0

I have a requirement to encrypt certain column of DB tables. Going through the links, have followed the below steps:

In /etc/my.cnf

[mysqld]
plugin-load-add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc
file_key_management_filekey = /etc/mysql/encryption/keyfile.key
file_key_management_encryption_algorithm = AES_CTR

Restarted the mysql

service mysqld restart

But i m unable to see the plugin added.

Executed the following mysql commands:

MariaDB [TestEncr]> CREATE TABLE table1 (col1 INT NOT NULL PRIMARY KEY, secret CHAR(200)) ENGINE=InnoDB ENCRYPTED=YES;
ERROR 1005 (HY000): Can't create table `TestEncr`.`table1` (errno: 140 "Wrong create options")

MariaDB [TestEncr]> install soname 'file_key_management';
ERROR 2 (HY000): Cannot decrypt /etc/mysql/encryption/keyfile.enc. Wrong key?

Unable to understand what is wrong???

2
  • Make sure you have log-error set in your .cnf file in the [mariadb] or [mysqld] sections. log-error doesn't have to specify a file, but it doesn't hurt. Then restart the mysqld service. Then check for clues in your MariaDB *.err file, which is usually in your datadir, which is usually /var/lib/mysql/. Does that have any relevant error or warning messages? Also, be sure to read the MariaDB documentation about the File Key Management Encryption Plugin. – dbdemon Aug 14 '19 at 20:37
  • Also, what do you get from SHOW PLUGINS SONAME WHERE Name LIKE 'file_key_management';? – dbdemon Aug 14 '19 at 20:58
0

If I understand the documentation correctly, you need to prefix the value of file_key_management_filekey with the literal FILE: in order for the subsequent part of the value to be interpreted as a file path containing the password, as opposed to being interpreted as the actual password. So in your case it should be:

file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.