MySQL Server – Ajustar la autenticación y los privilegios del usuario

Para las instalaciones recientes, querrá ejecutar el script de seguridad que viene incluido. Esto cambia algunas de las opciones predeterminadas menos seguras para cosas como inicios de sesión root remotos y usuarios de ejemplo. Para las versiones antiguas de MySQL, también deberá inicializar el directorio de datos manualmente, pero ahora esto se hace automáticamente.

Sigue leyendo

WARNING : Failed to connect to lvmetad. Falling back to device scanning

At boot time, the following message can pop up :

WARNING : Failed to connect to lvmetad. Falling back to device scanning

This message is displayed, whether running Debian stable or Debian testing.

To get rid of this message, disable lvmetad in /etc/lvm/lvm.conf


Update the initramfs for the current kernel your system uses :

update-initramfs -k $(uname -r) -u; sync

Reboot your system and you’re done !


Ubuntu 17.10 network configuration is completely changed. Have you heard of NetPlan? Probably not, but if you have, then you’re a step ahead of many. NetPlan is a new network configuration tool introduced in Ubuntu 17.10 to manage network settings.

It can be used by writing a simple YAML description of the required network interfaces with what they should be configured to do; and it will generate the required configuration for a chosen renderer tool. Sigue leyendo

Cómo proteger a Apache con Let’s Encrypt en Ubuntu 16.04


Este tutorial le mostrará cómo configurar un certificado TLS / SSL de Let's Encrypt en un servidor Ubuntu 16.04 que ejecute Apache como un servidor web. También cubriremos cómo automatizar el proceso de renovación de certificados.

Los certificados SSL se utilizan en los servidores web para cifrar el tráfico entre el servidor y el cliente, proporcionando seguridad adicional a los usuarios que acceden a su aplicación. Let's Encrypt proporciona una forma sencilla de obtener e instalar certificados de confianza de forma gratuita. Sigue leyendo

How To Configure SSL/TLS for MySQL on Ubuntu 16.04


MySQL is the most popular open-source relational database management system in the world. Modern package managers have reduced some of the friction to getting MySQL up and running, but there is still some configuration that should be done after installation. One of the most important areas to spend some extra time on is security.

By default, MySQL is configured to only accept local connections. If you need to allow remote connections, it is important to do so securely. In this guide, we will demonstrate how to configure MySQL on Ubuntu 16.04 to accept remote connections with SSL/TLS encryption.


To follow along with this guide, you will need two Ubuntu 16.04 servers. We will use one as the MySQL server and the other as the client. Create a non-root user with sudo privileges on each of these servers. Follow our Ubuntu 16.04 initial server setup guide to get your server into the appropriate initial state.

On the first machine, you should have the MySQL server installed and configured. Follow our MySQL installation guide for Ubuntu 16.04 to install and configure the software.

On the second machine, install the MySQL client package. You can update the apt package index and install the necessary software by typing:

  • sudo apt-get update
  • sudo apt-get install mysql-client

When your server and client are ready, continue below.

Check the Current SSL/TLS Status

Before we begin, we can check the current status of SSL/TLS on our MySQL server instance.

Log into a MySQL session using the root MySQL user. We'll use -h to specify the IPv4 local loopback interface in order to force the client to connect with TCP instead of using the local socket file. This will allow us to check the SSL status for TCP connections:

  • mysql -u root -p -h

You will be prompted for the MySQL root password that you selected during the installation process. Afterward, you will be dropped into an interactive MySQL session.

Show the state of the SSL/TLS variables by typing:

| Variable_name | Value    |
| have_openssl  | DISABLED |
| have_ssl      | DISABLED |
| ssl_ca        |          |
| ssl_capath    |          |
| ssl_cert      |          |
| ssl_cipher    |          |
| ssl_crl       |          |
| ssl_crlpath   |          |
| ssl_key       |          |
9 rows in set (0.01 sec)

The have_openssl and have_ssl variables are both marked as DISABLED. This means that SSL functionality has been compiled into the server, but that it is not yet enabled.

