AI导航网
微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦！

20190225 实验：实现基于SSL加密的主从复制

分类：Mariadb作者：编程之家原文地址

实验：实现基于SSL加密的主从复制
实验步骤： 环境：三台主机，一台CA：200，一台master：150 ，一台slave：100
平时都是在CA上帮用户生成私钥，在服务器上做的
1 CA,master,slave 的证书相关文件
mkdir /etc/my.cnf.d/ssl
cd /etc/my.cnf.d/ssl
openssl genrsa 2048 > cakey.pem
openssl req -new -x509 -key cakey.pem -out cacert.pem -days 3650
给master 颁发证书
openssl req -newkey rsa:2048 -days 365 -nodes -keyout master.key > master.csr
openssl x509 -req -in master.csr -days 365 -CA cacert.pem -CAkey cakey.pem -set_serial 01 > master.crt
给slave 颁发证书
openssl req -newkey rsa:2048 -days 365 -nodes -keyout slave.key > slave.csr
openssl x509 -req -in slave.csr -days 365 -CA cacert.pem -CAkey cakey.pem -set_serial 02 > slave.crt

root@CA ssl]#ls /etc/my.cnf.d/ssl/
cacert.pem cakey.pem master.crt master.csr master.key slave.crt slave.csr slave.key

scp -r /etc/my.cnf.d/ssl master:/etc/my.cnf.d/

scp -r /etc/my.cnf.d/ssl slave:/etc/my.cnf.d/

2 master
vim /etc/my.cnf
[MysqLd]
log-bin
server-id=17
ssl-ca=/etc/my.cnf.d/ssl/cacert.pem
ssl-cert=/etc/my.cnf.d/ssl/master.crt
ssl-key=/etc/my.cnf.d/ssl/master.key

MysqL> grant replication slave on . to ssluser@'192.168.35.%' identified by 'centos' require ssl ;

3 slave

vim /etc/my.cnf
[MysqLd]
server-id=27
read-only

MysqL> CHANGE MASTER TO
MASTER_HOST='master',
MASTER_USER='ssluser',
MASTER_PASSWORD='centos',
MASTER_PORT=3306,
MASTER_LOG_FILE='mariadb-bin.000003',
MASTER_LOG_POS=7821,
MASTER_SSL=1,
MASTER_SSL_CA = '/etc/my.cnf.d/ssl/cacert.pem',
MASTER_SSL_CERT = '/etc/my.cnf.d/ssl/slave.crt',
MASTER_SSL_KEY = '/etc/my.cnf.d/ssl/slave.key';
MysqL>start slave;

1、150主机修改配置文件：加入“log_bin server_id=150” 100主机修改配置文件：加入“server_id=100 read_only”
150master:[root@centos7 ~]#vim /etc/my.cnf
[root@centos7 ~]#systemctl restart mariadb
[root@centos7 ~]#MysqL
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 5.5.60-MariaDB MariaDB Server

copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> grant replication slave on . to repluser@'192.168.141.%' identified by '123gxy'; 创建用户
Query OK, 0 rows affected (0.01 sec)

MariaDB [(none)]> show master logs;
+--------------------+-----------+
| Log_name | File_size |
+--------------------+-----------+
| mariadb-bin.000001 | 401 |
+--------------------+-----------+
1 row in set (0.00 sec)
100slave：MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='192.168.141.150', MASTER_USER='repluser', MASTER_PASSWORD='123gxy', MASTER_PORT=3306, MASTER_LOG_FILE='mariadb-bin.000001', MASTER_LOG_POS=245;
Query OK, 0 rows affected (0.02 sec)

MariaDB [(none)]> start slave;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> show slave status\G;
1. row
Slave_IO_State: Waiting for master to send event
Master_Host: 192.168.141.150
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mariadb-bin.000001
Read_Master_Log_Pos: 401
Relay_Log_File: mariadb-relay-bin.000002
Relay_Log_Pos: 687
Relay_Master_Log_File: mariadb-bin.000001
Slave_IO_Running: Yes
Slave_sql_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 401
Relay_Log_Space: 983
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: No
Master_SSL_CA_File:
Master_SSL_CA_Path:
Master_SSL_Cert:
Master_SSL_Cipher:
Master_SSL_Key:
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_sql_Errno: 0
Last_sql_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 150
1 row in set (0.00 sec)

