启用文件密钥管理加密后，MariaDB 10.6.3无法启动
我试图在MariaDB 10.6.3服务器(Rocky )中启用文件密钥管理加密。我正在使用打开的ssl生成密钥文件。我遵循了这个指南https://mariadb.com/resources/blog/mariadb-encryption-tde-using-mariadbs-file-key-management-encryption-plugin/
echo "1;"$(openssl rand -hex 32) > /etc/mysql/encryption/keyfile
openssl rand -hex 128 > /etc/mysql/encryption/keyfile.key生成加密文件时，使用
openssl enc -aes-256-cbc -md sha1 -pass file:/etc/mysql/encryption/keyfile.key -in /etc/mysql/encryption/keyfile -out /etc/mysql/encryption/keyfile.enc我收到警告了
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.由于上面的代码生成了一个警告，所以我使用
openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000
-pass file:/etc/mysql/encryption/keyfile.key -in /etc/mysql/encryption/keyfile -out /etc/mysql/encryption/keyfile.enc这是我在server.cnf中添加的配置
#File Key Management Plugin
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc
file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key
file_key_management_encryption_algorithm = AES_CTR
# InnoDB Encryption Setup
innodb_encrypt_tables = ON
innodb_encrypt_log = ON
innodb_encrypt_temporary_tables = ON
innodb_encryption_threads = 4
innodb_encryption_rotation_iops = 2000
# Temp & Log Encryption
encrypt_tmp_disk_tables = ON
encrypt_tmp_files = ON
encrypt_binlog = ON
aria_encrypt_tables = ON保存配置后，当我尝试重新启动MariaDB时，它将无法启动。MariaDB状态产生
[ERROR] mariadbd: Cannot decrypt /etc/mysql/encryption/keyfile.enc. Wrong key?
[ERROR] Plugin 'file_key_management' init function returned error.
[ERROR] Plugin 'file_key_management' registration as a ENCRYPTION failed.
[ERROR] InnoDB: cannot enable encryption, encryption plugin is not available
[ERROR] Plugin 'InnoDB' init function returned error.
[ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
[Note] Plugin 'FEEDBACK' is disabled.
[ERROR] Failed to enable encryption of temporary files
[ERROR] Aborting
systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: mariadb.service: Failed with result 'exit-code'.
systemd[1]: Failed to start MariaDB 10.6.3 database server.我已经检查了/var/lib/mysql/，file_key_management.so文件是可用的。
我确信添加-pbkdf2 -iter 100000是问题所在。
有人能告诉我哪里出了问题吗？
回答 1
Stack Overflow用户
发布于 2022-08-09 12:52:46
当file_key_management插件不支持更新的格式和不同的键派生方法时，事情就会出错。但它可能在未来，见这个错误报告。
现在，您需要遵循加密密钥文件的说明：
在加密密钥文件时要记住一些重要的细节，例如: MariaDB目前支持的唯一加密密钥文件的算法是高级加密标准(AES)的密码块链接(CBC)模式。加密密钥大小可以是128位、192位或256位.加密密钥是从加密密码的SHA-1哈希创建的。加密密码的最大长度为256个字符。
https://mariadb.com/kb/en/file-key-management-encryption-plugin/#encrypting-the-key-file
$ sudo openssl enc -aes-256-cbc -md sha1 \
-pass file:/etc/mysql/encryption/keyfile.key \
-in /etc/mysql/encryption/keyfile \
-out /etc/mysql/encryption/keyfile.enc如果您使用-aes-256-cbc加密，请确保file_key_management_encryption_algorithm是而不是设置为AES_CTR。
祝好运!
https://stackoverflow.com/questions/71029299
复制相似问题
腾讯云开发者
