I'm work on setting up a MariaDB local instance on laptops that will spend most of their time disconnected/unable to connect to the internet.

One of the requirements of the project is to encrypt the local instance of the data. which is hosted on a central server and replicated out to individual nodes when they reconnect to the internet.

I have set up MariaDB's Data at rest encryption using the file key management plugin but it's a little disconcerting that the keyfile is available on the local machine. What alternatives are available; besides having the front end app encrypt the data before inserting it into the db?

  • 2
    I think a better way to address this requirement is full disk encryption on the mobile workstations.
    – mustaccio
    Jan 17 '19 at 18:53
  • That's something we're looking into. I'm just trying to sort out some potential fall back options if full disk encryption isn't an option.
    – saihtam8
    Jan 17 '19 at 19:01
  • 1
    You can mount /var/lib/mysql/ on an encrypted filesystem and leave / unencrypted.
    – isalgueiro
    Jan 17 '19 at 19:03
  • Full disk encryption was standard policy at the company I worked for a few years ago. The IT folks seemed to have no problem with it. You will also need SSL and/or VPN when syncing. Get it done fast; Potus seems headed for outlawing such.
    – Rick James
    Jan 17 '19 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.