Linux运维 第四阶段（八）MySQLREPLICATION（SSL）
一、准备：
mysql replication（ssl加密方式传输）
mysql-5.5.45-linux2.6-i686.tar.gz（通用二进制格式包）
两node，一主一从
master（node1:192.168.41.131，既是CA又是master）
slave（node2:192.168.41.132）
环境：
[[email protected] ~]# uname -a
Linux node1.magedu.com 2.6.18-308.el5 #1SMP Fri Jan 27 17:21:15 EST 2012 i686 i686 i386 GNU/Linux
注意：master和slave的私钥及证书要同名（本例中两端均为mysql.key、mysql.crt，要在两端各自生成），否则无法使用ssl传输
二、操作：
1、在master和slave上安装mysql
node{1,2}-side：
[[email protected] ~]# mkdir /mydata/data -pv（生产环境最好将数据目录放在LVM中）
[[email protected] ~]# useradd -r mysql
[[email protected] ~]# chown -R mysql.mysql/mydata/data/
[[email protected] ~]# tar xf mysql-5.5.45-linux2.6-i686.tar.gz -C /usr/local/
[[email protected] ~]# cd /usr/local/
[[email protected] local]# ln -sv mysql-5.5.45-linux2.6-i686/ mysql
[[email protected] local]# ll
……
lrwxrwxrwx 1 root root 27 Dec 18 23:13mysql -> mysql-5.5.45-linux2.6-i686/
……
[[email protected] mysql]# chown -R root.mysql ./
[[email protected] mysql]# ll
……
[[email protected] mysql]#scripts/mysql_install_db --user=mysql --datadir=/mydata/data
[[email protected] mysql]# cp support-files/my-large.cnf /etc/my.cnf
[[email protected] mysql]# cp support-files/mysql.server /etc/init.d/mysqld
[[email protected] mysql]# chkconfig --add mysqld
[[email protected] mysql]# chkconfig mysqld on
[[email protected] mysql]# chkconfig --list mysqld
mysqld 0:off 1:off 2:on 3:on 4:on 5:on 6:off
[[email protected] mysql]# vim /etc/profile.d/mysql.sh
export PATH=$PATH:/usr/local/mysql/bin
[[email protected] mysql]# . !$
2、在master上（生成ca私钥及颁发ca自签证书；并签署颁发mysql-master的证书）
node1-side：
[[email protected] mysql]# mkdir ssl/
[[email protected] mysql]# cd ssl
[[email protected] ssl]# vim /etc/pki/tls/openssl.cnf
[ CA_default ]
dir = /etc/pki/CA
[[email protected] ssl]# cd /etc/pki/CA
[[email protected] CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)（生成ca私钥）
Generating RSA private key, 2048 bit longmodulus
................+++
...........................................................................................................+++
e is 65537 (0x10001)
[[email protected] CA]# ll private/
total 8
-rw------- 1 root root 1679 Dec 19 06:51cakey.pem
[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem（颁发ca自签证书，注意server’shostname）
Country Name (2 letter code) [GB]:CN
State or Province Name (full name)[Berkshire]:SH
Locality Name (eg, city) [Newbury]:SH
Organization Name (eg, company) [My CompanyLtd]:itownet
Organizational Unit Name (eg, section)[]:TECH
Common Name (eg, your name or your server‘shostname) []:ca.magedu.com
Email Address []:[email protected]
[[email protected] CA]# touch index.txt
[[email protected] CA]# echo 01 > serial
[[email protected] CA]# ll
total 52
-rw-r--r-- 1 root root 1586 Dec 19 06:54cacert.pem
drwxr-xr-x 2 root root 4096 Dec 19 02:14certs
drwxr-xr-x 2 root root 4096 Dec 19 02:14crl
-rw-r--r-- 1 root root 0 Dec 19 06:55 index.txt
drwxr-xr-x 2 root root 4096 Dec 19 04:29newcerts
drwx------ 2 root root 4096 Dec 19 06:51private
-rw-r--r-- 1 root root 3 Dec 19 06:55 serial
[[email protected] CA]# cd /usr/local/mysql/ssl
[[email protected] ssl]# (umask 077;openssl genrsa -out mysql.key 1024)（生成master端的私钥）
Generating RSA private key, 1024 bit longmodulus
....++++++
...............................................................................++++++
e is 65537 (0x10001)
