查看當前連接方式，使用\s 或者status命令
Connection: Localhost via UNIX socket 表示使用 socket 進行本地的連接
SSL: Not in use 沒有使用SSL
[root@localhost bin]# mysql -uoot -p123456 -S/tmp/mysql.sock
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 15
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(root@localhost) [(none)]>status;
mysql Ver 14.14 Distrib 5.7.33, for linux-glibc2.12 (x86_64) using EditLine wrapper
Connection id: 15
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.33 MySQL Community Server (GPL)
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /tmp/mysql.sock
Uptime: 8 hours 15 min 5 sec
Threads: 4 Questions: 436 Slow queries: 0 Opens: 261 Flush tables: 1 Open tables: 254 Queries per second avg: 0.014
--------------
Connection: 127.0.0.1 via TCP/IP 使用TCP/IP 協議進行遠程連接
SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256 使用了SSL加密
root@localhost bin]# mysql -h127.0.0.1 -uroot -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
root@localhost) [(none)]>\s
--------------
mysql Ver 14.14 Distrib 5.7.33, for linux-glibc2.12 (x86_64) using EditLine wrapper
Connection id: 17
Current database:
Current user: root@localhost
SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.33 MySQL Community Server (GPL)
Protocol version: 10
Connection: 127.0.0.1 via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 8 hours 16 min 31 sec
Threads: 4 Questions: 448 Slow queries: 0 Opens: 261 Flush tables: 1 Open tables: 254 Queries per second avg: 0.015
--------------
1、本地socket連接
[root@localhost bin]# mysql -uoot -p123456 -S/tmp/mysql.sock
-S/tmp/mysql.sock可以省略，因爲默認參數如下：
(root@localhost) [mysql]>show variables like 'sock%';
+---------------+-----------------+
| Variable_name | Value |
+---------------+-----------------+
| socket | /tmp/mysql.sock |
+---------------+-----------------+
假如sock文件另有其它，那麼就後面不能省略，需要指定下。
2、TCP|IP協議遠程連接
mysql -h127.0.0.1 -P3306 -uroot -p123456
可以通過配置my.cnf免密登錄
[client]
user=root
password=123456
socket=/tmp/mysql.sock
配置mysql進行SSL連接
mysql5.7默認是使用SSL的方式來進行通訊的。
/s輸出SSL: Not in use，說明當前沒有使用SSL連接。
再看下error.log有一個waning：failed to set up SSL because of the following SSL liberary error：SSL context is not usable withut certificate and private key。公密鑰文件不存在，所以無法啓用SSL的連接方式。
1、進入bin目錄執行命令： mysql_ssl_rsa_setup 在/data 根目錄 生成相關的*.pem 密鑰文件。
2、對新生成到pem文件授權chown mysql:mysql *.pem
3、 /etc/init.d/mysqld restart 重啓mysql
4、進入命令客戶端執行\s
[root@localhost bin]# ./mysql_ssl_rsa_setup
