PHP MySQL - Stilson.net

CHAPTER 29 • SECURING MYSQLwww.it-ebooks.infoREQUIRE X509This grant option forces the user to provide a valid Certificate Authority (CA) certificate. This would berequired if you want to verify the certificate signature with the CA certificate. Note that this option doesnot cause MySQL to consider the origin, subject, or issuer. An example follows:mysql>GRANT insert, select, update on company.* to jason@client.wjgilmore.com->identified by 'secret' REQUIRE SSL REQUIRE X509;Note that this option also doesn’t specify which CAs are valid and which are not. Any CA thatverified the certificate would be considered valid. If you’d like to place a restriction on which CAs areconsidered valid, see the next grant option.REQUIRE ISSUERThis grant option forces the user to provide a valid certificate, issued by a valid CA issuer. Severaladditional pieces of information must be included with this, including the country of origin, state oforigin, city of origin, name of certificate owner, and certificate contact. An example follows:mysql>GRANT INSERT, SELECT, UPDATE ON company.* TO 'jason'@'client.wjgilmore.com'->IDENTIFIED BY 'secret' REQUIRE SSL REQUIRE ISSUER 'C=US, ST=Ohio,->L=Columbus, O=WJGILMORE,->OU=ADMIN, CN=db.wjgilmore.com/Email=admin@wjgilmore.com'REQUIRE SUBJECTThis grant option forces the user to provide a valid certificate including a valid certificate “subject.” Anexample follows:mysql>GRANT INSERT, SELECT, UPDATE ON company.* TO 'jason'@'client.wjgilmore.com'->IDENTIFIED BY 'secret' REQUIRE SSL REQUIRE SUBJECT->'C=US, ST=Ohio, L=Columbus, O=WJGILMORE, OU=ADMIN,->CN=db.wjgilmore.com/Email=admin@wjgilmore.com'REQUIRE CIPHERThis grant option enforces the use of recent encryption algorithms by forcing the user to connect using aparticular cipher. The options currently available include EDH, RSA, DES, CBC3, and SHA. An examplefollows:mysql>GRANT INSERT, SELECT, UPDATE ON company.* TO 'jason'@'client.wjgilmore.com'->IDENTIFIED BY 'secret' REQUIRE SSL REQUIRE CIPHER 'DES-RSA';SSL OptionsThe options introduced in this section are used by both the server and the connecting client todetermine whether SSL should be used and, if so, the location of the certificate and key files.584