content_image/802863.jpg
## Providing Replication User Credentials Securely 

To supply the user credentials for the replication user, you can set them permanently as the credentials for the group_replication_recovery  channel, using a CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement. Alternatively, from MySQL 8.0.21, you can specify them on the START GROUP_REPLICATION  statement each time Group Replication is started. User credentials specified on START GROUP_REPLICATION  take precedence over any user credentials that have been set using a CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement. 

User credentials set using CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  are stored in plain text in the replication metadata repositories on the server, but user credentials specified on START GROUP_REPLICATION  are saved in memory only, and are removed by a STOP GROUP_REPLICATION statement or server shutdown. Using START GROUP_REPLICATION  to specify the user credentials therefore helps to secure the Group Replication servers against unauthorized access. However, this method is not compatible with starting Group Replication automatically, as specified by the group_replication_start_on_boot  system variable. 

If you want to set the user credentials permanently using a CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement, issue this statement on the member that is going to join the group: 

mysql> CHANGE MASTER TO MASTER_USER=’ rec_ssl_user ’, MASTER_PASSWORD=’ password ’ FOR CHANNEL ’group_replication_recovery’; Or from MySQL 8.0.23: mysql> CHANGE REPLICATION SOURCE TO SOURCE_USER=’ rec_ssl_user ’, SOURCE_PASSWORD=’ password ’ FOR CHANNEL ’group_replication_recovery’; 

To supply the user credentials on START GROUP_REPLICATION , issue this statement when starting Group Replication for the first time, or after a server restart: 

mysql> START GROUP_REPLICATION USER=’ rec_ssl_user ’, PASSWORD=’ password ’; 

<img src='content_image/802863.jpg'>

## Important 

If you switch to using START GROUP_REPLICATION  to specify user credentials on a server that previously supplied the credentials using CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO , you must complete the following steps to get the security benefits of this change. 

1. Stop Group Replication on the group member using a STOP GROUP_REPLICATION  statement. Although it is possible to take the following two steps while Group Replication is running, you need to restart Group Replication to implement the changes. 

2. Set the value of the group_replication_start_on_boot  system variable to OFF  (the default is ON ). 

3. Remove the distributed recovery credentials from the replica status tables by issuing this statement: 

mysql> CHANGE MASTER TO MASTER_USER=’’, MASTER_PASSWORD=’’ FOR CHANNEL ’group_replication_recovery’; Or from MySQL 8.0.23: mysql> CHANGE REPLICATION SOURCE TO SOURCE_USER=’’, SOURCE_PASSWORD=’’ FOR CHANNEL ’group_replication_recovery’; 

4. Restart Group Replication on the group member using a START GROUP_REPLICATION  statement that specifies the distributed recovery user credentials. 

Without these steps, the credentials remain stored in the replica status tables, and can also be transferred to other group members during remote cloning operations for distributed recovery. The 

