[MariaDB]: Enforcing SSL for all connections
If we’ve configured required ssl configuration in the my.cnf and enabled ssl globally with required variables (have_ssl, have_open_ssl).
Though we create users without REQUIRE SSL privilege, they will use SSL connection.
[ root @ dbversity : /var/lib/mysql ] grep ‘ssl’ /etc/opt/rh/rh-mariadb101/my.cnf
ssl-ca = /etc/opt/rh/rh-mariadb101/pki/dbversity.crt
ssl
ssl-cipher = AES128+EECDH:AES128+EDH
ssl-ca = /etc/opt/rh/rh-mariadb101/pki/dbversity.crt
ssl-cert = /etc/opt/rh/rh-mariadb101/pki/dbversity_server.cer
ssl-key = /etc/opt/rh/rh-mariadb101/pki/dbversity.key
[ root @ dbversity : /var/lib/mysql ]
[ root @ dbversity : /var/lib/mysql ] mysql -u root -p”xxxxxxxx” -h localhost -e “SHOW GLOBAL VARIABLES LIKE ‘%ssl%’;”
+———————+——————————————————-+
| Variable_name | Value |
+———————+——————————————————-+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /etc/opt/rh/rh-mariadb101/pki/dbversity.crt |
| ssl_capath | |
| ssl_cert | /etc/opt/rh/rh-mariadb101/pki/dbversity_server.cer |
| ssl_cipher | AES128+EECDH:AES128+EDH |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | /etc/opt/rh/rh-mariadb101/pki/dbversity.key |
| version_ssl_library | OpenSSL 1.0.1e-fips 11 Feb 2013 |
+———————+——————————————————-+
[ root @ dbversity : /var/lib/mysql ]
[ root @ dbversity : /var/lib/mysql ]
[ root @ dbversity : /var/lib/mysql ] mysql -u root -p”xxxxxxxx” -h localhost
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 4
Server version: 10.1.13-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.
MariaDB [(none)]>
MariaDB [(none)]>
MariaDB [(none)]> GRANT all privileges on *.* to ‘nonsslusr’@’%’ identified by ‘XXXXXXXXX’;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> exit
Bye
[ root @ dbversity : /var/lib/mysql ] mysql -u nonsslusr -p”XXXXXXXXX” -h localhost -e “\s” | grep SSL
SSL: Cipher in use is DHE-RSA-AES128-GCM-SHA256
[ root @ dbversity : /var/lib/mysql ]
[ root @ dbversity : /var/lib/mysql ]