In addition to the explicit user/host based authentication support, the connector also includes general host-based authentication that allows client connections only from specific hosts.
Host-based authentication is not enabled in the default installation. To
enable it, create a file
authorized_hosts within the
tungsten/tungsten-connector/conf/
directory of the active installation. The connector will then need to be
restarted before host-based authentication is enabled.
The authorized_hosts file is
not automatically distributed during deployment and updates. The file
must be manually copied to other hosts.
If the content of the
authorized_hosts file is
changed, the connector configuration must be reloaded using the connector reconfigure
command for changes to take effect.
If the file exists, host-based authentication is enabled. If it is empty, all client connections are denied. The format of the file is that each line defines the host address and netmask in CIDR format. For example:
192.168.1.0/24
Enables connectivity from all hosts in the range 192.168.1.0-192.168.1.255.
Optional username(s) can be added before the host entries in order to apply restriction to a given (set of) user(s).
When no user is specified, restrictions will be applied on the given addresses for all users.
When the line starts with a username, or a comma separated list of users, then a space, then hostname(s) in CIDR format,
only the users connecting from the given IP address(es) will be accepted. Other connection attempts will be rejected
with "ERROR 1044 (42000): Authentication failed" (when SSL is disabled).
Limitations when SSL to the connector is enabled: When both bridge mode and SSL are enabled, it will NOT be possible to
use this new functionality; this limitation is due to the connector not having access to the data (including username)
being transferred between client and server, for the very reason it is encrypted. In other configurations including SSL,
and due to the way the MySQL protocol works, there is no possibility to cleanly reject SSL connections with the
"Authentication failed" error.
Denied connections will trigger an error in the SSL handshake phase, leading to error messages on the client application side
such as (depends on the client application itself): "ERROR 2026 (HY000): SSL connection error: error:00000001:lib(0):func(0):reason(1)"
or "ERROR 2013 (HY000): Lost connection to MySQL server at 'reading authorization packet', system error: 0"