Encrypting MySQL Traffic In Scripts

Question

Hello,

I need to be able to encrypt the MySQL traffic from a web server to a database server. I know how to set MySQL to use SSL based on the server and client settings in my.cnf however, this needs to be done using mysql_connect() in PHP. This may be a 2 part question.

1) Does mysql_connect() use the MySQL client settings that are set in my.cnf?

If not...

I have read that you can use MYSQL_CLIENT_SSL however, where is the SSL data obtained from? Does using MYSQL_CLIENT_SSL in the mysql_connect function automagically encrypt the traffic?

Simply put, what is the best way to do this?

Thanks!

Answer 1

As an alternate solution, you can also use SSH tunnels to accomplish compression and encryption.

Answer 2

MYSQL_CLIENT_SSL was removed from PHP and should not work.

You have a few options: the first is that if your web server is also your database server, you don't need encryption because the connection never leaves your box: it just uses localhost.

The second option is to use what Pablo suggested above and take advantage of SSH tunnels. An SSH tunnel essentially does the same thing as an SSL connection, except it takes one "extra step" to get it going.

This seems like a pretty decent tutorial to help get you started:

http://www.revsys.com/writings/quicktips/ssh-tunnel.html

Hope this helps!

Answer 3

If you connect to MySQL using SSL, all your traffic between your SSL client and server will be encrypted.

MYSQL_CLIENT_SSL is obsolete. Using mysqli if you need to use SSL,

$db = mysqli_init(); 
$db->ssl_set(null, null,'cacert.pem',NULL,NULL); 
$db->real_connect('host','user','pass','db');

Answer 4

According to http://www.php.net/manual/en/mysql.constants.php#mysql.client-flags MYSQL_CLIENT_SSL is still part of PHP 4 and 5. You need to set up the SSL connection beforehand though. You'll have to generate certificates and a bunch of other hassle (http://www.madirish.net/?article=244) but it will encrypt the traffic between your web server and your database host.

As mentioned above, if your web server is on the same host as the database server this encryption is unnecessary as the data travels over a local socket and isn't exposed to the network. The SSL encryption only encrypts traffic over the network.

I would warn against using an SSH tunnel because they have a tendency to die and you'll have to worry about maintaining the connection.