On 9 Apr 2009, at 07:55, sunanda menon wrote: > Martin MC Brown wrote: >> >> On 8 Apr 2009, at 13:56, sunanda menon wrote: >> >>> Martin MC Brown wrote: >>>> Hi Jyri, >>>> >>>>>> Please review the changes made to the MySQL-OpenSSL ARC writeup. >>>>> >>>>> >>>>>> MySQL source provides the Certificate Authority(CA) >>>>>> certificate, the server public key and the server private key >>>>>> to start the MySQL server so that it allows the clients to >>>>>> connect via SSL. >>>>> >>>>> Not clear to me what you mean by "MySQL source provides ..."? >>>>> It sounds as if the CA cert and server keys are embedded in the >>>>> source? >>>>> That can't be it though. But then what does the above paragraph >>>>> mean? >>>> >>>> They aren't embedded in the source - the test suite provides a >>>> set of suitable files so that the test suite can be executed by a >>>> user/developer without them having to produce their own >>>> certificates just to get the test suite to pass. >>>> >>>> When it comes to deploying their own server, users are expected >>>> to provide either own self-signed certs, or provide a suitable >>>> cert from Verisign or another CA. >>> As this means it's more for the test suite to run ,do we feel the >>> need to provide this for OpenSolaris and SWS respectively,since >>> the user may or may not choose to install the test package . >> >> I dont think it's needed for the core, but we should probably >> include this as part of the mysqltest package, otherwise people >> wont be able to complete the tests. >> >> MC >> > > MC ,these already form a part of the test package ,but Jyri thinks > there is a security hole in using this .I don't see his comments on > this though.
I appreciate that - I'm just stating that those files should be included in the test package, otherwise the tests will fail. I do not understand what kind of security hole can be presented by providing sample security certificates as part of the tests. To use the certificates within a distribution you would have to explicitly add them to the default configuration file, and the necessary lines to enable them. Installing the mysqltest package *DOES NOT* automatically enable the certificates in the server - they will only ever be used if you run the test suite, which starts up it's own mysqld servers with very specific configuration files - the settings of your config file in / etc/mysql/* is not used, updated, edited, or any way affected by running the test suite. We provide these certificate files in all our distributions (source and binaries) and have done for years, and they are there purely to enable tests for the SSL functionality to be conducted. I'll be blunt and say that if users are stupid enough to use the certificates that we supply for testing to secure their MySQL servers, then the chances are they don't know what they are doing, and probably open themselves up for plenty of other security problems beyond using sample certificates. MC -- Martin 'MC' Brown, mc at mcslp.com and mc.brown at sun.com Technical Writer, Database Group, Sun Microsystems Everything MCslp: http://planet.mcslp.com
