Zara  Bryant

Zara Bryant


How To Configure SSL/TLS for MySQL on Ubuntu 18.04


MySQL is the most popular open-source relational database management system in the world. While modern package managers have reduced some of the friction to getting MySQL up and running, there is still some further configuration that should be performed after you install it. One of the most important aspects to spend some extra time on is security.

By default, MySQL is configured to only accept local connections, or connections that originate from the same machine where MySQL is installed. If you need to access your MySQL database from a remote location, it's important that you do so securely. In this guide, we will demonstrate how to configure MySQL on Ubuntu 18.04 to accept remote connections with SSL/TLS encryption.


To complete this guide, you will need:

  • Two Ubuntu 18.04 servers. We will use one of these servers as the MySQL server while we'll use the other as the client machine. Create a non-root user with sudo privileges and enable a firewall with ufw on each of these servers. Follow our Ubuntu 18.04 initial server setup guide to get both servers into the appropriate initial state.
  • On one of the machines, install and configure the MySQL server. Follow Steps 1 through 3 of our MySQL installation guide for Ubuntu 18.04 to do this. As you follow this guide, be sure to configure your root MySQL user to authenticate with a password, as described in Step 3 of the guide, as this is necessary to connect to MySQL using TCP rather than the local Unix socket.

Please note that throughout this guide, the server on which you installed MySQL will be referred to as the MySQL server and any commands that should be run on this machine will be shown with a blue background, like this:

Similarly, this guide will refer to the other server as the MySQL client and any commands that must be run on that machine will be shown with a red background:

Please keep these in mind as you follow along with this tutorial so as to avoid any confusion.

Step 1 — Checking MySQL's Current SSL/TLS Status

Before you make any configuration changes, you can check the current SSL/TLS status on the MySQL server instance.

Use the following command to begin a MySQL session as the root MySQL user. This command includes the -p option, which instructs mysql to prompt you for a password in order to log in. It also includes the -h option which is used to specify the host to connect to. In this case it points it to, the IPv4 loopback interface also known as localhost. This will force the client to connect with TCP instead of using the local socket file. MySQL attempts to make connections through a Unix socket file by default. This is generally faster and more secure, since these connections can only be made locally and don't have to go through all the checks and routing operations that TCP connections must perform. Connecting with TCP, however, allows us to check the SSL status of the connection:

mysql -u root -p -h

You will be prompted for the MySQL root password that you chose when you installed and configured MySQL. After entering it you'll be dropped into an interactive MySQL session.

Show the state of the SSL/TLS variables issuing the following command:

| Variable_name | Value    |
| have_openssl  | DISABLED |
| have_ssl      | DISABLED |
| ssl_ca        |          |
| ssl_capath    |          |
| ssl_cert      |          |
| ssl_cipher    |          |
| ssl_crl       |          |
| ssl_crlpath   |          |
| ssl_key       |          |
9 rows in set (0.01 sec)

The have_openssl and have_ssl variables are both marked as DISABLED. This means that SSL functionality has been compiled into the server, but that it is not yet enabled.

Check the status of your current connection to confirm this:


mysql Ver 14.14 Distrib 5.7.26, for Linux (x86_64) using EditLine wrapper

Connection id: 9
Current database:
Current user: root@localhost
SSL: Not in use
Current pager: stdout
Using outfile: ‘’
Using delimiter: ;
Server version: 5.7.26-0ubuntu0.18.04.1 (Ubuntu)
Protocol version: 10
Connection: via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 40 min 11 sec

Threads: 1 Questions: 33 Slow queries: 0 Opens: 113 Flush tables: 1 Open tables: 106 Queries per second avg: 0.013

As the above output indicates, SSL is not currently in use for this connection, even though you’re connected over TCP.

Close the current MySQL session when you are finished:


Now that you’ve confirmed your MySQL server isn’t using SSL, you can move on to the next step where you will begin the process of enabling SSL by generating some certificates and keys. These will allow your server and client to communicate with one another securely.

