TMA-MYSQL-9.1
Ensure Replication Traffic is Secured
Description
The replication traffic between servers should be secured. Security measures should include ensuring the confidentiality and integrity of the traffic, and performing mutual authentication between the servers before performing replication.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Check that replication traffic uses a private network, a VPN, SSL/TLS or an SSH tunnel for confidentiality, integrity and mutual server authentication.
How it is fixed
Fix method: Guidance or infrastructure patch
Secure replication with TLS (CHANGE REPLICATION SOURCE TO SOURCE_SSL=1, SOURCE_SSL_CA=... and REQUIRE SSL/X509 for the replication account) or a private network/VPN.
Properties
- Operating systems
- Any
- Tags
- mysqldatabasereplicationtlsmanual
- Reference
- CIS Oracle MySQL Community Server 8.4 Benchmark v1.1.0 - 9.1 Ensure Replication Traffic is Secured