— \u5b89\u5168\u98ce\u9669;
\n\u2022 \u5f53\u591a\u4e2a\u7528\u6237\u540c\u65f6\u8bbf\u95eeMySQL\u670d\u52a1\u5668,\u5c24\u5176\u5f53\u8fd9\u4e9b\u7528\u6237\u901a\u8fc7Internet\u8fdb\u884c\u8fde\u63a5\u65f6,MySQL\u670d\u52a1\u5668\u5c06\u6709\u5b89\u5168\u98ce\u9669;
\n\u2022 \u4e0d\u4ec5MySQL\u670d\u52a1\u5668\u5904\u4e8e\u5371\u9669\u4e2d,\u6574\u4e2a\u670d\u52a1\u5668\u4e3b\u673a\u4e5f\u53ef\u80fd\u53d7\u5230\u635f\u5bb3;
\n\u2022 \u6709\u591a\u79cd\u7c7b\u578b\u7684\u5b89\u5168\u653b\u51fb:
\n \u2013 \u7a83\u542c
\n \u2013 \u66f4\u6539
\n \u2013 \u64ad\u653e
\n \u2013 \u62d2\u7edd\u670d\u52a1
\n\u2022 \u5bf9\u4e8e\u6240\u6709\u8fde\u63a5,\u67e5\u8be2\u548c\u5176\u4ed6\u64cd\u4f5c,MySQL\u4f7f\u7528\u57fa\u4e8eACL(\u8bbf\u95ee\u63a7\u5236\u5217\u8868,access control list)\u7684\u5b89\u5168;
\n\u2022 ACL\u4e5f\u652f\u6301MySQL\u5ba2\u6237\u673a\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u7684SSL\u52a0\u5bc6\u8fde\u63a5;<\/p>\n
— MySQL\u5b89\u88c5\u5b89\u5168\u98ce\u9669;
\n\u6700\u5e38\u89c1\u7684\u5b89\u88c5\u5b89\u5168\u98ce\u9669\u4e3a:
\n1.\u7f51\u7edc\u5b89\u5168
\n 1.MySQL\u670d\u52a1\u5668\u5141\u8bb8\u5ba2\u6237\u673a\u901a\u8fc7\u7f51\u7edc\u8fdb\u884c\u8fde\u63a5\u5e76\u53d1\u51fa\u8bf7\u6c42;
\n 2.\u5982\u679c\u672a\u9650\u5236\u7279\u6743,\u5219\u7528\u6237\u53ef\u4ee5\u67e5\u770b\u5ba2\u6237\u673a\u5e10\u6237\u4fe1\u606f:\u4e3a\u6bcf\u4e2a\u5e10\u6237\u8bbe\u7f6e\u7684\u7279\u6743\u5e94\u8be5\u4ec5\u63d0\u4f9b\u5bf9\u8be5\u5e10\u6237\u9700\u8981\u67e5\u770b\u6216\u4fee\u6539\u7684\u6570\u636e\u7684\u8bbf\u95ee\u6743\u9650;
\n 3.\u4efb\u4f55\u6ca1\u6709\u53e3\u4ee4\u7684\u5e10\u6237\u90fd\u5f88\u5bb9\u6613\u53d7\u5230\u653b\u51fb;
\n2.\u64cd\u4f5c\u7cfb\u7edf\u5b89\u5168:\u901a\u5e38\u4f7f\u7528\u4e13\u7528\u7684\u767b\u5f55\u5e10\u6237\u7ba1\u7406MySQL;\u4f46\u662f,\u8be5\u5e10\u6237\u6240\u5728\u7684\u4e3b\u673a\u4e0a\u53ef\u80fd\u8fd8\u6709\u5176\u4ed6\u767b\u5f55\u5e10\u6237,\u5c06\u4e0eMySQL\u4e0d\u76f8\u5173\u7684\u5e10\u6237\u6570\u91cf\u51cf\u81f3\u6700\u5c11\u53ef\u4ee5\u5c3d\u53ef\u80fd\u5730\u964d\u4f4e\u6b64\u98ce\u9669;
\n3.\u6587\u4ef6\u7cfb\u7edf\u5b89\u5168:\u670d\u52a1\u5668\u4e0a\u7684\u76ee\u5f55,\u6570\u636e\u5e93\u6587\u4ef6\u548c\u65e5\u5fd7\u6587\u4ef6\u53ef\u80fd\u4f1a\u88ab\u4e0d\u5e94\u5177\u6709\u8bbf\u95ee\u6743\u9650\u7684\u7528\u6237\u6253\u5f00;<\/p>\n
— \u7f51\u7edc\u5b89\u5168;
\n\u98ce\u9669\u9884\u9632\u4efb\u52a1:
\n1.\u6295\u8d44\u8bbe\u7f6e\u9632\u706b\u5899;
\n2.\u786e\u4fdd\u4ec5\u4f9b\u6388\u6743\u7684\u5ba2\u6237\u673a\u8fdb\u884c\u8bbf\u95ee;
\n3.\u9650\u5236\u670d\u52a1\u5668\u6240\u4f7f\u7528\u7684\u7f51\u7edc\u63a5\u53e3;
