{"id":97664,"date":"2020-10-20T08:42:20","date_gmt":"2020-10-20T06:42:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej"},"modified":"2020-10-20T08:42:20","modified_gmt":"2020-10-20T06:42:20","slug":"shifrovanie-v-mysql-hranilishhe-klyuchej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej","title":{"rendered":"\u0160ifrov\u00e1n\u00ed v MySQL: \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><b><i>V p\u0159edve\u010der zah\u00e1jen\u00ed nov\u00e9ho z\u00e1pisu do kurzu <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/luFp\/\">\u201eDatab\u00e1ze\u201c<\/a><\/noindex> p\u0159ipravili jsme pro v\u00e1s p\u0159eklad u\u017eite\u010dn\u00e9ho \u010dl\u00e1nku.<\/i><\/b><\/p>\n<p><img decoding=\"async\" alt=\"\u0160ifrov\u00e1n\u00ed v MySQL: \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f\" src=\"\/wp-content\/uploads\/2020\/10\/aeca40f53fe6bdf2a9897aa835ff597d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Transparentn\u00ed \u0161ifrov\u00e1n\u00ed dat (Transparent Data Encryption, TDE) se objevilo v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.percona.com\/software\/mysql-database\/percona-server\">Percona Server for MySQL<\/a><\/noindex> MySQL u\u017e pom\u011brn\u011b dlouho. P\u0159em\u00fd\u0161leli jste ale n\u011bkdy o tom, jak funguje pod kapotou a jak\u00fd vliv m\u016f\u017ee TDE m\u00edt na v\u00e1\u0161 server? V t\u00e9to s\u00e9rii \u010dl\u00e1nk\u016f se pod\u00edv\u00e1me na to, jak TDE funguje uvnit\u0159. Za\u010dneme ukl\u00e1d\u00e1n\u00edm kl\u00ed\u010d\u016f, proto\u017ee je to nezbytn\u00e9 pro fungov\u00e1n\u00ed jak\u00e9hokoli \u0161ifrov\u00e1n\u00ed. D\u00e1le se podrobn\u011b pod\u00edv\u00e1me na to, jak funguje \u0161ifrov\u00e1n\u00ed v Percona Server for MySQL\/MySQL a jak\u00e9 dal\u0161\u00ed mo\u017enosti m\u00e1 Percona Server for MySQL.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>MySQL Keyring<\/h3>\n<p>\nKeyring je plugin, kter\u00fd umo\u017e\u0148uje serveru vy\u017eadovat, vytv\u00e1\u0159et a mazat kl\u00ed\u010de v m\u00edstn\u00edm souboru (keyring_file) nebo na vzd\u00e1len\u00e9m serveru (nap\u0159\u00edklad v HashiCorp Vault). Kl\u00ed\u010de jsou v\u017edy ukl\u00e1d\u00e1ny do mezipam\u011bti lok\u00e1ln\u011b, aby se urychlilo jejich z\u00edsk\u00e1v\u00e1n\u00ed. <\/p>\n<p>Pluginy lze rozd\u011blit do dvou kategori\u00ed:<\/p>\n<ul>\n<li>Lok\u00e1ln\u00ed \u00falo\u017ei\u0161t\u011b. Nap\u0159\u00edklad m\u00edstn\u00ed soubor (tomu \u0159\u00edk\u00e1me \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f zalo\u017een\u00e9 na souboru, file-based keyring).<\/li>\n<li>Vzd\u00e1len\u00e9 \u00falo\u017ei\u0161t\u011b. Nap\u0159\u00edklad Vault Server (tomu \u0159\u00edk\u00e1me \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f na serveru, server-based keyring).<\/li>\n<\/ul>\n<p>\nToto rozd\u011blen\u00ed je d\u016fle\u017eit\u00e9, proto\u017ee r\u016fzn\u00e9 typy \u00falo\u017ei\u0161\u0165 se chovaj\u00ed pon\u011bkud odli\u0161n\u011b nejen p\u0159i ukl\u00e1d\u00e1n\u00ed a z\u00edsk\u00e1v\u00e1n\u00ed kl\u00ed\u010d\u016f, ale i p\u0159i spu\u0161t\u011bn\u00ed.