MariaDB CeBIT MariaDB 10.1: Datenbankverschlüsselung und andere Sicherheitsvorteile. Jens Bollmann, Principal Instructor/Consultant

Transcription

1 2015, MariaDB Corp. MariaDB CeBIT 2016 MariaDB 10.1: Datenbankverschlüsselung und andere Sicherheitsvorteile Jens Bollmann, Principal Instructor/Consultant

2 Agenda MariaDB 10.1/10.2 new features High Availabilty For Scalability For Security MariaDB 10.1 Security Feature Set 2

3 MariaDB 10.1 Released First GA version released in October Based on MariaDB 10.0 Includes contributions from community members like Facebook 3

4 MariaDB 10.1 Themes High Availability Scalability Security 4

5 High Availability 5

6 Galera Cluster integrated Full integration of Galera Cluster into MariaDB 10.1 all out of the box Enable Galera Cluster when you need it 6

7 Galera Custer integrated Per default MariaDB 10.1 works like a vanilla MariaDB Server For Galera Cluster it is required to: wrep_on = ON enable the code on startup wsrep_provider simply point to the galera library wsrep_cluster_address binlog_format=row define your cluster members default_storage_engine=innodb innodb_autoinc_lock_mode=2 innodb_doublewrite=1 galera takes over auto_increment query_cache_type=0/1 default on now query_cache_size=xxxm default 1M 7

8 Scalability 8

9 Parallel Slave Replication (10.0) Multi-source replication from different masters (domains) executed in parallel Queries that are run in parallel on the master are run in parallel on the slave (based on group commit) Transactions modifying the same table can be updated in parallel on the slave! Supports both statement based and row based replication. 9

10 Optimistic Parallel Replication New replicaton mode in MariaDB 10.1 Any INSERT, UPDATE or DELETE can be applied in parallel on the slave Not neccessarily means that it was commited in parallel on the master Needs a 10.1 master Needs a transactional engine for rollback in case of a conflict 10

11 Optimistic Parallel Replication Enabled by slave-parallel-mode=optimistic Temporarily disable by variable Server optimistically assumes that few conflicts will occur roll back and retry for conflicting transactions 11

12 Performance Improvements Especially for High-End Servers High processing power More cores Benchmark 10.1 on Linux Only POWER8 1 million SQL queries per second: GA MariaDB 10.1 on POWER8 12

13 InnoDB Defragmentation Deleted records can create gaps on pages Defragmentation based on an implementation from Facebook and Kakao Corp But no new SQL literals needed and changes to the server needed OPTIMIZE TABLE is used innodb_defragment=1 13

14 MySQL Compatibility Feature MariaDB 10.1 can be a slave to MySQL 5.6 Also when GTIDs are used Feature was requested from the Community To test MariaDB in a MySQL deployment For migrating to MariaDB / or Galera 14

15 Security 15

16 Security Features in MariaDB 10.1 Data at Rest Encryption Password Validation Plugin PAM Authentication Plugin Audit Plugin SSL Connections Encryption functions 16

17 Data at Rest Encryption I New with MariaDB 10.1 Originates from Google encryption patch Table space and table encryption Based on Encyption key Key id Key rotation Key version 17

18 Data at Rest Encyption II Encryption for XtraDB/InnoDB tablespaces XtraDB/InnoDB log files Binary logs Aria tables Temporary files 18

19 Data at Rest Encyption III No Encryption for Metadata Memory Config-Files 19

20 Data at Rest Encryption Last internal benchmarks on encryption overhead XtraDB/InnoDB encryption <1% (ro) 8-14% (rw) Temporary files encryption 7-10% (filesort) Binary log encryption: <4% 20

21 Deleted Data Encryption Scrubbing Background threads periodically scan tablespaces and logs and overwrite all data that should be deleted. More info: 21

22 Password Validation Plugins Password validation plugin API simple_password_check plugin Can enforce a minimum password length and guarantee that a password contains at least a specified number of upper and lowercase letters, digits, and punctuation characters cracklib_password_check plugin A widely used library Stop users from choosing easy to guess passwords. It includes checks for not allowing passwords based on the username or a dictionary word etc. 22

23 PAM Authentication Plugin Authentication using /etc/shadow Authentication using LDAP, SSH pass phrases, password expiration, username mapping, logging every login attempt, etc INSTALL PLUGIN pam SONAME 'auth_pam.so'; CREATE USER IDENTIFIED via pam; REMEMBER to configure PAM (/etc/pam.d or /etc/pam.conf) 23

24 MariaDB Audit Plugin Auditing database access to File (comma delimited format) Syslog Modified Plugin API in MariaDB Audit Plugin compatible with MySQL Server Only MariaDB allows to monitor table level events 24

25 MariaDB Audit Plugin CONNECT CONNECTION DISCONNECT FAILED CONNECT QUERY DDL DML+TCL DCL TIMESTAMP HOST USER SESSION OBJECT DATABASE TABLES 25

26 MariaDB Audit Plugin Password filtering included :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'CREATE USER IDENTIFIED BY *****', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'CREATE USER IDENTIFIED BY PASSWORD *****', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'INSERT INTO t_pwdtest VALUES (1,PASSWORD("mypwd"))', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'UPDATE t_pwdtest SET mypwd = PASSWORD("mynewpwd")', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'INSERT INTO t_pwdtest VALUES (2,OLD_PASSWORD("mypwd2"))', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'UPDATE t_pwdtest SET mypwd = OLD_PASSWORD("mynewpwd2")', :40:56,MYSQL5530,root,localhost,1,1,QUERY,,'GRANT ALL ON *.* TO "test5"@"localhost" IDENTIFIED BY *****',0 26

27 SSL Connections Encrytion between client and server Disabled by default TLSv1.2 protocol SSL also available for replication Variables needed to use SSL ssl-ca=ca.pem ssl-cert=server-cert.pem ssl-key=server-key.pem 27

28 Encryption Functions Encrytion functions are used per column Available encryptions AES (Advanced Encryption Standard) algorithm DES (Data Encryption Standard) algorithm Requires SSL to be configured String encryption via DECODE / ENCODE 28

29 Thank You mariadb.com "MySQL is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. MariaDB is not affiliated with MySQL." 29