Step 2 — Generating SSL/TLS Certificates and Keys

To enable SSL connections to MySQL, you first need to generate the appropriate certificate and key files. MySQL versions 5.7 and above provide a utility called mysql_ssl_rsa_setup that helps simplify this process. The version of MySQL you installed by following the prerequisite MySQL tutorial includes this utility, so we will use it here to generate the necessary files.

The MySQL process must be able to read the generated files, so use the –uid option to declare mysql as the system user that should own the generated files:

sudo mysql_ssl_rsa_setup --uid=mysql

This will produce output that looks similar to the following:

Generating a 2048 bit RSA private key
writing new private key to ‘ca-key.pem’

Generating a 2048 bit RSA private key
writing new private key to ‘server-key.pem’

Generating a 2048 bit RSA private key
writing new private key to ‘client-key.pem’

These new files will be stored in MySQL’s data directory, located by default at /var/lib/mysql. Check the generated files by typing:

sudo find /var/lib/mysql -name ‘*.pem’ -ls
258930 4 -rw-r–r-- 1 mysql mysql 1107 May 3 16:43 /var/lib/mysql/client-cert.pem
258919 4 -rw-r–r-- 1 mysql mysql 451 May 3 16:43 /var/lib/mysql/public_key.pem
258925 4 -rw------- 1 mysql mysql 1675 May 3 16:43 /var/lib/mysql/server-key.pem
258927 4 -rw-r–r-- 1 mysql mysql 1107 May 3 16:43 /var/lib/mysql/server-cert.pem
258922 4 -rw------- 1 mysql mysql 1675 May 3 16:43 /var/lib/mysql/ca-key.pem
258928 4 -rw------- 1 mysql mysql 1675 May 3 16:43 /var/lib/mysql/client-key.pem
258924 4 -rw-r–r-- 1 mysql mysql 1107 May 3 16:43 /var/lib/mysql/ca.pem
258918 4 -rw------- 1 mysql mysql 1679 May 3 16:43 /var/lib/mysql/private_key.pem

These files are the key and certificate pairs for the certificate authority (starting with “ca”), the MySQL server process (starting with “server”), and for MySQL clients (starting with “client”). Additionally, the private_key.pem and public_key.pem files are used by MySQL to securely transfer passwords when not using SSL.

Now that you have the necessary certificate and key files, continue on to enable the use of SSL on your MySQL instance.

Step 3 — Enabling SSL Connections on the MySQL Server

Modern versions of MySQL look for the appropriate certificate files within the MySQL data directory whenever the server starts. Because of this, you won’t need to modify MySQL’s configuration to enable SSL.

Instead, enable SSL by restarting the MySQL service:

sudo systemctl restart mysql

After restarting, open up a new MySQL session using the same command as before. The MySQL client will automatically attempt to connect using SSL if it is supported by the server:

mysql -u root -p -h

Let’s take another look at the same information we requested last time. Check the values of the SSL-related variables:

| Variable_name | Value |
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | ca.pem |
| ssl_capath | |
| ssl_cert | server-cert.pem |
| ssl_cipher | |
| ssl_crl | |
| ssl_crlpath | |
| ssl_key | server-key.pem |
9 rows in set (0.00 sec)

The have_openssl and have_ssl variables now read YES instead of DISABLED. Furthermore, the ssl_ca, ssl_cert, and ssl_key variables have been populated with the names of the respective files that we just generated.

Next, check the connection details again:


. . .
SSL: Cipher in use is DHE-RSA-AES256-SHA
. . .
Connection: via TCP/IP
. . .

This time, the specific SSL cipher is displayed, indicating that SSL is being used to secure the connection.

Exit back out to the shell:


Your server is now capable of using encryption, but some additional configuration is required to allow remote access and mandate the use of secure connections.