<\/p>\n<p>P\u0159i pou\u017eit\u00ed \u00falo\u017ei\u0161t\u011b zalo\u017een\u00e9ho na souboru se p\u0159i spu\u0161t\u011bn\u00ed do mezipam\u011bti na\u010dte ve\u0161ker\u00fd obsah \u00falo\u017ei\u0161t\u011b: key id, key user, key type a samotn\u00fd kl\u00ed\u010d.<\/p>\n<p>V p\u0159\u00edpad\u011b serverov\u00e9ho \u00falo\u017ei\u0161t\u011b (nap\u0159\u00edklad server Vault) se p\u0159i spu\u0161t\u011bn\u00ed na\u010d\u00edt\u00e1 pouze key id a key user, tak\u017ee z\u00edsk\u00e1n\u00ed v\u0161ech kl\u00ed\u010d\u016f nezpomal\u00ed spu\u0161t\u011bn\u00ed. Kl\u00ed\u010de se na\u010d\u00edtaj\u00ed leniv\u011b. To znamen\u00e1, \u017ee se samotn\u00fd kl\u00ed\u010d na\u010dte z Vaultu pouze tehdy, kdy\u017e je skute\u010dn\u011b pot\u0159eba. Po na\u010dten\u00ed je kl\u00ed\u010d ulo\u017een do mezipam\u011bti, aby v budoucnu nebylo nutn\u00e9 se na n\u011bj obracet p\u0159es TLS spojen\u00ed k Vault Serveru. Nyn\u00ed se pod\u00edv\u00e1me, jak\u00e9 informace jsou obsa\u017eeny v \u00falo\u017ei\u0161ti kl\u00ed\u010d\u016f.<\/p>\n<p>Informace o kl\u00ed\u010di obsahuj\u00ed n\u00e1sleduj\u00edc\u00ed:<\/p>\n<ul>\n<li><b>key id<\/b> \u2014 identifik\u00e1tor kl\u00ed\u010de, nap\u0159\u00edklad: <br \/>\n <code>INNODBKey-764d382a-7324-11e9-ad8f-9cb6d0d5dc99-1<\/code><\/li>\n<li><b>key type<\/b> \u2014 typ kl\u00ed\u010de, ur\u010den\u00fd podle pou\u017eit\u00e9ho \u0161ifrovac\u00edho algoritmu, mo\u017en\u00e9 hodnoty: \u201eAES\u201c, \u201eRSA\u201c nebo \u201eDSA\u201c.<\/li>\n<li><b>key length<\/b> \u2014 d\u00e9lka kl\u00ed\u010de v bajtech, AES: 16, 24 nebo 32, RSA 128, 256, 512 a DSA 128, 256 nebo 384.<\/li>\n<li><b>u\u017eivatel<\/b> \u2014 vlastn\u00edk kl\u00ed\u010de. Pokud je kl\u00ed\u010d syst\u00e9mov\u00fd, nap\u0159\u00edklad Master Key, je toto pole pr\u00e1zdn\u00e9. Pokud je kl\u00ed\u010d vytvo\u0159en pomoc\u00ed keyring_udf, toto pole ozna\u010duje vlastn\u00edka kl\u00ed\u010de.<\/li>\n<li><b>samotn\u00fd kl\u00ed\u010d<\/b><\/li>\n<\/ul>\n<p>\nKl\u00ed\u010d je jednozna\u010dn\u011b identifikov\u00e1n dvojic\u00ed: key_id, user.<\/p>\n<p>Existuj\u00ed tak\u00e9 rozd\u00edly ve skladov\u00e1n\u00ed a odstra\u0148ov\u00e1n\u00ed kl\u00ed\u010d\u016f.<\/p>\n<p>Pokladna soubor\u016f funguje rychleji. Dalo by se p\u0159edpokl\u00e1dat, \u017ee pokladna kl\u00ed\u010d\u016f je pouze jednoduch\u00fd jednor\u00e1zov\u00fd z\u00e1znam kl\u00ed\u010de v souboru, ale nen\u00ed tomu tak \u2014 zde prob\u00edh\u00e1 v\u00edce operac\u00ed. P\u0159i jak\u00e9koliv \u00faprav\u011b pokladny soubor\u016f se nejprve vytvo\u0159\u00ed z\u00e1loha cel\u00e9ho obsahu. P\u0159edpokl\u00e1dejme, \u017ee soubor se jmenuje my_biggest_secrets, pak z\u00e1loha bude my_biggest_secrets.backup. D\u00e1le se upravuje cache (p\u0159id\u00e1vaj\u00ed se nebo odstra\u0148uj\u00ed kl\u00ed\u010de) a pokud v\u0161e prob\u011bhne \u00fasp\u011b\u0161n\u011b, cache se resetuje do souboru. Ve vz\u00e1cn\u00fdch p\u0159\u00edpadech, jako je selh\u00e1n\u00ed serveru, m\u016f\u017eete tento z\u00e1lo\u017en\u00ed soubor vid\u011bt. Z\u00e1lo\u017en\u00ed soubor se odstran\u00ed p\u0159i n\u00e1sledn\u00e9m na\u010dten\u00ed kl\u00ed\u010d\u016f (obvykle po restartu serveru).