ERROR: No query specified

MariaDB [(none)]> select user,host from MysqL.user;
+----------+---------------+
| user | host |
+----------+---------------+
| root | 127.0.0.1 |
| repluser | 192.168.141.% |
| root | ::1 |
| root | localhost |
+----------+---------------+
4 rows in set (0.00 sec) 可见此时已经连接master。
2、[root@CA ~]#mkdir /etc/my.cnf.d/ssl 专门存放证书
[root@CA ssl]#openssl genrsa 2048 > cakey.pem 生成CA的私钥
Generating RSA private key, 2048 bit long modulus
.....................................................................................................+++
.................................+++
e is 65537 (0x10001)
[root@CA ssl]#openssl req -new -x509 -key cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter @R_296_4045@ion that will be incorporated
into your certificate request.
What you are about to enter is what is called a distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:huayixiongdi
Organizational Unit Name (eg, section) []:devops
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:
[root@CA ssl]#ll 这是CA给自己颁发的自签名的证书
total 8
-rw-r--r--. 1 root root 1346 Feb 26 15:59 cacert.pem
-rw-r--r--. 1 root root 1679 Feb 26 15:56 cakey.pem
[root@CA ssl]#openssl req -newkey rsa:2048 -days 365 -nodes -keyout master.key > master.csr 生成master的私钥文件
Generating a 2048 bit RSA private key
.........................+++
....................................................+++
writing new private key to 'master.key'

You are about to be asked to enter @R_296_4045@ion that will be incorporated
into your certificate request.
What you are about to enter is what is called a distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:huayixiongdi
Organizational Unit Name (eg, section) []:devops
Common Name (eg, your name or your server's hostname) []:master.huayixiongdi.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@CA ssl]#ll
total 16
-rw-r--r--. 1 root root 1346 Feb 26 15:59 cacert.pem
-rw-r--r--. 1 root root 1679 Feb 26 15:56 cakey.pem
-rw-r--r--. 1 root root 1029 Feb 26 16:11 master.csr
-rw-r--r--. 1 root root 1708 Feb 26 16:11 master.key
3、颁发CA证书：
[root@CA ssl]#openssl x509 -req -in master.csr -days 365 -CA cacert.pem -CAkey cakey.pem -set_serial 01 > master.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=huayixiongdI/OU=devops/CN=master.huayixiongdi.com
Getting CA Private Key
[root@CA ssl]#ll
total 20
-rw-r--r--. 1 root root 1346 Feb 26 15:59 cacert.pem
-rw-r--r--. 1 root root 1679 Feb 26 15:56 cakey.pem
-rw-r--r--. 1 root root 1233 Feb 26 16:15 master.crt
-rw-r--r--. 1 root root 1029 Feb 26 16:11 master.csr
-rw-r--r--. 1 root root 1708 Feb 26 16:11 master.key 有三个文件
[root@CA ssl]#openssl x509 -req -in slave.csr -days 365 -CA cacert.pem -CAkey cakey.pem -set_serial 01 > slave.crt
Signature ok
subject=/C=cn/ST=beijing/L=beijing/O=huayixiongdI/OU=devops/CN=slave.huayixiongdi.com
Getting CA Private Key
[root@CA ssl]#ll
total 32
-rw-r--r--. 1 root root 1346 Feb 26 15:59 cacert.pem
-rw-r--r--. 1 root root 1679 Feb 26 15:56 cakey.pem
-rw-r--r--. 1 root root 1233 Feb 26 16:15 master.crt
-rw-r--r--. 1 root root 1029 Feb 26 16:11 master.csr
-rw-r--r--. 1 root root 1708 Feb 26 16:11 master.key
-rw-r--r--. 1 root root 1229 Feb 26 16:51 slave.crt
-rw-r--r--. 1 root root 1029 Feb 26 16:18 slave.csr
-rw-r--r--. 1 root root 1704 Feb 26 16:18 slave.key
主服务器此时没开启加密：
MariaDB [(none)]> show variables like'%ssl%';
+---------------+----------+
| Variable_name | Value |
+---------------+----------+
| have_openssl | disABLED |
| have_ssl | disABLED |
| ssl_ca | |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_key | |
+---------------+----------+
7 rows in set (0.00 sec)

MariaDB [(none)]> show variables like'%ssl%';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | |
| ssl_capath | |
| ssl_cert | |
| ssl_cipher | |
| ssl_key | |
+---------------+-------+
master：[root@centos7 ssl]#vim /etc/my.cnf
[MysqLd]
log_bin
server_id=150
ssl-ca=/etc/my.cnf.d/ssl/cacert.pem
ssl-cert=/etc/my.cnf.d/ssl/master.crt
ssl-key=/etc/my.cnf.d/ssl/master.key