\n4.\u4f7f\u7528\u5b89\u5168\u5b89\u88c5\u811a\u672c:mysql_secure_installation;
\n5.\u9075\u5b88\u5e38\u89c4\u7279\u6743\u5b89\u5168\u4e8b\u9879;
\n6.\u4e0d\u901a\u8fc7Internet\u4f20\u8f93\u660e\u6587(\u672a\u52a0\u5bc6)\u6570\u636e:\u672a\u52a0\u5bc6\u7684\u6570\u636e\u53ef\u88ab\u4efb\u4f55\u6709\u65f6\u95f4\u548c\u80fd\u529b\u62e6\u622a\u8be5\u6570\u636e\u5e76\u4f7f\u7528\u5b83\u6765\u8fbe\u5230\u81ea\u5df1\u76ee\u7684\u7684\u7528\u6237\u8bbf\u95ee,\u56e0\u6b64,\u60a8\u5e94\u8be5\u4f7f\u7528SSL\u6216SSH\u7b49\u52a0\u5bc6\u534f\u8bae;<\/p>\n
— \u53e3\u4ee4\u5b89\u5168;
\n\u98ce\u9669\u9884\u9632\u4efb\u52a1:
\n1.\u4f7f\u7528\u5f3a\u53e3\u4ee4\u4fdd\u62a4\u521d\u59cbMySQL\u5e10\u6237;
\n2.\u4e0d\u5728\u6570\u636e\u5e93\u4e2d\u5b58\u50a8\u4efb\u4f55\u7eaf\u6587\u672c\u53e3\u4ee4:
\n 1.mysql\u6570\u636e\u5e93\u5c06\u53e3\u4ee4\u5b58\u50a8\u5728user\u8868\u4e2d;
\n 2.\u6700\u597d\u4f7f\u7528\u5355\u5411\u6563\u5217\u5b58\u50a8\u8fd9\u4e9b\u53e3\u4ee4:MD5(),SHA1(),SHA2()\u3002
\n3.\u4e0d\u4ece\u5b57\u5178\u4e2d\u9009\u62e9\u53e3\u4ee4:\u6709\u4e00\u4e9b\u7279\u6b8a\u7a0b\u5e8f\u53ef\u7834\u8bd1\u53e3\u4ee4,\u5e94\u5bf9\u8fd9\u4e9b\u7a0b\u5e8f\u7684\u65b9\u6cd5\u4e4b\u4e00\u662f\u4f7f\u7528\u7531\u53e5\u5b50\u4e2d\u6bcf\u4e2a\u5355\u8bcd\u7684\u7b2c\u4e00\u4e2a\u5b57\u7b26\u7ec4\u6210\u7684\u53e3\u4ee4(\u4f8b\u5982,\u201cMary had a little lamb\u201d\u53ef\u4ee5\u751f\u6210\u53e3\u4ee4\u201cMhall\u201d);\u8fd9\u79cd\u53e3\u4ee4\u6613\u4e8e\u8bb0\u5fc6\u548c\u8f93\u5165,\u4f46\u4e0d\u77e5\u9053\u53e5\u5b50\u7684\u4eba\u5f88\u96be\u731c\u5230;<\/p>\n
— \u64cd\u4f5c\u7cfb\u7edf\u5b89\u5168;
\n1.\u4e0e\u914d\u7f6e\u7684\u590d\u6742\u7a0b\u5ea6\u6709\u5173:
\n 1.\u5c06\u670d\u52a1\u5668\u4e3b\u673a\u4e0a\u4e0eMySQL\u4e0d\u76f8\u5173\u7684\u4efb\u52a1\u6570\u51cf\u81f3\u6700\u5c11;
\n 2.\u5f53\u4e3a\u4e3b\u673a\u914d\u7f6e\u7684\u4efb\u52a1\u8f83\u5c11\u65f6,\u4e0e\u8fd0\u884c\u590d\u6742\u914d\u7f6e\u4ee5\u652f\u6301\u591a\u4e2a\u670d\u52a1\u7684\u4e3b\u673a\u76f8\u6bd4,\u524d\u4e00\u4e2a\u4e3b\u673a\u66f4\u6613\u4e8e\u786e\u4fdd\u5b89\u5168;
\n2.\u5176\u4ed6\u4f7f\u7528\u4f1a\u5bfc\u81f4\u6f5c\u5728\u98ce\u9669:\u6240\u5206\u914d\u7684MySQL\u670d\u52a1\u5668\u6700\u597d\u662f\u4e3b\u8981\u7528\u4e8eMySQL\u6216\u4e13\u4f9b\u5176\u7528;
\n3.\u767b\u5f55\u5e10\u6237\u5bf9\u4e8e\u4e13\u7528\u4e8eMySQL\u7684\u8ba1\u7b97\u673a\u4e0d\u662f\u5fc5\u9700\u7684;
\n4.\u5b8c\u5168\u4e13\u7528\u4e8eMySQL\u7684\u7cfb\u7edf\u53ef\u4ee5\u5728\u6027\u80fd\u65b9\u9762\u83b7\u76ca;<\/p>\n
— \u6587\u4ef6\u7cfb\u7edf\u5b89\u5168;
