Prerequisites
To use the Securosys MariaDB encryption plugin, you need:
- A Securosys Primus HSM or CloudHSM
- A Transaction Security Broker (TSB) instance (to provide the REST API)
- In CloudHSM, Securosys manages the TSB for you, for on-premise Primus HSMs you can host the TSB yourself.
- A server to run MariaDB on
- With installed dependencies, as specified in
BUILDINFO.txt
- With installed dependencies, as specified in
Version Overview
When downloading the Securosys MariaDB encryption plugin, you need to choose the correct artifact. This is because the plugin is specific to the operating system and MariaDB family and version. If they don't match, the plugin will fail to load.
The release artifacts are named securosys-key-management-<target>-<plugin_version>.zip.
| Target | MariaDB | Operating System |
|---|---|---|
debian12-10.11, debian12-11.4, debian12-11.8, debian12-12.3 | Community: 10.11, 11.4, 11.8, 12.3 Enterprise: 11.4, 11.8, 12.3 | Debian 12, Ubuntu 24.04 |
debian13-11.8, debian13-12.3 | Community: 11.8, 12.3 | Debian 13, Ubuntu 26.04 |
rhel8-10.11, rhel8-11.4, rhel8-11.8, rhel8-12.3 | Community: 10.11, 11.4, 11.8, 12.3 Enterprise: 11.4, 11.8, 12.3 | RHEL 8, Rocky 8 |
ubi9-10.11, ubi9-11.4, ubi9-11.8, ubi9-12.3 | Community: 10.11, 11.4, 11.8, 12.3 Enterprise: 11.4, 11.8, 12.3 | RHEL 9, Rocky 9, UBI 9 |
ubi10-10.11, ubi10-11.4, ubi10-11.8, ubi10-12.3 | Community: 10.11, 11.4, 11.8, 12.3 Enterprise: 11.4, 11.8, 12.3 | RHEL 10, Rocky 10, UBI 10 |
The Community edition versions in bold are the ones that are pre-packaged by the respective distributions. Other MariaDB versions also work, but need to be installed manually.
For a given plugin .so file, you use the following command to check what target it was build for:
$ strings securosys_key_management.so | grep SECUROSYS_BUILD
SECUROSYS_BUILD target=debian12-10.11 version=1.0.0 mariadb=1:10.11.19+maria~deb12 commit=7597f8c
Each plugin .so file links against the glibc and libstdc++ of the OS it was built for.
A Debian-built plugin will not load in a RHEL/UBI container, and vice-versa.
Match the base OS of the container or host that runs mariadbd, not the one you build or deploy from.
Using Docker
If you are running MariaDB in a Docker environment, you will need to:
- Build a Docker image that installs the Securosys plugin and its dependencies.
- Add the required configuration files, either in the image or as file mounts.
For more details, see this blog post.