<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="mysql-cluster-tde-setup">
      </a>
      25.6.14.1 NDB File System Encryption Setup and Usage
     </h4>
    </div>
   </div>
  </div>
  <p>
   <span class="emphasis">
    <em>
     Encryption of file system
    </em>
   </span>
   : To enable
        encryption of a previously unencrypted file system, the
        following steps are required:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      Set the required data node parameters in the
      <code class="literal">
       [ndbd
            default]
      </code>
      section of the
      <code class="filename">
       config.ini
      </code>
      file, as shown here:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa24733928"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[ndbd default]</span>
<span class="token constant">EncryptedFileSystem</span><span class="token attr-value"><span class="token punctuation">=</span> 1</span></code></pre>
     </div>
     <p>
      These parameters must be set as shown on all data nodes.
     </p>
    </li>
    <li class="listitem">
     <p>
      Start the management server with either
      <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_initial">
       <code class="option">
        --initial
       </code>
      </a>
      or
      <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_reload">
       <code class="option">
        --reload
       </code>
      </a>
      to cause it to
            read the updated configuration file.
     </p>
    </li>
    <li class="listitem">
     <p>
      Perform a rolling initial start (or restart) of all the data
            nodes (see
      <a class="xref" href="mysql-cluster-rolling-restart.html" title="25.6.5 Performing a Rolling Restart of an NDB Cluster">
       Section 25.6.5, “Performing a Rolling Restart of an NDB Cluster”
      </a>
      ):
            Start each data node with
      <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_initial">
       <code class="option">
        --initial
       </code>
      </a>
      ; in addition, supply
            either of the options
      <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_filesystem-password">
       <code class="option">
        --filesystem-password
       </code>
      </a>
      or
      <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_filesystem-password-from-stdin">
       <code class="option">
        --filesystem-password-from-stdin
       </code>
      </a>
      ,
            plus a password, to each data node process. When you supply
            the password on the command line, a warning is shown,
            similar to this one:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa67561162"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">&gt; ndbmtd <span class="token property">-c</span> 127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1 <span class="token constant">--filesystem-password</span><span class="token attr-value"><span class="token punctuation">=</span>ndbsecret</span>
ndbmtd<span class="token punctuation">:</span> <span class="token punctuation">[</span>Warning<span class="token punctuation">]</span> Using a password on the command line interface can be insecure<span class="token punctuation">.</span>
2022-08-22 16<span class="token punctuation">:</span>17<span class="token punctuation">:</span>58 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> Angel connected to <span class="token atrule">'127.0.0.1:1186'</span>
2022-08-22 16<span class="token punctuation">:</span>17<span class="token punctuation">:</span>58 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> Angel allocated nodeid<span class="token punctuation">:</span> 5</code></pre>
     </div>
     <p>
      <code class="option">
       --filesystem-password
      </code>
      can accept the
            password form a file,
      <code class="literal">
       tty
      </code>
      , or
      <code class="literal">
       stdin
      </code>
      ;
      <code class="option">
       --filesystem-password-from-stdin
      </code>
      accepts
            the password from
      <code class="literal">
       stdin
      </code>
      only. The latter
            protects the password from exposure on the process command
            line or in the file system, and allows for the possibility
            of passing it from another secure application.
     </p>
     <p>
      You can also place the password in a
      <code class="filename">
       my.cnf
      </code>
      file that can be read by the
            data node process, but not by other users of the system.
            Using the same password as in the previous example, the
            relevant portion of the file should look like this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa11886616"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[ndbd]</span>

<span class="token constant">filesystem-password</span><span class="token attr-value"><span class="token punctuation">=</span>ndbsecret</span></code></pre>
     </div>
     <p>
      You can also prompt the user starting the data node process
            to supply the encryption password when doing so, by using
            the
      <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_filesystem-password-from-stdin">
       <code class="option">
        --filesystem-password-from-stdin
       </code>
      </a>
      option in the
      <code class="filename">
       my.cnf
      </code>
      file instead, like
            this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa18566545"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[ndbd]</span>

<span class="token constant">filesystem-password-from-stdin</span></code></pre>
     </div>
     <p>
      In this case, the user is prompted for the password when
            starting the data node process, as shown here:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-ndbmgm"><div class="docs-select-all right" id="sa18121554"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ndbmgm"><span class="token operator">&gt;</span> ndbmtd <span class="token operator">-</span>c 127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
Enter filesystem password<span class="token operator">:</span> <span class="token operator">**</span><span class="token operator">**</span><span class="token operator">**</span><span class="token operator">**</span><span class="token operator">*</span>
<span class="token selector">2022-08-22 16:36:00 [ndbd]</span> <span class="token datatype">INFO</span>     <span class="token operator">--</span> Angel connected to '127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1<span class="token operator">:</span>1186'
<span class="token selector">2022-08-22 16:36:00 [ndbd]</span> <span class="token datatype">INFO</span>     <span class="token operator">--</span> Angel allocated nodeid<span class="token operator">:</span> 5
<span class="token operator">&gt;</span></code></pre>
     </div>
     <p>
      Regardless of the method used, the format of the encryption
            password is the same as that used for passwords for
            encrypted backups (see
      <a class="xref" href="mysql-cluster-backup-using-management-client.html" title="25.6.8.2 Using The NDB Cluster Management Client to Create a Backup">
       Section 25.6.8.2, “Using The NDB Cluster Management Client to Create a Backup”
      </a>
      );
            the password must be supplied when starting each data node
            process; otherwise the data node process cannot start. This
            is indicated by the following message in the data node log:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa57750876"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">&gt; tail <span class="token property">-n2</span> ndb_5_out<span class="token punctuation">.</span>log
2022-08-22 16<span class="token punctuation">:</span>08<span class="token punctuation">:</span>30 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> Data node configured to have encryption but password not provided
2022-08-22 16<span class="token punctuation">:</span>08<span class="token punctuation">:</span>31 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> ALERT    <span class="token property">--</span> Node 5<span class="token punctuation">:</span> Forced node shutdown completed<span class="token punctuation">.</span> Occurred during startphase 0<span class="token punctuation">.</span></code></pre>
     </div>
     <p>
      When restarted as just described, each data node clears its
            on-disk state, and rebuilds it in encrypted form.