[[email protected] ssl]# openssl req -new -key mysql.key -out mysql.csr（生成master的证书签署请求certificate signature request，注意server’s hostname一定不能与slave端的重名）
……
Country Name (2 letter code) [GB]:CN
State or Province Name (full name)[Berkshire]:SH
Locality Name (eg, city) [Newbury]:SH
Organization Name (eg, company) [My CompanyLtd]:itownet
Organizational Unit Name (eg, section)[]:TECH
Common Name (eg, your name or your server‘shostname) []:master.magedu.com
Email Address []:[email protected]
Please enter the following ‘extra‘attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[[email protected] ssl]# openssl ca -in mysql.csr -out mysql.crt -days 365（为master颁发证书）
……
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified,commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[[email protected] ssl]# cp /etc/pki/CA/cacert.pem./
[[email protected] ssl]# chown -R mysql.mysql ./
[[email protected] ssl]# ll
total 32
-rw-r--r-- 1 mysql mysql 1586 Dec 19 07:10 cacert.pem
-rw-r--r-- 1 mysql mysql 3830 Dec 19 07:08mysql.crt
-rw-r--r-- 1 mysql mysql 692 Dec 19 07:03 mysql.csr
-rw------- 1 mysql mysql 887 Dec 19 07:02 mysql.key
3、在slave上（生成私钥及slave的证书签署请求，传至ca端签署）
node2-side：
[[email protected] ~]# mkdir /usr/local/mysql/ssl
[[email protected] ~]# cd !$
cd /usr/local/mysql/ssl
[[email protected] ssl]# (umask 077;openssl genrsa -out mysql.key 1024)（私钥）
Generating RSA private key, 1024 bit longmodulus
................................++++++
..++++++
e is 65537 (0x10001)
[[email protected] ssl]# openssl req -new -key mysql.key -out mysql.csr（证书签署请求，注意server’s hostname）
……
Country Name (2 letter code) [GB]:CN
State or Province Name (full name)[Berkshire]:SH
Locality Name (eg, city) [Newbury]:SH
Organization Name (eg, company) [My CompanyLtd]:itownet
Organizational Unit Name (eg, section)[]:TECH
Common Name (eg, your name or your server‘shostname) []:slave.magedu.com
Email Address []:[email protected]
Please enter the following ‘extra‘attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[[email protected] ssl]# scp mysql.csrnode1:/root/
mysql.csr 100% 692 0.7KB/s 00:00
node1-side：（在主上签署请求，并将颁发给slave的证书及ca自签证书一同传给slave）
[[email protected] ssl]# cd
[[email protected] ~]# openssl ca -in mysql.csr -out mysql.crt -days 365（在主上给予签署）
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified,commit? [y/n]y
[[email protected] ~]# scp mysql.crt node2:/usr/local/mysql/ssl/
mysql.crt 100% 3824 3.7KB/s 00:00
[[email protected] ~]# scp /etc/pki/CA/cacert.pem node2:/usr/local/mysql/ssl/
cacert.pem 100%1586 1.6KB/s 00:00
node2-side：
[[email protected] ssl]# chown -R mysql.mysql ./
[[email protected] ssl]# ll
total 32
-rw-r--r-- 1 mysql mysql 1586 Dec 19 07:23cacert.pem
-rw-r--r-- 1 mysql mysql 3824 Dec 19 07:23mysql.crt
-rw-r--r-- 1 mysql mysql 692 Dec 19 07:17 mysql.csr
-rw------- 1 mysql mysql 891 Dec 19 07:16 mysql.key
4、编辑master、slave的配置文件，并启动服务：
node1-side：
[[email protected] ~]# vim /etc/my.cnf
[mysqld]
log-bin = mysql-bin
log-bin-index = mysql-bin.index
server-id = 1（注意主从不能一样，MySQL集群内唯一，范围1至2^32-1）
datadir = /mydata/data
ssl（表示开启ssl）
ssl_ca = /usr/local/mysql/ssl/cacert.pem
ssl_cert = /usr/local/mysql/ssl/mysql.crt
ssl_key = /usr/local/mysql/ssl/mysql.key
innodb_file_per_table = 1
[[email protected] ~]# service mysqld start
Starting MySQL.. [ OK ]
node2-side：（中继日志必须开，可以不开启二进制日志）
[mysqld]
relay-log = relay-log
relay-log-index = relay-log.index
server-id = 11
datadir = /mydata/data
ssl
ssl_ca = /usr/local/mysql/ssl/cacert.pem