\nMySQL\u5b89\u88c5(\u76ee\u5f55\u548c\u6587\u4ef6)\u98ce\u9669\u9884\u9632\u4efb\u52a1:
\n1.\u66f4\u6539\u6240\u6709\u6743\u548c\u8bbf\u95ee\u6743\u9650\u540e,\u518d\u542f\u52a8\u670d\u52a1\u5668:
\n 1.\u5c06\u591a\u7528\u6237\u7cfb\u7edf\u7684\u6240\u6709\u6743\u8bbe\u7f6e\u4e3a\u5177\u6709\u7ba1\u7406\u7279\u6743\u7684\u5e10\u6237\u3002
\n 2.\u5c06\u4e0eMySQL\u76f8\u5173\u7684\u76ee\u5f55\u548c\u6587\u4ef6\u4ee5\u53causer\u548cgroup\u8868\u6240\u6709\u6743\u8bbe\u7f6e\u4e3amysql,\u5176\u4e2d\u5305\u62ec:
\n 1.MySQL\u7a0b\u5e8f;
\n 2.\u6570\u636e\u5e93\u76ee\u5f55\u548c\u6587\u4ef6;
\n 3.\u65e5\u5fd7,\u72b6\u6001\u548c\u914d\u7f6e\u6587\u4ef6;
\n2.\u4e0d\u8981\u5728\u4fdd\u62a4\u6587\u4ef6\u4e4b\u524d\u8bbe\u7f6e\u53e3\u4ee4,\u5426\u5219,\u5c06\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u66ff\u6362\u6587\u4ef6;
\n3.\u8bbe\u7f6e\u4e00\u4e2a\u4e13\u7528\u4e8eMySQL\u7ba1\u7406\u7684\u5e10\u6237:
\n 1.\u5bf9\u4e8eLinux\u4e4b\u7c7b\u7684\u591a\u7528\u6237\u7cfb\u7edf,\u8bf7\u5c06MySQL\u5b89\u88c5\u7684\u6240\u6709\u7ec4\u4ef6\u7684\u6240\u6709\u6743\u8bbe\u7f6e\u4e3a\u5177\u6709\u6b63\u786e\u7ba1\u7406\u7279\u6743\u7684\u4e13\u7528\u767b\u5f55\u5e10\u6237,\u8fd9\u5c06\u4fdd\u62a4\u5b89\u88c5\u514d\u53d7\u4e0d\u8d1f\u8d23\u6570\u636e\u5e93\u7ba1\u7406\u7684\u7528\u6237\u7684\u8bbf\u95ee;
\n 2.\u8bbe\u7f6e\u6b64\u5e10\u6237\u7684\u53e6\u5916\u4e00\u4e2a\u597d\u5904\u662f,\u53ef\u4ee5\u4f7f\u7528\u8be5\u5e10\u6237\u8fd0\u884cMySQL\u670d\u52a1\u5668,\u800c\u4e0d\u662f\u4eceLinux root\u5e10\u6237\u8fd0\u884c\u670d\u52a1\u5668;\u5177\u6709root\u767b\u5f55\u5e10\u6237\u7279\u6743\u7684\u670d\u52a1\u5668\u62e5\u6709\u4e0d\u5fc5\u8981\u7684\u6587\u4ef6\u7cfb\u7edf\u8bbf\u95ee\u6743\u9650,\u4ece\u800c\u6210\u4e3a\u4e00\u4e2a\u5b89\u5168\u98ce\u9669;<\/p>\n
— \u4fdd\u62a4\u6570\u636e;
\n\u7528\u6237\u53ef\u901a\u8fc7\u591a\u79cd\u65b9\u6cd5\u6765\u635f\u574f\u6570\u636e,\u5fc5\u987b\u91c7\u53d6\u63aa\u65bd\u4ee5\u4fdd\u62a4\u6570\u636e\u514d\u53d7\u5982SQL\u6ce8\u5165\u7b49\u653b\u51fb:
\n1.\u8bf7\u52ff\u4fe1\u4efb\u5e94\u7528\u7a0b\u5e8f\u7528\u6237\u8f93\u5165\u7684\u4efb\u4f55\u6570\u636e:
\n 1.\u7528\u6237\u53ef\u4ee5\u4f7f\u7528\u5177\u6709\u7279\u6b8a\u610f\u4e49\u7684\u5b57\u7b26(\u5982\u5f15\u53f7\u6216\u8f6c\u4e49\u5e8f\u5217)\u83b7\u53d6\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801;
\n 2.\u5982\u679c\u7528\u6237\u8f93\u5165\u7c7b\u4f3c\u4e8eDROP DATABASE mysql;\u7684\u5185\u5bb9,\u8bf7\u786e\u4fdd\u5e94\u7528\u7a0b\u5e8f\u4fdd\u6301\u5b89\u5168;