     </p>
    </li>
   </ol>
  </div>
  <p>
   <span class="emphasis">
    <em>
     Rotation of File system password
    </em>
   </span>
   : To update
        the encryption password used by the data nodes, perform a
        rolling initial restart of the data nodes, supplying the new
        password to each data node when restarting it using
   <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_filesystem-password">
    <code class="option">
     --filesystem-password
    </code>
   </a>
   or
   <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_filesystem-password-from-stdin">
    <code class="option">
     --filesystem-password-from-stdin
    </code>
   </a>
   .
  </p>
  <p>
   <span class="emphasis">
    <em>
     Decryption of file system
    </em>
   </span>
   : To remove
        encryption from an encrypted file system, do the following:
  </p>
  <div class="orderedlist">
   <ol class="orderedlist" type="1">
    <li class="listitem">
     <p>
      In the
      <code class="literal">
       [ndbd default]
      </code>
      section of the
      <code class="filename">
       config.ini
      </code>
      file, set
      <code class="literal">
       EncryptedFileSystem = OFF
      </code>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Restart the management server with
      <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_initial">
       <code class="option">
        --initial
       </code>
      </a>
      or
      <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_reload">
       <code class="option">
        --reload
       </code>
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      Perform a rolling initial restart of the data nodes. Do
      <span class="emphasis">
       <em>
        not
       </em>
      </span>
      use any password-related options
            when restarting the node binaries.
     </p>
     <p>
      When restarted, each data node clears its on-disk state, and
            rebuilds it in unencrypted form.
     </p>
    </li>
   </ol>
  </div>
  <p>
   To see whether file system encryption is properly configured,
        you can use a query against the
   <code class="literal">
    ndbinfo
   </code>
   <a class="link" href="mysql-cluster-ndbinfo-config-values.html" title="25.6.17.12 The ndbinfo config_values Table">
    <code class="literal">
     config_values
    </code>
   </a>
   and
   <a class="link" href="mysql-cluster-ndbinfo-config-params.html" title="25.6.17.11 The ndbinfo config_params Table">
    <code class="literal">
     config_params
    </code>
   </a>
   tables similar
        to this one:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa30908465"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> v<span class="token punctuation">.</span>node_id <span class="token keyword">AS</span> Node<span class="token punctuation">,</span> p<span class="token punctuation">.</span>param_name <span class="token keyword">AS</span> Parameter<span class="token punctuation">,</span> v<span class="token punctuation">.</span>config_value <span class="token keyword">AS</span> <span class="token keyword">Value</span>
<span class="token prompt">    -&gt;</span>    <span class="token keyword">FROM</span> ndbinfo<span class="token punctuation">.</span>config_values v
<span class="token prompt">    -&gt;</span>  <span class="token keyword">JOIN</span> ndbinfo<span class="token punctuation">.</span>config_params p
<span class="token prompt">    -&gt;</span>    <span class="token keyword">ON</span> v<span class="token punctuation">.</span>config_param<span class="token operator">=</span>p<span class="token punctuation">.</span>param_number
<span class="token prompt">    -&gt;</span>  <span class="token keyword">WHERE</span> p<span class="token punctuation">.</span>param_name<span class="token operator">=</span><span class="token string">'EncryptedFileSystem'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Node <span class="token punctuation">|</span> Parameter            <span class="token punctuation">|</span> Value <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span>    5 <span class="token punctuation">|</span> EncryptedFileSystem  <span class="token punctuation">|</span> 1     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span>    6 <span class="token punctuation">|</span> EncryptedFileSystem  <span class="token punctuation">|</span> 1     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span>    7 <span class="token punctuation">|</span> EncryptedFileSystem  <span class="token punctuation">|</span> 1     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span>    8 <span class="token punctuation">|</span> EncryptedFileSystem  <span class="token punctuation">|</span> 1     <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output">4 rows in set (0.10 sec)</span></code></pre>
  </div>
  <p>
   Here,
   <a class="link" href="mysql-cluster-ndbd-definition.html#ndbparam-ndbd-encryptedfilesystem">
    <code class="literal">
     EncryptedFileSystem
    </code>
   </a>
   is
        equal to
   <code class="literal">
    1
   </code>
   on all data nodes, which means
        that filesystem encryption is enabled for this cluster.
  </p>
 </div>
 <br/>
</div>
