启用文件密钥管理加密后，MariaDB 10.6.3无法启动

Question

我正在尝试在MariaDB 10.6.3服务器(Rocky Linux(中启用文件密钥管理加密。我正在使用开放ssl生成密钥文件。我遵循了这个指南https://mariadb.com/resources/blog/mariadb-encryption-tde-using-mariadbs-file-key-management-encryption-plugin/

echo "1;"$(openssl rand -hex 32) > /etc/mysql/encryption/keyfile
openssl rand -hex 128 > /etc/mysql/encryption/keyfile.key

使用生成加密文件时

openssl enc -aes-256-cbc -md sha1 -pass file:/etc/mysql/encryption/keyfile.key -in /etc/mysql/encryption/keyfile -out /etc/mysql/encryption/keyfile.enc

我收到警告

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.

由于上面的代码正在生成警告，我使用

openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 100000 
-pass file:/etc/mysql/encryption/keyfile.key -in /etc/mysql/encryption/keyfile -out /etc/mysql/encryption/keyfile.enc

这是我在server.cnf 中添加的配置

#File Key Management Plugin
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc
file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key
file_key_management_encryption_algorithm = AES_CTR
# InnoDB Encryption Setup
innodb_encrypt_tables = ON
innodb_encrypt_log = ON
innodb_encrypt_temporary_tables = ON
innodb_encryption_threads = 4
innodb_encryption_rotation_iops = 2000
# Temp & Log Encryption
encrypt_tmp_disk_tables = ON
encrypt_tmp_files = ON
encrypt_binlog = ON
aria_encrypt_tables = ON

保存配置后，当我尝试重新启动MariaDB时，它无法启动。MariaDB状态产生

[ERROR] mariadbd: Cannot decrypt /etc/mysql/encryption/keyfile.enc. Wrong key?
[ERROR] Plugin 'file_key_management' init function returned error.

[ERROR] Plugin 'file_key_management' registration as a ENCRYPTION failed.
[ERROR] InnoDB: cannot enable encryption, encryption plugin is not available
[ERROR] Plugin 'InnoDB' init function returned error.
[ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
[Note] Plugin 'FEEDBACK' is disabled.
[ERROR] Failed to enable encryption of temporary files
[ERROR] Aborting
systemd[1]: mariadb.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: mariadb.service: Failed with result 'exit-code'.
systemd[1]: Failed to start MariaDB 10.6.3 database server.

我已经检查了/var/lib/mysql/和file_key_management.so文件是否可用。

我确信添加-pbkdf2 -iter 100000是个问题。

有人能告诉我哪里出了问题吗？

Answer 1

当file_key_management插件不支持更新的格式和不同的密钥派生方法时，就会出现问题。但将来可能会看到这个错误报告。

现在你需要按照加密密钥文件的说明：

关于加密密钥文件，需要记住一些重要的细节，例如：MariaDB目前唯一支持的加密密钥文件的算法是高级加密标准(AES(的密码块链接(CBC(模式。加密密钥大小可以是128位、192位或256位。加密密钥是根据加密密码的SHA-1哈希创建的。加密密码的最大长度为256个字符。

https://mariadb.com/kb/en/file-key-management-encryption-plugin/#encrypting-密钥文件

$ sudo openssl enc -aes-256-cbc -md sha1 
-pass file:/etc/mysql/encryption/keyfile.key 
-in /etc/mysql/encryption/keyfile 
-out /etc/mysql/encryption/keyfile.enc

如果使用-aes-256-cbc进行加密，请确保file_key_management_encryption_algorithm是而不是设置为aes_CTR。

祝你好运！