MySQL 8.4 Release Notes
为了防止对存储在复制源服务器和副本之间传输的数据的未经授权访问，应为涉及的所有服务器设置与您在安装的任何 MySQL 实例中选择的安全措施相同的安全措施，如第 8 章 安全性所述。此外，对于复制拓扑中的服务器，应考虑实施以下安全措施：To protect against unauthorized access to data that is stored on and transferred between replication source servers and replicas, set up all the servers involved using the security measures that you would choose for any MySQL instance in your installation, as described in Chapter 8, Security. In addition, for servers in a replication topology, consider implementing the following security measures:
设置源和副本以使用加密连接传输二进制日志，从而保护传输中的数据。必须使用
CHANGE REPLICATION SOURCE TO语句激活这些连接的加密，同时设置服务器以支持加密的网络连接。请参阅第 19.3.1 节，“设置复制以使用加密连接”。Set up sources and replicas to use encrypted connections to transfer the binary log, which protects this data in motion. Encryption for these connections must be activated using aCHANGE REPLICATION SOURCE TOstatement, in addition to setting up the servers to support encrypted network connections. See Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”.对源服务器和副本的二进制日志文件及中继日志文件进行加密，这可以保护静态数据，以及二进制日志缓存中使用的任何数据。二进制日志加密可通过
binlog_encryption系统变量启用。请参阅 第 19.3.2 节，“加密二进制日志文件和中继日志文件”。Encrypt the binary log files and relay log files on sources and replicas, which protects this data at rest, and also any data in use in the binary log cache. Binary log encryption is activated using thebinlog_encryptionsystem variable. See Section 19.3.2, “Encrypting Binary Log Files and Relay Log Files”.对复制应用程序执行权限检查，这有助于保护复制通道免受未授权或意外使用的特权或不需要操作的影响。权限检查是通过设置一个
PRIVILEGE_CHECKS_USER账户来实现的，MySQL 使用该账户来验证您是否已授权该通道的每个特定事务。请参见 第 19.3.3 节，“复制权限检查”。Apply privilege checks to replication appliers, which help to secure replication channels against the unauthorized or accidental use of privileged or unwanted operations. Privilege checks are implemented by setting up aPRIVILEGE_CHECKS_USERaccount, which MySQL uses to verify that you have authorized each specific transaction for that channel. See Section 19.3.3, “Replication Privilege Checks”.
对于组复制，可以在复制组成员上使用二进制日志加密和权限检查作为安全措施。您还应该考虑加密组成员之间的连接，包括组通信连接和分布式恢复连接，并应用 IP 地址允许列表以排除不受信任的主机。有关针对组复制的这些安全措施的信息，请参见第 20.6 节，“组复制安全”。For Group Replication, binary log encryption and privilege checks can be used as a security measure on replication group members. You should also consider encrypting the connections between group members, comprising group communication connections and distributed recovery connections, and applying IP address allowlisting to exclude untrusted hosts. For information on these security measures specific to Group Replication, see Section 20.6, “Group Replication Security”.