<\/p>\n<p>P\u0159i ukl\u00e1d\u00e1n\u00ed nebo odstra\u0148ov\u00e1n\u00ed kl\u00ed\u010de v serverov\u00e9 pokladn\u011b se pokladna mus\u00ed p\u0159ipojit k serveru MySQL s p\u0159\u00edkazy \"odeslat kl\u00ed\u010d\" \/ \"\u017e\u00e1dat o odstran\u011bn\u00ed kl\u00ed\u010de\" (\"send the key\" \/ \"request key deletion\").<\/p>\n<p>Vra\u0165me se ke rychlosti spou\u0161t\u011bn\u00ed serveru. Krom\u011b toho, \u017ee na rychlost spou\u0161t\u011bn\u00ed m\u00e1 vliv samotn\u00e1 pokladna, je zde tak\u00e9 ot\u00e1zka, kolik kl\u00ed\u010d\u016f je t\u0159eba z pokladny z\u00edskat p\u0159i spu\u0161t\u011bn\u00ed. Samoz\u0159ejm\u011b, \u017ee to je zvl\u00e1\u0161t\u011b d\u016fle\u017eit\u00e9 pro serverov\u00e9 pokladny. P\u0159i spu\u0161t\u011bn\u00ed server zkontroluje, kter\u00fd kl\u00ed\u010d je pot\u0159ebn\u00fd pro \u0161ifrovan\u00e9 tabulky \/ tabulkov\u00e1 prostory a po\u017eaduje kl\u00ed\u010d z pokladny. Na \"\u010dist\u00e9m\" serveru s Master Key \u2014 \u0161ifrovan\u00edm by m\u011bl b\u00fdt jeden Master Key, kter\u00fd je t\u0159eba vyjmout z pokladny. Nicm\u00e9n\u011b, m\u016f\u017ee b\u00fdt zapot\u0159eb\u00ed i v\u011bt\u0161\u00ed mno\u017estv\u00ed kl\u00ed\u010d\u016f, nap\u0159\u00edklad kdy\u017e se na z\u00e1lo\u017en\u00edm serveru obnovuje z\u00e1loha z hlavn\u00edho serveru. V takov\u00fdch p\u0159\u00edpadech by m\u011blo b\u00fdt zv\u00e1\u017eeno rotov\u00e1n\u00ed Master Key. Podrobn\u011bji se t\u00edm budeme zab\u00fdvat v budouc\u00edch \u010dl\u00e1nc\u00edch, p\u0159i\u010dem\u017e bych zde cht\u011bl poznamenat, \u017ee server pou\u017e\u00edvaj\u00edc\u00ed n\u011bkolik Master Key m\u016f\u017ee b\u00fdt spu\u0161t\u011bn o n\u011bco d\u00e9le, zejm\u00e9na p\u0159i pou\u017eit\u00ed serverov\u00e9 pokladny kl\u00ed\u010d\u016f.<\/p>\n<p>Nyn\u00ed si je\u0161t\u011b pohovo\u0159\u00edme o keyring_file. Kdy\u017e jsem vyv\u00edjel keyring_file, tak\u00e9 m\u011b zaj\u00edmalo, jak kontrolovat zm\u011bnu keyring_file b\u011bhem provozu serveru. Ve verzi 5.7 byla kontrola prov\u00e1d\u011bna na z\u00e1klad\u011b statistik souboru, co\u017e nebylo ide\u00e1ln\u00ed \u0159e\u0161en\u00ed, a ve verzi 8.0 byla nahrazena kontroln\u00edm sou\u010dtem SHA256.<\/p>\n<p>P\u0159i prvn\u00edm spu\u0161t\u011bn\u00ed se v keyring_file vypo\u010d\u00edtaj\u00ed statistiky souboru a kontroln\u00ed sou\u010det, kter\u00e9 si server zapamatuje, a zm\u011bny se pou\u017eij\u00ed pouze v p\u0159\u00edpad\u011b, \u017ee se shoduj\u00ed. P\u0159i zm\u011bn\u011b souboru se kontroln\u00ed sou\u010det aktualizuje.<\/p>\n<p>Ji u\u017e jsme probrali mnoh\u00e9 ot\u00e1zky o \u00falo\u017ei\u0161t\u00edch kl\u00ed\u010d\u016f. Existuje v\u0161ak je\u0161t\u011b jedno d\u016fle\u017eit\u00e9 t\u00e9ma, na kter\u00e9 se \u010dasto zapom\u00edn\u00e1 nebo kter\u00e9 se \u0161patn\u011b ch\u00e1pe \u2014 odd\u011blen\u00ed kl\u00ed\u010d\u016f podle server\u016f. <\/p>\n<p>Co t\u00edm mysl\u00edm? Ka\u017ed\u00fd server (nap\u0159\u00edklad Percona Server) v clusteru by m\u011bl m\u00edt vyhrazen\u00e9 m\u00edsto na serveru Vault, kde by Percona Server m\u011bl uchov\u00e1vat sv\u00e9 kl\u00ed\u010de. V ka\u017ed\u00e9m Master Key ulo\u017een\u00e9m v \u00falo\u017ei\u0161ti se nach\u00e1z\u00ed GUID serveru Percona Server uvnit\u0159 jeho identifik\u00e1toru. Pro\u010d je to