For MariaDB encryption at-rest, my setting is
[mysqld] # at-rest encryption plugin_load_add = file_key_management file_key_management_filename = /etc/mysql/rest/keyfile.enc file_key_management_filekey = FILE:/etc/mysql/rest/keyfile.passwd file_key_management_encryption_algorithm = AES_CBC
However, if hackers steals the database, they has access to both
keyfile.passwd and the point of encryption at-rest is useless.
Can I tell the key manager not to read the super password from the file. Instead, read it from the user at the startup?