I've set up encryption at rest for MariaDB but I can't seem to get my key fetching service to fetch the key.

I have the following fetch script and a systemd service set up.

# Fetch the encryption file for MariaDB, restart service, then remove file
/usr/bin/wget -P /etc/mysql https://example.com/my_maria_key.key 
/bin/systemctl restart mysql
sleep 10
rm /etc/mysql/my_maria_key.key
touch /tmp/mariadb.started
exit 0

And my systemd service file:




I made sure I enabled the service and I can run the service using:

sudo service fetch_key restart

But it doesn't fetch the key.

What have I done wrong?


file_key_management = ON
file_key_management_filename = /etc/mysql/secretkeyname.enc
file_key_management_filekey = FILE:/etc/mysql/.key
encrypt_binlog = 1
innodb_encrypt_tables = ON
innodb_encrypt_log = ON
aria_encrypt_tables = ON
encrypt_tmp_disk_tables = ON
innodb_encryption_threads = 8
innodb_encryption_rotate_key_age = 0 # Do not rotate key


when using wget via sudo in the terminal: 
644 -rw-r--r-- root root 620 mysecretkey.enc

letting the service download the key:
660 -rw-rw---- root root 620 mysecretkey.enc

generating the key with openssl:
644 -rw-r--r-- root root 336 mysecretkey.enc

Rather than making it its own server, extend the mariadb service:

mkdir /etc/systemd/system/mariadb.service.d

create a file /etc/systemd/system/mariadb.service.d/prefetch.conf with contents

ExecStartPre=/usr/bin/wget -P /etc/mysql https://example.com/my_maria_key.key
ExecStartPost={something to ensure the key is loaded - mysql -e '...' } 
ExecStartPost=rm my_maria_key.key

I don't know if this will deleting the key too early. Consider including journalctl -u mariadb.service -n 50 in your question.

  • I gave this a try and the ExecStartPre service doesn't ever get run that I can see here from the mariadb status. Its too long to post here in a comment. – Vince Kronlein Sep 24 '20 at 8:15
  • OK I had the name of the file wrong, .cnf instead of .conf. So now the ExecStartPre runs and saves the key to the correct directory, but mysql will not start. Do you know what the permissions of that key file should be? I can't imagine why it would encrypt my tables on first run, then not let the server start once it's removed and redownloaded. – Vince Kronlein Sep 24 '20 at 8:33
  • Adding my encrypt.cnf to my original question. – Vince Kronlein Sep 24 '20 at 8:35
  • Yes I think the permissions are the issue. When a make the key using openssl the file has permissions of 644 but when I import it via the service it has a permission of 660. I tried adding a new pre command ExecStartPre={chmod 644 /etc/mysql/mysecretkey.enc} but it had no effect. How do I change the file permission after the key downloads? – Vince Kronlein Sep 24 '20 at 9:18
  • PermissionsStartOnly=true means its doing pre/post as root. You can enter multiple ExecStartPre/Post – danblack Sep 24 '20 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.