MariaDB [(none)]> show variables like'%ssl%';
+---------------+------------------------------+
| Variable_name | Value |
+---------------+------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /etc/my.cnf.d/ssl/cacert.pem |
| ssl_capath | |
| ssl_cert | /etc/my.cnf.d/ssl/master.crt |
| ssl_cipher | |
| ssl_key | /etc/my.cnf.d/ssl/master.key |
+---------------+------------------------------+
7 rows in set (0.00 sec)
我们用秘钥登陆：
[root@centos7 ssl]#MysqL -ussluser -p123gxy -h 192.168.141.150 --ssl-ca=cacert.pem --ssl-cert=slave.crt --ssl-key=slave.key
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 7
Server version: 5.5.60-MariaDB MariaDB Server

copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> status

MysqL Ver 15.1 distrib 5.5.60-MariaDB, for Linux (x86_64) using readline 5.1

Connection id: 7
Current database:
Current user: [email protected]
SSL: Cipher in use is DHE-RSA-AES256-GCM-SHA384
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server: MariaDB
Server version: 5.5.60-MariaDB MariaDB Server
Protocol version: 10
Connection: 192.168.141.150 via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 8 min 25 sec
普通登录：
[root@centos7 ssl]#MysqL -ussluser -p123gxy -h 192.168.141.150
ERROR 1045 (28000): Access denied for user 'ssluser'@'192.168.141.100' (using password: YES)
[root@centos7 ssl]#MysqL -urepluser -p123gxy -h 192.168.141.150
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 9
Server version: 5.5.60-MariaDB MariaDB Server

copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> status;

MysqL Ver 15.1 distrib 5.5.60-MariaDB, for Linux (x86_64) using readline 5.1

Connection id: 9
Current database:
Current user: [email protected]
SSL: Not in use
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server: MariaDB
Server version: 5.5.60-MariaDB MariaDB Server
Protocol version: 10
Connection: 192.168.141.150 via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 11 min 7 sec
5、master：MariaDB [(none)]> show master logs;
+--------------------+-----------+
| Log_name | File_size |
+--------------------+-----------+
| mariadb-bin.000001 | 420 |
| mariadb-bin.000002 | 264 |
| mariadb-bin.000003 | 264 |
| mariadb-bin.000004 | 7897 |
+--------------------+-----------+
4 rows in set (0.00 sec) 已经7897了
MariaDB [(none)]> stop slave；
Query OK, 0 rows affected (0.01 sec)

MariaDB [(none)]> reset slave all;
Query OK, 0 rows affected (0.01 sec) 关闭清空slave的复制
重新建： 在slave：
MariaDB [(none)]> CHANGE MASTER TO
-> MASTER_HOST='192.168.141.150',
-> MASTER_USER='ssluser',
-> MASTER_PASSWORD='123gxy',
-> MASTER_PORT=3306,
-> MASTER_LOG_FILE='mariadb-bin.000004',
-> MASTER_LOG_POS=7897,
-> MASTER_SSL=1,
-> MASTER_SSL_CA = '/etc/my.cnf.d/ssl/cacert.pem',
-> MASTER_SSL_CERT = '/etc/my.cnf.d/ssl/slave.crt',
-> MASTER_SSL_KEY = '/etc/my.cnf.d/ssl/slave.key';
Query OK, 0 rows affected (0.01 sec)
MariaDB [(none)]> show slave status\G
1. row
Slave_IO_State:
Master_Host: 192.168.141.150
Master_User: ssluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mariadb-bin.000004
Read_Master_Log_Pos: 7897
Relay_Log_File: mariadb-relay-bin.000001
Relay_Log_Pos: 4
Relay_Master_Log_File: mariadb-bin.000004
Slave_IO_Running: No
Slave_sql_Running: No
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 7897
Relay_Log_Space: 245
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes
Master_SSL_CA_File: /etc/my.cnf.d/ssl/cacert.pem
Master_SSL_CA_Path:
Master_SSL_Cert: /etc/my.cnf.d/ssl/slave.crt
Master_SSL_Cipher:
Master_SSL_Key: /etc/my.cnf.d/ssl/slave.key
Seconds_Behind_Master: NULL
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_sql_Errno: 0
Last_sql_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 150
1 row in set (0.00 sec)
这时，开启从服务器：
DB [(none)]> start slave;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> show slave status\G
1. row
Slave_IO_State: Waiting for master to send event
Master_Host: 192.168.141.150
Master_User: ssluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mariadb-bin.000004
Read_Master_Log_Pos: 7897
Relay_Log_File: mariadb-relay-bin.000002
Relay_Log_Pos: 531
Relay_Master_Log_File: mariadb-bin.000004
Slave_IO_Running: Yes
Slave_sql_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 7897
Relay_Log_Space: 827
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes
Master_SSL_CA_File: /etc/my.cnf.d/ssl/cacert.pem
Master_SSL_CA_Path:
Master_SSL_Cert: /etc/my.cnf.d/ssl/slave.crt
Master_SSL_Cipher:
Master_SSL_Key: /etc/my.cnf.d/ssl/slave.key
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_sql_Errno: 0
Last_sql_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 150
在master上创建用户：
MariaDB [(none)]> create database db1;
Query OK, 1 row affected (0.00 sec)
slave上马上回显示：
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| @R_296_4045@ion_schema |
| db1 |
| hellodb |
| MysqL |
| performance_schema |
+--------------------+
5 rows in set (0.00 sec)
至此，本实验结束！

