Detections
Analytics
4.9 Enable data-at-rest encryption in MariaDB
Information
Data-at-rest encryption protects the privacy of your information, prevents data breaches and helps meet regulatory requirements.Rationale:
File system based encryption does a good job of protecting against data theft on devices unable to limit physical access. It does not, however, protect against users who have or gain access to the operating system, backups, over the network copies, etc. Encrypting data from MariaDB adds an additional layer of data protection.
Solution
MariaDB's data-at-rest encryption requires the use of a key management and encryption plugin.Create the key file:
$ sudo mkdir -p /etc/mysql/encryption && (echo -n '1;' ; openssl rand -hex 32 ) | sudo tee -a /etc/mysql/encryption/keyfile
Generate a random encryption password:
$ sudo openssl rand -hex 128 | sudo tee -a /etc/mysql/encryption/keyfile.key
Encrypt the key file:
$ sudo openssl enc -aes-256-cbc -md sha1
-pass file:/etc/mysql/encryption/keyfile.key
-in /etc/mysql/encryption/keyfile
-out /etc/mysql/encryption/keyfile.enc
Delete the unencrypted key file:
$ sudo rm /etc/mysql/encryption/keyfile
Set permissions and ownership on the keyfile and key:
$ sudo chown mysql:mysql -R /etc/mysql/encryption
$ sudo chmod 640 /etc/mysql/encryption/keyfile*
Edit mariadb.cnf to resemble the following block, optionally uncommenting file_key_management_encryption_algorithm = AES_CTR:
[mariadb]
...
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc
file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key
# Binary Log Encryption
encrypt_binlog = ON
# Redo Log Encryption
innodb_encrypt_log = ON
# Encrypting Temporary Files
encrypt_tmp_files = ON
# Encrypt Temporary Tables
innodb_encrypt_temporary_tables = ON
# You can configure InnoDB encryption to automatically have all new InnoDB tables automatically encrypted, or specify encrypt per table.
innodb_encrypt_tables = ON
# Uncomment the line below if utilizing MariaDB built with OpenSSL
# file_key_management_encryption_algorithm = AES_CTR
If needed, see References for information about file_key_management_encryption_algorithm and OpenSSL usage.
Restart MariaDB:
$ sudo systemctl restart mariadb.service
Run ALTER to enable encryption (Note: This will lock the table as table is encrypted).
ALTER TABLE tab1
ENCRYPTED=YES ENCRYPTION_KEY_ID=1;
Revisit recommendation 3.10 after completing remediation.
Default Value:
At rest encryption is off by default.
When innodb_encrypt_tables is set to ON, InnoDB tables are automatically encrypted by default.
mariadb.cnf.
innodb_encrypt_tables=ON
See Also
Item Details
Audit Name: CIS MariaDB 10.6 on Linux L2 v1.1.0
Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|14.8
Plugin: Unix
Control ID: b5370d74a09c245339df369ada640fa4be21aaa8b30da5b4e2d608e6b5c8b35a