install mysql keyring plugin - mysql

Question

I was trying to install keyring plugin on MySQL 5.7.18.
I edited my.ini file. It was blank so I added the following text and restarted MySQL.
[mysqld]
early-plugin-load=keyring_file.dll
I ran the following command to install the plugin.
mysql> install plugin keyring_file soname 'keyring_file.dll';
I then ran the following sql to check:
mysql> SELECT PLUGIN_NAME, PLUGIN_STATUS
-> FROM INFORMATION_SCHEMA.PLUGINS
-> WHERE PLUGIN_NAME LIKE 'keyring%';
+--------------+---------------+
| PLUGIN_NAME | PLUGIN_STATUS |
+--------------+---------------+
| keyring_file | ACTIVE |
+--------------+---------------+
1 row in set (0.00 sec)
But when I tried to alter a table to use encryption, I got errors.
mysql> ALTER TABLE t1 ENCRYPTION='Y';
ERROR 3185 (HY000): Can't find master key from keyring, please check keyring
plugin is loaded.
Did I miss a step somewhere?

Answer 1

Harriett, do the following:
Check the user that the MySQL service runs as (e.g., NETWORK SERVICE)
Create a keyring folder in C:/Program Files/MySQL/MySQL Server 5.7
Explicitly grant the MySQL service user permissions on the keyring folder
By default on Windows when using keyring_file, the keyring file is stored in C:/Program Files/MySQL/MySQL Server 5.7/keyring/keyring (I determined this by running SHOW VARIABLES LIKE 'keyring%' after installing the plugin and confirming its loading as you described).
After creating the keyring folder in C:/Program Files/MySQL/MySQL Server 5.7 right-click, then Properties -> Security, then Edit -> Add etc. Once the user is added check "Modify" in addition to Read & execute, List folder contents, Read and Write.
Then restart the MySQL service and you should be able to create an encrypted table without error.
NOTE: For security reasons you should go back and remove all users/groups you don't think will absolutely need to have access to the keyring folder (e.g., local machine users). On Unix the docs recommend that the mysql user and group alone have access to the folder.

Answer 2

On windows you don't need this line:
mysql> install plugin keyring_file soname 'keyring_file.dll';
that's the install operation for Linux (maybe you might if running under Node?)
BUT make sure you have a FULL install of MySql - I didn't realise there are cut down versions that don't have the plugin dlls (and other stuff).
And make sure you have the keyring_udf.dll installed and you've also created the UDF functions.
The documentation on mySql's pages for all this is badly organised and hard to follow.
This is one of those tasks that goes on for ever.. got key set up, got everything running - keyfile gets encrypted.
Then I use ALTER TABLE mytable ENCRYPTION='Y' but nothing happens.
I export the table and the export states "ENCRYPTION='Y'" but nope it's not encrypted. No error messages in mysql log, nothing.

Answer 3

I was facing the exact same issue on m local MySQL instance and following steps helped me resolve the ‘Encryption can't find master key, please check the keyring plugin is loaded.' issue.
Add following line in my.ini file
early-plugin-load=keyring_file.dll
Create a folder named keyring at C:\Program Files\MySQL\MySQL Server 8.0 location.
Grant modify access to this folder as MySQL needs to read the folder and insert keyring in the folder.
Also Grant modify access to MySQL folder inside Program Files.
Uninstall existing installed keyring plugin using following command -
UNINSTALL PLUGIN keyring_file;
Restart the MySQL server after making above changes.
Check if the keyring plugin is loaded or not using the following command :-
show variables like '%keyring%';
It should show an output like this :-
+--------------------+---------------------------------------------------------+
| Variable_name | Value |
+--------------------+---------------------------------------------------------+
| keyring_file_data | C:/Program Files/MySQL/MySQL Server 8.0/keyring\keyring |
| keyring_operations | ON |
+--------------------+---------------------------------------------------------+
2 rows in set (0.0024 sec)
Now you should be able to enable encryption on your table using this command :-
ALTER TABLE city ENCRYPTION='Y';
I hope the answer helps.

Answer 4

Check for my.ini file in "C:\Program Files\MySQL\MySQL Server 8.0"
if not available create my.ini file and add the below lines
[mysqld]
early-plugin-load=keyring_file.dll
grant read,write,execute,modify permissions to MYSQL folder and its internal folders in "C:\Program Files\MYSQL"
Restart your MYSQL80 service.
once you have restarted the service you should be able to see the "keyring" file in the default location
C:\Program Files\MySQL\MySQL Server 8.0\keyring
Note: keyring file will be in keyring folder i.e.,
C:\Program Files\MySQL\MySQL Server 8.0\keyring\keyring
if you don't find the file try to restart your system. In my case after restarting my system, i am able to see the files.
Now open mysql command line and execute below command
install plugin keyring_file soname 'keyring_file.dll';
Result :
Query OK, 0 rows affected (0.03 sec)
Now you can run the below command to see the keyring details.
SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'keyring%';
Result:
keyring_file_data C:/Program Files/MySQL/MySQL Server 8.0/keyring\keyring
keyring_operations ON
Now create your table with Encryption
ex:
CREATE TABLE dept ( deptno int NOT NULL
> AUTO_INCREMENT, dname varchar(20) , loc
> varchar(20) , CONSTRAINT pk_dept PRIMARY KEY ( deptno ) )
> engine=InnoDB ENCRYPTION = 'Y';

Answer 5

i think everything is wonderful as mentioned above, but a small change can run your tables.
use this.
ALTER TABLE t1 ENCRYPTION='N';
i will see you around.