ssl_cert = /usr/local/mysql/ssl/mysql.crt
ssl_key = /usr/local/mysql/ssl/mysql.key
innodb_file_per_table = 1
[[email protected] ~]# service mysqld start
Starting MySQL.. [ OK ]
5、在主端授权（复制仅能通过ssl传输复制），在从端连接到主：
node1-side：
[[email protected] ~]# mysql
mysql> GRANT REPLICATION SLAVE ON *.* TO ‘jowin‘@‘192.168.41.%‘ IDENTIFIED BY ‘jowin‘ REQUIRE SSL;
Query OK, 0 rows affected (0.17 sec)
mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.02 sec)
mysql> SHOW MASTER STATUS;
+------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB |Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000011 | 347 | | |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)
mysql> SHOW GLOBAL VARIABLES LIKE ‘%ssl%‘;
+---------------+---------------------------------+
| Variable_name | Value |
+---------------+---------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /usr/local/mysql/ssl/cacert.pem |
| ssl_capath | |
| ssl_cert | /usr/local/mysql/ssl/mysql.crt |
| ssl_cipher | |
| ssl_key | /usr/local/mysql/ssl/mysql.key |
+---------------+---------------------------------+
7 rows in set (0.00 sec)
node2-side：
[[email protected] ~]# mysql
mysql> change master to master_host=‘192.168.41.131‘,master_user=‘jowin‘,master_password=‘jowin‘,master_log_file=‘mysql-bin.000011‘,master_log_pos=347,master_ssl=1,master_ssl_ca=‘/usr/local/mysql/ssl/cacert.pem‘,master_ssl_cert=‘/usr/local/mysql/ssl/mysql.crt‘,master_ssl_key=‘/usr/local/mysql/ssl/mysql.key‘;
Query OK, 0 rows affected (0.13 sec)
mysql> START SLAVE;
Query OK, 0 rows affected (0.00 sec)
6、测试：
node1-side：
mysql> CREATE DATABASE mydb;
Query OK, 1 row affected (0.01 sec)
node2-side：
mysql> SHOW DATABASES;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mydb |
| mysql |
| performance_schema |
| test |
+--------------------+
5 rows in set (0.08 sec)
mysql> SHOW SLAVE STATUS\G
*************************** 1. row***************************
Slave_IO_State: Waiting formaster to send event
Master_Host: 192.168.41.131
Master_User: jowin
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mysql-bin.000012
Read_Master_Log_Pos: 107
Relay_Log_File: relay-log.000005
Relay_Log_Pos: 253
Relay_Master_Log_File: mysql-bin.000012
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 107
Relay_Log_Space: 549
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes
Master_SSL_CA_File: /usr/local/mysql/ssl/cacert.pem
Master_SSL_CA_Path:
Master_SSL_Cert:/usr/local/mysql/ssl/mysql.crt
Master_SSL_Cipher:
Master_SSL_Key:/usr/local/mysql/ssl/mysql.key
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_SQL_Errno: 0
Last_SQL_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 1
1 row in set (0.00 sec)
[[email protected] ~]# mysql -u jowin -p -h192.168.41.131（若不用ssl方式连接，则连不上）
Enter password:
ERROR 1045 (28000): Access denied for user‘jowin‘@‘node2.magedu.com‘ (using password: YES)
[[email protected] ~]# mysql -ujowin -p -h192.168.41.131 --ssl-ca=/usr/local/mysql/ssl/cacert.pem --ssl-cert=/usr/local/mysql/ssl/mysql.crt --ssl-key=/usr/local/mysql/ssl/mysql.key（使用ssl方式则连接正常）
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 5.5.45-log MySQL CommunityServer (GPL)
Copyright (c) 2000, 2015, Oracle and/or itsaffiliates. All rights reserved.
Oracle is a registered trademark of OracleCorporation and/or its
affiliates. Other names may be trademarksof their respective
owners.
Type ‘help;‘ or ‘\h‘ for help. Type ‘\c‘ toclear the current input statement.
mysql>
以上内容自找资料整理。