I'm using a Galera cluster between a few web servers over the WAN. I have the traffic encrypted with ipsec between the servers, but it just struck me that anyone can connect to my Galera cluster and start downloading the database.

What would be the best way to protect my self against this? Is it possible to set some sort of authentication (e.g. a password) or only allow certain IP's to join the cluster in Maria DB?

(I'm aware Galera has support for SSL, but since I already use ipsec for secure server to server communication I don't want to have the extra overhead of encrypting things twice.)

The current option I came up with is using iptables to block the port for Galera and only allow certain IP's.


You could set up a private network between your machines and bind Galera to the respective IPs, to make sure it's not reachable from the public internet.

Edit: Not sure which version you're using, but according to this, starting with 5.2.10, MariaDB includes a PAM Authentication Plugin.

  • Is that possible with ipsec? – gijs007 Jan 1 '16 at 19:24
  • @gijs007 Yes. I'm not that familiar with IPsec, but I think the tunnel mode is what you're looking for. – gf_ Jan 1 '16 at 22:22
  • A tunnel would be possible but as far as I can see it only allows tunnels from A to B. Which would make it hard to configure. Instead I've decided to use IPtables to close the port except for a few allowed IP's. the PAM module is for authentication as a MySQL user, but can't be used for Galera afaik. – gijs007 Jan 2 '16 at 20:38
  • @gijs007 If you're searching for a alternative to your IPtables solution it would be worth to check out tinc. – gf_ Jan 8 '16 at 1:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.