<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="group-replication-secure-user">
      </a>
      20.6.3.1 Secure User Credentials for Distributed Recovery
     </h4>
    </div>
   </div>
  </div>
  <p>
   State transfer from the binary log requires a replication user
        with the correct permissions so that Group Replication can
        establish direct member-to-member replication channels. The same
        replication user is used for distributed recovery on all the
        group members. If group members have been set up to support the
        use of a remote cloning operation as part of distributed
        recovery, this replication user is also used as the clone user
        on the donor, and requires the correct permissions for this
        role. For detailed instructions to set up this user, see
   <a class="xref" href="group-replication-user-credentials.html" title="20.2.1.3 User Credentials For Distributed Recovery">
    Section 20.2.1.3, “User Credentials For Distributed Recovery”
   </a>
   .
  </p>
  <p>
   To secure the user credentials, you can require SSL for
        connections with the user account, and provide the user
        credentials when Group Replication is started, rather than
        storing them in the replica status tables. Also, if you are
        using caching SHA-2 authentication, you must set up RSA
        key-pairs on the group members.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    When using the MySQL communication stack
          (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
     <code class="literal">
      group_replication_communication_stack=MYSQL
     </code>
    </a>
    )
          AND secure connections between members
          (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
     <code class="literal">
      group_replication_ssl_mode
     </code>
    </a>
    is not set to
    <code class="literal">
     DISABLED
    </code>
    ), the recovery users
          must be properly set up, as they are also the users for group
          communications. Follow the instructions in
    <a class="xref" href="group-replication-secure-user.html#group-replication-secure-user-ssl" title="20.6.3.1.2 Replication User With SSL">
     Section 20.6.3.1.2, “Replication User With SSL”
    </a>
    and
    <a class="xref" href="group-replication-secure-user.html#group-replication-secure-user-provide" title="20.6.3.1.3 Providing Replication User Credentials Securely">
     Section 20.6.3.1.3, “Providing Replication User Credentials Securely”
    </a>
    .
   </p>
  </div>
  <div class="section">
   <div class="titlepage">
    <div>
     <div>
      <h5 class="title">
       <a name="group-replication-caching-sha2-user-credentials">
       </a>
       20.6.3.1.1 Replication User With The Caching SHA-2 Authentication Plugin
      </h5>
     </div>
    </div>
   </div>
   <p>
    By default, users created in MySQL 8 use
    <a class="xref" href="caching-sha2-pluggable-authentication.html" title="8.4.1.2 Caching SHA-2 Pluggable Authentication">
     Section 8.4.1.2, “Caching SHA-2 Pluggable Authentication”
    </a>
    . If
          the replication user you configure for distributed recovery
          uses the caching SHA-2 authentication plugin, and you are
    <span class="emphasis">
     <em>
      not
     </em>
    </span>
    using SSL for distributed recovery
          connections, RSA key-pairs are used for password exchange. For
          more information on RSA key-pairs, see
    <a class="xref" href="creating-ssl-rsa-files.html" title="8.3.3 Creating SSL and RSA Certificates and Keys">
     Section 8.3.3, “Creating SSL and RSA Certificates and Keys”
    </a>
    .
   </p>
   <p>
    In this situation, you can either copy the public key of the
    <code class="literal">
     rpl_user
    </code>
    to the joining member, or
          configure the donors to provide the public key when requested.
          The more secure approach is to copy the public key of the
          replication user account to the joining member. Then you need
          to configure the
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_public_key_path">
     <code class="literal">
      group_replication_recovery_public_key_path
     </code>
    </a>
    system variable on the joining member with the path to the
          public key for the replication user account.
   </p>
   <p>
    The less secure approach is to set
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_get_public_key">
     <code class="literal">
      group_replication_recovery_get_public_key=ON
     </code>
    </a>
    on donors so that they provide the public key of the
          replication user account to joining members. There is no way
          to verify the identity of a server, therefore only set
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_get_public_key">
     <code class="literal">
      group_replication_recovery_get_public_key=ON
     </code>
    </a>
    when you are sure there is no risk of server identity being
          compromised, for example by a man-in-the-middle attack.
   </p>
  </div>
  <div class="section">
   <div class="titlepage">
    <div>
     <div>
      <h5 class="title">
       <a name="group-replication-secure-user-ssl">
       </a>
       20.6.3.1.2 Replication User With SSL
      </h5>
     </div>
    </div>
   </div>
   <p>
    A replication user that requires an SSL connection must be
          created
    <span class="emphasis">
     <em>
      before
     </em>
    </span>
    the server joining the
          group (the joining member) connects to the donor. Typically,
          this is set up at the time you are provisioning a server to
          join the group. To create a replication user for distributed
          recovery that requires an SSL connection, issue these
          statements on all servers that are going to participate in the
          group:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa62204726"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> SQL_LOG_BIN<span class="token operator">=</span><span class="token number">0</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span>@<span class="token string">'%'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SLAVE</span> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> CONNECTION_ADMIN <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> BACKUP_ADMIN <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> GROUP_REPLICATION_STREAM <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <em class="replaceable">rec_ssl_user</em>@<span class="token string">'%'</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">FLUSH</span> <span class="token keyword">PRIVILEGES</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">SET</span> SQL_LOG_BIN<span class="token operator">=</span><span class="token number">1</span><span class="token punctuation">;</span></code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     The
     <a class="link" href="privileges-provided.html#priv_group-replication-stream">
      <code class="literal">
       GROUP_REPLICATION_STREAM
      </code>
     </a>
     privilege is required when using both the MySQL
            communication stack
            (
     <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
      <code class="literal">
       group_replication_communication_stack=MYSQL
      </code>
     </a>
     )
            and secure connections between members
            (
     <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
      <code class="literal">
       group_replication_ssl_mode
      </code>
     </a>
     not set to
     <code class="literal">
      DISABLED
     </code>
     ). See
     <a class="xref" href="group-replication-connection-security.html" title="20.6.1 Communication Stack for Connection Security Management">
      Section 20.6.1, “Communication Stack for Connection Security Management”
     </a>
     .