d\u016fle\u017eit\u00e9? P\u0159edstavte si, \u017ee m\u00e1te pouze jeden server Vault a v\u0161echny Percona servery v clusteru pou\u017e\u00edvaj\u00ed tento jedin\u00fd server Vault. Probl\u00e9m se zd\u00e1 b\u00fdt z\u0159ejm\u00fd. Kdyby v\u0161echny Percona servery pou\u017e\u00edvaly Master Key bez unik\u00e1tn\u00edch identifik\u00e1tor\u016f, nap\u0159\u00edklad id = 1, id = 2 atd., pak by v\u0161echny servery v clusteru pou\u017e\u00edvaly stejn\u00fd Master Key. Co\u017e je zaji\u0161\u0165ov\u00e1no GUID \u2014 rozhran\u00edm mezi servery. Pro\u010d tedy hovo\u0159it o odd\u011blen\u00ed kl\u00ed\u010d\u016f mezi servery, kdy\u017e u\u017e existuje unik\u00e1tn\u00ed GUID? Existuje je\u0161t\u011b jeden plugin \u2014 keyring_udf. Pomoc\u00ed tohoto pluginu m\u016f\u017ee u\u017eivatel va\u0161eho serveru uchov\u00e1vat sv\u00e9 kl\u00ed\u010de na serveru Vault. Probl\u00e9m nast\u00e1v\u00e1, kdy\u017e u\u017eivatel vytvo\u0159\u00ed kl\u00ed\u010d, nap\u0159\u00edklad na serveru server1, a pot\u00e9 se pokus\u00ed vytvo\u0159it kl\u00ed\u010d se stejn\u00fdm identifik\u00e1torem na serveru server2, nap\u0159\u00edklad:<\/p>\n<pre><code class=\"sql\">--server1:\nselect keyring_key_store('ROB_1','AES',\"123456789012345\");\n1\n--1 znamen\u00e1 \u00fasp\u011b\u0161n\u00e9 dokon\u010den\u00ed\n--server2:\nselect keyring_key_store('ROB_1','AES',\"543210987654321\");\n1<\/code><\/pre>\n<p>\nPo\u010dkejte. Oba servery pou\u017e\u00edvaj\u00ed stejn\u00fd server Vault, nem\u011bla by funkce keyring_key_store na serveru server2 skon\u010dit chybou? Zaj\u00edmav\u00e9 je, \u017ee pokud se pokus\u00edte to sam\u00e9 ud\u011blat na jednom serveru, dostanete chybu:<\/p>\n<pre><code class=\"sql\">--server1:\nselect keyring_key_store('ROB_1','AES',\"123456789012345\");\n1\nselect keyring_key_store('ROB_1','AES',\"543210987654321\");\n0<\/code><\/pre>\n<p>\nSpr\u00e1vn\u011b, ROB_1 ji\u017e existuje.<\/p>\n<p>Nejprve si probereme druh\u00fd p\u0159\u00edklad. Jak jsme ji\u017e d\u0159\u00edve zmi\u0148ovali, keyring_vault nebo jak\u00fdkoli jin\u00fd plugin \u00falo\u017ei\u0161t\u011b (keyring) ukl\u00e1d\u00e1 v\u0161echny identifik\u00e1tory kl\u00ed\u010d\u016f do pam\u011bti. Jakmile tedy vytvo\u0159\u00edme nov\u00fd kl\u00ed\u010d, ROB_1 je p\u0159id\u00e1n na server1, a krom\u011b odesl\u00e1n\u00ed tohoto kl\u00ed\u010de do Vault, kl\u00ed\u010d je tak\u00e9 p\u0159id\u00e1n do cache. Nyn\u00ed, kdy\u017e se pokou\u0161\u00edme p\u0159idat stejn\u00fd kl\u00ed\u010d podruh\u00e9, keyring_vault kontroluje, zda tento kl\u00ed\u010d existuje v cache a vyhod\u00ed chybu. <\/p>\n<p>V prvn\u00edm p\u0159\u00edpad\u011b je situace jin\u00e1. Na serverech server1 a server2 jsou odd\u011blen\u00e9 cache. Po p\u0159id\u00e1n\u00ed ROB_1 do cache kl\u00ed\u010d\u016f na serveru server1 a do serveru Vault, cache kl\u00ed\u010d\u016f na server2 nen\u00ed synchronizov\u00e1na. V cache na server2 nen\u00ed kl\u00ed\u010d ROB_1. Jakmile to za\u010dne, kl\u00ed\u010d ROB_1 se zap\u00ed\u0161e do keyring_key_store a na server Vault, co\u017e v podstat\u011b p\u0159episuje (!) p\u0159edchoz\u00ed hodnotu. Nyn\u00ed je kl\u00ed\u010d ROB_1 na serveru Vault roven 543210987654321. Je zaj\u00edmav\u00e9, \u017ee server Vault neblokuje takov\u00e9 akce a bez probl\u00e9mu p\u0159episuje starou hodnotu.