\n 3.\u5982\u679c\u7528\u6237\u8f93\u5165\u503c234\u65f6,\u5e94\u7528\u7a0b\u5e8f\u751f\u6210\u4e00\u4e2a\u7c7b\u4f3c\u4e8eSELECT * FROM table WHERE ID=234\u7684\u67e5\u8be2,\u5219\u7528\u6237\u53ef\u4ee5\u8f93\u5165\u503c234 OR 1=1\u4f7f\u5e94\u7528\u7a0b\u5e8f\u751f\u6210\u67e5\u8be2SELECT * FROM table WHERE ID=234 OR 1=1;\u4f7f\u7528\u4e0d\u4f1a\u5c06\u503c\u89e3\u91ca\u4e3aSQL\u8868\u8fbe\u5f0f\u7684\u5b58\u50a8\u4f8b\u7a0b\u6216\u9884\u5904\u7406\u8bed\u53e5;
\n2.\u4fdd\u62a4\u6570\u503c\u548c\u5b57\u7b26\u4e32\u6570\u636e\u7684\u503c:
\n 1.\u5728\u6570\u503c\u5b57\u6bb5\u4e2d\u8f93\u5165\u5b57\u7b26,\u7a7a\u683c\u548c\u7279\u6b8a\u7b26\u53f7\u800c\u4e0d\u662f\u6570\u5b57;\u5e94\u7528\u7a0b\u5e8f\u5e94\u5220\u9664\u8fd9\u4e9b\u5185\u5bb9\u518d\u5c06\u5176\u4f20\u9012\u7ed9MySQL;
\n 2.\u5426\u5219,\u7528\u6237\u53ef\u4ee5\u83b7\u53d6\u5bf9\u5b89\u5168\u6570\u636e\u7684\u8bbf\u95ee\u6743\u9650,\u7136\u540e\u63d0\u4ea4\u53ef\u4ee5\u9500\u6bc1\u6570\u636e\u6216\u5bfc\u81f4\u670d\u52a1\u5668\u8d1f\u8f7d\u8fc7\u9ad8\u7684\u67e5\u8be2;
\n3.\u751a\u81f3\u9700\u8981\u4fdd\u62a4\u516c\u5f00\u53ef\u7528\u7684\u6570\u636e:
\n 1.\u653b\u51fb\u4f1a\u6d6a\u8d39\u670d\u52a1\u5668\u8d44\u6e90;
\n 2.\u4fdd\u62a4Web\u8868\u5355(\u5728\u5ba2\u6237\u7aef\u6821\u9a8c),URL\u540d\u79f0,\u7279\u6b8a\u5b57\u7b26\u7b49;<\/p>\n
— \u4f7f\u7528\u5b89\u5168\u8fde\u63a5;
\n1.\u9ed8\u8ba4\u60c5\u51b5\u4e0b,MySQL\u4f7f\u7528\u672a\u52a0\u5bc6\u7684\u5ba2\u6237\u673a\/\u670d\u52a1\u5668\u8fde\u63a5;
\n2.\u672a\u52a0\u5bc6\u8fde\u63a5\u65e0\u6cd5\u6ee1\u8db3\u5728\u7f51\u7edc\u4e0a\u5b89\u5168\u4f20\u8f93\u6570\u636e\u7684\u8981\u6c42:
\n 1.\u7f51\u7edc\u901a\u4fe1\u5bb9\u6613\u53d7\u5230\u76d1\u89c6\u548c\u653b\u51fb;
\n 2.\u5728\u5ba2\u6237\u673a\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u4f20\u8f93\u7684\u6570\u636e\u53ef\u80fd\u4f1a\u88ab\u66f4\u6539;
\n3.\u4f7f\u7528\u52a0\u5bc6\u7b97\u6cd5\u53ef\u62b5\u5fa1\u5927\u591a\u6570\u5a01\u80c1:
\n 1.\u8fd9\u4e9b\u7b97\u6cd5\u4f1a\u4f7f\u6240\u6709\u7c7b\u578b\u7684\u6570\u636e\u65e0\u6cd5\u8bfb\u53d6;
\n 2.\u8fd9\u53ef\u62b5\u5fa1\u591a\u79cd\u7c7b\u578b\u7684\u653b\u51fb;
\n4.\u67d0\u4e9b\u5e94\u7528\u7a0b\u5e8f\u9700\u8981\u52a0\u5bc6\u8fde\u63a5\u6240\u63d0\u4f9b\u7684\u5b89\u5168\u6027,\u5bf9\u4e8e\u8fd9\u4e9b\u8fde\u63a5,\u5fc5\u987b\u8fdb\u884c\u989d\u5916\u7684\u8ba1\u7b97(\u6570\u636e\u52a0\u5bc6\u662fCPU\u5bc6\u96c6\u578b\u64cd\u4f5c,\u9700\u8981\u8ba1\u7b97\u673a\u6267\u884c\u989d\u5916\u5de5\u4f5c);<\/p>\n
— SSL\u534f\u8bae;