Step 4 — Configuring Secure Connections for Remote Clients

Now that you’ve enabled SSL on the MySQL server, you can begin configuring secure remote access. To do this, you’ll configure your MySQL server to require that any remote connections be made over SSL, bind MySQL to listen on a public interface, and adjust your system’s firewall rules to allow external connections

Currently, the MySQL server is configured to accept SSL connections from clients. However, it will still allow unencrypted connections if requested by the client. We can change this by turning on the require_secure_transport option. This requires all connections to be made either with SSL or with a local Unix socket. Since Unix sockets are only accessible from within the server itself, the only connection option available to remote users will be with SSL.

To enable this setting, open the MySQL configuration file in your preferred text editor. Here, we’ll use nano:

sudo nano /etc/mysql/my.cnf

Inside there will be two !includedir directives which are used to source additional configuration files. You must add your own configuration beneath these lines so that it overrides any conflicting settings found in these additional configuration files.

Start by creating a [mysqld] section to target the MySQL server process. Under that section header, set require_secure_transport to ON, which will force MySQL to only allow secure connections:


. . .

!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/


Require clients to connect either using SSL

or through a local socket file

require_secure_transport = ON

By default, MySQL is configured to only listen for connections that originate from, the loopback IP address that represents localhost. This means that MySQL is configured to only listen for connections that originate from the machine on which the MySQL server is installed.

In order to allow MySQL to listen for external connections, you must configure it to listen for connections on an external IP address. To do this, you can add the bind-address setting and point it to, a wildcard IP address that represents all IP addresses. Essentially, this will force MySQL to listen for connections on every interface:


. . .

!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/


Require clients to connect either using SSL

or through a local socket file

require_secure_transport = ON
bind-address =

Note: You could alternatively set bind-address to your MySQL server’s public IP address. However, you would need to remember to update your my.cnf file if you ever migrate your database to another machine.

After adding these lines, save and close the file. If you used nano to edit the file, you can do so by pressing CTRL+X, Y, then ENTER.

Next, restart MySQL to apply the new settings:

sudo systemctl restart mysql

Verify that MySQL is listening on instead of by typing:

sudo netstat -plunt

The output of this command will look like this:


Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0* LISTEN 13317/mysqld
tcp 0 0* LISTEN 1293/sshd
tcp6 0 0 :::22 :::* LISTEN 1293/sshd

The highlighted in the above output indicates that MySQL is listening for connections on all available interfaces.

Next, allow MySQL connections through your server’s firewall. Add an exception to your ufw rules by typing:

sudo ufw allow mysql
Rule added
Rule added (v6)

With that, remote connection attempts are now able to reach your MySQL server. However, you don’t currently have any users configured that can connect from a remote machine. We’ll create and configure a MySQL user that can connect from your client machine in the next step.

Step 5 — Creating a Dedicated MySQL User

At this point, your MySQL server will reject any attempt to connect from a remote client machine. This is because the existing MySQL users are all only configured to connect locally from the MySQL server. To resolve this, you will create a dedicated user that will only be able to connect from your client machine.

To create such a user, log back into MySQL as the root user:

mysql -u root -p

From the prompt, create a new remote user with the CREATE USER command. You can name this user whatever you’d like, but in this guide we name it mysql_user. Be sure to specify your client machine’s IP address in the host portion of the user specification to restrict connections to that machine and to replace password with a secure password of your choosing. Also, for some redundancy in case the require_secure_transport option is turned off in the future, specify that this user requires SSL by including the REQUIRE SSL clause, as shown here:

CREATE USER ‘mysql_user’@‘your_mysql_client_IP’ IDENTIFIED BY ‘password’ REQUIRE SSL;

Next, grant the new user permissions on whichever databases or tables that they should have access to. To demonstrate, create an example database:


Then give your new user access to this database and all of its tables:

GRANT ALL ON example.* TO ‘mysql_user’@‘your_mysql_client_IP’;

Next, flush the privileges to apply those settings immediately:


Then exit back out to the shell when you are done:


Your MySQL server is now set up to allow connections from your remote user. To test that you can connect to MySQL successfully, you will need to install the mysql-client package on the MySQL client.