[root@localhost bin]# ll
總用量 1347960
-rwxr-xr-x. 1 mysql mysql 8107712 12月 10 11:23 innochecksum
-rwxr-xr-x. 1 mysql mysql 236710 12月 10 11:23 lz4_decompress
-rwxr-xr-x. 1 mysql mysql 10043637 12月 10 11:24 myisamchk
-rwxr-xr-x. 1 mysql mysql 9588122 12月 10 11:24 myisam_ftdump
-rwxr-xr-x. 1 mysql mysql 7487512 12月 10 11:24 myisamlog
-rwxr-xr-x. 1 mysql mysql 9712786 12月 10 11:24 myisampack
-rwxr-xr-x. 1 mysql mysql 7401199 12月 10 11:23 my_print_defaults
-rwxr-xr-x. 1 mysql mysql 10366606 12月 10 11:24 mysql
-rwxr-xr-x. 1 mysql mysql 9223981 12月 10 11:24 mysqladmin
-rwxr-xr-x. 1 mysql mysql 11195779 12月 10 11:24 mysqlbinlog
-rwxr-xr-x. 1 mysql mysql 9595053 12月 10 11:24 mysqlcheck
-rwxr-xr-x. 1 mysql mysql 219791001 12月 10 11:28 mysql_client_test_embedded
-rwxr-xr-x. 1 mysql mysql 5245 12月 10 11:23 mysql_config
-rwxr-xr-x. 1 mysql mysql 7577740 12月 10 11:23 mysql_config_editor
-rwxr-xr-x. 1 mysql mysql 255061158 12月 10 11:28 mysqld
-rwxr-xr-x. 1 mysql mysql 207729722 12月 10 11:21 mysqld-debug
-rwxr-xr-x. 1 mysql mysql 27139 12月 10 11:23 mysqld_multi
-rwxr-xr-x. 1 mysql mysql 27836 12月 10 11:23 mysqld_safe
-rwxr-xr-x. 1 mysql mysql 9497744 12月 10 11:24 mysqldump
-rwxr-xr-x. 1 mysql mysql 7865 12月 10 11:23 mysqldumpslow
-rwxr-xr-x. 1 mysql mysql 219359082 12月 10 11:28 mysql_embedded
-rwxr-xr-x. 1 mysql mysql 9246562 12月 10 11:24 mysqlimport
-rwxr-xr-x. 1 mysql mysql 9727964 12月 10 11:24 mysql_install_db
-rwxr-xr-x. 1 mysql mysql 7464232 12月 10 11:24 mysql_plugin
-rwxr-xr-x. 1 mysql mysql 17480316 12月 10 11:25 mysqlpump
-rwxr-xr-x. 1 mysql mysql 9175578 12月 10 11:24 mysql_secure_installation
-rwxr-xr-x. 1 mysql mysql 9183463 12月 10 11:24 mysqlshow
-rwxr-xr-x. 1 mysql mysql 9287213 12月 10 11:24 mysqlslap
-rwxr-xr-x. 1 mysql mysql 7785427 12月 10 11:23 mysql_ssl_rsa_setup
-rwxr-xr-x. 1 mysql mysql 218947689 12月 10 11:28 mysqltest_embedded
-rwxr-xr-x. 1 mysql mysql 5109314 12月 10 11:23 mysql_tzinfo_to_sql
-rwxr-xr-x. 1 mysql mysql 12433225 12月 10 11:24 mysql_upgrade
-rwxr-xr-x. 1 mysql mysql 24487998 12月 10 11:24 mysqlxtest
-rwxr-xr-x. 1 mysql mysql 7539954 12月 10 11:23 perror
-rwxr-xr-x. 1 mysql mysql 5326743 12月 10 11:23 replace
-rwxr-xr-x. 1 mysql mysql 7397397 12月 10 11:23 resolveip
-rwxr-xr-x. 1 mysql mysql 7486857 12月 10 11:23 resolve_stack_dump
-rwxr-xr-x. 1 mysql mysql 112339 12月 10 11:23 zlib_decompress
[root@localhost bin]# ./mysql_ssl_rsa_setup
[root@localhost bin]# cd ..
