码迷,mamicode.com
首页 > 数据库 > 详细

Linux运维 第四阶段(八)MySQL REPLICATION(SSL)

时间:2015-12-25 17:25:53      阅读:421      评论:0      收藏:0      [点我收藏+]

标签:mysql   linux运维   

Linux运维 第四阶段(八)MySQLREPLICATIONSSL

 

一、准备:

mysql replicationssl加密方式传输)

mysql-5.5.45-linux2.6-i686.tar.gz(通用二进制格式包)

node,一主一从

masternode1:192.168.41.131,既是CA又是master

slavenode2:192.168.41.132

环境:

[root@node1 ~]# uname -a

Linux node1.magedu.com 2.6.18-308.el5 #1SMP Fri Jan 27 17:21:15 EST 2012 i686 i686 i386 GNU/Linux

注意:masterslave的私钥及证书要同名(本例中两端均为mysql.keymysql.crt,要在两端各自生成),否则无法使用ssl传输

 

二、操作:

1、在masterslave上安装mysql

node{1,2}-side

[root@node1 ~]# mkdir /mydata/data -pv(生产环境最好将数据目录放在LVM中)

[root@node1 ~]# useradd -r mysql

[root@node1 ~]# chown -R mysql.mysql/mydata/data/

[root@node1 ~]# tar xf mysql-5.5.45-linux2.6-i686.tar.gz -C /usr/local/

[root@node1 ~]# cd /usr/local/

[root@node1 local]# ln -sv mysql-5.5.45-linux2.6-i686/ mysql

[root@node1 local]# ll

……

lrwxrwxrwx 1 root root    27 Dec 18 23:13mysql -> mysql-5.5.45-linux2.6-i686/

……

[root@node1 mysql]# chown -R root.mysql ./

[root@node1 mysql]# ll

……

[root@node1 mysql]#scripts/mysql_install_db --user=mysql --datadir=/mydata/data

[root@node1 mysql]# cp support-files/my-large.cnf /etc/my.cnf

[root@node1 mysql]# cp support-files/mysql.server /etc/init.d/mysqld

[root@node1 mysql]# chkconfig --add mysqld

[root@node1 mysql]# chkconfig mysqld on

[root@node1 mysql]# chkconfig --list mysqld

mysqld            0:off 1:off 2:on 3:on 4:on 5:on 6:off

[root@node1 mysql]# vim /etc/profile.d/mysql.sh

export PATH=$PATH:/usr/local/mysql/bin

[root@node1 mysql]# . !$

 

2、在master上(生成ca私钥及颁发ca自签证书;并签署颁发mysql-master的证书)

node1-side

[root@node1 mysql]# mkdir ssl/

[root@node1 mysql]# cd ssl

[root@node1 ssl]# vim /etc/pki/tls/openssl.cnf

[ CA_default ]

dir     = /etc/pki/CA

[root@node1 ssl]# cd /etc/pki/CA

 

[root@node1 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)(生成ca私钥)

Generating RSA private key, 2048 bit longmodulus

................+++

...........................................................................................................+++

e is 65537 (0x10001)

 

[root@node1 CA]# ll private/

total 8

-rw------- 1 root root 1679 Dec 19 06:51cakey.pem

 

[root@node1 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem(颁发ca自签证书,注意server’shostname

Country Name (2 letter code) [GB]:CN

State or Province Name (full name)[Berkshire]:SH

Locality Name (eg, city) [Newbury]:SH

Organization Name (eg, company) [My CompanyLtd]:itownet

Organizational Unit Name (eg, section)[]:TECH

Common Name (eg, your name or your server‘shostname) []:ca.magedu.com   

Email Address []:ca@magedu.com

 

[root@node1 CA]# touch index.txt

[root@node1 CA]# echo 01 > serial

[root@node1 CA]# ll

total 52

-rw-r--r-- 1 root root 1586 Dec 19 06:54cacert.pem

drwxr-xr-x 2 root root 4096 Dec 19 02:14certs

drwxr-xr-x 2 root root 4096 Dec 19 02:14crl

-rw-r--r-- 1 root root    0 Dec 19 06:55 index.txt

drwxr-xr-x 2 root root 4096 Dec 19 04:29newcerts

drwx------ 2 root root 4096 Dec 19 06:51private

-rw-r--r-- 1 root root    3 Dec 19 06:55 serial

 

[root@node1 CA]# cd /usr/local/mysql/ssl

[root@node1 ssl]# (umask 077;openssl genrsa -out mysql.key 1024)(生成master端的私钥)

Generating RSA private key, 1024 bit longmodulus

....++++++

...............................................................................++++++

e is 65537 (0x10001)

[root@node1 ssl]# openssl req -new -key mysql.key -out mysql.csr(生成master的证书签署请求certificate signature request,注意server’s hostname一定不能与slave端的重名)

……

Country Name (2 letter code) [GB]:CN

State or Province Name (full name)[Berkshire]:SH

Locality Name (eg, city) [Newbury]:SH

Organization Name (eg, company) [My CompanyLtd]:itownet

Organizational Unit Name (eg, section)[]:TECH

Common Name (eg, your name or your server‘shostname) []:master.magedu.com

Email Address []:master@magedu.com

Please enter the following ‘extra‘attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

