Certificate Authentication for MySQL

Leverage Banyan's short-lived x509 Certificates to manage end user access to MySQL servers, including access control and audit logging

  • Updated on Apr 12, 2022

This article describes features - Certificate authentication for databases - that are currently in early preview. Contact your account team to enable these features for your organization and for further assistance.

Overview

It’s often quite difficult to manage and share passwords and accounts between developers for database access. By leveraging Banyan’s Mutually Authenticated TLS (MTLS) flows for TCP services, and combining that with Certificate-Based authentication using short-lived x509 certificates, it’s possible to provide your end users VPN-free Zero Trust Database access regardless of their network location.

Because the Banyan platform automatically provisions short-lived x509 certificates for your users when they log in, it natively provides the ability to authenticate and authorize users against MySQL Databases. This gives end users the ability to connect to MySQL Databases without a VPN, authenticate against the database directly through the Desktop App, and authorize users with native MySQL access control.

Best of all, the Banyan Database access mechanism works seamlessly with the Mutually Authenticated TLS (MTLS) mechanism, letting you choose one or both capabilities based on your needs.


How It Works

With Banyan, you modify your MySQL server to require client certificates signed by your Banyan Root CA, which can be obtained from the Command Center.

The MySQL Client connection flow using Banyan login certificates leverage the in-build client-certificate authentication mechanism that MySQL provides, but also wraps the connection in an MTLS tunnel for complete VPN-free access.


Steps

Setting up VPN-free access to a MySQL Database is very similar to the setup process followed to secure a TCP service, as described in Notes on Securing TCP Services.

Then, there are a few additional steps to enable Banyan Client Certificate Authentication:

1. Retrieve the Banyan Root CA

We will use Banyan’s ability to provision short-lived x509 certificates for end users (called login certificates) to authenticate with the MySQL Database.

Navigate to Settings > TrustProvider Settings > Advanced Settings and copy the Issuing CA Certificate to your MySQL Server Host at /etc/ssl/certs/banyan-ca.crt. This will be used in later steps.

2. Provision a Server Certificate

In order for the MySQL Client to verify your server’s identity, you will need to obtain a server. You can use a self-signed private certificate (using OpenSSL or other such tool) or a public certificate here.

3. Modify MySQL for SSL and Client Certificate Authentication

At this point you should have the following certificates present on the MySQL Server Host:

  • /etc/ssl/certs/banyan-ca.crt
  • /etc/ssl/certs/mysql-server.crt
  • /etc/ssl/certs/mysql-server.key

And they should be owned by the mysql user on the host:

$ sudo chown mysql:mysql /etc/ssl/certs/banyan-ca.crt /etc/ssl/certs/mysql-server.crt /etc/ssl/certs/mysql-server.key
$ sudo chmod 0600 /etc/ssl/certs/mysql-server.key

Next, you’ll need to modify your MySQL configuration file, named my.cnf. This can often be found at /etc/mysql/my.cnf or /etc/my.cnf. You will need to configure this file to tell MySQL to require clients to connect over TLS and where to look for the Banyan CA:

#...
[mysqld]
ssl-cert=/etc/ssl/certs/mysql-server.crt
ssl-key=/etc/ssl/certs/mysql-server.key
ssl-ca=/etc/ssl/certs/banyan-ca.crt
require_secure_transport=ON # Used to require TLS for connections
#...

With this configured it may be required to restart your mysqld process. This can often be done by running sudo systemctl restart mysql.

4. Configure MySQL to require x509 Certificates issued by Banyan

Next, we need to tell MySQL to use client-certificate authentication and ensure clients present a certificate from the Banyan CA when they connect.

MySQL requires client certificates on a per-user basis. The requirement can be configured using CREATE USER or ALTER USER statements. When set, MySQL will reject connections from these users if they don’t present a valid certificate signed by your CA.

In this example we will be modifying the root user to grant access to any authenticated Banyan User:

mysql> CREATE USER 'root'@'%' REQUIRE ISSUER '/O=YOUR_ORG_NAME/OU=Certificate Authority/CN=YOUR_ORG_NAME Banyan Private Root CA';

Where YOUR_ORG_NAME is the name of your Banyan Organization.

It is also possible to configure access for a single authenticated Banyan User:

mysql> CREATE USER 'root'@'%' REQUIRE ISSUER '/O=YOUR_ORG_NAME/OU=Certificate Authority/CN=YOUR_ORG_NAME Banyan Private Root CA' AND SUBJECT '/OU=Banyan Client USER_EMAIL/CN=Banyan Client USER_EMAIL';

Where YOUR_ORG_NAME is the name of your Banyan Organization and USER_EMAIL is the email address of the registered Banyan User.

5. Connect to MySQL using the MySQL Client

Ensure your end users install the latest Banyan Desktop App and register their device.

Once the TCP Service is defined, your end users will see it in their Banyan Desktop App.

When the user clicks Connect, the Desktop App will launch the banyanproxy in TCP Mode, on the specified port (we recommend 3306 for MySQL).

The user can now use the MySQL Client (mysql) to access the Database by using their Login Certificate. IN this example we’ve set the port to 3306, and are connecting to the default database as the root user:

mysql -h 127.0.0.1 --P 3306 default -u root --ssl-mode=PREFERRED --ssl-cert="/Users/shivanshvij/Library/Application Support/banyanapp/login-cert.pem" --ssl-key="/Users/shivanshvij/Library/Application Support/banyanapp/login-key.pem"

The MySQL Database will validate the Banyan-issued short-lived login certificate to allow database access.


Audit logs

You can grab granular logs of authorized accesses and unauthorized attempts. Instructions coming soon!