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 [email protected] 举报，一经查实，本站将立刻删除。

相关推荐

2022年-5月22日centos7网络源安装mysql
安装开始...1.打开“https://dev.mysql.com/downloadsepo/yum/”下载Mysql源      将下载好的mysql源上传linux服务器 2.yumlocalinstallmysql80*#安装源 centos7中默认安装的是mariadb数据库，如果想要安装my...
K8S Helm安装部署 MariaDB 高可用、主从集群
安装Helm3#官网下载慢#wgethttps://get.helm.sh/helm-v3.5.4-linux-amd64.tar.gzwgethttp://qiniu.dev-share.top/helm-v3.5.4-linux-amd64.tar.gztar-zxvfhelm-v3.5.4-linux-amd64.tar.gzcplinux-amd64/helm/usr/loc...
安装MariaDB后无法启动怎么解决？
通过Linux命令行启动用的指令：systemctlstartmariadb.service反馈：Failedtostartmariadb.service:Unitmariadb.servicenotfound.MariaDB简介MariaDB是MySQL的一个分支，MariaDB打算保持与MySQL的高度兼容性，确保具...
Centos7安装mariaDB
InstallingMariaDBServer10.4TodeployMariaDBCommunityServer10.4onRHEL7orCentOS7,firstdownloadandusethe mariadb_repo_setup scripttoconfiguretheMariaDBrepositoriesforYUM:$sudoyuminstallwget$wgethttps://...
MySQL存储引擎
阅读目录一什么是存储引擎二mysql支持的存储引擎三使用存储引擎一什么是存储引擎mysql中建立的库--> 文件夹库中建立的表--> 文件现实生活中我们用来存储数据的文件有不同的类型，每种文件类型对应各自不同的...
centos7 Mariadb 安装
1、安装MariaDB安装命令yum-yinstallmariadbmariadb-server安装完成MariaDB，首先启动MariaDBsystemctlstartmariadb设置开机启动systemctlenablemariadb[root@node1~]#systemctlenablemariadbCreatedsymlinkfrom/etc...
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: N
Centos7.5 刚安装的mariadb数据库报错报错:ERROR1045(28000):Accessdeniedforuser'root'@'localhost'(usingpassword:NO)原因一:没有启动数据库解决方法:systemctlstartmariadbsystemctlenablem...
mariadb多实例安装
基于YUM安装的mariadb多实例.=================================================================1.yum安装mariadb-server包#yuminstallmariadb-server2.创建多实例对应的目录结构#mkdir/mysql/{3306,3307,3308}/{d...
centos7 mysql数据库安装和配置
一、系统环境[root@localhost~]#cat/etcedhat-releaseCentOSLinuxrelease7.6.1810(Core)二、mysql安装#yuminstallmysqlmysql-servermysql-devel安装mysql-server失败，如下图：[root@localhost~]#yuminstallmysql-se...
MariaDB
数据库的选择两大点是：开源和跨平台，满足这三点MySQL、MongoDB和MariaDB。其中MariaDB是MySQL的分支，也是它的进阶产品，未来很有可能替代MySQL。与MySQL相比较，MariaDB更强的地方在于：Maria 存储引擎PBXT存储引...
    pythonJavaScriptjavaHTMLreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-bootreact-native