Log in to your client machine with ssh

ssh sammy@your_mysql_client_ip

Then update the client machine’s package index:

sudo apt update

And install mysql-client with the following command:

sudo apt install mysql-client

When prompted, confirm the installation by pressing ENTER.

Once APT finishes installing the package, run the following command to test whether you can connect to the server successfully. This command includes the -u user option to specify mysql_user and the -h option to specify the MySQL server’s IP address:

mysql -u mysql_user -p -h your_mysql_server_IP

After submitting the password, you will be logged in to the remote server. Use \s to check the server’s status and confirm that your connection is secure:


. . .
SSL: Cipher in use is DHE-RSA-AES256-SHA
. . .
Connection: your_mysql_server_IP via TCP/IP
. . .

Exit back out to the shell:


You’ve confirmed that you’re able to connect to MySQL over SSL. However, you’ve not yet confirmed that the MySQL server is rejecting insecure connections. To test this, try connecting once more, but this time append –ssl-mode=disabled to the login command. This will instruct mysql-client to attempt an unencrypted connection:

mysql -u mysql_user -p -h mysql_server_IP --ssl-mode=disabled

After entering your password when prompted, your connection will be refused:

ERROR 1045 (28000): Access denied for user ‘mysql_user’@‘mysql_server_IP’ (using password: YES)

This shows that SSL connections are permitted while unencrypted connections are refused.

At this point, your MySQL server has been configured to accept secure remote connections. You can stop here if this satisfies your security requirements, but there are some additional pieces that you can put into place to enhance security and trust between your two servers.

Step 6 — (Optional) Configuring Validation for MySQL Connections

Currently, your MySQL server is configured with an SSL certificate signed by a locally generated certificate authority (CA). The server’s certificate and key pair are enough to provide encryption for incoming connections.

However, you aren’t yet fully leveraging the trust relationship that a certificate authority can provide. By distributing the CA certificate to clients — as well as the client certificate and key — both parties can provide proof that their certificates were signed by a mutually trusted certificate authority. This can help prevent spoofed connections from malicious servers.

In order to implement this extra, optional safeguard, we will transfer the appropriate SSL files to the client machine, create a client configuration file, and alter the remote MySQL user to require a trusted certificate.

Note: The process for transferring the CA certificate, client certificate, and client key to the MySQL client outlined in the following paragraphs involves displaying each file’s contents with cat, copying those contents to your clipboard, and pasting them in to a new file on the client machine. While it is possible to copy these files directly with a program like scp or sftp, this also requires you to set up SSH keys for both servers so as to allow them to communicate over SSH.

Our goal here is to keep the number of potential avenues for connecting to your MySQL server down to a minimum. While this process is slightly more laborious than directly transferring the files, it is equally secure and doesn’t require you to open an SSH connection between the two machines.

Begin by making a directory on the MySQL client in the home directory of your non-root user. Call this directory client-ssl:

mkdir ~/client-ssl

Because the certificate key is sensitive, lock down access to this directory so that only the current user can access it:

chmod 700 ~/client-ssl

On the MySQL server, display the contents of the CA certificate by typing:

sudo cat /var/lib/mysql/ca.pem

. . .


Copy the entire output, including the BEGIN CERTIFICATE and END CERTIFICATE lines, to your clipboard.

On the MySQL client, create a file with the same name inside the new directory:

nano ~/client-ssl/ca.pem

Inside, paste the copied certificate contents from your clipboard. Save and close the file when you are finished.

Next, display the client certificate on the MySQL server:

sudo cat /var/lib/mysql/client-cert.pem

. . .


Copy the file contents to your clipboard. Again, remember to include the first and last line.

Open a file with the same name on the MySQL client within the client-ssl directory:

nano ~/client-ssl/client-cert.pem

Paste the contents from your clipboard. Save and close the file.

Finally, display the contents of the client key file on the MySQL server:

sudo cat /var/lib/mysql/client-key.pem

. . .


