<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="group-replication-distributed-recovery-securing">
      </a>
      20.6.3 Securing Distributed Recovery Connections
     </h3>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="group-replication-secure-user.html">
       20.6.3.1 Secure User Credentials for Distributed Recovery
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="group-replication-configuring-ssl-for-recovery.html">
       20.6.3.2 Secure Socket Layer (SSL) Connections for Distributed Recovery
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    When using the MySQL communication stack
        (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
     <code class="literal">
      group_replication_communication_stack=MYSQL
     </code>
    </a>
    )
        AND secure connections between members
        (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
     <code class="literal">
      group_replication_ssl_mode
     </code>
    </a>
    is
        not set to
    <code class="literal">
     DISABLED
    </code>
    ), the security settings
        discussed in this section are applied not just to distributed
        recovery connections, but to group communications between
        members in general.
   </p>
  </div>
  <p>
   When a member joins the group, distributed recovery is carried out
      using a combination of a remote cloning operation, if available
      and appropriate, and an asynchronous replication connection. For a
      full description of distributed recovery, see
   <a class="xref" href="group-replication-distributed-recovery.html" title="20.5.4 Distributed Recovery">
    Section 20.5.4, “Distributed Recovery”
   </a>
   .
  </p>
  <p>
   Group members offer their standard SQL client connection to
      joining members for distributed recovery, as specified by MySQL
      Server's
   <a class="link" href="server-system-variables.html#sysvar_hostname">
    <code class="literal">
     hostname
    </code>
   </a>
   and
   <a class="link" href="server-system-variables.html#sysvar_port">
    <code class="literal">
     port
    </code>
   </a>
   system variables, and may
      (also) advertise an alternative list of distributed recovery
      endpoints as dedicated client connections for joining members. For
      more details, see
   <a class="xref" href="group-replication-distributed-recovery-connections.html" title="20.5.4.1 Connections for Distributed Recovery">
    Section 20.5.4.1, “Connections for Distributed Recovery”
   </a>
   .
      Notice that such connections offered to a joining member for
      distributed recovery is
   <span class="emphasis">
    <em>
     not
    </em>
   </span>
   the same
      connections that are used by Group Replication for communication
      between online members when the XCom communication stack is used
      for group communications
      (
   <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
    <code class="literal">
     group_replication_communication_stack=XCOM
    </code>
   </a>
   ).
  </p>
  <p>
   To secure distributed recovery connections in the group, ensure
      that user credentials for the replication user are properly
      secured, and use SSL for distributed recovery connections if
      possible.
  </p>
 </div>
 <br/>
</div>