<\/p>\n<p>Nyn\u00ed vid\u00edme, pro\u010d m\u016f\u017ee b\u00fdt rozd\u011blen\u00ed podle server\u016f na Vault d\u016fle\u017eit\u00e9 \u2014 kdy\u017e pou\u017e\u00edv\u00e1te keyring_udf a chcete ukl\u00e1dat kl\u00ed\u010de do Vault. Jak zajistit takov\u00e9 rozd\u011blen\u00ed na serveru Vault? <\/p>\n<p>Existuj\u00ed dva zp\u016fsoby rozd\u011blen\u00ed na Vault. M\u016f\u017eete vytvo\u0159it r\u016fzn\u00e9 body p\u0159ipojen\u00ed pro ka\u017ed\u00fd server nebo pou\u017e\u00edt r\u016fzn\u00e9 cesty v r\u00e1mci jednoho bodu p\u0159ipojen\u00ed. Nejl\u00e9pe to p\u0159edvedeme na p\u0159\u00edkladech. Nejprve se pod\u00edv\u00e1me na odd\u011blen\u00e9 body p\u0159ipojen\u00ed: <\/p>\n<pre><code class=\"sql\">--server1:\nvault_url = http:\/\/127.0.0.1:8200\nsecret_mount_point = server1_mount\ntoken = (...)\nvault_ca = (...)\n\n--server2:\nvault_url = http:\/\/127.0.0.1:8200\nsecret_mount_point = sever2_mount\ntoken = (...)\nvault_ca = (...)<\/code><\/pre>\n<p>\nZde je vid\u011bt, \u017ee server1 a server2 pou\u017e\u00edvaj\u00ed r\u016fzn\u00e9 body p\u0159ipojen\u00ed. P\u0159i d\u011blen\u00ed cest bude konfigurace vypadat n\u00e1sledovn\u011b:<\/p>\n<pre><code class=\"sql\">--server1:\nvault_url = http:\/\/127.0.0.1:8200\nsecret_mount_point = mount_point\/server1\ntoken = (...)\nvault_ca = (...)\n--server2:\nvault_url = http:\/\/127.0.0.1:8200\nsecret_mount_point = mount_point\/sever2\ntoken = (...)\nvault_ca = (...)<\/code><\/pre>\n<p>\nV tomto p\u0159\u00edpad\u011b oba servery pou\u017e\u00edvaj\u00ed stejn\u00fd bod p\u0159ipojen\u00ed \u201emount_point\u201c, ale r\u016fzn\u00e9 cesty. P\u0159i vytvo\u0159en\u00ed prvn\u00edho tajemstv\u00ed na serveru server1 na t\u00e9to cest\u011b server Vault automaticky vytvo\u0159\u00ed adres\u00e1\u0159 \u201eserver1\u201c. Pro server2 to plat\u00ed stejn\u011b. Kdy\u017e odstran\u00edte posledn\u00ed tajemstv\u00ed v mount_point\/server1 nebo mount_point\/server2, server Vault tak\u00e9 tyto adres\u00e1\u0159e odstran\u00ed. Pokud pou\u017e\u00edv\u00e1te rozd\u011blen\u00ed cest, m\u011bli byste vytvo\u0159it pouze jeden bod p\u0159ipojen\u00ed a zm\u011bnit konfigura\u010dn\u00ed soubory, aby servery pou\u017e\u00edvaly odd\u011blen\u00e9 cesty. Bod p\u0159ipojen\u00ed lze vytvo\u0159it pomoc\u00ed HTTP po\u017eadavku. Pomoc\u00ed CURL to lze prov\u00e9st n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<pre><code class=\"sql\">curl -L -H \"X-Vault-Token: TOKEN\" \u2013cacert VAULT_CA\n--data '{\"type\":\"generic\"}' --request POST VAULT_URL\/v1\/sys\/mounts\/SECRET_MOUNT_POINT<\/code><\/pre>\n<p>\nV\u0161echny pole (TOKEN, VAULT_CA, VAULT_URL, SECRET_MOUNT_POINT) odpov\u00eddaj\u00ed parametr\u016fm konfigura\u010dn\u00edho souboru. Samoz\u0159ejm\u011b m\u016f\u017eete pou\u017e\u00edt n\u00e1stroje Vault, abyste ud\u011blali tot\u00e9\u017e. Ale takto je snadn\u011bj\u0161\u00ed automatizovat vytvo\u0159en\u00ed bodu p\u0159ipojen\u00ed. Douf\u00e1m, \u017ee v\u00e1s tyto informace oslov\u00ed, a setk\u00e1me se v dal\u0161\u00edch \u010dl\u00e1nc\u00edch t\u00e9to s\u00e9rie.