[root@localhost mysql-5.7.33-linux-glibc2.12-x86_64]# ll
總用量 300
drwxr-xr-x. 2 mysql mysql 4096 4月 18 10:16 bin
drwxr-xr-x. 2 mysql mysql 55 4月 18 10:16 docs
-rw-r-----. 1 mysql mysql 33756 4月 18 11:08 error.log
drwxr-xr-x. 3 mysql mysql 4096 4月 18 10:16 include
drwxr-xr-x. 5 mysql mysql 230 4月 18 10:16 lib
-rw-r--r--. 1 mysql mysql 250129 12月 10 11:01 LICENSE
drwxr-xr-x. 4 mysql mysql 30 4月 18 10:16 man
-rw-r--r--. 1 mysql mysql 566 12月 10 11:01 README
drwxr-xr-x. 28 mysql mysql 4096 4月 18 10:16 share
drwxr-xr-x. 2 mysql mysql 90 4月 18 10:16 support-files
[root@localhost mysql-5.7.33-linux-glibc2.12-x86_64]# cd /mdata/mysql57/
[root@localhost mysql57]# ll
總用量 122988
-rw-r-----. 1 mysql mysql 56 4月 18 10:36 auto.cnf
-rw-------. 1 mysql mysql 1680 4月 18 10:36 ca-key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 ca.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 client-cert.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 client-key.pem
-rw-r-----. 1 mysql mysql 36046 4月 18 19:33 error.log
-rw-r-----. 1 mysql mysql 325 4月 18 11:20 ib_buffer_pool
-rw-r-----. 1 mysql mysql 12582912 4月 18 11:20 ibdata1
-rw-r-----. 1 mysql mysql 50331648 4月 18 11:20 ib_logfile0
-rw-r-----. 1 mysql mysql 50331648 4月 18 10:36 ib_logfile1
-rw-r-----. 1 mysql mysql 12582912 4月 18 12:37 ibtmp1
-rw-r-----. 1 mysql mysql 6 4月 18 11:20 localhost.localdomain.pid
-rw-r--r--. 1 root root 0 4月 18 11:20 localhost.localdomain.pid.shutdown
drwxr-x---. 2 mysql mysql 4096 4月 18 10:36 mysql
drwxr-x---. 2 mysql mysql 8192 4月 18 10:36 performance_schema
-rw-------. 1 mysql mysql 1680 4月 18 10:36 private_key.pem
-rw-r--r--. 1 mysql mysql 452 4月 18 10:36 public_key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 server-cert.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 server-key.pem
drwxr-x---. 2 mysql mysql 8192 4月 18 10:36 sys
drwx------. 2 mysql mysql 6 4月 18 16:47 test
[root@localhost mysql57]# cd test
[root@localhost test]# cd ..
[root@localhost mysql57]# ll *.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 ca-key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 ca.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 client-cert.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 client-key.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 private_key.pem
-rw-r--r--. 1 mysql mysql 452 4月 18 10:36 public_key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 10:36 server-cert.pem
-rw-------. 1 mysql mysql 1680 4月 18 10:36 server-key.pem
[root@localhost mysql57]# chown mysql:mysql *.pem
[root@localhost mysql57]# /etc/init.d/mysqld restart
Shutting down MySQL.... SUCCESS!
Starting MySQL.. SUCCESS!
[root@localhost mysql57]# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(root@localhost) [(none)]>show variables like '%ssl%';
+---------------+-----------------+
| Variable_name | Value |
+---------------+-----------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | ca.pem |
| ssl_capath | |
| ssl_cert | server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | server-key.pem |
+---------------+-----------------+
9 rows in set (0.01 sec)
注意：若是使用本地socket連接，則不會進行SSL加密。\s還是輸出SSL: Not in use；只有在使用IP/TCP遠程連接時纔會進行SSL加密。如下：
使用IP/TCP遠程連接時，\s輸出 SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256。說明已經用上SSL加密。
[root@localhost bin]# mysql -h127.0.0.1 -uroot -p123456
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
([email protected]) [(none)]>\s
--------------
mysql Ver 14.14 Distrib 5.7.33, for linux-glibc2.12 (x86_64) using EditLine wrapper
Connection id: 4
Current database:
Current user: root@localhost
SSL: Cipher in use is ECDHE-RSA-AES128-GCM-SHA256