\n1.MySQL\u652f\u6301MySQL\u5ba2\u6237\u673a\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u7684SSL(secure sockets layer,\u5b89\u5168\u5957\u63a5\u5b57\u5c42)\u8fde\u63a5:MySQL\u53ef\u4ee5\u9488\u5bf9\u5355\u4e2a\u8fde\u63a5\u542f\u7528\u52a0\u5bc6,\u6839\u636e\u5404\u4e2a\u5e94\u7528\u7a0b\u5e8f\u7684\u9700\u8981,\u60a8\u53ef\u4ee5\u9009\u62e9\u5e38\u89c4\u7684\u672a\u52a0\u5bc6\u8fde\u63a5\u6216\u5b89\u5168\u7684\u52a0\u5bc6SSL\u8fde\u63a5;
\n2.SSL\u8fde\u63a5\u534f\u8bae\u5177\u6709\u4ee5\u4e0b\u7279\u70b9:
\n 1.\u4f7f\u7528\u4e0d\u540c\u7684\u52a0\u5bc6\u7b97\u6cd5\u786e\u4fdd\u516c\u5171\u7f51\u7edc\u4e0a\u6570\u636e\u7684\u5b89\u5168;
\n 2.\u68c0\u6d4b\u4efb\u4f55\u6570\u636e\u66f4\u6539,\u4e22\u5931\u6216\u91cd\u653e;
\n 3.\u7ed3\u5408\u4e86\u4f7f\u7528X509\u6807\u51c6\u63d0\u4f9b\u8eab\u4efd\u9a8c\u8bc1\u7684\u7b97\u6cd5;
\n3.\u9700\u8981\u989d\u5916\u5b89\u5168\u4fdd\u62a4(\u52a0\u5bc6)\u7684\u5e94\u7528\u7a0b\u5e8f\u5e94\u4f7f\u7528SSL\u3002
\n4.\u5b89\u5168\u8fde\u63a5\u57fa\u4e8eOpenSSL API\u3002<\/p>\n
\u8865\u5145:
\nX509\u4f7f\u5f97\u5728Internet\u4e0a\u8fdb\u884c\u8eab\u4efd\u8bc6\u522b\u6210\u4e3a\u53ef\u80fd,\u8fd9\u4e3b\u8981\u7528\u4e8e\u7535\u5b50\u5546\u52a1\u5e94\u7528\u7a0b\u5e8f\u4e2d;\u57fa\u672c\u4e0a,\u5e94\u8be5\u6709\u4e00\u4e2a\u53d7\u4fe1\u4efb\u7684\u8bc1\u4e66\u9881\u53d1\u673a\u6784(Certificate Authority, CA),\u8be5\u673a\u6784\u5c06\u7535\u5b50\u8bc1\u4e66\u5206\u914d\u7ed9\u4efb\u4f55\u9700\u8981\u5b83\u4eec\u7684\u4eba;\u8bc1\u4e66\u4f9d\u8d56\u4e8e\u5305\u542b\u4e24\u4e2a\u52a0\u5bc6\u5bc6\u94a5(\u516c\u94a5\u548c\u79c1\u94a5)\u7684\u975e\u5bf9\u79f0\u52a0\u5bc6\u7b97\u6cd5;<\/p>\n
— \u5bf9MySQL\u670d\u52a1\u5668\u4f7f\u7528SSL;
\n1.SSL\u4f7f\u7528\u8981\u6c42:
\n 1.\u7cfb\u7edf\u5fc5\u987b\u652f\u6301yaSSL(\u5df2\u968fMySQL\u63d0\u4f9b)\u6216OpenSSL(http:\/\/www.openssl.org);
\n 2.\u4f7f\u7528\u7684MySQL\u7248\u672c\u5fc5\u987b\u5305\u542bSSL\u652f\u6301;
\n2.\u8981\u83b7\u53d6\u5b89\u5168\u8fde\u63a5\u4ee5\u4fbf\u4f7f\u7528MySQL\u548cSSL,\u5fc5\u987b\u9996\u5148\u6267\u884c\u4ee5\u4e0b\u64cd\u4f5c:
\n 1.\u88c5\u5165OpenSSL(\u5982\u679c\u4f7f\u7528\u7684\u4e0d\u662f\u9884\u7f16\u8bd1\u7684MySQL);
\n 2.\u4e3aMySQL\u914d\u7f6eSSL\u652f\u6301,\u8981\u5c06MySQL\u6e90\u4ee3\u7801\u5206\u53d1\u914d\u7f6e\u4e3a\u4f7f\u7528SSL,\u8bf7\u8c03\u7528CMake: shell> cmake . -DWITH_SSL=bundled;
\n 1.\u8be5\u64cd\u4f5c\u4f1a\u5c06\u5206\u53d1\u914d\u7f6e\u4e3a\u4f7f\u7528\u9644\u5e26\u7684yaSSL\u5e93;
\n 2.\u8981\u6539\u7528\u7cfb\u7edfSSL\u5e93,\u8bf7\u5c06\u76f8\u5e94\u9009\u9879\u6307\u5b9a\u4e3a-DWITH_SSL=system;
\n 3.\u786e\u4fddMySQL\u6570\u636e\u5e93\u4e2d\u7684user\u8868\u5305\u542b\u4e0eSSL\u76f8\u5173\u7684\u5217(ssl_*\u548cx509_*),\u5426\u5219\u5fc5\u987b\u4f7f\u7528mysql_upgrade\u7a0b\u5e8f\u5bf9\u5176\u8fdb\u884c\u5347\u7ea7;