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/luFp\/\"><img decoding=\"async\" alt=\"\u0160ifrov\u00e1n\u00ed v MySQL: \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f\" src=\"\/wp-content\/uploads\/2020\/10\/291dcdd68660bfc312021582baa628ab.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<blockquote>\n<h4>\u010c\u00edst v\u00edc:<\/h4>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/497466\/\">Sysbench a rozd\u011blen\u00ed n\u00e1hodn\u00fdch veli\u010din<\/a><\/noindex><\/li>\n<\/ul>\n<\/blockquote>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/522092\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043b\u044f \u0432\u0430\u0441 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438. \u041f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 (Transparent Data Encryption, TDE) \u043f\u043e\u044f\u0432\u0438\u043b\u043e\u0441\u044c \u0432 Percona Server for MySQL \u0438 MySQL \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u0434\u0430\u0432\u043d\u043e. \u041d\u043e \u0437\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0432\u044b \u043a\u043e\u0433\u0434\u0430-\u043d\u0438\u0431\u0443\u0434\u044c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c \u0438 \u043a\u0430\u043a\u043e\u0435 \u0432\u043b\u0438\u044f\u043d\u0438\u0435 TDE \u043c\u043e\u0436\u0435\u0442 \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0432\u0430\u0448 \u0441\u0435\u0440\u0432\u0435\u0440? \u0412 \u044d\u0442\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97665,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043b\u044f \u0432\u0430\u0441 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043b\u044f \u0432\u0430\u0441 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-20T06:42:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-20T06:42:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160ifrov\u00e1n\u00ed v MySQL: \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f | ProHoster","description":"V p\u0159edve\u010der zah\u00e1jen\u00ed nov\u00e9ho n\u00e1boru do kurzu \u201eDatab\u00e1ze\u201c jsme pro v\u00e1s p\u0159ipravili p\u0159eklad u\u017eite\u010dn\u00e9ho \u010dl\u00e1nku.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 MySQL: \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043d\u043e\u0432\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u043d\u0430 \u043a\u0443\u0440\u0441 \u00ab\u0411\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445\u00bb \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043b\u044f \u0432\u0430\u0441 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifrovanie-v-mysql-hranilishhe-klyuchej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-20T06:42:20+00:00","article:modified_time":"2020-10-20T06:42:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97664","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:15:28","updated":"2022-10-03 07:13:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=97664"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97664\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/97665"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=97664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=97664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=97664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}