Encrypt your –defaults-file

Encrypt your credentials using GPG

This blog post will look at how to use encryption to secure your database credentials.

In the recent blog post Use MySQL Shell Securely from Bash, there are examples of avoiding a ~/.my.cnf, but you still need to store credentials somewhere. MySQL 5.6.6 introduced the –login-path option, which stores credentials in an encrypted format. However, as shown in this post, those credentials can still be extracted.

Let’s improve this using gpg-agent, mkfifo, and some Bash techniques.

If you want to keep credentials secure, encryption is essential. GPG (GNU Privacy Guard) is a free implementation of OpenPGP that allows encryption and signing of data.

First Steps

Install GPG (example uses Ubuntu 16.04):

Create a GPG key:

List keys:

Create GPG config:

Create agent config:

Encrypt Your Credentials

Test encryption:

Encrypt a MySQL config file:

Using Encrypted Credentials

The following script decrypts credentials into a FIFO and passes them to MySQL:

Usage:

Extending to Other Tools

You can extend this approach to other tools like mysqldump, mysqladmin, and Percona Toolkit tools by mapping commands and using symlinks.

Examples

Enjoy improved security for your database credentials across environments.