Movatterモバイル変換

For MySQL Enterprise Backup to backup encrypted InnoDB tablespaces, the operating system user that runs MySQL Enterprise Backup must have write permission for the keyring file on the server if thekeyring_file orkeyring_aws plugin is used on it.

• mysqlbackup contacts the MySQL server to determine the keyring plugin or component the server is using.

• If the server is using thekeyring_encrypted_file plugin or thecomponent_keyring_encrypted_file component, the user must use the option--encrypt-password to supply tomysqlbackup the keyring file encryption password that has been set on the server either with the--keyring_encrypted_file_password option (if the plugin is used) or with thecomponent_keyring_encrypted_file.cnf file (if the component is used).mysqlbackup then copies over from the server the encrypted keyring data file, which contains the master key used to encrypt all the tablespace keys, into themeta folder in the backup; the file is encrypted with the user password supplied with the option--encrypt-password. The encrypted tablespace files are also copied into the backup.

• If the server uses a keyring plugin other thankeyring_encrypted_file or a keyring component other thancomponent_keyring_encrypted_file,mysqlbackup accesses the keyring to obtain the master key and uses it to decrypt the encrypted tablespace keys, which were used to encrypt the InnoDB tablespaces on the server. The master key is then put into a keyring data file namedkeyring_kef and saved in themeta folder in the backup; the file is encrypted with the user password supplied with the option--encrypt-password.

  Notes

  • Backing up a server that uses a keyring plugin other thankeyring_encrypted_file or a keyring component other thancomponent_keyring_encrypted_file is only supported for servers that allow socket connections or TCP/IP connections using TLS; it is, therefore, not supported when, for example, the server is running on a Windows platform and only allows shared memory connections.

  • Users who do not want to supply the password on the command line or in a defaults file may use the--encrypt-password option without specifying any value;mysqlbackup then asks the user to type in the password before the operation starts. This applies to all commands that use the--encrypt-password option.

  • If the server uses thekeyring_hashicorp plugin, use the--encrypt-password to supply the HashiCorp Vault AppRole authentication secret ID, which was the value ofkeyring_hashicorp_secret_id on the server to be backed up.

• When any keyring plugin other thankeyring_file was used on the backed-up server,mysqlbackup restores the encrypted keyring data file to its proper location on the server. The restored server has to be started withkeyring_encrypted_file plugin and with the optionskeyring_encrypted_file_data and--keyring_encrypted_file_password (which should supply the server with the same password used with the--encrypt-password option during the restore). After the server is up and running, if another keyring plugin or component is needed (for example, the backed-up user was usingkeyring_aws and the restored server is supposed to use it too), akeyring migration can be performed.

• When thekeyring_file keyring plugin was used on the backed-up server,mysqlbackup uses the password supplied with the--encrypt-password option to decrypt the keyring data file and then restores it under the data directory with the file namekeyring_kuf for thekeyring_file plugin to use.

• When thecomponent_keyring_encrypted_file.cnf keyring component was used on the backed-up server,mysqlbackup restores the encrypted keyring data file to its proper location on the server, and also creates amanifest file and the configuration filecomponent_keyring_encrypted_file.cnf (which contains the password used with the--encrypt-password option during the restore) on the restored server, so that the server will load thecomponent_keyring_encrypted_file component when it restarts.

• When thecomponent_keyring_file keyring component was used on the backed-up server,mysqlbackup uses the password supplied with the--encrypt-password option to decrypt the keyring data file and then restores it to the proper location on the server. It also creates amanifest file and the configuration filecomponent_keyring_file.cnf on the restored server, so that the server will load thecomponent_keyring_file component when it restarts.

• To use global manifest and configuration file for starting the keyring component:

  • Copy themanifest file from restored data directory to the folder where themysqld binary resides.

  • Copy the configuration filecomponent_keyring_file.cnf from the restore data directory to the folder where the component binary resides.

• To use local manifest and configuration file for starting the keyring component:

  • Create a newmanifest file with following contents in the folder where themysqld binary resides

    { "read_local_manifest": true }

  • Create a new configuration filecomponent_keyring_file.cnf with following contents in the folder where the component binary resides :

    { "read_local_config": true }

• For MySQL Enterprise Backup 8.0.20 and earlier: During avalidate operation, ifmysqlbackup encounters any encrypted InnoDB tablespaces, it issues a warning and then skips over them.

• For MySQL Enterprise Backup 8.0.20 and earlier: For partial backups using transportable table spaces (that is, when the--use-tts option is used), encrypted InnoDB tables are never included in a backup. A warning is issued in the log file whenever an encrypted InnoDB table that matches the table selection criteria has been skipped over.

• The--skip-unused-pages option has no effect on encrypted InnoDB tables during a backup (that is, empty pages for those tables are not skipped).

• If the server performs amaster key rotation when a backup is running, the resulting backup might become corrupted.