You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/explanation/e-audit-logs.md
+9-2Lines changed: 9 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
# Audit Logs
2
2
3
-
The Audit Log plugin allows all login/logout records to be stored in a log file. It is enabled in Charmed MySQL by default.
3
+
The Audit Log plugin allows fine grained configuration for all login/logout, queries or both records to be stored in a log file. It is enabled in Charmed MySQL by default.
4
4
5
5
## Overview
6
-
The following is a sample of the audit logs, with format json with login/logout records:
6
+
The following is a sample of the audit logs, with format json with only logins records (default configuration):
This document describes the cryptography used by Charmed MySQL.
4
+
5
+
## Resource checksums
6
+
7
+
Charmed MySQL and Charmed MySQL Router operators use pinned revisions of the [Charmed MySQL snap](https://github.com/canonical/charmed-mysql-snap) to provide reproducible and secure environments.
8
+
9
+
The Charmed MySQL snap packages the MySQL workload along with the necessary dependencies and utilities required for the operators’ lifecycle. For more details, see the snap contents in the [snapcraft.yaml file](https://github.com/canonical/charmed-mysql-snap/blob/8.0/edge/snap/snapcraft.yaml).
10
+
11
+
Every artifact bundled into the Charmed MySQL snap is verified against its MD5, SHA256, or SHA512 checksum after download. The installation of certified snap into the rock is ensured by snap primitives that verify their squashfs filesystems images GPG signature. For more information on the snap verification process, refer to the [snapcraft.io documentation](https://snapcraft.io/docs/assertions).
12
+
13
+
## Sources verification
14
+
15
+
MySQL and its extra components (mysql-shell, xtrabackup, mysqld-exporter, mysqlrouter-exporter, percona-server-plugins, mysql-pitr-helper, etc.) are built by Canonical from upstream source codes into PPAs and stored on [Launchpad](https://launchpad.net/mysql).
16
+
17
+
Charmed MySQL snap is published using a GitHub repository workflow.
18
+
19
+
All repositories in GitHub are set up with branch protection rules, requiring:
20
+
21
+
* new commits to be merged to main branches via pull request with at least 2 approvals from repository maintainers
22
+
* new commits to be signed (e.g. using GPG keys)
23
+
* developers to sign the [Canonical Contributor License Agreement (CLA)](https://ubuntu.com/legal/contributors)
24
+
25
+
## Encryption
26
+
27
+
Charmed MySQL can be used to deploy a secure MySQL cluster that provides encryption-in-transit capabilities out of the box for:
28
+
29
+
* Cluster communications
30
+
* MySQL Router connection
31
+
* External client connection
32
+
33
+
To set up a secure connection Charmed MySQL and Charmed MySQL Router need to be integrated with TLS Certificate Provider charms, e.g. `self-signed-certificates` operator. Certificate Singing Requests (CSRs) are generated for every unit using the `tls_certificates_interface` library that uses the `cryptography` Python library to create X.509 compatible certificates. The CSR is signed by the TLS Certificate Provider, returned to the units, and stored in Juju secret. The relation also provides the CA certificate, which is loaded into Juju secret.
34
+
35
+
Encryption at rest is currently not supported, although it can be provided by the substrate (cloud or on-premises).
36
+
37
+
## Authentication
38
+
39
+
In Charmed MySQL, authentication layers can be enabled for:
40
+
41
+
1. MySQL Router connections
42
+
2. MySQL cluster communication
43
+
3. MySQL clients connections
44
+
45
+
### MySQL Router authentication to MySQL
46
+
47
+
Authentication to MySQL Router is based on the [caching_sha2_password auth plugin](https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html).
48
+
49
+
Credentials are exchanged via [Juju secrets](https://canonical-juju.readthedocs-hosted.com/en/latest/user/howto/manage-secrets/).
50
+
51
+
### MySQL cluster authentication
52
+
53
+
Authentication among members of a MySQL cluster is based on the [caching_sha2_password auth plugin](https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html).
54
+
55
+
An internal user is used for this authentication with its hashed password stored in a system metadata database.
56
+
57
+
### Client authentication to MySQL
58
+
59
+
Authentication to MySQL Router is based on the [caching_sha2_password auth plugin](https://dev.mysql.com/doc/refman/8.0/en/caching-sha2-pluggable-authentication.html).
60
+
61
+
Credentials are exchanged via [Juju secrets](https://canonical-juju.readthedocs-hosted.com/en/latest/user/howto/manage-secrets/).
Copy file name to clipboardExpand all lines: docs/explanation/e-logs.md
+55-66Lines changed: 55 additions & 66 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,62 +1,59 @@
1
1
# Logs
2
2
3
-
This explanation goes over the types of logging in MySQL and the configuration parameters for log rotation.
4
-
5
-
The charm currently has audit, error and general logs enabled by default, while slow query logs are disabled by default. All of these files are rotated if present into a separate dedicated archive folder under the logs directory.
3
+
This explanation goes over the types of logging in MySQL and the configuration parameters for log
4
+
rotation.
6
5
6
+
The charm currently has audit and error logs enabled by default. All of these files are rotated if
7
+
present into a separate dedicated archive folder under the logs directory.
7
8
We do not yet support the rotation of binary logs (binlog, relay log, undo log, redo log, etc).
-rw-r----- 1 mysql mysql 8.7K Oct 23 20:44 error.log-43_2045.gz
41
+
-rw-r----- 1 mysql mysql 2.3K Oct 23 20:45 error.log-43_2046.gz
49
42
```
50
43
51
-
It is recommended to set up a [COS integration] so that these log files can be streamed to Loki. This leads to better persistence and security of the logs.
44
+
It is recommended to set up a [COS integration] so that these log files can be streamed to Loki.
