<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="replication-security">
      </a>
      19.3 Replication Security
     </h2>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="replication-encrypted-connections.html">
       19.3.1 Setting Up Replication to Use Encrypted Connections
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-binlog-encryption.html">
       19.3.2 Encrypting Binary Log Files and Relay Log Files
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="replication-privilege-checks.html">
       19.3.3 Replication Privilege Checks
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <p>
   To protect against unauthorized access to data that is stored on and
    transferred between replication source servers and replicas, set up
    all the servers involved using the security measures that you would
    choose for any MySQL instance in your installation, as described in
   <a class="xref" href="security.html" title="Chapter 8 Security">
    Chapter 8,
    <i>
     Security
    </i>
   </a>
   . In addition, for servers in a
    replication topology, consider implementing the following security
    measures:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Set up sources and replicas to use encrypted connections to
        transfer the binary log, which protects this data in motion.
        Encryption for these connections must be activated using a
      <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
       <code class="literal">
        CHANGE REPLICATION SOURCE TO
       </code>
      </a>
      statement, in addition to setting up the servers to support
        encrypted network connections. See
      <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
       Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Encrypt the binary log files and relay log files on sources and
        replicas, which protects this data at rest, and also any data in
        use in the binary log cache. Binary log encryption is activated
        using the
      <a class="link" href="replication-options-binary-log.html#sysvar_binlog_encryption">
       <code class="literal">
        binlog_encryption
       </code>
      </a>
      system variable. See
      <a class="xref" href="replication-binlog-encryption.html" title="19.3.2 Encrypting Binary Log Files and Relay Log Files">
       Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Apply privilege checks to replication appliers, which help to
        secure replication channels against the unauthorized or
        accidental use of privileged or unwanted operations. Privilege
        checks are implemented by setting up a
      <code class="literal">
       PRIVILEGE_CHECKS_USER
      </code>
      account, which MySQL
        uses to verify that you have authorized each specific
        transaction for that channel. See
      <a class="xref" href="replication-privilege-checks.html" title="19.3.3 Replication Privilege Checks">
       Section 19.3.3, “Replication Privilege Checks”
      </a>
      .
     </p>
    </li>
   </ul>
  </div>
  <p>
   For Group Replication, binary log encryption and privilege checks
    can be used as a security measure on replication group members. You
    should also consider encrypting the connections between group
    members, comprising group communication connections and distributed
    recovery connections, and applying IP address allowlisting to
    exclude untrusted hosts. For information on these security measures
    specific to Group Replication, see
   <a class="xref" href="group-replication-security.html" title="20.6 Group Replication Security">
    Section 20.6, “Group Replication Security”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
