MariaDB uses encryption at rest to secure data stored in tables, tablespaces, and logs. The steps below outline how you can set up encryption in MariaDB.
But before proceeding, note that setting up encryption in MariaDB requires a running instance of MariaDB 10.1.4 or later version.
1. Firstly, open my.cnf file for editing:
```
sudo nano /etc/mysql/my.cnf
```
Add the following lines under the [mysqld] section:
```
[mysqld]
…
plugin_load_add=file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile.enc #Specify the path to the encryption key file
file_key_management_filekey = FILE:/etc/mysql/encryption/keyfile.key #Specify the path to the key that will be used to encrypt the key file
file_key_management_encryption_algorithm=aes_cbc #Specify the encryption algorithm that will be used
```
Close and save the file when you are finished.
1. Now, create keyfile.enc and keyfile.key:
```
sudo mkdir /etc/mysql/encryption
sudo dd if=/dev/urandom of=/etc/mysql/encryption/keyfile.enc bs=1 count=32
sudo chmod 400 /etc/mysql/encryption/keyfile.enc
openssl rand -hex 16 > /etc/mysql/encryption/keyfile.key
sudo chmod 400 /etc/mysql/encryption/keyfile.key
```
1. Next, restart MariaDB to apply the changes:
```
sudo systemctl restart mariadb
```
1. Verify that MariaDB is correctly configured and that encryption is enabled. Log in to MariaDB shell and execute this command:
```
SHOW GLOBAL VARIABLES LIKE ‘file_key_management%’;
```
You will see a table that confirms the encryption configuration.
1. Finally ensure that MariaDB is correctly decrypting the tables, and check the encryption status of a table using this command:
```
SHOW CREATE TABLE yourtablename;
```
Replace `yourtablename` with the name of the table.
Be sure to take all necessary precautions when dealing with encryption, such as secure storage and backups of keys. It’s also worth to remember that performance may be impacted when encrypting a database.
Remember, only a person with root access to the server can configure encryption, so ensure that you’ve the required administration privileges before you begin setting it up.