45
+
This leads to better persistence and security of the logs.
52
46
53
47
### Audit logs
48
+
54
49
The Audit Log plugin allows all login/logout records to be stored in a log file.
55
50
56
51
<details>
52
+
57
53
<summary>Example of audit logs in JSON format with login/logout records</summary>
@@ -86,7 +86,7 @@ For more details, see the [Audit Logs explanation].
86
86
2023-10-24T23:28:11.486308Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
87
87
2023-10-24T23:28:11.487473Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
88
88
2023-10-24T23:28:11.538807Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '0.0.0.0' port: 33060, socket: /var/snap/charmed-mysql/common/var/run/mysqld/mysqlx.sock
2023-10-24T23:28:17.983851Z 12 [Warning] [MY-010604] [Repl] Neither --relay-log nor --relay-log-index were used; so replication may break when this MySQL server acts as a replica and has his hostname changed!! Please use '--relay-log=juju-9860bb-0-relay-bin' to avoid this problem.
91
91
2023-10-24T23:28:17.999093Z 12 [System] [MY-010597] [Repl] 'CHANGE REPLICATION SOURCE TO FOR CHANNEL 'mysqlsh.test' executed'. Previous state source_host='', source_port= 3306, source_log_file='', source_log_pos= 4, source_bind=''. New state source_host='juju-9860bb-0.lxd', source_port= 3306, source_log_file='', source_log_pos= 4, source_bind=''.
92
92
2023-10-24T23:28:18.025941Z 15 [Warning] [MY-010897] [Repl] Storing MySQL user name or password information in the connection metadata repository is not secure and is therefore not recommended. Please consider using the USER and PASSWORD connection options forSTART REPLICA; see the 'START REPLICA Syntax'in the MySQL Manual for more information.
@@ -108,55 +108,36 @@ For more details, see the [Audit Logs explanation].
2023-10-24T23:28:19.179408Z 28 [System] [MY-013731] [Repl] Plugin group_replication reported: 'The member action "mysql_start_failover_channels_if_primary" for event "AFTER_PRIMARY_ELECTION" with priority "10" will be run.'
110
110
2023-10-24T23:28:19.179600Z 31 [System] [MY-011510] [Repl] Plugin group_replication reported: 'This server is working as primary member.'
111
-
2023-10-24T23:28:19.875216Z 12 [System] [MY-014010] [Repl] Plugin group_replication reported: 'Plugin 'group_replication' has been started.'
111
+
2023-10-24T23:28:19.875216Z 12 [System] [MY-014010] [Repl] Plugin group_replication reported: 'Plugin 'group_replication' has been started.'
112
112
```
113
-
</details>
114
-
115
-
### General logs
116
113
117
-
<details>
118
-
<summary>Example of general logs, with format <code>time thread_id command_type query_body</code></summary>
`='Y') as is_account_locked, (`password_expired`!='N') as `is_password_expired`, @@disconnect_on_expired_password as `disconnect_on_expired_password`, @@offline_mode and (`Super_priv`='N') as `is_offline_
125
-
mode_and_not_super_user`, `ssl_type`, `ssl_cipher`, `x509_issuer`, `x509_subject` FROM mysql.user WHERE 'serverconfig' = `user` AND '%' = `host`
`='Y') as is_account_locked, (`password_expired`!='N') as `is_password_expired`, @@disconnect_on_expired_password as `disconnect_on_expired_password`, @@offline_mode and (`Super_priv`='N') as `is_offline_
128
-
mode_and_not_super_user`, `ssl_type`, `ssl_cipher`, `x509_issuer`, `x509_subject` FROM mysql.user WHERE 'serverconfig' = `user` AND '%' = `host`
129
-
2023-10-23T20:50:02.668778Z 95 Query select@@lower_case_table_names, @@version, connection_id(), variable_value from performance_schema.session_status where variable_name = 'mysqlx_ssl_cipher'
130
-
2023-10-23T20:50:02.669991Z 95 Query SET sql_log_bin = 0
There is a cron job on the machine where the charm exists that is triggered every minute and runs `logrotate`. The logrotate utility does *not* use `copytruncate`. Instead, the existing log file is moved into the archive directory by logrotate, and then the logrotate's postrotate script invokes `juju-run` (or `juju-exec` depending on the juju version) to dispatch a custom event. This custom event's handler flushes the MySQL log with the [FLUSH](https://dev.mysql.com/doc/refman/8.0/en/flush.html) statement that will result in a new and empty log file being created under `/var/snap/charmed-mysql/common/var/log/mysql` and the rotated file's descriptor being closed.
183
-
184
-
We use a custom event in juju to execute the FLUSH statement in order to avoid storing any credentials on the disk. The charm code has a mechanism that will retrieve credentials from the peer relation databag or juju secrets backend, if available, and keep these credentials in memory for the duration of the event handler.
185
-
163
+
There is a cron job on the machine where the charm exists that is triggered every minute and runs
164
+
`logrotate`. The logrotate utility does *not* use `copytruncate`. Instead, the existing log file is
165
+
moved into the archive directory by logrotate, and then the logrotate's postrotate script invokes
166
+
`juju-run` (or `juju-exec` depending on the juju version) to dispatch a custom event. This custom
167
+
event's handler flushes the MySQL log with the
168
+
[FLUSH](https://dev.mysql.com/doc/refman/8.0/en/flush.html) statement that will result in a new and
169
+
empty log file being created under `/var/snap/charmed-mysql/common/var/log/mysql` and the rotated
170
+
file's descriptor being closed.
171
+
We use a custom event in juju to execute the FLUSH statement in order to avoid storing any
172
+
credentials on the disk. The charm code has a mechanism that will retrieve credentials from the
173
+
peer relation databag or juju secrets backend, if available, and keep these credentials in memory
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments