Cannot enable encryption via keyring-file

user_3030926 0
Viewed 1474

Ok, i'm following official Mysql docs to enable encryption on a mysql database on docker:

So here's what i've done:

  1. added early-plugin-load and keyring_file_data to /etc/mysql/my.cnf (i used echo stuff >> file since mysql docker image has no text editor), so now it is:
[mysqld]
pid-file        = /var/run/mysqld/mysqld.pid
socket          = /var/run/mysqld/mysqld.sock
datadir         = /var/lib/mysql
secure-file-priv= NULL
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links=0

# Custom config should go here
!includedir /etc/mysql/conf.d/
early-plugin-load=keyring_file.so
keyring_file_data=/usr/local/mysql/mysql-keyring/keyring
  1. created keyring file with
cd /usr/local/mysql
mkdir mysql-keyring
chmod 750 mysql-keyring
chown mysql mysql-keyring
chgrp mysql mysql-keyring
  1. restarted container to restart mysql
  2. connected to mysql and checked plugin availability (whith no luck) with
mysql> SELECT PLUGIN_NAME, PLUGIN_STATUS
       FROM INFORMATION_SCHEMA.PLUGINS
       WHERE PLUGIN_NAME LIKE 'keyring%';
  1. Checked the logs for errors:
2020-03-15T12:30:08.669015Z 0 [ERROR] [MY-011370] [Server] Plugin keyring_file reported: 'File '/usr/local/mysql/mysql-keyring/keyring' not found (OS errno 20 - Not a directory)'
2020-03-15T12:30:08.669036Z 0 [ERROR] [MY-011355] [Server] Plugin keyring_file reported: 'keyring_file initialization failure. Please check if the keyring_file_data points to readable keyring file or keyring file can be created in the specified location. The keyring_file will stay unusable until correct path to the keyring file gets provided'
2020-03-15T12:30:08.669053Z 0 [ERROR] [MY-010202] [Server] Plugin 'keyring_file' init function returned error.

So it look like that i correctly enabled the plugin, but something is wrong with the file.

Am i missing some steps?

keyring file

root@8c3670db35d4:/# ls -la /usr/local/mysql/mysql-keyring/
total 8
drwxr-s--- 2 mysql mysql 4096 Mar 15 12:34 .
drwxr-sr-x 3 root  staff 4096 Mar 15 12:33 ..
-rw-r----- 1 mysql mysql    0 Mar 15 12:34 keyring
mysql-8.0 docker encryption mysql
1 Answers

Are you sure you created the keyring file correctly inside the container ? This is how I was able to achieve the above with a correctly crafted Dockerfile.

  1. Create a folder for your image project (use whatever folder you like) 
    mkdir /tmp/testMysqlKeyring
cd /tmp/testMysqlKeyring
  2. Create a mysql keyring dropin configuration file keyring.cnf with the following content: 
    [mysqld]
early-plugin-load=keyring_file.so
keyring_file_data=/usr/local/mysql/mysql-keyring/keyring

  3. Create a Dockerfile with the following content

    FROM mysql:8

# Place the dropin config file in the relevant folder
COPY keyring.cnf /etc/mysql/conf.d/

# Create the keyring folder and adapt perms
RUN mkdir -p /usr/local/mysql/mysql-keyring && \
    chmod 750 /usr/local/mysql/mysql-keyring && \
    chown mysql.mysql /usr/local/mysql/mysql-keyring
  4. Build image from the above configuration: 
    docker build -t file_keyringed_mysql:latest .
  5. Run a container from that image (you will adapt with your exact volumes and environment later...) 
    docker run -d --rm --name my_keyring_test -e MYSQL_ALLOW_EMPTY_PASSWORD=true file_keyringed_mysql:latest
  6. Check that plugin is correctly installed inside the container 
    $ docker exec my_keyring_test mysql -e "SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'keyring%';"
PLUGIN_NAME     PLUGIN_STATUS
keyring_file    ACTIVE
user_94010960
Related