\n 4.\u4f7f\u7528–ssl\u9009\u9879\u68c0\u67e5\u670d\u52a1\u5668\u4e8c\u8fdb\u5236\u6587\u4ef6\u662f\u5426\u4f7f\u7528SSL\u652f\u6301\u8fdb\u884c\u7f16\u8bd1;
\n shell> mysqld –ssl –help
\n 060525 14:18:52 [ERROR] mysqld: unknown option ‘–ssl’
\n3.\u4f7f\u7528\u5141\u8bb8\u5ba2\u6237\u673a\u4f7f\u7528SSL\u7684\u9009\u9879\u542f\u52a8\u670d\u52a1\u5668;<\/p>\n
— \u4f7f\u7528SSL\u542f\u52a8MySQL\u670d\u52a1\u5668;
\n\u901a\u8fc7\u4ee5\u4e0b\u9009\u9879,\u4f7fmysqld\u670d\u52a1\u5668\u5ba2\u6237\u673a\u53ef\u4ee5\u4f7f\u7528SSL\u8fdb\u884c\u8fde\u63a5:
\n1.–ssl-ca:\u786e\u5b9a\u8981\u4f7f\u7528\u7684\u8bc1\u4e66\u9881\u53d1\u673a\u6784(Certificate Authority, CA)\u8bc1\u4e66(\u52a0\u5bc6\u5fc5\u9700);
\n2.–ssl-key:\u786e\u5b9a\u670d\u52a1\u5668\u516c\u94a5;
\n3.–ssl-cert:\u786e\u5b9a\u670d\u52a1\u5668\u79c1\u94a5;
\neg:shell> mysqld –ssl-ca=ca-cert.pem –ssl-cert=server-cert.pem –ssl-key=server-key.pem<\/p>\n
— \u8981\u6c42SSL\u52a0\u5bc6\u8fde\u63a5;
\n1.\u4f7f\u7528GRANT\u8bed\u53e5\u7684REQUIRE SSL\u9009\u9879\u53ef\u4ec5\u5141\u8bb8\u67d0\u4e2a\u5e10\u6237\u4f7f\u7528SSL\u52a0\u5bc6\u8fde\u63a5:
\nGRANT ALL PRIVILEGES ON test.* TO ‘root’@’localhost’ IDENTIFIED BY ‘goodsecret’ REQUIRE SSL;
\n2.\u901a\u8fc7\u4f7f\u7528–ssl-ca\u9009\u9879\u542f\u52a8mysql\u5ba2\u6237\u673a\u53ef\u83b7\u5f97\u52a0\u5bc6\u8fde\u63a5;
\n3.(\u53ef\u9009)\u53ef\u4ee5\u4e3aX509\u8fde\u63a5\u6307\u5b9a–ssl-key\u548c–ssl-cert\u9009\u9879:
\nshell> mysql –ssl-ca=ca-cert.pem –ssl-cert=server-cert.pem –ssl-key=server-key.pem<\/p>\n
\u8865\u5145:
\n\u6709\u5f88\u591a\u65b9\u6cd5\u53ef\u9650\u5236\u7ed9\u5b9a\u5e10\u6237\u7684\u8fde\u63a5\u7c7b\u578b:
\n1.REQUIRE NONE:\u6307\u793a\u5e10\u6237\u6ca1\u6709SSL\u6216X509\u8981\u6c42;\u5982\u679c\u672a\u6307\u5b9a\u4e0eSSL\u76f8\u5173\u7684REQUIRE\u9009\u9879,\u5219\u8fd9\u662f\u9ed8\u8ba4\u9009\u9879;\u5982\u679c\u7528\u6237\u540d\u548c\u53e3\u4ee4\u6709\u6548,\u5219\u5141\u8bb8\u672a\u52a0\u5bc6\u7684\u8fde\u63a5;\u4f46\u662f,\u5982\u679c\u5ba2\u6237\u673a\u5177\u6709\u76f8\u5e94\u7684\u8bc1\u4e66\u548c\u5bc6\u94a5\u6587\u4ef6,\u5219\u5ba2\u6237\u673a\u4e5f\u53ef\u4ee5\u901a\u8fc7\u6307\u5b9a\u4e00\u4e2a\u9009\u9879\u6765\u8981\u6c42\u52a0\u5bc6\u8fde\u63a5,\u5373,\u5ba2\u6237\u673a\u65e0\u9700\u6307\u5b9a\u4efb\u4f55SSL\u547d\u4ee4\u9009\u9879,\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b,\u8fde\u63a5\u662f\u672a\u52a0\u5bc6\u7684;
\n2.REQUIRE SSL:\u6307\u793a\u670d\u52a1\u5668\u4ec5\u5141\u8bb8\u5e10\u6237\u4f7f\u7528SSL\u52a0\u5bc6\u8fde\u63a5;