Copy the displayed contents, including the first and last line, to your clipboard.

On the MySQL client, open a file with the same name in the client-ssl directory:

nano ~/client-ssl/client-key.pem

Paste the contents from your clipboard. Save and close the file.

The client machine now has all of the credentials required to access the MySQL server. However, the MySQL server is still not set up to require trusted certificates for client connections.

To change this, log in to the MySQL root account again on the MySQL server:

mysql -u root -p

From here, change the security requirements for your remote user. Instead of the REQUIRE SSL clause, apply the REQUIRE X509 clause. This implies all of the security provided by the REQUIRE SSL clause, but additionally requires the connecting client to present a certificate signed by a certificate authority that the MySQL server trusts.

To adjust the user requirements, use the ALTER USER command:

ALTER USER ‘mysql_user’@‘mysql_client_IP’ REQUIRE X509;

Then flush the changes to ensure that they are applied immediately:


Exit back out to the shell when you are finished:


Following that, check whether you can validate both parties when you connect.

On the MySQL client, first try to connect without providing the client certificates:

mysql -u mysql_user -p -h mysql_server_IP
ERROR 1045 (28000): Access denied for user ‘mysql_user’@‘mysql_client_IP’ (using password: YES)

As expected, the server rejects the connection when no client certificate is presented.

Now, connect while using the –ssl-ca, –ssl-cert, and –ssl-key options to point to the relevant files within the ~/client-ssl directory:

mysql -u mysql_user -p -h mysql_server_IP --ssl-ca=~/client-ssl/ca.pem --ssl-cert=~/client-ssl/client-cert.pem --ssl-key=~/client-ssl/client-key.pem

You’ve provided the client with the appropriate certificates and keys, so this attempt will be successful:

Log back out to regain access to your shell session:


Now that you’ve confirmed access to the server, let’s implement a small usability improvement in order to avoid having to specify the certificate files each time you connect.

Inside your home directory on the MySQL client machine, create a hidden configuration file called ~/.my.cnf:

nano ~/.my.cnf

At the top of the file, create a section called [client]. Underneath, add the ssl-ca, ssl-cert, and ssl-key options and point them to the respective files you copied over from the server. It will look like this:


ssl-ca = ~/client-ssl/ca.pem
ssl-cert = ~/client-ssl/client-cert.pem
ssl-key = ~/client-ssl/client-key.pem

The ssl-ca option tells the client to verify that the certificate presented by the MySQL server is signed by the certificate authority you pointed to. This allows the client to trust that it is connecting to a trusted MySQL server. Likewise, the ssl-cert and ssl-key options point to the files needed to prove to the MySQL server that it too has a certificate that has been signed by the same certificate authority. You’ll need this if you want the MySQL server to verify that the client was trusted by the CA as well.

Save and close the file when you are finished.

Now, you can connect to the MySQL server without adding the –ssl-ca, –ssl-cert, and –ssl-key options on the command line:

mysql -u remote_user -p -h mysql_server_ip

Your client and server will now each be presenting certificates when negotiating the connection. Each party is configured to verify the remote certificate against the CA certificate it has locally.


Your MySQL server is now configured to require secure connections from remote clients. Additionally, if you followed the steps to validate connections using the certificate authority, some level of trust is established by both sides that the remote party is legitimate. 

Thanks for reading

If you liked this post, share it with all of your programming buddies!

Follow us on Facebook | Twitter

Learn More

The Complete SQL Bootcamp

The Ultimate MySQL Bootcamp: Go from SQL Beginner to Expert

The Complete Oracle SQL Certification Course

MySQL Databases With Python Tutorial

SQL vs NoSQL or MySQL vs MongoDB

MySQL Database Tutorial for Beginners to Advanced Part 1/2

An Introduction to Queries in MySQL

How To Troubleshoot MySQL Queries?

