<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="administrative-connection-interface">
      </a>
      7.1.12.2 Administrative Connection Management
     </h4>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045260945632">
  </a>
  <p>
   As mentioned in
   <a class="xref" href="connection-interfaces.html#connection-interfaces-volume-management" title="Connection Volume Management">
    Connection Volume Management
   </a>
   , to
        allow for the need to perform administrative operations even
        when
   <a class="link" href="server-system-variables.html#sysvar_max_connections">
    <code class="literal">
     max_connections
    </code>
   </a>
   connections are already established on the interfaces used for
        ordinary connections, the MySQL server permits a single
        administrative connection to users who have the
   <a class="link" href="privileges-provided.html#priv_connection-admin">
    <code class="literal">
     CONNECTION_ADMIN
    </code>
   </a>
   privilege (or
        the deprecated
   <a class="link" href="privileges-provided.html#priv_super">
    <code class="literal">
     SUPER
    </code>
   </a>
   privilege).
  </p>
  <p>
   The server also permits dedicating a TCP/IP port for
        administrative connections, as described in the following
        sections.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="administrative-connection-interface.html#administrative-interface-characteristics" title="Administrative Interface Characteristics">
       Administrative Interface Characteristics
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="administrative-connection-interface.html#administrative-interface-encrypted-connections" title="Administrative Interface Support for Encrypted Connections">
       Administrative Interface Support for Encrypted Connections
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="administrative-interface-characteristics">
       </a>
       Administrative Interface Characteristics
      </h5>
     </div>
    </div>
   </div>
   <p>
    The administrative connection interface has these
          characteristics:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The server enables the interface only if the
       <a class="link" href="server-system-variables.html#sysvar_admin_address">
        <code class="literal">
         admin_address
        </code>
       </a>
       system
              variable is set at startup to indicate the IP address for
              it. If
       <a class="link" href="server-system-variables.html#sysvar_admin_address">
        <code class="literal">
         admin_address
        </code>
       </a>
       is
              not set, the server maintains no administrative interface.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="server-system-variables.html#sysvar_admin_port">
        <code class="literal">
         admin_port
        </code>
       </a>
       system
              variable specifies the interface TCP/IP port number
              (default 33062).
      </p>
     </li>
     <li class="listitem">
      <p>
       There is no limit on the number of administrative
              connections, but connections are permitted only for users
              who have the
       <a class="link" href="privileges-provided.html#priv_service-connection-admin">
        <code class="literal">
         SERVICE_CONNECTION_ADMIN
        </code>
       </a>
       privilege.
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="server-system-variables.html#sysvar_create_admin_listener_thread">
        <code class="literal">
         create_admin_listener_thread
        </code>
       </a>
       system variable enables DBAs to choose at startup whether
              the administrative interface has its own separate thread.
              The default is
       <code class="literal">
        OFF
       </code>
       ; that is, the
              manager thread for ordinary connections on the main
              interface also handles connections for the administrative
              interface.
      </p>
     </li>
    </ul>
   </div>
   <p>
    These lines in the server
    <code class="filename">
     my.cnf
    </code>
    file
          enable the administrative interface on the loopback interface
          and configure it to use port number 33064 (that is, a port
          different from the default):
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa77990822"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">admin_address</span><span class="token attr-value"><span class="token punctuation">=</span>127.0.0.1</span>
<span class="token constant">admin_port</span><span class="token attr-value"><span class="token punctuation">=</span>33064</span></code></pre>
   </div>
   <p>
    MySQL client programs connect to either the main or
          administrative interface by specifying appropriate connection
          parameters. If the server running on the local host is using
          the default TCP/IP port numbers of 3306 and 33062 for the main
          and administrative interfaces, these commands connect to those
          interfaces:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa35705331"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">mysql <span class="token constant">--protocol</span><span class="token attr-value"><span class="token punctuation">=</span>TCP</span> <span class="token constant">--port</span><span class="token attr-value"><span class="token punctuation">=</span>3306</span>
mysql <span class="token constant">--protocol</span><span class="token attr-value"><span class="token punctuation">=</span>TCP</span> <span class="token constant">--port</span><span class="token attr-value"><span class="token punctuation">=</span>33062</span></code></pre>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h5 class="title">
       <a name="administrative-interface-encrypted-connections">
       </a>
       Administrative Interface Support for Encrypted Connections
      </h5>
     </div>
    </div>
   </div>
   <p>
    The administrative interface has its own configuration
          parameters for encrypted connections. These correspond to the
          main interface parameters but enable independent configuration
          of encrypted connections for the administrative interface:
   </p>
   <p>
    The
    <code class="literal">
     admin_tls_
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
    </code>
    and
    <code class="literal">
     admin_ssl_
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
    </code>
    system variables are like the
    <code class="literal">
     tls_
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
    </code>
    and
    <code class="literal">
     ssl_
     <em class="replaceable">
      <code>
       xxx
      </code>
     </em>
    </code>
    system
          variables, but they configure the TLS context for the
          administrative interface rather than the main interface.
