For MariaDB encryption at-rest, my setting is

# at-rest encryption
plugin_load_add              = file_key_management
file_key_management_filename = /etc/mysql/rest/keyfile.enc
file_key_management_filekey  = FILE:/etc/mysql/rest/keyfile.passwd
file_key_management_encryption_algorithm = AES_CBC

However, if hackers steals the database, they has access to both keyfile.enc and keyfile.passwd and the point of encryption at-rest is useless.

Can I tell the key manager not to read the super password from the file. Instead, read it from the user at the startup?


1 Answer 1


Usually database is started as a service in background, so entering keys at startup will not be possible.

To separate key(s) and data you have the following options:

  • store keys on a separate device which can be unplugged after start of database server.
  • use an external key management system, e.g Eperi which also supports key rotation.
  • Is AWS Key Management Plugin similar to Eperi in this sense? There is no much information in the link about how Eperi connects to another server. A bit hard to evaluate it.
    – mercury
    Aug 14, 2020 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.