I normally do not endorse any one specific product, but in this case I will make an exception.

I have personally evaluated a product called Gazzang. It can encrypt data in such a way that when transported to another server, the data is unreadable unless the encryption key is copied and verified on that external server. I have tried this and copied /var/lib/mysql on another server that did not have the encryption key. The only SQL command that worked with the database encrypted is SHOW DATABASES;. Nothing else worked.

There are some hoops to jump through to get an entire /var/lib/mysql folder encrypted. Once done, you never have to worry about data encryption. Perhaps you could start like this:

• Installation MySQL on a DB Server
• Apply Gazzang's ezncrypt program against the empty /var/lib/mysql
• Load a mysqldump into it

The beautiful part of my evaluation was that the MySQL data was fully accessible by standard DB Connections. Gazzang does not shield normal access protocols. You must take up responsibility for securing passwords:

• June 6, 2012 : Limiting database security
• Feb 17, 2012 : MySQL : Why are there "test" entries in mysql.db?
• Feb 17, 2012 : What is the mysql.db table used for?
• Jan 19, 2012 : MySQL error: Access denied for user 'a'@'localhost' (using password: YES)
• Sep 28, 2011 : Weird MySQL Users Been Created (eg. bug115166_10073) and not by me
• Sep 11, 2011 : Is this a normal set of MySQL privileges?

EPILOGUE

As for the physical data itself, this worked during the 30-day evaluation. Please evaluate it for yourself. I will leave it to you to investigate production case studies on Gazzang.

UPDATE 2015-09-29 12:26 EDT

Cloudera purchased and deprecated Gazzang.

Cloudera Data Encryption is still available.

Encryption at rest can't address server breaches, it is only intended to mitigate cases of

• physical data storage theft, and
• data access by unauthorised people, e.g. cloud technicians.

MariaDB encryption wouldn't be able effectively deal with either, because stealing the drives would effectively provide root access to the system, including access to the encryption keys and complete unrestricted access to the database. This is also the case with cloud technicians, who can access backup copies of the system or peer into the filesystem by analysing the underlying datastore. MariaDB encryption can minimise the risk of intrusion, however in order to access the drive or mysql files, the attacker would have to have either root or at least mysql user privileges, and would access not only the files but also the encryption keys in that case.

A good way to ensure encryption at rest is using dm-crypt (or equivalent) to have the OS encrypting the partition where the database files are located, and entering the password manually by an authorised operator at system or RDBMS startup time (i.e. no keys stored in the system at all). This system is not particularly effective against server breaches, but it makes the data completely secure in case of physical storage theft, or access to system backups or underlying datastores.