\n3.REQUIRE X509:\u5ba2\u6237\u673a\u5fc5\u987b\u5177\u6709\u6709\u6548\u7684\u8bc1\u4e66,\u4f46\u5177\u4f53\u7684\u8bc1\u4e66,\u9881\u53d1\u8005\u548c\u4e3b\u9898\u65e0\u5173\u7d27\u8981;\u552f\u4e00\u7684\u8981\u6c42\u662f,\u5e94\u8be5\u53ef\u4ee5\u4f7f\u7528\u5176\u4e2d\u4e00\u4e2aCA\u8bc1\u4e66\u9a8c\u8bc1\u5176\u7b7e\u540d;<\/p>\n
— \u68c0\u67e5SSL\u72b6\u6001;
\n1.\u68c0\u67e5\u6b63\u5728\u8fd0\u884c\u7684mysqld\u670d\u52a1\u5668\u662f\u5426\u652f\u6301SSL:mysql> SHOW VARIABLES LIKE ‘have_ssl’;
\n 1.\u5982\u679chave_ssl\u7684\u503c\u4e3aYES,\u5219\u670d\u52a1\u5668\u652f\u6301SSL\u8fde\u63a5;
\n 2.\u5982\u679c\u503c\u4e3aDISABLED,\u5219\u670d\u52a1\u5668\u652f\u6301SSL\u8fde\u63a5,\u4f46\u5728\u542f\u52a8\u65f6\u672a\u63d0\u4f9b\u76f8\u5e94\u7684–ssl-*\u9009\u9879;
\n2.\u4f7f\u7528ssl_cipher\u72b6\u6001\u53d8\u91cf\u7684\u503c\u68c0\u67e5\u5f53\u524d\u670d\u52a1\u5668\u8fde\u63a5\u662f\u5426\u4f7f\u7528\u4e86SSL:mysql> SHOW STATUS LIKE ‘ssl_cipher’;<\/p>\n
\u4f8b\u5b50:
\n1.Create clean environment
\nshell> \/tmp
\nshell> rm -rf newcerts
\nshell> mkdir newcerts && cd newcerts
\n2.Create CA certificate
\nshell> openssl genrsa 2048 > ca-key.pem
\nshell> openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem
\n3.Create server certificate, remove passphrase, and sign it server-cert.pem = public key, server-key.pem = private key
\nshell> openssl req -newkey rsa:2048 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
\nshell> openssl rsa -in server-key.pem -out server-key.pem
\nshell> openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
\n4.Create client certificate, remove passphrase, and sign it client-cert.pem = public key, client-key.pem = private key
\nshell> openssl req -newkey rsa:2048 -days 3600 -nodes -keyout client-key.pem -out client-req.pem
\nshell> openssl rsa -in client-key.pem -out client-key.pem
\nshell> openssl x509 -req -in client-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
\n5.After generating the certificates, verify them:
\nshell> openssl verify -CAfile ca-cert.pem server-cert.pem client-cert.pem
\nserver-cert.pem: OK
\nclient-cert.pem: OK
\n6.\u4fee\u6539my.cnf\u5e76\u4e14\u91cd\u65b0\u542f\u52a8\u6570\u636e\u5e93\u670d\u52a1\u5668;
\n[mysqld]
\nssl-ca=\/tmp\/newcerts\/ca-cert.pem
\nssl-cert=\/tmp\/newcerts\/server-cert.pem
\nssl-key=\/tmp\/newcerts\/server-key.pem
\n7.\u68c0\u67e5\u662f\u5426\u652f\u6301SSL:mysql> SHOW VARIABLES LIKE ‘have_ssl’;
\n8.\u521b\u5efa\u7528\u6237:GRANT ALL PRIVILEGES ON *.* TO ‘ssl_user’@’localhost’ IDENTIFIED BY ‘mysql’ REQUIRE SSL;
\n9.\u5ba2\u6237\u7aef\u8fde\u63a5:
\nshell> mysql -ussl_user -pmysql
