Encrypting a mySQL database how to? Perfomance issues etc.

Next topic

Author	Message
R Sutton	Monday 20 August 2007 10:05:43 am I have a client who wants their db to be encrypted and to run on https due to sensitive information. I personally think this is overkill, but I have to see what can be done if they insist. First of all, what is involved in this. I can't find a "how to" anywhere in the docs or forum, much less a mention of this. Has anyone else setup anything similar? If so how big of a performance hit should we expect going this route? Any real world numbers would be most insightful. I think that https would be enough of a performance hit in the first place, but anything that would back up my argument is great. Alternately, is there a way to have one node on https while the rest of the site has a standard setup? Any direction from someone who has traversed this road would be most helpful and appreciated. Thanks!
Bruce Morrison	Monday 20 August 2007 3:42:40 pm Hi While I'm not aware of the reasoning behind the request I'd assume that if the database was to be encrypted then you wouldn't want unencrypted cache files hanging around on the local file system. You might want to look into encrypted filesystems as a lower level solution. http://www.google.com.au/search?q=linux+encrypted+filesystems I'd suggest taking a step back and identifying the security requirements and then looking for appropriate solutions to meet those requirements. Cheers Bruce My Blog: http://www.stuffandcontent.com/ Follow me on twitter: http://twitter.com/brucemorrison Consolidated eZ Publish Feed : http://friendfeed.com/rooms/ez-publish
R Sutton	Tuesday 21 August 2007 6:06:47 pm While I'm not aware of the reasoning behind the request I'd assume that if the database was to be encrypted then you wouldn't want unencrypted cache files hanging around on the local file system. That's what I have looked into for the past day. I think you're right. And I think it will be easier and less of a kludged feel to it once done. Thank for the push, I found several great write ups on encrypting the freeBSD system this will run on. I am pushing this out as an experiment tomorrow, so we will see how this goes :)

Author

Message

Monday 20 August 2007 10:05:43 am

I have a client who wants their db to be encrypted *and* to run on https due to sensitive information. I personally think this is overkill, but I have to see what can be done if they insist.

First of all, what is involved in this. I can't find a "how to" anywhere in the docs or forum, much less a mention of this. Has anyone else setup anything similar? If so how big of a performance hit should we expect going this route? Any real world numbers would be most insightful.

I think that https would be enough of a performance hit in the first place, but anything that would back up my argument is great. Alternately, is there a way to have one node on https while the rest of the site has a standard setup?

Any direction from someone who has traversed this road would be most helpful and appreciated.

Thanks!

Bruce Morrison

Monday 20 August 2007 3:42:40 pm

While I'm not aware of the reasoning behind the request I'd assume that if the database was to be encrypted then you wouldn't want unencrypted cache files hanging around on the local file system.

You might want to look into encrypted filesystems as a lower level solution. http://www.google.com.au/search?q=linux+encrypted+filesystems

I'd suggest taking a step back and identifying the security requirements and then looking for appropriate solutions to meet those requirements.

Cheers
Bruce

My Blog: http://www.stuffandcontent.com/
Follow me on twitter: http://twitter.com/brucemorrison
Consolidated eZ Publish Feed : http://friendfeed.com/rooms/ez-publish

R Sutton

Tuesday 21 August 2007 6:06:47 pm

While I'm not aware of the reasoning behind the request I'd assume that if the database was to be encrypted then you wouldn't want unencrypted cache files hanging around on the local file system.

That's what I have looked into for the past day. I think you're right. And I think it will be easier and less of a kludged feel to it once done. Thank for the push, I found several great write ups on encrypting the freeBSD system this will run on. I am pushing this out as an experiment tomorrow, so we will see how this goes :)

eZ debug

Timing:	Jan 18 2025 18:31:59
Script start
Timing:	Jan 18 2025 18:31:59
Module start 'layout'
Timing:	Jan 18 2025 18:31:59
Module start 'content'
Timing:	Jan 18 2025 18:32:00
Module end 'content'
Timing:	Jan 18 2025 18:32:00
Script end

Main resources:

Total runtime	0.8255 sec
Peak memory usage	4,096.0000 KB
Database Queries	57

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0061	589.3281	152.6563
Module start 'layout'	0.0061	0.0025	741.9844	39.4922
Module start 'content'	0.0086	0.8153	781.4766	531.5078
Module end 'content'	0.8239	0.0015	1,312.9844	12.0938
Script end	0.8254		1,325.0781

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0035	0.4232	16	0.0002
Check MTime	0.0014	0.1697	16	0.0001
Mysql Total
Database connection	0.0010	0.1194	1	0.0010
Mysqli_queries	0.7780	94.2495	57	0.0136
Looping result	0.0005	0.0626	55	0.0000
Template Total	0.7990	96.8	2	0.3995
Template load	0.0025	0.3010	2	0.0012
Template processing	0.7965	96.4885	2	0.3982
Template load and register function	0.0002	0.0201	1	0.0002
states
state_id_array	0.0008	0.0992	1	0.0008
state_identifier_array	0.0007	0.0883	2	0.0004
Override
Cache load	0.0021	0.2555	19	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0010	0.1219	2	0.0005
Fetch class attribute name	0.0010	0.1171	4	0.0002
XML
Image XML parsing	0.0007	0.0875	2	0.0004
class_abstraction
Instantiating content class attribute	0.0000	0.0011	4	0.0000
General
dbfile	0.0008	0.0964	16	0.0000
String conversion	0.0000	0.0007	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
3	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
4	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
1	content/datatype/view/ezimage.tpl	<No override>	extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tpl
1	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 11 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs