Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I'm in the process of setting up SSL-secured replication between two servers. Each server has its own public/private keypair, and the CA cert is just the concatenation of the two public certs, like this answer.

Now I'm updating the replication account with REQUIRE SUBJECT "exact subject of the client"

Is there any practical value to also having a password on the replication account (IDENTIFIED BY "secret")?

share|improve this question

2 Answers 2

The operating system parallel I was trying to draw probably isn't entirely appropriate.

If you want an operating system user that authenticates with SSH keys but can not authenticate by password, you can have an entry in /etc/shadow like:

user:!!:15792::::::

(There are lots of special values you can put in the hash column, that happens to be the one RHEL/CentOS use.) That user might be able to authenticate with other means (e.g., having ~user/.ssh/authorized_keys) but if the other means break, the password fallback won't work--it fails closed.

A merely blank Password column in mysql.user is not equivalent to that at all. If for some reason the REQUIRE SUBJECT part of the user's grant is ever removed, the account will fail open.

share|improve this answer

When a user account has REQUIRE SUBJECT, it simply places the restriction on connection attempts that the client must present a valid X509 certificate containing the subject subject. If the client presents a certificate that is valid but has a different subject, the server rejects the connection.

Note that, in the MySQL Documentation, a sample user was created with both:

GRANT ALL PRIVILEGES ON test.* TO 'root'@'localhost'
  IDENTIFIED BY 'goodsecret'
  REQUIRE SUBJECT '/C=EE/ST=Some-State/L=Tallinn/
    O=MySQL demo client certificate/
    CN=Tonu Samuel/emailAddress=tonu@example.com';

PCI and HIPAA would shriek "INSECURE" if a root user had no password, SSL or no SSL. This would be the case even more so with a Replication User.

Therefore, what is the practical value? : Having a password would provide another level security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.