    </p>
   </div>
  </div>
  <div class="section">
   <div class="titlepage">
    <div>
     <div>
      <h5 class="title">
       <a name="group-replication-secure-user-provide">
       </a>
       20.6.3.1.3 Providing Replication User Credentials Securely
      </h5>
     </div>
    </div>
   </div>
   <p>
    To supply the user credentials for the replication user, you
          can set them permanently as the credentials for the
    <code class="literal">
     group_replication_recovery
    </code>
    channel, using a
    <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
     <code class="literal">
      CHANGE REPLICATION SOURCE TO
     </code>
    </a>
    statement. Alternatively, you can specify them in the
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START GROUP_REPLICATION
     </code>
    </a>
    statement each time Group Replication is started. User
          credentials specified in
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START
          GROUP_REPLICATION
     </code>
    </a>
    take precedence over any user
          credentials that have been set using a
    <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
     <code class="literal">
      CHANGE REPLICATION SOURCE TO
     </code>
    </a>
    statement.
   </p>
   <p>
    User credentials set using
    <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
     <code class="literal">
      CHANGE
          REPLICATION SOURCE TO
     </code>
    </a>
    are stored in plain text in
          the replication metadata repositories on the server, but user
          credentials specified on
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START
          GROUP_REPLICATION
     </code>
    </a>
    are saved in memory only, and are
          removed by a
    <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
     <code class="literal">
      STOP
          GROUP_REPLICATION
     </code>
    </a>
    statement or server shutdown.
          Using
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START GROUP_REPLICATION
     </code>
    </a>
    to specify the user credentials therefore helps to secure the
          Group Replication servers against unauthorized access.
          However, this method is not compatible with starting Group
          Replication automatically, as specified by the
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_start_on_boot">
     <code class="literal">
      group_replication_start_on_boot
     </code>
    </a>
    system variable.
   </p>
   <p>
    If you want to set the user credentials permanently using a
    <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
     <code class="literal">
      CHANGE REPLICATION SOURCE TO
     </code>
    </a>
    statement, issue this statement on the member that is going to
          join the group:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa26194437"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CHANGE</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SOURCE</span> <span class="token keyword">TO</span> <span class="token keyword">SOURCE_USER</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span><span class="token punctuation">,</span> 
<span class="token prompt">    -&gt;</span>   <span class="token keyword">SOURCE_PASSWORD</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">password</em>'</span> 
<span class="token prompt">    -&gt;</span>   <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'group_replication_recovery'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    To supply the user credentials on
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START
          GROUP_REPLICATION
     </code>
    </a>
    , issue this statement when
          starting Group Replication for the first time, or after a
          server restart:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa25516935"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">START</span> <span class="token keyword">GROUP_REPLICATION</span> <span class="token keyword">USER</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">rec_ssl_user</em>'</span><span class="token punctuation">,</span> <span class="token keyword">PASSWORD</span><span class="token operator">=</span><span class="token string">'<em class="replaceable">password</em>'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     If you switch to using
     <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
      <code class="literal">
       START
            GROUP_REPLICATION
      </code>
     </a>
     to specify user credentials on a
            server that previously supplied the credentials using
     <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
      <code class="literal">
       CHANGE REPLICATION SOURCE TO
      </code>
     </a>
     ,
            you must complete the following steps to get the security
            benefits of this change.
    </p>
   </div>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Stop Group Replication on the group member using a
       <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
        <code class="literal">
         STOP GROUP_REPLICATION
        </code>
       </a>
       statement. Although it is possible to take the following
              two steps while Group Replication is running, you need to
              restart Group Replication to implement the changes.
      </p>
     </li>
     <li class="listitem">
      <p>
       Set the value of the
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_start_on_boot">
        <code class="literal">
         group_replication_start_on_boot
        </code>
       </a>
       system variable to
       <code class="literal">
        OFF
       </code>
       (the default is
       <code class="literal">
        ON
       </code>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       Remove the distributed recovery credentials from the
              replica status tables by issuing this statement:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa87569379"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CHANGE</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SOURCE</span> <span class="token keyword">TO</span> <span class="token keyword">SOURCE_USER</span><span class="token operator">=</span><span class="token string">''</span><span class="token punctuation">,</span> <span class="token keyword">SOURCE_PASSWORD</span><span class="token operator">=</span><span class="token string">''</span> 
<span class="token prompt">    -&gt;</span>   <span class="token keyword">FOR</span> <span class="token keyword">CHANNEL</span> <span class="token string">'group_replication_recovery'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       Restart Group Replication on the group member using a
       <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
        <code class="literal">
         START GROUP_REPLICATION
        </code>
       </a>
       statement that specifies the distributed recovery user
              credentials.
      </p>
     </li>
    </ol>
   </div>
   <p>
    Without these steps, the credentials remain stored in the
          replica status tables, and can also be transferred to other
          group members during remote cloning operations for distributed
          recovery. The
    <code class="literal">
     group_replication_recovery
    </code>
    channel could then be inadvertently started with the stored
          credentials, on either the original member or members that
          were cloned from it. An automatic start of Group Replication
          on server boot (including after a remote cloning operation)
          would use the stored user credentials, and they would also be
          used if an operator did not specify the distributed recovery
          credentials as part of
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START
          GROUP_REPLICATION
     </code>
    </a>
    .
   </p>
  </div>
 </div>
 <br/>
</div>
