I am wondering what is the point of encryption at rest?
It is said that a hacker cannot steal the database and look through it. I'm afraid that it does not protect the database while the key is stored on the same machine.
Let's have a look at my MariaDB settings:
[mysqld] # at-rest encryption plugin_load_add = file_key_management file_key_management_filename = /etc/mysql/rest/keyfile.enc file_key_management_filekey = FILE:/etc/mysql/rest/keyfile.passwd file_key_management_encryption_algorithm = AES_CBC
keyfile.enc are on the same machine, the hackers will steal all of them together and decrypt
keyfile.passwd and then they will obtain the key in a plain text and via the key, they decrypt the encrypted database.
Where will be the protection?