Check the status of our current connection to confirm:

  • \s
mysql  Ver 14.14 Distrib 5.7.17, for Linux (x86_64) using  EditLine wrapper

Connection id:      30
Current database:   
Current user:       root@localhost
SSL:         Not in use
Current pager:      stdout
Using outfile:      ''
Using delimiter:    ;
Server version:     5.7.17-0ubuntu0.16.04.1 (Ubuntu)
Protocol version:   10
Connection: via TCP/IP
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    utf8
Conn.  characterset:    utf8
TCP port:       3306
Uptime:         3 hours 38 min 44 sec

Threads: 1  Questions: 70  Slow queries: 0  Opens: 121  Flush tables: 1  Open tables: 40  Queries per second avg: 0.005

As the above output indicates, SSL is not currently in use for our connection, even though we are connected over TCP.

Close the current MySQL session when you are finished:

  • exit

Now we can start configuring MySQL for SSL to secure our connections.

Generate SSL/TLS Certificates and Keys

To enable SSL connections to MySQL, we first need to generate the appropriate certificate and key files. A utility called mysql_ssl_rsa_setup is provided with MySQL 5.7 and above to simplify this process. Ubuntu 16.04 has a compatible version of MySQL, so we can use this command to generate the necessary files.

The files will be created in MySQL's data directory, located at /var/lib/mysql. We need the MySQL process to be able to read the generated files, so we will pass mysql as the user that should own the generated files:

  • sudo mysql_ssl_rsa_setup --uid=mysql

The generation will produce output that looks something like this:

Generating a 2048 bit RSA private key
writing new private key to 'ca-key.pem'
Generating a 2048 bit RSA private key
writing new private key to 'server-key.pem'
Generating a 2048 bit RSA private key
writing new private key to 'client-key.pem'

Check the generated files by typing:

  • sudo find /var/lib/mysql -name '*.pem' -ls
   256740      4 -rw-r--r--   1 mysql    mysql        1078 Mar 17 17:24 /var/lib/mysql/server-cert.pem
   256735      4 -rw-------   1 mysql    mysql        1675 Mar 17 17:24 /var/lib/mysqlsql/ca-key.pem<^>
   256739      4 -rw-r--r--   1 mysql    mysql         451 Mar 17 17:24 /var/lib/mysqlsql/public_key.pem<^>
   256741      4 -rw-------   1 mysql    mysql        1679 Mar 17 17:24 /var/lib/mysqlsql/client-key.pem<^>
   256737      4 -rw-r--r--   1 mysql    mysql        1074 Mar 17 17:24 /var/lib/mysqlsql/ca.pem<^>
   256743      4 -rw-r--r--   1 mysql    mysql        1078 Mar 17 17:24 /var/lib/mysqlsql/client-cert.pem<^>
   256736      4 -rw-------   1 mysql    mysql        1675 Mar 17 17:24 /var/lib/mysqlsql/private_key.pem<^>
   256738      4 -rw-------   1 mysql    mysql        1675 Mar 17 17:24 /var/lib/mysqlsql/server-key.pem<^>

The last column shows the generated filenames. The central columns that show "mysql" indicate that the generated files have the correct user and group ownership.

These files are the key and certificate pairs for the certificate authority (starting with "ca"), the MySQL server process (starting with "server"), and for MySQL clients (starting with "client"). Additionally, the private_key.pem and public_key.pem files are used by MySQL to securely transfer password when not using SSL.

Enable SSL Connections on the MySQL Server

Modern MySQL versions will look for the appropriate certificate files within the MySQL data directory when the server starts. Because of this, we don't actually need to modify the MySQL configuration to enable SSL.