SQL with MySQL - Complete Tutorial for Beginners

Build a Basic CRUD App with PHP and MySQL

Originally published on

#mysql #ubuntu #security #database

What is GEEK

Buddha Community

How To Configure SSL/TLS for MySQL on Ubuntu 18.04
Joe  Hoppe

Joe Hoppe


Best MySQL DigitalOcean Performance – ScaleGrid vs. DigitalOcean Managed Databases

HTML to Markdown

MySQL is the all-time number one open source database in the world, and a staple in RDBMS space. DigitalOcean is quickly building its reputation as the developers cloud by providing an affordable, flexible and easy to use cloud platform for developers to work with. MySQL on DigitalOcean is a natural fit, but what’s the best way to deploy your cloud database? In this post, we are going to compare the top two providers, DigitalOcean Managed Databases for MySQL vs. ScaleGrid MySQL hosting on DigitalOcean.

At a glance – TLDR
ScaleGrid Blog - At a glance overview - 1st pointCompare Throughput
ScaleGrid averages almost 40% higher throughput over DigitalOcean for MySQL, with up to 46% higher throughput in write-intensive workloads. Read now

ScaleGrid Blog - At a glance overview - 2nd pointCompare Latency
On average, ScaleGrid achieves almost 30% lower latency over DigitalOcean for the same deployment configurations. Read now

ScaleGrid Blog - At a glance overview - 3rd pointCompare Pricing
ScaleGrid provides 30% more storage on average vs. DigitalOcean for MySQL at the same affordable price. Read now

MySQL DigitalOcean Performance Benchmark
In this benchmark, we compare equivalent plan sizes between ScaleGrid MySQL on DigitalOcean and DigitalOcean Managed Databases for MySQL. We are going to use a common, popular plan size using the below configurations for this performance benchmark:

Comparison Overview
ScaleGridDigitalOceanInstance TypeMedium: 4 vCPUsMedium: 4 vCPUsMySQL Version8. TypeStandaloneStandaloneRegionSF03SF03SupportIncludedBusiness-level support included with account sizes over $500/monthMonthly Price$120$120

As you can see above, ScaleGrid and DigitalOcean offer the same plan configurations across this plan size, apart from SSD where ScaleGrid provides over 20% more storage for the same price.

To ensure the most accurate results in our performance tests, we run the benchmark four times for each comparison to find the average performance across throughput and latency over read-intensive workloads, balanced workloads, and write-intensive workloads.

In this benchmark, we measure MySQL throughput in terms of queries per second (QPS) to measure our query efficiency. To quickly summarize the results, we display read-intensive, write-intensive and balanced workload averages below for 150 threads for ScaleGrid vs. DigitalOcean MySQL:

ScaleGrid MySQL vs DigitalOcean Managed Databases - Throughput Performance Graph

For the common 150 thread comparison, ScaleGrid averages almost 40% higher throughput over DigitalOcean for MySQL, with up to 46% higher throughput in write-intensive workloads.

#cloud #database #developer #digital ocean #mysql #performance #scalegrid #95th percentile latency #balanced workloads #developers cloud #digitalocean droplet #digitalocean managed databases #digitalocean performance #digitalocean pricing #higher throughput #latency benchmark #lower latency #mysql benchmark setup #mysql client threads #mysql configuration #mysql digitalocean #mysql latency #mysql on digitalocean #mysql throughput #performance benchmark #queries per second #read-intensive #scalegrid mysql #scalegrid vs. digitalocean #throughput benchmark #write-intensive

Myriam  Rogahn

Myriam Rogahn


How to Secure phpMyAdmin Access with Apache on Ubuntu 18.04

How to secure PHPMyAdmin login access in ubuntu apache on aws. Here, we will show you a simple 2 solution to secure PHPMyAdmin login in ubuntu apache on aws web server.

The first solution is to change the PHPMyAdmin login URL. And the second solution is add an extra security layer for access PHPMyAdmin login url in ubuntu 18.04 apache 2 on aws. And prevent the attacks.

