entityMap|blocks|key|2opv2|text|通常，数据库服务器应该只接受来自一个由IP配置的应用程序服务器的连接。如果数据库由多个应用程序使用，则能够连接到数据库的服务器必须持有可用于访问数据库的the服务。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|9tk38|不需要从不同的服务器连接到数据库。因此，您不需要任何会减慢传输速度的安全连接。^0|0^^$0|$]|1|@$2|3|4|5|6|7|8|E|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|F|9|@]|A|@]|B|$]]]]

Normally a database server should accept connects only from one application server configured by IP. If the database is used by more then one application, the server, which is able to connect to the database must hold a webservice which can be used to access the database.
There is no need to connect from different servers to a database. So you do not need any secure connection which would slow down the transfer.

entityMap|blocks|key|6dm65|text|是的，如果您担心恶意用户可以访问您的网络，您应该使用SSL在应用程序和数据库服务器之间进行连接。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|dj1ur|在我的公司，所有东西都必须是SSL。每个应用程序到应用程序的连接都必须是https。每个数据库连接都必须是SSL。在我们的内部网络中，它位于多层防火墙之后，这并不重要。这是深度防御。|cpkrg|我们确实将证书与SSL一起使用，用于验证SSL加密和身份验证。它比使用密码更强的身份验证。|9i4bh|当我们说SSL时，那是因为MySQL选项使用了这个术语。但我们真正使用的是TLS。|2c9hb|请注意，MySQL的bind-address虽然限制可以连接到数据库服务器的客户端，但不会阻止窃听程序截获TCP数据包。他们不需要连接到数据库服务器就可以做到这一点，他们只需要在同一个网络上就可以了。|offset|length|style|CODE^0|0|0|0|0|A|C^^$0|$]|1|@$2|3|4|5|6|7|8|O|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|P|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|Q|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|R|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|S|9|@$K|T|L|U|M|N]]|A|@]|B|$]]]]

Yes, if you have concerns about malicious users having access to your network, you should use SSL for connections between the app and the database server.
At my company, everything must be SSL. Every app-to-app connection must be https. Every database connection must be SSL. It doesn't matter that it's behind multiple levels of firewall in our internal network. It's defense in depth.
We do use certificates with the SSL, for both validating the SSL encryption and for authentication. It's stronger authentication than using passwords.
When we say SSL that's because the MySQL options use that term. But we really use TLS.
Note that MySQL's <code>bind-address</code> while limiting the clients who can connect to the database server, does not stop wiretappers from intercepting TCP packets. They don't have to connect to the database server to do that, they just have to be on the same network.

entityMap|0|type|LINK|mutability|MUTABLE|data|url|https://mariadb.com/kb/en/securing-connections-for-client-and-server/|1|2|https://en.wikipedia.org/wiki/Transport_Layer_Security|blocks|key|282gs|text|SSL+(最新版本为SSLv3)被认为是易受攻击的，并且不再被最新版本的MariaDB+(和MySQL)支持。|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|4g2jp|而不是使用后续TLS+(传输层安全)，更好的协议版本TLSv1.2或TLSv1.3被认为是安全的。此外，MariaDB还为TLS连接提供了额外的安全检查。|eab87|客户端：|aqah1|检查服务器证书中的名称是否与连接字符串中的主机名匹配|unordered-list-item|b52p8|验证服务器证书的指纹|4l101|指定用于连接的密码套件(或排除某些密码套件)|bhpss|服务器：|5era2|需要来自客户端的X509证书|dg3k4|检查客户端证书的主题和/或颁发者。|9f6bm|6er4q|欲了解更多信息，请检查|apf6n|保护客户端和服务器的连接。|339tb|传输层安全^0|A|5|0|0|0|0|0|0|0|0|0|0|0|0|0|D|1|0|0|5|2^^$0|$1|$2|3|4|5|6|$7|8]]|9|$2|3|4|5|6|$7|8]]|A|$2|3|4|5|6|$7|B]]]|C|@$D|E|F|G|2|H|I|1B|J|@]|K|@$L|1C|M|1D|D|1E]]|6|$]]|$D|N|F|O|2|H|I|1F|J|@]|K|@]|6|$]]|$D|P|F|Q|2|H|I|1G|J|@]|K|@]|6|$]]|$D|R|F|S|2|T|I|1H|J|@]|K|@]|6|$]]|$D|U|F|V|2|T|I|1I|J|@]|K|@]|6|$]]|$D|W|F|X|2|T|I|1J|J|@]|K|@]|6|$]]|$D|Y|F|Z|2|H|I|1K|J|@]|K|@]|6|$]]|$D|10|F|11|2|T|I|1L|J|@]|K|@]|6|$]]|$D|12|F|13|2|T|I|1M|J|@]|K|@]|6|$]]|$D|14|F|X|2|T|I|1N|J|@]|K|@]|6|$]]|$D|15|F|16|2|H|I|1O|J|@]|K|@]|6|$]]|$D|17|F|18|2|T|I|1P|J|@]|K|@$L|1Q|M|1R|D|1S]]|6|$]]|$D|19|F|1A|2|T|I|1T|J|@]|K|@$L|1U|M|1V|D|1W]]|6|$]]]]