 

[root@node1 ssl]# openssl ca -in mysql.csr -out mysql.crt -days 365(为master颁发证书)

……

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified,commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

 

[root@node1 ssl]# cp /etc/pki/CA/cacert.pem./

[root@node1 ssl]# chown -R mysql.mysql ./

[root@node1 ssl]# ll

total 32

-rw-r--r-- 1 mysql mysql 1586 Dec 19 07:10 cacert.pem

-rw-r--r-- 1 mysql mysql 3830 Dec 19 07:08mysql.crt

-rw-r--r-- 1 mysql mysql  692 Dec 19 07:03 mysql.csr

-rw------- 1 mysql mysql  887 Dec 19 07:02 mysql.key

 

3、在slave上(生成私钥及slave的证书签署请求,传至ca端签署)

node2-side

[root@node2 ~]# mkdir /usr/local/mysql/ssl

[root@node2 ~]# cd !$

cd /usr/local/mysql/ssl

[root@node2 ssl]# (umask 077;openssl genrsa -out mysql.key 1024)(私钥)

Generating RSA private key, 1024 bit longmodulus

................................++++++

..++++++

e is 65537 (0x10001)

[root@node2 ssl]# openssl req -new -key mysql.key -out mysql.csr(证书签署请求,注意server’s hostname

……

Country Name (2 letter code) [GB]:CN

State or Province Name (full name)[Berkshire]:SH

Locality Name (eg, city) [Newbury]:SH

Organization Name (eg, company) [My CompanyLtd]:itownet

Organizational Unit Name (eg, section)[]:TECH

Common Name (eg, your name or your server‘shostname) []:slave.magedu.com

Email Address []:slave@magedu.com

Please enter the following ‘extra‘attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

 

[root@node2 ssl]# scp mysql.csrnode1:/root/

mysql.csr                                      100%  692     0.7KB/s  00:00 

 

node1-side:(在主上签署请求,并将颁发给slave的证书及ca自签证书一同传给slave

[root@node1 ssl]# cd

[root@node1 ~]# openssl ca -in mysql.csr -out mysql.crt -days 365(在主上给予签署)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified,commit? [y/n]y

[root@node1 ~]# scp mysql.crt  node2:/usr/local/mysql/ssl/

mysql.crt                                       100% 3824     3.7KB/s  00:00   

[root@node1 ~]# scp /etc/pki/CA/cacert.pem  node2:/usr/local/mysql/ssl/

cacert.pem                                      100%1586     1.6KB/s   00:00

 

node2-side

[root@node2 ssl]# chown -R mysql.mysql ./

[root@node2 ssl]# ll

total 32

-rw-r--r-- 1 mysql mysql 1586 Dec 19 07:23cacert.pem

-rw-r--r-- 1 mysql mysql 3824 Dec 19 07:23mysql.crt

-rw-r--r-- 1 mysql mysql  692 Dec 19 07:17 mysql.csr

-rw------- 1 mysql mysql  891 Dec 19 07:16 mysql.key

 

4、编辑masterslave的配置文件,并启动服务:

node1-side

[root@node1 ~]# vim /etc/my.cnf

[mysqld]

log-bin = mysql-bin

log-bin-index = mysql-bin.index

server-id = 1(注意主从不能一样,MySQL集群内唯一,范围12^32-1

datadir = /mydata/data

ssl(表示开启ssl

ssl_ca = /usr/local/mysql/ssl/cacert.pem

ssl_cert = /usr/local/mysql/ssl/mysql.crt

ssl_key = /usr/local/mysql/ssl/mysql.key

innodb_file_per_table = 1

[root@node1 ~]# service mysqld start

Starting MySQL..                                          [  OK  ]

 

node2-side:(中继日志必须开,可以不开启二进制日志)

[mysqld]

relay-log = relay-log

relay-log-index = relay-log.index

server-id = 11

datadir = /mydata/data

ssl

ssl_ca = /usr/local/mysql/ssl/cacert.pem

ssl_cert = /usr/local/mysql/ssl/mysql.crt

ssl_key = /usr/local/mysql/ssl/mysql.key

innodb_file_per_table = 1

[root@node2 ~]# service mysqld start

Starting MySQL..                                          [  OK  ]

 

5、在主端授权(复制仅能通过ssl传输复制),在从端连接到主:

node1-side

[root@node1 ~]# mysql

mysql> GRANT REPLICATION SLAVE ON *.* TO ‘jowin‘@‘192.168.41.%‘ IDENTIFIED BY  ‘jowin‘ REQUIRE SSL;

Query OK, 0 rows affected (0.17 sec)

mysql> FLUSH PRIVILEGES;

Query OK, 0 rows affected (0.02 sec)

mysql> SHOW MASTER STATUS;

