为MySQL设置安全的远程连接

需求：开发、测试部门需要对准生产和生产数据库进行远程访问。

有一阵子，是直MySQL层面接授予最小权限，并限制只允许从公司出口ip访问；iptables层面也是针对数据库端口只允许公司出口ip访问。

但是这个样子终究觉得不够放心。后来研究了下MySQL的登录过程（wireshark抓包和参考官方文档），虽然说MySQL实现的登录机制（这里有机会单独说）基本不存在泄露密码的风险（理论上存在被破解的可能，但是也会相当费劲），但是登录之后的SQL语句和执行结果的传输却都是明文传输的。
这对于运维来说是不可容忍的，必须搞加密。

一开始打算通过MySQL原生的ssl来实现：
大致研究了下：
首先检查服务器是否支持ssl，

mysql> show global variables like '%ssl%';      
+---------------+----------+
| Variable_name | Value    |
+---------------+----------+
| have_openssl  | DISABLED |
| have_ssl      | DISABLED |

## have_openssl is alias of have_ssl

YES if mysqld supports SSL connections, NO if not. DISABLED indicates that the server was compiled with SSL support, but was not started with the appropriate –ssl-xxx options

To use SSL connections between the MySQL server and client programs, your system must support either OpenSSL or yaSSL:

• MySQL Enterprise Edition binary distributions are compiled using OpenSSL. It is not possible to use yaSSL with MySQL Enterprise Edition.
• MySQL Community Edition binary distributions are compiled using yaSSL.
• MySQL Community Edition source distributions can be compiled using either OpenSSL or yaSSL

To determine whether your server was compiled using OpenSSL, test the existence of any of those variables. For example, this statement returns a row if OpenSSL was used and an empty result if yaSSL was used:

SHOW STATUS LIKE 'Rsa_public_key';

如何配置:
参见https://dev.mysql.com/doc/refman/5.6/en/using-secure-connections.html
参见https://dev.mysql.com/doc/refman/5.6/en/creating-ssl-files-using-openssl.html

综合考虑，基于mysql（5.7之前）原生支持的ssl配置安全连接，需要手动在server和client端生成对应的证书，公钥、私钥等文件：一是服务端配置步骤较为繁琐；二是客户端的配置也要增加用户证书及私钥等文件，还得算上指导相关修改配置的时间，感觉有些小题大做了。
5.7的ssl配置及性能损失参考

---

之前就知道ssh能实现端口转发，正好借此需求深入研究一番

最终解决方案：
通过ssh的端口转发，简单说就是:
1. 让一台本地server和远程server间建立一个长ssh连接(ssh隧道),该隧道openssh有保活机制，默认300s会发送noop保持存活(抓包观察到)
2. 同时openssh会在本地(内网)server监听一个端口，目标是该本地IP:port的流量通过ssh隧道经由远程server转发到对应的目标server的内网IP:port
3. 这样，数据库只需要给远程账号授权该中间server的内网ip即可。即在公网上的传输是经过ssh隧道保证了安全

配置步骤
1.

[kai@git-svn ~]$ cat .ssh/config 
ControlPath ~/.ssh/master-%r@%h:%p
ControlMaster auto

上述配置详细信息，参考man ssh_config
2.

[kai@git-svn ~]$ ssh -MNf -L 172.18.200.23:33062:192.168.1.2:3306 ljk@178.19.39.2
[kai@git-svn ~]$ ssh -MNf -L 172.18.200.23:33065:192.168.1.5:3306 ljk@178.19.39.2 

#实验过程中发现针对一个“中继主机”实现两个“本地端口转发”，会有如下报错，但是经验证不影响使用
ControlSocket /home/kai/.ssh/master-kai@178.19.39.2:22 already exists, disabling multiplexin

如此，相关需求人员的MySQL客户端软件就只需要更改下对应库的ip:port，其他都不需改变，以对用户最小的改变实现了安全性的需求。

关于SSH ControlMaster and ControlPath:
参考1

You want SSH’s ControlMaster feature. I wrote a blog post about using it with git a little while back. Briefly, you set a ControlPath so all your SSH processes know how to find each other, and then you make one connection as a “master” that stays around forever. Every other SSH will check for an existing, shared connection before making a new one, which lets them skip authentication.

You may also want to use -o ServerAliveInterval=30 or something on the master, which sends a keep-alive packet over the SSH connection every 30 seconds. Depending on your network and server configuration, you may need this to prevent the connection from timing out.

---

全局参考1
全局参考2
全局参考3 OpenSSH/Cookbook/Multiplexing