MySQL5.7表空间加密

Posted 文采飞扬

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了MySQL5.7表空间加密相关的知识,希望对你有一定的参考价值。

mysql5.7开始支持表空间加密了,增强了MySQL的数据文件的安全性,这是一个很不错的一个功能,这个特性默认是没有启用的,要使用这个功能要安装插件keyring_file。

下面就来看看怎么安装,安装这个插件不用重启MySQL

1.安装插件

1.1 安装插件

(mysql5.7)[email protected] [(none)]> INSTALL PLUGIN keyring_file  soname ‘keyring_file.so‘;
Query OK, 0 rows affected ( 0.01 sec)

2.创建密钥文件目录

mkdir -p /ssd01/3306/mysql-keyring/

chown -R mysql.mysql /ssd01/3306/mysql-keyring/

chmod 750  /ssd01/3306/mysql-keyring/

3.设置KEY文件,这个是动态参数,可以直接设置

(mysql5.7)[email protected] [(none)]> set global keyring_file_data=‘/ssd01/3306/mysql-keyring/keyring‘;

Query OK, 0 rows affected (0.00 sec)

 

(mysql5.7)[email protected] [(none)]>

 

4.重要事情说三遍:更新配置文件,避免遗忘更新配置文件,避免下次重启出问题

在my.cnf的[mysqld]段,加这两行

early-plugin-load=keyring_file.so keyring_file_data=/ssd01/3306/mysql-keyring/keyring

 

##这个是遗忘更新配置文件时候的重启出现的情况

 KEY文件默认这只到base目录

(mysql5.7)[email protected] [(none)]> show global variables like ‘%keyring_file_data%‘;

+-------------------+----------------------------------+

| Variable_name     | Value                            |

+-------------------+----------------------------------+

| keyring_file_data | /usr/local/mysql/keyring/keyring |

+-------------------+----------------------------------+

1 row in set (0.00 sec)

插件还是在的

(mysql5.7)[email protected] [(none)]> show plugins;

+----------------------------+----------+--------------------+-----------------+---------+

| Name                       | Status   | Type               | Library         | License |

+----------------------------+----------+--------------------+-----------------+---------+

| binlog                     | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| mysql_native_password      | ACTIVE   | AUTHENTICATION     | NULL            | GPL     |

| sha256_password            | ACTIVE   | AUTHENTICATION     | NULL            | GPL     |

| InnoDB                     | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| INNODB_TRX                 | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_LOCKS               | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_LOCK_WAITS          | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMP                 | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMP_RESET           | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMPMEM              | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMPMEM_RESET        | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMP_PER_INDEX       | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_CMP_PER_INDEX_RESET | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_BUFFER_PAGE         | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_BUFFER_PAGE_LRU     | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_BUFFER_POOL_STATS   | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_TEMP_TABLE_INFO     | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_METRICS             | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_DEFAULT_STOPWORD | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_DELETED          | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_BEING_DELETED    | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_CONFIG           | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_INDEX_CACHE      | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_FT_INDEX_TABLE      | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_TABLES          | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_TABLESTATS      | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_INDEXES         | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_COLUMNS         | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_FIELDS          | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_FOREIGN         | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_FOREIGN_COLS    | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_TABLESPACES     | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_DATAFILES       | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| INNODB_SYS_VIRTUAL         | ACTIVE   | INFORMATION SCHEMA | NULL            | GPL     |

| PERFORMANCE_SCHEMA         | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| MRG_MYISAM                 | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| MyISAM                     | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| MEMORY                     | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| CSV                        | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| BLACKHOLE                  | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| partition                  | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| FEDERATED                  | DISABLED | STORAGE ENGINE     | NULL            | GPL     |

| ARCHIVE                    | ACTIVE   | STORAGE ENGINE     | NULL            | GPL     |

| ngram                      | ACTIVE   | FTPARSER           | NULL            | GPL     |

| keyring_file               | ACTIVE   | KEYRING            | keyring_file.so | GPL     |

+----------------------------+----------+--------------------+-----------------+---------+

45 rows in set (0.00 sec)

访问表出错了

 (mysql5.7)[email protected] [test]> show create table test_1;
ERROR 3185 (HY000): Can‘t find master key from keyring, please check keyring plugin is loaded.

2.测试加密表

(mysql5.7)[email protected] [(none)]> use test11;

Database changed

(mysql5.7)[email protected] [test11]> alter table test1 encryption=‘Y‘;

Query OK, 17 rows affected (0.04 sec) Records: 17  Duplicates: 0  Warnings: 0

查看一下information_schema.tables 看看是否加密成功

(mysql5.7)[email protected] [test11]> select * from information_schema.tables where CREATE_OPTIONS like ‘%ENCRYPTION="Y"%‘\G;

*************************** 1. row ***************************

  TABLE_CATALOG: def

   TABLE_SCHEMA: test11

     TABLE_NAME: test1

     TABLE_TYPE: BASE TABLE

         ENGINE: InnoDB

        VERSION: 10

     ROW_FORMAT: Dynamic

     TABLE_ROWS: 17

 AVG_ROW_LENGTH: 963

    DATA_LENGTH: 16384

MAX_DATA_LENGTH: 0

   INDEX_LENGTH: 16384

      DATA_FREE: 0

 AUTO_INCREMENT: 102

    CREATE_TIME: 2016-06-21 15:17:33

    UPDATE_TIME: 2016-06-21 15:17:33

     CHECK_TIME: NULL

TABLE_COLLATION: utf8_general_ci

       CHECKSUM: NULL

 CREATE_OPTIONS: ENCRYPTION="Y"

  TABLE_COMMENT:

1 row in set (0.03 sec)

  

(mysql5.7)[email protected] [test11]>

也许有人问,我这个支持在线DDL么,其实想一下,加密表空间应该是拷贝表方式。

(mysql5.7)[email protected] [test]> alter table test_1 encryption=‘Y‘,ALGORITHM=INPLACE,LOCK=none;
ERROR 1846 (0A000): ALGORITHM=INPLACE is not supported. Reason: Invalid encryption option.. Try ALGORITHM=COPY.
(mysql5.7)[email protected] [test]>

 3.小结

安装插件很简单,有必要测试一下加密表空间对性能的影响。测试也很简单,用sysbench,tpcc先创建表,再修改为加密表空间。还有key密钥不要误删除了,不然就呵呵哒。你数据只能用备份来恢复了

 

以上是关于MySQL5.7表空间加密的主要内容,如果未能解决你的问题,请参考以下文章

MySQL5.7传输表空间——迁移分区表

MySQL5.7新特性——在线收缩undo表空间

mysql5.7:mysql安装和基于SSL加密的主从复制(详细剖析)

mysql5.7 General tablespace使用说明

MySQL中MyISAM与InnoDB的主要区别对比

使用percona mysql插件来监控mysql5.7