+------------------+----------+--------------+------------------+

| File             | Position | Binlog_Do_DB |Binlog_Ignore_DB |

+------------------+----------+--------------+------------------+

| mysql-bin.000011 |      347 |              |                  |

+------------------+----------+--------------+------------------+

1 row in set (0.00 sec)

mysql> SHOW GLOBAL VARIABLES LIKE ‘%ssl%‘;

+---------------+---------------------------------+

| Variable_name | Value                           |

+---------------+---------------------------------+

| have_openssl  | YES                             |

| have_ssl      | YES                             |

| ssl_ca        | /usr/local/mysql/ssl/cacert.pem |

| ssl_capath    |                                 |

| ssl_cert      | /usr/local/mysql/ssl/mysql.crt  |

| ssl_cipher    |                                 |

| ssl_key       | /usr/local/mysql/ssl/mysql.key  |

+---------------+---------------------------------+

7 rows in set (0.00 sec)

 

node2-side

[root@node2 ~]# mysql

mysql> change master to master_host=‘192.168.41.131‘,master_user=‘jowin‘,master_password=‘jowin‘,master_log_file=‘mysql-bin.000011‘,master_log_pos=347,master_ssl=1,master_ssl_ca=‘/usr/local/mysql/ssl/cacert.pem‘,master_ssl_cert=‘/usr/local/mysql/ssl/mysql.crt‘,master_ssl_key=‘/usr/local/mysql/ssl/mysql.key‘;

Query OK, 0 rows affected (0.13 sec)

mysql> START SLAVE;

Query OK, 0 rows affected (0.00 sec)

 

6、测试:

node1-side

mysql> CREATE DATABASE mydb;

Query OK, 1 row affected (0.01 sec)

 

node2-side

mysql> SHOW DATABASES;

+--------------------+

| Database           |

+--------------------+

| information_schema |

| mydb               |

| mysql              |

| performance_schema |

| test               |

+--------------------+

5 rows in set (0.08 sec)

mysql> SHOW SLAVE STATUS\G

*************************** 1. row***************************

               Slave_IO_State: Waiting formaster to send event

                  Master_Host: 192.168.41.131

                  Master_User: jowin

                  Master_Port: 3306

                Connect_Retry: 60

              Master_Log_File: mysql-bin.000012

         Read_Master_Log_Pos: 107

               Relay_Log_File: relay-log.000005

                Relay_Log_Pos: 253

       Relay_Master_Log_File: mysql-bin.000012

            Slave_IO_Running: Yes

           Slave_SQL_Running: Yes

             Replicate_Do_DB:

         Replicate_Ignore_DB:

          Replicate_Do_Table:

      Replicate_Ignore_Table:

     Replicate_Wild_Do_Table:

 Replicate_Wild_Ignore_Table:

                   Last_Errno: 0

                   Last_Error:

                Skip_Counter: 0

         Exec_Master_Log_Pos: 107

              Relay_Log_Space: 549

              Until_Condition: None

               Until_Log_File:

                Until_Log_Pos: 0

          Master_SSL_Allowed: Yes

          Master_SSL_CA_File: /usr/local/mysql/ssl/cacert.pem

          Master_SSL_CA_Path:

              Master_SSL_Cert:/usr/local/mysql/ssl/mysql.crt

           Master_SSL_Cipher:

               Master_SSL_Key:/usr/local/mysql/ssl/mysql.key

        Seconds_Behind_Master: 0

Master_SSL_Verify_Server_Cert: No

                Last_IO_Errno: 0

                Last_IO_Error:

               Last_SQL_Errno: 0

               Last_SQL_Error:

 Replicate_Ignore_Server_Ids:

            Master_Server_Id: 1

1 row in set (0.00 sec)

 

[root@node2 ~]# mysql -u jowin -p -h192.168.41.131(若不用ssl方式连接,则连不上)

Enter password:

ERROR 1045 (28000): Access denied for user‘jowin‘@‘node2.magedu.com‘ (using password: YES)

 

[root@node2 ~]# mysql -ujowin -p -h192.168.41.131 --ssl-ca=/usr/local/mysql/ssl/cacert.pem  --ssl-cert=/usr/local/mysql/ssl/mysql.crt  --ssl-key=/usr/local/mysql/ssl/mysql.key(使用ssl方式则连接正常)

Enter password:

Welcome to the MySQL monitor.  Commands end with ; or \g.

Your MySQL connection id is 8

Server version: 5.5.45-log MySQL CommunityServer (GPL)

 

Copyright (c) 2000, 2015, Oracle and/or itsaffiliates. All rights reserved.

 

Oracle is a registered trademark of OracleCorporation and/or its

affiliates. Other names may be trademarksof their respective

owners.

 

Type ‘help;‘ or ‘\h‘ for help. Type ‘\c‘ toclear the current input statement.

 

mysql>

 

 

 

 

 

以上内容自找资料整理。


本文出自 “Linux运维重难点学习笔记” 博客,谢绝转载!

Linux运维 第四阶段(八)MySQL REPLICATION(SSL)

标签:mysql   linux运维   

原文地址:http://jowin.blog.51cto.com/10090021/1728229

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!