Unable to connect to MariaDB with SSL

Tammes · April 10, 2024, 10:55am

Hello,
I would like to use Crowdsec with an external MariaDB-Cluster as backend for the Lapi. When I configured Crowdsec to use the DB on the Cluster, I got an access denied error until I disabled SSL for that database. According to the documentation, SSL can be used with Postgres. But I could not find any mention of using it with Mysql/MariaDB. Is there any option to enable SSL with MariaDB that I did not see?
Thanks in advance

iiAmLoz · April 12, 2024, 10:26am

Hey

Looking at the code it seems we do not take into account a SSL mode

github.com

crowdsecurity/crowdsec/blob/0746e0c091b8426791a4a495b25a186efd899c9d/pkg/csconfig/database.go#L134


      
          			sqliteConnectionStringParameters = "_busy_timeout=100000&_fk=1&_journal_mode=WAL"
          		} else {
          			sqliteConnectionStringParameters = "_busy_timeout=100000&_fk=1"
          		}
          
          		connString = fmt.Sprintf("file:%s?%s", d.DbPath, sqliteConnectionStringParameters)
          	case "mysql":
          		if d.isSocketConfig() {
          			connString = fmt.Sprintf("%s:%s@unix(%s)/%s?parseTime=True", d.User, d.Password, d.DbPath, d.DbName)
          		} else {
          			connString = fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?parseTime=True", d.User, d.Password, d.Host, d.Port, d.DbName)
          		}
          	case "postgres", "postgresql", "pgx":
          		if d.isSocketConfig() {
          			connString = fmt.Sprintf("host=%s user=%s dbname=%s password=%s", d.DbPath, d.User, d.DbName, d.Password)
          		} else {
          			connString = fmt.Sprintf("host=%s port=%d user=%s dbname=%s password=%s sslmode=%s", d.Host, d.Port, d.User, d.DbName, d.Password, d.Sslmode)
          		}
          	}
          
          	return connString

I can dive into the documentation for what the connect string should be if SSL is enabled, however, if you know then please add it to the discussion

Edit: it seems mysql driver for golang uses the tls param

github.com

go-sql-driver/mysql/blob/d7ddb8b9e324830b1ede89c5fea090c824497c51/README.md?plain=1#L415-L425


      
          ##### `tls`
          
          ```
          Type:           bool / string
          Valid Values:   true, false, skip-verify, preferred, <name>
          Default:        false
          ```
          
          `tls=true` enables TLS / SSL encrypted connection to the server. Use `skip-verify` if you want to use a self-signed or invalid certificate (server side) or use `preferred` to use TLS only when advertised by the server. This is similar to `skip-verify`, but additionally allows a fallback to a connection which is not encrypted. Neither `skip-verify` nor `preferred` add any reliable security. You can use a custom TLS config after registering it with [`mysql.RegisterTLSConfig`](https://godoc.org/github.com/go-sql-driver/mysql#RegisterTLSConfig).

Tammes · May 10, 2024, 9:49am

Alright, so in order to make the db connection work with tls, I would have to add the parameter in that database.go file and then compile crowdsec myself?

iiAmLoz · May 10, 2024, 12:18pm

We have a soft feature lock for 1.6.2 already in progress, I apologize I forgot to raise as an actual issue so I will create a tag a fix for 1.6.3

Edit: [mariadb/msql] Add support for SSL flag · Issue #2993 · crowdsecurity/crowdsec · GitHub

Edit Edit: I have asked the dev team if there a possibility to sneak in the fix to 1.6.2 but cant guarantee anything

iiAmLoz · May 14, 2024, 11:41am

FYI, the dev team have accepted a PR for 1.6.2 so I have just crafted the changes it was pretty simple honestly and I tested it locally with a self sign certificate.

Tammes · May 15, 2024, 8:47am

Wow that ist cool. Thank you very much, I am looking forward to using that version

Topic		Replies	Views
3 Hosts with ONE database and ONE console crowdsec	1	346	September 29, 2023
Crowdsec versions compatibility	5	803	March 21, 2022
Using Helm Chart and External DB crowdsec	0	416	September 10, 2023
Is anyone using CrowdSec FreeBSD packages? crowdsec	4	855	December 23, 2021
Local dashboard crowdsec	0	399	February 22, 2024

Unable to connect to MariaDB with SSL

Related Topics