+-------+ | have_openssl | YES | | have_ssl | YES | +---------------+-------+ 2 rows in set (0.00 sec)
2.2.5 查看SSL的加密方式
In hd01
mysql -uroot -p show global variables like 'tls_version';
顯示如下：
+---------------+---------------+ | Variable_name | Value | +---------------+---------------+ | tls_version | TLSv1,TLSv1.1 | +---------------+---------------+ 1 row in set (0.00 sec)
2.2.6 配置SSL用戶
In hd01
mysql -uroot -p grant all privileges on *.* to scm@'hd01.cmdschool.org' identified by 'scm' require none; grant all privileges on *.* to scm@'hd02.cmdschool.org' identified by 'scm' require ssl; flush privileges;
查看是否開啓強制用戶使用SSL
select user,host,ssl_type from mysql.user where user='scm';
顯示如下：
+------+--------------------+----------+ | user | host | ssl_type | +------+--------------------+----------+ | scm | hd01.cmdschool.org | | | scm | hd02.cmdschool.org | ANY | +------+--------------------+----------+ 2 rows in set (0.00 sec)
注：帳號“[email protected]”不強制使用SSL鏈接而“[email protected]”被強制使用SSL鏈接，不使用SSL無法登陸。
2.2.7 登錄測試
1) 使用SSL鏈接
In hd02
mysql -uscm -hhd01.cmdschool.org -p
2) 禁用SSL鏈接
In hd01
mysql -uscm -hhd01.cmdschool.org -p --ssl-mode=disable
3) 使用證書登錄（可選，不用也能SSL登陸）
In hd01
mysql --ssl-ca=/var/lib/mysql/ca.pem \ --ssl-cert=/var/lib/mysql/client-cert.pem \ --ssl-key=/var/lib/mysql/client-key.pem \ -uscm -p -hhd01.cmdschool.org
4) 配置文件指定證書登錄（可選，不用也能SSL登陸）
In hd01
vim ~/.my.cnf
輸入如下配置：
[client] ssl-ca = /var/lib/mysql/ca.pem ssl-cert = /var/lib/mysql/client-cert.pem ssl-key = /var/lib/mysql/client-key.pem
2.2.8 客戶端查看SSL狀態
1) 從狀態中查看
In hd02
status
顯示如下：
-------------- mysql Ver 14.14 Distrib 5.7.18, for Linux (x86_64) using EditLine wrapper Connection id: 8 Current database: Current user: [email protected] SSL: Cipher in use is DHE-RSA-AES256-SHA Current pager: stdout Using outfile: '' Using delimiter: ; Server version: 5.7.18-log MySQL Community Server (GPL) Protocol version: 10 Connection: hd01.cmdschool.org via TCP/IP Server characterset: latin1 Db characterset: latin1 Client characterset: utf8 Conn. characterset: utf8 TCP port: 3306 Uptime: 12 min 51 sec Threads: 6 Questions: 1446 Slow queries: 0 Opens: 156 Flush tables: 1 Open tables: 149 Queries per second avg: 1.875 --------------
注：正常會看到“SSL: Cipher in use is DHE-RSA-AES256-SHA”字樣
2) 查看SSL版本
In hd02
show session status like 'ssl_version';
顯示如下：
+---------------+---------+ | Variable_name | Value | +---------------+---------+ | Ssl_version | TLSv1.1 | +---------------+---------+ 1 row in set (0.00 sec)
3) 查看加密方式
In hd02
show session status like 'ssl_cipher';
顯示如下：
+---------------+--------------------+ | Variable_name | Value | +---------------+--------------------+ | Ssl_cipher | DHE-RSA-AES256-SHA | +---------------+--------------------+ 1 row in set (0.01 sec)
4) 支持的加密方式
In hd02
show session status like 'ssl_cipher_list';
顯示如下：
+-----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Variable_name | Value | +-----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Ssl_cipher_list | DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES128-RMD:DES-CBC3-RMD:DHE-RSA-AES256-RMD:DHE-RSA-AES128-RMD:DHE-RSA-DES-CBC3-RMD:AES256-SHA:RC4-SHA:RC4-MD5:DES-CBC3-SHA:DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:AES128-SHA:AES256-RMD | +-----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 1 row in set (0.00 sec)
3 附錄
3.1 JDBC的鏈接處理方式
3.1.1 錯誤提示（Error）
JAVA_HOME=/usr/java/jdk1.8.0_121 Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=256m; support was removed in 8.0 Sat Apr 22 19:09:20 CST 2017 WARN: Establishing SSL connection without server's identity verification is not recommended. According to MySQL 5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance with existing applications not using SSL the verifyServerCertificate property is set to 'false'. You need either to explicitly disable SSL by setting useSSL=false, or set useSSL=true and provide truststore for server certificate verification.
3.1.2 JDBC客戶端的解決方法
連接字符串url中加入ssl=true或false：
url=jdbc:mysql://127.0.0.1:3306/framework?characterEncoding=utf8&useSSL=true
注：本文只是筆着希望可以在MySQL的服務端解決以上錯誤提示而整理，如果網友有方案提供，筆者感激不盡。
參閱文檔
===================================
MySQL Database
----------------------
https://www.cloudera.com/documentation/enterprise/latest/topics/cm_ig_mysql.html
https://dev.mysql.com/doc/refman/5.7/en/validate-password-plugin.html
https://dev.mysql.com/doc/refman/5.7/en/secure-connection-options.html
MySQL開啓SSL
-----------------------
https://dev.mysql.com/doc/refman/5.7/en/using-secure-connections.html
SSL