SSL (latest version was <a href="https://mariadb.com/kb/en/securing-connections-for-client-and-server/" rel="nofollow noreferrer">SSLv3</a>) is considered to be vulnerable and isn't supported anymore by recent versions of MariaDB (and MySQL).
Instead of use the successor TLS (Transport Layer Security), preferrable protocol versions TLSv1.2 or TLSv1.3 which are considered to be safe.
In Addition MariaDB also offers additional security checks for TLS connections, e.g.
Client:
<ul>
<li>check the the name in server certificate matches the host name in connection string</li>
<li>verify the finger print of server certificate</li>
<li>specify a cipher suite for connection (or exclude certain cipher suites)</li>
</ul>
Server:
<ul>
<li>require X509 certificate from client</li>
<li>check subject and/or issuer of client certificate.</li>
<li>specify a cipher suite for connection (or exclude certain cipher suites)</li>
</ul>
For more information please check
<ul>
<li><a href="https://mariadb.com/kb/en/securing-connections-for-client-and-server/" rel="nofollow noreferrer">Securing connections for client and server</a>.</li>
<li><a href="https://en.wikipedia.org/wiki/Transport_Layer_Security" rel="nofollow noreferrer">Transport Layer Security</a></li>
</ul>

entityMap|blocks|key|1l55p|text|对我来说，解决方案很简单：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|7nbfk|我了解到，使用PHP+(MariaDB和MySQL)和本地主机作为主机的未加密连接将通过UNIX套接字进行连接，因此安全啊！|623sp|但是，使用SSL证书并不是错误的。这对于通过其他编程语言​​(例如Java)中的应用程序进行连接尤其重要。|ebrt9|即使网络中存在内部危险，也建议您选择加密连接。(TLS比SSLv3更安全)。|fn5gi|在我的例子中，我不需要使用SSL或TLS。^0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|K|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|L|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|M|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|N|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|O|9|@]|A|@]|B|$]]]]

For me the solution is very simple: 
I learned that an unencrypted connection with PHP (MariaDB and MySQL) and the localhost as host will connect via the UNIX socket and is therefore safe! However, it is not a mistake to use an SSL certificate. This is particularly important for connections via applications in other programming languages ​​(e.g. Java). Even if there is an internal danger in the network, it is advisable to choose an encrypted connection. (TLS is even safer then SSLv3). In my case I don't need to use SSL or TLS.

Does a localhost connection to a MariaDB (or MySQL) database could be intercepted without SSL / TLS protocol.

Is SSL certificate necessary for MariaDB (or MySQL) to ensure the security

 已关闭..。这个问题是opinion-based..。它目前不接受答案。 ---- 想要改进这个问题吗？更新问题，以便可以通过以下方式使用事实和引用回答问题编辑此帖子..。 4天前就关门了。 改进此问题 到MariaDB (或MySQL)数据库的本地主机连接是否可以在没有SSL / TLS协议的情况下被截获。

问MariaDB (或MySQL)是否需要SSL证书以确保安全性[已关闭]
EN

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问MariaDB (或MySQL)是否需要SSL证书以确保安全性[已关闭]EN