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.33 MySQL Community Server (GPL)
Protocol version: 10
Connection: 127.0.0.1 via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 4 min 18 sec
Threads: 2 Questions: 18 Slow queries: 0 Opens: 106 Flush tables: 1 Open tables: 99 Queries per second avg: 0.069
--------------
使用socket進行本地連接，就不會使用SSL加密。\s輸出SSL: Not in use；
[root@localhost bin]# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(root@localhost) [(none)]>\s
--------------
mysql Ver 14.14 Distrib 5.7.33, for linux-glibc2.12 (x86_64) using EditLine wrapper
Connection id: 5
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.33 MySQL Community Server (GPL)
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /tmp/mysql.sock
Uptime: 9 min 34 sec
Threads: 2 Questions: 24 Slow queries: 0 Opens: 106 Flush tables: 1 Open tables: 99 Queries per second avg: 0.041
--------------
因爲SSL開啓可能有性能影響。如果不希望使用ssl加密登錄連接，那麼可以使用下面命令進行禁用：mysql -h127.0.0.1 -uroot -p123456 --ssl-mode=DISABLED
[root@localhost bin]# mysql -h127.0.0.1 -uroot -p123456 --ssl-mode=DISABLED
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 6
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
([email protected]) [(none)]>\s
--------------
mysql Ver 14.14 Distrib 5.7.33, for linux-glibc2.12 (x86_64) using EditLine wrapper
Connection id: 6
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.7.33 MySQL Community Server (GPL)
Protocol version: 10
Connection: 127.0.0.1 via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 22 min 52 sec
Threads: 2 Questions: 30 Slow queries: 0 Opens: 106 Flush tables: 1 Open tables: 99 Queries per second avg: 0.021
--------------
強制一個用戶使用ssl
([email protected]) [(none)]>alter user david@'%' require ssl;
Query OK, 0 rows affected (0.03 sec)
([email protected]) [(none)]>show grants for david@'%';
之後david用戶就必須使用ssl登錄了，否則報錯如下：
[root@localhost ~]# mysql -h127.0.0.1 -udavid -p456 --ssl-mode=DISABLED
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'david'@'localhost' (using password: YES)
[root@localhost ~]# mysql -udavid -p456 -S/tmp/mysql.sock
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'david'@'localhost' (using password: YES)
取消一個用戶強制使用ssl
(root@localhost) [(none)]>alter user david@'%' require none;
Query OK, 0 rows affected (0.00 sec)
(root@localhost) [(none)]>exit;
Bye
[root@localhost ~]# mysql -udavid -p456 -S/tmp/mysql.sock
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 14
Server version: 5.7.33 MySQL Community Server (GPL)
Copyright (c) 2000, 2021, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(david@localhost) [(none)]>
x509認證
x509認證在開啓SSL的基礎下，還強制指定用戶必須使用client-cert.pem和client-key.pem證書、密鑰文件來登錄，否則登錄不了。x509是mysql最高等級的認證機制。
alter user david@'%' require x509;
之前已經在data根目錄生成了8個 *.pem文件
[root@localhost mysql57]# ll *.pem
-rw-------. 1 mysql mysql 1676 4月 18 20:08 ca-key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 20:08 ca.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 20:08 client-cert.pem
-rw-------. 1 mysql mysql 1676 4月 18 20:08 client-key.pem
-rw-------. 1 mysql mysql 1676 4月 18 20:08 private_key.pem
-rw-r--r--. 1 mysql mysql 452 4月 18 20:08 public_key.pem
-rw-r--r--. 1 mysql mysql 1112 4月 18 20:08 server-cert.pem
-rw-------. 1 mysql mysql 1680 4月 18 20:08 server-key.pem
把其中client-cert.pem和client-key.pem導出
如下，再使用之前的命令登錄。發現登錄不了了。
[root@localhost mysql57]# mysql -udavid -p456 -S/tmp/mysql.sock
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1045 (28000): Access denied for user 'david'@'localhost' (using password: YES)
此時想要登錄必須在客戶端指定SSL CERT File和SSL Key File 如下在navicat中
在mysql workbench中