   </p>
   <p>
    For general information about configuring
          connection-encryption support, see
    <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
     Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
    </a>
    , and
    <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
     Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
    </a>
    . That
          discussion is written for the main connection interface, but
          the parameter names are similar for the administrative
          connection interface. Use that discussion together with the
          following remarks, which provide information specific to the
          administrative interface.
   </p>
   <p>
    TLS configuration for the administrative interface follows
          these rules:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The administrative interface supports encrypted
              connections. For connections on the interface, the
              applicable TLS context depends on whether any nondefault
              administrative TLS parameter is configured:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          If all administrative TLS parameters have their
                  default values, the administrative interface uses the
                  same TLS context as the main interface.
         </p>
        </li>
        <li class="listitem">
         <p>
          If any administrative TLS parameter has a nondefault
                  value, the administrative interface uses the TLS
                  context defined by its own parameters. (This is the
                  case if any
          <code class="literal">
           admin_tls_
           <em class="replaceable">
            <code>
             xxx
            </code>
           </em>
          </code>
          or
          <code class="literal">
           admin_ssl_
           <em class="replaceable">
            <code>
             xxx
            </code>
           </em>
          </code>
          system variable is set to a value different from its
                  default.) If a valid TLS context cannot be created
                  from those parameters, the administrative interface
                  falls back to the main interface TLS context.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       It is possible to disable encrypted connections to the
              administrative interface by setting the
       <a class="link" href="server-system-variables.html#sysvar_admin_tls_version">
        <code class="literal">
         admin_tls_version
        </code>
       </a>
       system
              variable to the empty value to indicate that no TLS
              versions are supported. For example, these lines in the
              server
       <code class="filename">
        my.cnf
       </code>
       file disable encrypted
              connections on the administrative interface:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa92069572"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">admin_tls_version</span><span class="token attr-value"><span class="token punctuation">=</span>''</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    Examples:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       This configuration in the server
       <code class="filename">
        my.cnf
       </code>
       file enables the
              administrative interface, but does not set any of the TLS
              parameters specific to that interface:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa75092941"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">admin_address</span><span class="token attr-value"><span class="token punctuation">=</span>127.0.0.1</span></code></pre>
      </div>
      <p>
       As a result, the administrative interface supports
              encrypted connections (because encryption is supported by
              default when the administrative interface is enabled), and
              uses the main interface TLS context. When clients connect
              to the administrative interface, they should use the same
              certificate and key files as for ordinary connections on
              the main interface. For example (enter the command on a
              single line):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa49422114"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">mysql <span class="token constant">--protocol</span><span class="token attr-value"><span class="token punctuation">=</span>TCP</span> <span class="token constant">--port</span><span class="token attr-value"><span class="token punctuation">=</span>33062</span>
      <span class="token constant">--ssl-ca</span><span class="token attr-value"><span class="token punctuation">=</span>ca.pem</span>
      <span class="token constant">--ssl-cert</span><span class="token attr-value"><span class="token punctuation">=</span>client-cert.pem</span>
      <span class="token constant">--ssl-key</span><span class="token attr-value"><span class="token punctuation">=</span>client-key.pem</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       This server configuration enables the administrative
              interface and sets the TLS certificate and key file
              parameters specific to that interface:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa97781042"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">admin_address</span><span class="token attr-value"><span class="token punctuation">=</span>127.0.0.1</span>
<span class="token constant">admin_ssl_ca</span><span class="token attr-value"><span class="token punctuation">=</span>admin-ca.pem</span>
<span class="token constant">admin_ssl_cert</span><span class="token attr-value"><span class="token punctuation">=</span>admin-server-cert.pem</span>
<span class="token constant">admin_ssl_key</span><span class="token attr-value"><span class="token punctuation">=</span>admin-server-key.pem</span></code></pre>
      </div>
      <p>
       As a result, the administrative interface supports
              encrypted connections using its own TLS context. When
              clients connect to the administrative interface, they
              should use certificate and key files specific to that
              interface. For example (enter the command on a single
              line):
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa72258547"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">mysql <span class="token constant">--protocol</span><span class="token attr-value"><span class="token punctuation">=</span>TCP</span> <span class="token constant">--port</span><span class="token attr-value"><span class="token punctuation">=</span>33062</span>
      <span class="token constant">--ssl-ca</span><span class="token attr-value"><span class="token punctuation">=</span>admin-ca.pem</span>
      <span class="token constant">--ssl-cert</span><span class="token attr-value"><span class="token punctuation">=</span>admin-client-cert.pem</span>
      <span class="token constant">--ssl-key</span><span class="token attr-value"><span class="token punctuation">=</span>admin-client-key.pem</span></code></pre>
      </div>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