Because by default, phpmyadmin login url is located on http:///phpmyadmin. So, The main reason of change phpmyadmin login url in ubuntu apache aws server to prevent attackers attack.

How to Secure phpMyAdmin with Apache 2 on Ubuntu 18.04

Now, you can see the following two solutions to secure PHPMyAdmin login access in ubuntu apache 2 on aws server.

Solution 1 – Change PhpMyAdmin Login Page URL in Apache 2 Ubuntu

In ubuntu, default phpmyadmin login url can be located at apache configuration that name apache.conf.

So, you can use sudo nano /etc/phpmyadmin/apache.conf command to open apache.conf file:

sudo nano /etc/phpmyadmin/apache.conf

Then, you can add the following line with your phpmyadmin url:

Alias /my-phpmyadmin /usr/share/phpmyadmin

Note that, you can replace my-phpmyadmin to your own word.

Now you need to restart apache 2 web server. So type the following command on your ssh terminal to restart apache service:

sudo service apache2 restart

Solution 2 – Secure PHPMyAdmin Access in ubuntu aws

Now, you can add extra security layer for access phpmyadmin login in ubuntu apache 2 on aws web server.

So, first of all, you need to create a password file with users using the htpasswd tool that comes with the Apache package. So open your ssh terminal and type the following command:

sudo htpasswd -c /etc/phpmyadmin/.htpasswd

Note that, You can choose any username instance of myAdmin with above command.

After that, one prompt box appear with password and confirm password. So, you can add password and confirm password here.

New password:
Re-type new password:
Adding password for user myAdmin

Now, you need to configure Apache 2 to password protect the phpMyAdmin directory and use the .htpasswd file.

So, open your ssh terminal and type the below command to open the phpmyadmin.conf file.

sudo nano /etc/apache2/conf-available/phpmyadmin.conf

Then add the following lines in phpmyadmin.conf file and save it:

Options  +FollowSymLinks +Multiviews +Indexes  ## edit this line
DirectoryIndex index.php

AllowOverride None
AuthType basic
AuthName "Authentication Required"
AuthUserFile /etc/phpmyadmin/.htpasswd
Require valid-user

Finally, restart apache web server by using the following command:

sudo service apache2 restart

#aws #mysql #ubuntu #how to change and secure default phpmyadmin login url ubuntu #how to change phpmyadmin login url ubuntu 18.04 #how to secure phpmyadmin access #how to secure phpmyadmin access with apache on ubuntu 18.04

Alisha  Larkin

Alisha Larkin


Configure PMM2 For Azure MySQL Database With SSL

Registering AzureDB without SSL in PMM

If you are registering a normal MySQL database you will run the below command & it will be registered.
server_name=MyProdDB1pmm-admin add mysql --username=$monitoruser --password=$monitorpwd --host=$server --service-name=$server_name --query-source=perfschema


DB connectivity with SSL

As per the link provided below you can download the generic certificate to connect to the Azure database. Using that you can connect to MySQL even with verify_ca mode too.

Successful connection with SSL
mysql --user=$monitoruser --password=$monitorpwd --host=$serverUnsuccessful connection with verify ca SSLmysql --user=$monitoruser --password=$monitorpwd --host=$server --ssl-mode=VERIFY_CA
ERROR 2026 (HY000): SSL connection error: CA certificate is required if ssl-mode is VERIFY_CA or VERIFY_IDENTITYSuccessful connection with verify ca SSL
mysql --user=$monitoruser --password=$monitorpwd --host=$server --ssl-mode=VERIFY_CA --ssl-ca=azure-ca.crt


Error Registering SSL DB

For SSL you need to supply the parameter -tls, however, that also throws an error.

