加密 apache 和 mysql 服务器
我有一个关于加密磁盘的问题。
我有 2 台服务器：1 台是用于 Web/前端的 apache，它与服务器 2（即 mysql）通信。它们都是仅供内联网使用的；没有外部访问。我正在研究使用 PGP 或 GnuPG 来加密磁盘。不过，我不清楚这到底是如何运作的。
密钥将存储在哪里？在客户端？在阿帕奇上？如果apache上有访问mysql的密钥，那么每个用户都需要有一个密钥吗？如果是这样，如果密钥 1 用于更改某些数据，那么使用密钥 2 的用户是否无法访问该数据？还有 apache 密钥，是否只有拥有本地密钥的用户才能访问？
加密是即时完成的吗？它会降低性能吗？
加密这些服务器上的数据但又可供用户访问的最佳方法是什么？
谢谢！
I have a question about encrypting disks.
I have 2 servers: 1 is apache for web/frontend and it talks to server 2 which is mysql. They are all for intranet only; no external access. I was looking into using PGP or GnuPG to encrypt the disks. I'm not clear, though, as to exactly how this would work.
Where would the keys be stored? On the client? On apache? If there is a key on apache to access mysql, does there need to be a key for each user? If so, if key 1 is used to alter some data, would then that data be inaccessible to a user using key 2? And the apache key, would that only be accessible to users with local keys?
Is encryption done on the fly? Does it degrade performance?
What would be the best approach to encrypt the data on these servers, but have them accessible to users?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在您描述的设置中，可以有很多地方和方法可以对数据进行加密。如果您想加密服务器之间传输的所有数据，在它们之间设置虚拟专用网络 (VPN) 就可以了。
如果要加密磁盘上的实际数据，可以使用加密文件系统，例如 Linux 上的 CFS。如果您更偏执一点，您可能也想加密交换空间。
考虑到加密操作对 CPU 的负荷可能相当大，始终加密所有数据可能效率不高。我猜加密所有内容是没有必要的，您只想加密一些敏感数据。我认为最直接的方法是使用用户的密码加上随机 salt （为每个用户生成一次）作为密钥并使用对称密钥算法 类似 AES。
您的 Web 应用程序应以加密形式在数据库中存储和检索数据，并注意不要将未加密数据在内存中保留的时间超过严格必要的时间。为了（尝试）确保之后将其发送给客户端时保持机密，您应该使用 TLS。
In the setup you describe there can be many places and ways the data can be encrypted. If you want to encrypt all transferred data between servers, setting up a Virtual Private Network (VPN) between them would to the trick.
If you want to encrypt the actual data on the disk, you can use a crypto filesystem like CFS on Linux. If you are a bit more paranoid you might want to encrypt the swap space too.
It's probably not efficient to encrypt all data all the time, considering encryption operations can be quite heavy on the CPU. I'm guessing encrypting everything is not necessary and you just want to encrypt some of your data which is sensitive. I think the most straightforward way to do that would be to use the user's password plus a random salt (generated once for each user) as a key and use a symmetric key algorithm like AES.
Your web application should store and retrieve the data in the database in an encrypted form, and take care not to keep the unencrypted data in memory for any longer than strictly necessary. To (try to) make sure it stays secret when you send it out to the client after that, you should use TLS.