\nERROR 1045 (28000): Access denied for user ‘ssl_user’@’localhost’ (using password: YES)
\nshell> mysql -ussl_user -pmysql –ssl-ca=\/tmp\/newcerts\/ca-cert.pem<\/p>\n
— \u4f7f\u7528SSL\u7684\u4f18\u70b9\u548c\u7f3a\u70b9;
\n1.\u4f18\u70b9:
\n 1.\u63d0\u9ad8\u4e86\u6709\u9700\u6c42\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u5b89\u5168\u6027;
\n 2.\u53ef\u4ee5\u9488\u5bf9\u5355\u4e2a\u8fde\u63a5\u542f\u7528;
\n 3.\u53ef\u7528\u4e8e\u590d\u5236\u64cd\u4f5c;
\n2.\u7f3a\u70b9:
\n 1.\u5360\u7528\u5927\u91cfCPU\u8d44\u6e90;
\n 2.\u964d\u4f4e\u4e86\u5ba2\u6237\u673a\/\u670d\u52a1\u5668\u534f\u8bae\u7684\u901f\u5ea6;
\n 3.\u53ef\u80fd\u4f1a\u63a8\u8fdf\u5176\u4ed6SQL\u4efb\u52a1;<\/p>\n
— \u4e0eMySQL\u7684\u5b89\u5168\u8fdc\u7a0b\u8fde\u63a5;
\n1.MySQL\u652f\u6301\u4e0e\u8fdc\u7a0bMySQL\u670d\u52a1\u5668\u7684SSH(secure shell,\u5b89\u5168shell)\u8fde\u63a5,\u8fd9\u4e00\u529f\u80fd\u8981\u6c42:
\n \u2013 \u5ba2\u6237\u673a\u4e0a\u5b58\u5728 SSH \u5ba2\u6237\u673a;
\n \u2013 \u901a\u8fc7 SSH \u96a7\u9053\u8fdb\u884c\u4ece\u5ba2\u6237\u673a\u5230\u670d\u52a1\u5668\u7684\u7aef\u53e3\u8f6c\u53d1;
\n \u2013 \u5177\u6709 SSH \u5ba2\u6237\u673a\u7684\u8ba1\u7b97\u673a\u4e0a\u5b58\u5728\u5ba2\u6237\u673a\u5e94\u7528\u7a0b\u5e8f;
\n2.\u8bbe\u7f6e\u5b8c\u6210\u540e,\u5c06\u6709\u4e00\u4e2a\u672c\u5730\u7aef\u53e3\u6258\u7ba1\u5230 MySQL \u7684 SSH \u8fde\u63a5\u5e76\u4f7f\u7528 SSH \u8fdb\u884c\u52a0\u5bc6;<\/p>\n
— MySQL\u5b89\u5168\u5e38\u89c1\u95ee\u9898;
\nfile:\/\/\/Users\/royalwzy\/Applications\/refman-5.6-en.html-chapter\/faqs.html#faqs-security<\/p>\n
— \u8bfe\u540e\u7ec3\u4e60;<\/p>\n","protected":false},"excerpt":{"rendered":"
— \u5b89\u5168\u98ce\u9669; \u2022 \u5f53\u591a\u4e2a\u7528\u6237\u540c\u65f6\u8bbf\u95eeMySQL\u670d\u52a1\u5668,\u5c24\u5176\u5f53\u8fd9\u4e9b\u7528\u6237\u901a\u8fc7Internet\u8fdb\u884c\u8fde\u63a5 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[27,31],"class_list":["post-1311","post","type-post","status-publish","format-standard","hentry","category-mysql","tag-mysql","tag-mysql_ocp"],"_links":{"self":[{"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/posts\/1311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1311"}],"version-history":[{"count":1,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/posts\/1311\/revisions"}],"predecessor-version":[{"id":1312,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=\/wp\/v2\/posts\/1311\/revisions\/1312"}],"wp:attachment":[{"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1311"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.royalwzy.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}