We can just restart the MySQL service instead:

  • sudo systemctl restart mysql

After restarting, open up a new MySQL session using the same command as before. The MySQL client will automatically attempt to connect using SSL if it is supported by the server:

  • mysql -u root -p -h

Let's take a look at the same information we requested last time. Check the values of the SSL related variables:

| Variable_name | Value           |
| have_openssl  | YES             |
| have_ssl      | YES             |
| ssl_ca        | ca.pem          |
| ssl_capath    |                 |
| ssl_cert      | server-cert.pem |
| ssl_cipher    |                 |
| ssl_crl       |                 |
| ssl_crlpath   |                 |
| ssl_key       | server-key.pem  |
9 rows in set (0.00 sec)

The have_openssl and have_ssl variables read "YES" instead of "DISABLED" this time. Furthermore, the ssl_ca, ssl_cert, and ssl_key variables have been populated with the names of the relevant certificates that we generated.

Next, check the connection details again:

  • \s
. . .
SSL:            Cipher in use is DHE-RSA-AES256-SHA
. . .
Connection: via TCP/IP
. . .

This time, the specific SSL cipher is displayed, indicating that SSL is being used to secure our connection.

Exit back out to the shell:

  • exit

Our server is now capable of using encryption, but some additional configuration is required to allow remote access and mandate use of secure connections.

Configuring Secure Connections for Remote Clients

Now that we have SSL available on the server, we can begin configuring secure remote access. To do this, we need to:

  • Require SSL for remote connections
  • Bind to a public interface
  • Create MySQL user for remote connections
  • Adjust our firewall rules to allow external connections

Configure Remote Access with Mandatory SSL

Currently, the MySQL server is configured to accept SSL connections from clients. However, it will still allow unencrypted connections if requested by the client.

We can fix this by turning on the require_secure_transport option. This requires all connections to be made either with SSL or with a local Unix socket. Since Unix sockets are only accessible from within the server itself, the only connection option open to remote users will be with SSL.

To enable this setting, open the /etc/mysql/my.cnf file in your text editor:

  • sudo nano /etc/mysql/my.cnf

Inside, there will be two !includedir directives used to source additional configuration files. We will need to put our own configuration beneath these lines so that they override any conflicting settings.

Start by creating a [mysqld] section to target the MySQL server process. Under that section header, set require_secure_transport to ON:

. . .

!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/

# Require clients to connect either using SSL
# or through a local socket file
require_secure_transport = ON

That line is the only setting required to enforce secure connections.

By default MySQL is configured to only listen for connections originating on the local computer. To configure it to listen for remote connections, we can set the bind-address to a different interface.

To allow MySQL to accept connections on any of its interfaces, we can set bind-address to "":

. . .

!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/

# Require clients to connect either using SSL
# or through a local socket file
require_secure_transport = ON
bind-address =

Save and close the file when you are finished.

Next, restart MySQL to apply the new settings:

  • sudo systemctl restart mysql

Verify that MySQL is listening on "" instead of "" by typing:

  • sudo netstat -plunt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0  *               LISTEN      4330/mysqld     
tcp        0      0    *               LISTEN      1874/sshd       
tcp6       0      0 :::22                   :::*                    LISTEN      1874/sshd

The "" in the above output indicates that MySQL is listening for connections on all available interfaces.

Next, we need to allow MySQL connections through our firewall. Create an exception by typing:

  • sudo ufw allow mysql
Rule added
Rule added (v6)

Remote connection attempts should now be able to reach our MySQL server.

Configure a Remote MySQL User

The MySQL server is now listening for remote connections, but we currently don't have any users configured that can connect from an outside computer.

Log into MySQL as the root user to get started:

  • mysql -u root -p

Inside, you can create a new remote user using the CREATE USER command. We will use our client machine's IP address in the host portion of the user specification to restrict connections to that machine.

For some redundancy in case the require_secure_transport option is turned off in the future, we'll also specify during account creation that this user requires SSL by including the REQUIRE SSL clause:

  • CREATE USER 'remote_user'@'mysql_client_IP' IDENTIFIED BY 'password' REQUIRE SSL;

Next, grant the new user permissions on the databases or tables they should have access to. To demonstrate, we'll create an example database and give our new user ownership:

  • CREATE DATABASE example;
  • GRANT ALL ON example.* TO 'remote_user'@'mysql_client_IP';

Next, flush the privileges to apply those settings immediately:


Exit back out to the shell when you are done:

  • exit

Our server is set up to allow connections to our remote user.

Testing Remote Connections

On the MySQL client machine, test to make sure you can connect to the server successfully. Use the -uoption to specify the remote user and the -h option to specify the MySQL server's IP address:

  • mysql -u remote_user -p -h mysql_server_IP

After specifying the password, you will be logged in to the remote server.

Check to make sure that your connection is secure:

  • \s
. . .
SSL:         Cipher in use is DHE-RSA-AES256-SHA
. . .
Connection:      mysql_server_IP via TCP/IP
. . .

Exit back out to the shell:

  • exit

Next, attempt to connect insecurely:

  • mysql -u remote_user -p -h mysql_server_IP --ssl-mode=disabled

After being prompted for your password, your connection should be refused:

ERROR 1045 (28000): Access denied for user 'remote_user'@'mysql_server_IP' (using password: YES)

This is what we were working towards. It shows that SSL connections are permitted, while unencrypted connections are refused.

At this point, our MySQL server has been configured to accept remote connections securely. You can stop here if this satisfies your security requirements, but there are some additional pieces that we can put into place to increase our security and trust further.

Configuring Validation for MySQL Connections (Optional)

Currently, our MySQL server is configured with an SSL certificate signed by a locally generated certificate authority (CA). The server's certificate and key pair are enough to provide encryption for incoming connections.

However, we aren't currently leveraging the trust relationship that a certificate authority can provide. By distributing the CA certificate to clients, as well as the client certificate and key, both parties can provide proof that their certificates were signed by a mutually trusted certificate authority. This can help prevent spoofed connections to malicious servers.

In order to implement this extra, optional safeguard, we will need to:

  • Transfer the appropriate SSL files to the client machine
  • Create a client configuration file
  • Alter our remote user to require a trusted certificate

Transfer the Client Certificates to the Client Machine

To start, we need to grab the MySQL CA and client certificate files from the MySQL server and place them on the MySQL client.

Begin by making a directory on the MySQL client in the home directory of the user you will use to connect. Call this client-ssl:

  • mkdir ~/client-ssl

Since the certificate key is sensitive, we should lock down access to this directory so that only the current user can access it:

  • chmod 700 ~/client-ssl

Now, we can copy the certificate information to the new directory.

On the MySQL server machine, display the contents of the CA certificate by typing:

  • sudo cat /var/lib/mysql/ca.pem

. . .


Copy the entire output, including the BEGIN CERTIFICATE and END CERTIFICATE lines to your clipboard.

On the MySQL client, create a file with the same name inside the new directory:

  • nano ~/client-ssl/ca.pem

Inside, paste the copied certificate contents from your clipboard. Save and close the file when you are finished.

Next, display the client certificate on the MySQL server:

  • sudo cat /var/lib/mysql/client-cert.pem

. . .


Again, copy the contents to your clipboard. Remember to include the first and last line.

Open a file with the same name on the MySQL client within the client-ssl directory:

  • nano ~/client-ssl/client-cert.pem

Paste the contents from your clipboard. Save and close the file.

Finally, display the contents of the client key file on the MySQL server:

  • sudo cat /var/lib/mysql/client-key.pem

. . .


Copy the displayed contents, including the first and last line, to your clipboard.

On the MySQL client, open a file with the same name in the client-ssl directory:

  • nano ~/client-ssl/client-key.pem

Paste the contents from your clipboard. Save and close the file.

The client machine should now have all of the credentials required to access the MySQL server. Next, we need to alter our remote user.

Require a Certificate from a Trusted CA for the Remote User

Currently, the MySQL client has the files available to present its certificate to the server when connecting. However, the server is still not set up to require the client certificate from a trusted CA.

To change this, log into the MySQL root account again on the MySQL server:

  • mysql -u root -p

Next, we need to change the requirements for our remote user. Instead of the REQUIRE SSL clause, we need to apply the REQUIRE X509 clause. This implies all of the security provided by the previous requirement, but additionally requires the connecting client to present a certificate signed by a certificate authority that the MySQL server trusts.

To adjust the user requirements, use the ALTER USER command:

  • ALTER USER 'remote_user'@'mysql_client_IP' REQUIRE X509;

Flush the changes to ensure that they are applied immediately:


Exit back out to the shell when you are finished:

  • exit

Next, we can test to make sure we can still connect.

Test Certificate Validation When Connecting

Now is a good time to check whether we can validate both parties when we connect.

On the MySQL client, first try to connect without providing the client certificates:

  • mysql -u remote_user -p -h mysql_server_IP
ERROR 1045 (28000): Access denied for user 'remote_user'@'mysql_client_IP' (using password: YES)

Without providing the client certificate, the server rejects the connection.

Now, connect while using the --ssl-ca, --ssl-cert, and --ssl-key options to point to the relevant files within the ~/client-ssl directory:

  • mysql -u remote_user -p -h mysql_server_IP --ssl-ca=~/client-ssl/ca.pem --ssl-cert=~/client-ssl/client-cert.pem --ssl-key=~/client-ssl/client-key.pem

You should be logged in successfully. Log back out to regain access to your shell session:

  • exit

Now that we've confirmed access to the server, we can implement a small usability improvement.

Create a MySQL Client Configuration File

To avoid having to specify the certificate files each time you connect, we can create a simple MySQL client configuration file.

Inside your home directory on the MySQL client machine, create a hidden file called ~/.my.cnf:

  • nano ~/.my.cnf

At the top of the file, create a section called [client]. Underneath, we can set the ssl-ca, ssl-cert, and ssl-key options to point to the files we copied over from the server. It should look like this:

ssl-ca = ~/client-ssl/ca.pem
ssl-cert = ~/client-ssl/client-cert.pem
ssl-key = ~/client-ssl/client-key.pem

The ssl-ca option tells the client to verify that the certificate presented by the MySQL server is signed by the certificate authority we pointed to. This allows the client to trust that it is connecting to a trusted MySQL server.

The ssl-cert and ssl-key options point to the files required to prove to the MySQL server that it too has a certificate that has been signed by the same certificate authority. We need this if we want the MySQL server to verify that the client was trusted by the CA as well.

Save and close the file when you are finished.

Now, you can connect to the MySQL server without adding the --ssl-ca, --ssl-cert, and --ssl-key options on the command line:

  • mysql -u remote_user -p -h mysql_server_ip

Your client and server should now each be presenting certificates when negotiating the connection. Each party is configured to verify the remote certificate against the CA certificate it has locally.


Your MySQL server should now be configured to require secured connections for remote clients. Additionally, if you followed the steps to validate connections using the certificate authority, some level of trust is established by both sides that the remote party is legitimate.

Cómo crear un certificado SSL auto-firmado para Apache en Ubuntu 16.04


TLS o seguridad de capa de transporte, y su predecesor SSL , que representa la capa de sockets seguros, son protocolos web usados ​​para envolver el tráfico normal en un contenedor protegido y encriptado.

Utilizando esta tecnología, los servidores pueden enviar tráfico de forma segura entre el servidor y los clientes sin la posibilidad de que los mensajes sean interceptados por terceros. El sistema de certificados también ayuda a los usuarios a verificar la identidad de los sitios con los que se conectan.

En esta guía, le mostraremos cómo configurar un certificado SSL autofirmado para su uso con un servidor web Apache en un servidor Ubuntu 16.04.

Nota: Un certificado autofirmado cifrará la comunicación entre su servidor y cualquier cliente. Sin embargo, debido a que no está firmado por ninguna de las autoridades de certificados de confianza incluidas en los exploradores web, los usuarios no pueden utilizar el certificado para validar la identidad de su servidor de forma automática.

Un certificado autofirmado puede ser apropiado si no tiene un nombre de dominio asociado con su servidor y para instancias en las que la interfaz web cifrada no es orientada al usuario. Si hacer tener un nombre de dominio, en muchos casos, es mejor utilizar un certificado firmado. Puede averiguar cómo configurar un certificado de confianza gratuito con el proyecto Let's Encrypt aquí .

Sigue leyendo

Configurar Gmail en Outlook, en Apple Mail o en otros clientes de correo electrónico

Puedes descargarte mensajes de Gmail y verlos con otro programa (Microsoft Outlook, Apple Mail, Thunderbird, etc.) aunque no estés conectado a Internet. Este procedimiento se conoce como POP o IMAP, y es gratuito para todos los usuarios de Gmail.

Consejo: Te recomendamos que uses IMAP siempre que sea posible, pues te garantiza que puedas ver todo tu correo cuando quieras y en todos tus dispositivos. Si prefieres utilizar POP, lee las instrucciones para habilitar POP.

Paso 1: Habilita IMAP

Puedes recuperar tus mensajes de Gmail a través de un cliente o dispositivo que sea compatible con el acceso IMAP, como son Microsoft Outlook y Apple Mail.

Inicia sesión en Gmail.
Haz clic en el icono de la rueda dentada de la esquina superior derecha y selecciona Configuración.
Haz clic en Reenvío y correo POP/IMAP.
Selecciona Habilitar IMAP.
Haz clic en Guardar cambios.
Nota: Este ajuste no está disponible si tienes activada la vista básica en HTML de Gmail. Para habilitar IMAP, tienes que utilizar la vista estándar. Más información sobre la vista estándar y la vista básica en HTML

Paso 2: Configura tu cliente

Consulta la tabla siguiente para configurar tu cliente de correo.

Servidor de correo entrante (IMAP):

Requiere SSL: sí

Puerto: 993

Servidor de correo saliente (SMTP):

Utilizar autenticación:

Puerto para SSL: 465 o 587

Utilizar la misma configuración que para el servidor de correo entrante

Nombre completo o Nombre para mostrar: [tu nombre]
Nombre de cuenta o Nombre de usuario: tu dirección de correo electrónico completa (incluido o
Dirección de correo electrónico: tu dirección de correo electrónico completa (incluido o
Contraseña: tu contraseña de Gmail

Inspeccionando la cola de correos sin entregar en Postfix

Por defecto se reintenta la entrega de los correos cada 5 minutos y se descartan (generando un correo de advertencia al remitente) si no ha podido hacerse transcurridos cinco días del envío. Podemos variar estos valores introduciendo los siguientes parámetros en el fichero de configuración principal (/etc/postfix/

queue_run_delay = 600
maximal_queue_lifetime = 1d

Existen más parámetros relacionados con esta directiva en este enlace del manual de postfix.

Podemos inspeccionar la cola de postfix para ver que mensajes no ha podido entregar y la causa de ello en cualquier momento usando los comandos mailq o postqueue -p (ambos son equivalentes y proporcionan la misma salida aunque mailq es un comando mucho más flexible y potente con más opciones).

8A5E9E9225A 1708097 Mon Mar 7 22:40:01
(host[] refused to talk to me: 554 : HOSTING RELAY : d9OoamSM5zzCi : DED : You've rea
ched your daily relay quota - 67309 Mon Mar 7 17:55:15
(host[] refused to talk to me: 554 HOSTING RELAY : d9JyaxC4eLF21 : DED : You've reach
ed your daily relay quota -

el identificador del mensaje que nos permite ver mucha más información acerca del mismo, su estado y su contenido usando el comando postcat -vq seguido de dicho identificador. Por ejemplo, para inspeccionar el primer mensaje de la cola de aquí arriba:

postcat -vq A3C3486137

También podemos decirle en cualquier momento a postfix que reprocese esos mensajes mediante los comandos postqueue -f o postfix flush. O podemos pedirle que reintente sólo uno de los mensajes de la cola usando el identificador que ya conocemos así:

postqueue -i A3C3486137

Por último, para eliminar todos los mensajes en espera de entrega que están en la cola podemos usar el siguiente comando:

postsuper -d ALL deferred

Ten en cuenta que, en este caso, los mensajes serán eliminados sin que el remitente reciba ningún tipo de notificación de que no ha podido realizarse la entrega.

El siguiente comando elimina de la cola de correos el mensaje especificado.

postsuper -d D8D24E923E4