Securing MariaDB: Data-at-Rest Encryption and Reliable Backups

Goals

Encrypt data-at-rest to protect against stolen disks and ensure backups are encrypted and restorable.

TDE via Filesystem

If MariaDB doesn't support native TDE in your build, prefer encrypting the filesystem (LUKS) for the data directory and secure key management.

Encrypted Offsite Backups

Use restic or duplicity to create encrypted backups and push to S3-compatible storage:

# initialize restic repository
restic init -r s3:s3.amazonaws.com/mybucket
# backup mysql dump
mysqldump -u root -p mydb > /tmp/mydb.sql
restic -r s3:s3.amazonaws.com/mybucket backup /tmp/mydb.sql