Error trying to connect without SSL
pmm-admin add mysql --username=$monitoruser --password=$monitorpwd --host=$server --service-name=$server_name --query-source=perfschemaConnection check failed: Error 9002: SSL connection is required. Please specify SSL options and retry..Error trying to connect with SSL
pmm-admin add mysql --username=$monitoruser --password=$monitorpwd --host=$server --service-name=$server_name --query-source=perfschema -tlsTLS is on. You must also define tls-ca, tls-cert and tls-key flags.Error trying to connect with SSL & azure provided certificate
pmm-admin add mysql --username=$monitoruser --password=$monitorpwd --host=$server --service-name=$server_name --query-source=perfschema -tls --tls-ca=azure-ca.crtTLS is on. You must also define tls-ca, tls-cert and tls-key flags.


Generate new SSL

Based on the bug raised, I found that we need SSL client key & client certificate generated separately. I used the below command to generate new files. I have highlighted the one I used later.

mysql_ssl_rsa_setup --datadir ssl/
ls ssl/
-rw------- 1 nirav nirav 1679 Jun 17 14:52 ca-key.pem
-rw-r--r-- 1 nirav nirav 1107 Jun 17 14:52 ca.pem
-rw-r--r-- 1 nirav nirav 1107 Jun 17 14:52 client-cert.pem
-rw------- 1 nirav nirav 1679 Jun 17 14:52 client-key.pem
-rw------- 1 nirav nirav 1675 Jun 17 14:52 private_key.pem
-rw-r--r-- 1 nirav nirav  451 Jun 17 14:52 public_key.pem
-rw-r--r-- 1 nirav nirav 1107 Jun 17 14:52 server-cert.pem
-rw------- 1 nirav nirav 1679 Jun 17 14:52 server-key.pem

#azure mysql #ssl #azure #mysql #configure #azure mysql database with ssl

Alycia  Klein

Alycia Klein


How To Install Jenkins on Ubuntu 20.04 / Ubuntu 18.04

Jenkins is an open-source automation server that helps to automate the repetitive tasks involved in the software development process, which includes building, testing, and deployments.

Jenkins was forked from the Oracle Hudson project and written in Java.

Here, we will see how to install Jenkins on Ubuntu 20.04 / Ubuntu 18.04.

Install Jenkins On Ubuntu 20.04

Install Java

Since Jenkins is written in Java, it requires Java 8 or Java 11 to run. Here, I will install the OpenJDK 11 for Jenkins installation.

sudo apt update

sudo apt install -y default-jre apt-transport-https wget

If you want to use the Oracle Java in place of OpenJDK, then use any one of the links to install it.

READ: How To Install Oracle Java on Ubuntu 20.04

READ: How To Install Oracle Java on Ubuntu 18.04

Verify the Java version after the installation.

java -version


openjdk version "11.0.8" 2020-07-14
OpenJDK Runtime Environment (build 11.0.8+10-post-Ubuntu-0ubuntu120.04)
OpenJDK 64-Bit Server VM (build 11.0.8+10-post-Ubuntu-0ubuntu120.04, mixed mode, sharing)

Add Jenkins Repository

Jenkins provides an official repository for its packages. To use the Jenkins repository, first, we will need to add the Jenkins public key to the system.

wget -q -O - | sudo apt-key add -

Then, add the Jenkins repository to your system.

echo "deb binary/" | sudo tee /etc/apt/sources.list.d/jenkins.list

Install Jenkins

Install Jenkins package using the apt command.

sudo apt update

sudo apt install -y jenkins

The Jenkins service should now be up and running. You can check the status of the Jenkins service using the below command.

sudo systemctl status jenkins

#ubuntu #jenkins #ubuntu 18.04 #ubuntu 20.04

Linux Tutorial


How To Install Nvidia Drivers On Ubuntu 20.04 / Ubuntu 18.04 | ITzGeek

All Desktops and Laptops come with a graphics card for displaying images over a monitor. Graphics cards either come with a system board or attached to the system board via a PCI-E slot. Nvidia and AMD manufactured graphics cards are the most commonly used graphics cards in laptops or desktops.

Here, we will see how to install Nvidia drivers on Ubuntu 20.04/Ubuntu 18.04.

#ubuntu #nvidia #ubuntu 18.04 #ubuntu 20.04