Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-25343

Error log message not helpful when encryption key is too long

    XMLWordPrintable

    Details

      Description

      Relevant Configuration in mariadb.cnf:

      [mysqld]
      plugin_load_add = file_key_management
      file_key_management_filename = /etc/mysql/keys/enc_key.enc
      file_key_management_filekey = FILE:/etc/mysql/keys/enc_passwd.key
      file_key_management_encryption_algorithm = AES_CBC
      

      MariaDB [(none)]> show plugins soname 'file_key_management.so';
      +---------------------+---------------+------------+------------------------+---------+
      | Name                | Status        | Type       | Library                | License |
      +---------------------+---------------+------------+------------------------+---------+
      | file_key_management | NOT INSTALLED | ENCRYPTION | file_key_management.so | GPL     |
      +---------------------+---------------+------------+------------------------+---------+
      

      Error log:

      Apr  6 03:29:43 localhost mariadbd[27605]: 2021-04-06  3:29:43 0 [ERROR] mariadbd: Cannot decrypt /etc/mysql/keys/enc_key.enc. Wrong key?
      Apr  6 03:29:43 localhost mariadbd[27605]: 2021-04-06  3:29:43 0 [ERROR] Plugin 'file_key_management' init function returned error.
      Apr  6 03:29:43 localhost mariadbd[27605]: 2021-04-06  3:29:43 0 [ERROR] Plugin 'file_key_management' registration as a ENCRYPTION failed.
      

      After hours of trying different things, it turned out that the key was too long (I'd inadvertently used 512 characters). Recreated the file_key_management_filename and file_key_management_filekey using a 256 character key and it all worked fine.

      I suggest checking the length (if not already happening) and then issuing a more helpful error like "Cannot decrypt <file_key_management_filename>. <file_key_management_filekey> has incorrect length"

      This would have helped me realise where the error was (ie between chair and keyboard) and would have taken less than a minute to address.

        Attachments

          Activity

            People

            Assignee:
            Unassigned
            Reporter:
            thenatsky thenatsky
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated: