[MDEV-27105] --ssl option set as default for mariadb CLI Created: 2021-11-21  Updated: 2023-03-21  Resolved: 2022-07-28

Status: Closed
Project: MariaDB Server
Component/s: Scripts & Clients, SSL
Fix Version/s: 10.10.1

Type: Task Priority: Minor
Reporter: Chu3Shah Assignee: Sergei Golubchik
Resolution: Fixed Votes: 0
Labels: Preview_10.10

Issue Links:
Issue split
split from MDEV-26997 Wrong ssl-ca breaks TLS without throw... Closed
Problem/Incident
causes MDEV-29608 Default SSL makes mysqlslap much slow... Closed
causes MDEV-30639 Upgrade to 10.6 and later does not wo... Closed
Relates
relates to MDEV-28634 Client's --ssl-* options (without --s... Closed

 Description   

Hello

I'd like to propose that the mariadb CLI has the --ssl option set by default. Although this option alone wont prevent MitM attacks, it raises the security for the CLI by establishing TLS connections, given the database server is able to serve TLS.

I create this ticket in reference to an off-topic discussion in yonder ticket: MDEV-26997

Kind regards

 Comments   
Comment by Sergei Golubchik [ 2022-05-21 ]

This contradicts MDEV-28634. We can either have --ssl by default or we can have an error if --ssl was requested, but TLS connection couldn't be established. But not both.

Comment by Soh2oMie [ 2022-05-22 ]

I think a desired default behavior could be to fallback to a unencrypted connection and throw a warning that the TLS connection couldn't be established. Nevertheless if TLS is explicitly requested via the --ssl option and the encrypted connection couldn't be established, an error is thrown.

Comment by Sergei Golubchik [ 2022-06-18 ]

Without MDEV-28634 the behavior simply is — --ssl is enabled by default. That is everything behaves as if --ssl was specified. Nothing else.

It's in this branch: preview-10.10-misc.

Comment by Sergei Golubchik [ 2022-06-27 ]

Also in bb-10.10-MDEV-27105, without other misc features

Comment by Ramesh Sivaraman [ 2022-07-28 ]

ok to push

Generated at Thu Feb 08 09:50:22 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.