基于SSL的mysql(MariaDB)主从复制

一、前言

   备份数据库是生产环境中的首要任务，重中之重，有时候不得不通过网络进行数据库的复制，这样就需要保证数据在网络传输过程中的安全性，因此使用基于SSL的复制会大加强数据的安全性

二、准备工作

1、主从服务器时间同步

1
2
[root@master ~]# crontab -e
*/30 * * * * /usr/sbin/ntpdate 172.16.0.1 &>/dev/null

2、mysql说明

（1）主服务器

   hostname:master    IP：172.16.7.202

（2）从服务器

   hostname:slave     IP：172.16.7.250

（3）数据目录

   /mydata/data

（4）二进制日志目录

   /mydata/binlogs

（5）中继日志目录

   /mydata/relaylogs

三、SSL主从同步的实现

1、master（172.16.7.202）安装后配置文件

1
2
3
4
5
6
7
8
9
10
thread_concurrency = 4
datadir = /mydata/data    #数据目录
log-bin=/mydata/binlogs/master-bin
relay-log=/mydata/relaylogs/relay
sync_binlog = 1    #设定每1秒钟同步一次缓冲中的数据到日志文件中
binlog_format=mixed    #二进制日志格式为混合模式
server-id       = 1       #主服务器的server-id=1,从的等于2
#
#
#slave（172.16.7.250）同master

2、将master（172.16.7.202）做为CA服务器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
[root@master ~]# cd /etc/pki/CA
[root@master CA]#
[root@master CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
..........................................+++
..................+++
e is 65537 (0x10001)
[root@master CA]#
[root@master CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 36500
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:sina
Organizational Unit Name (eg, section) []:mysql
Common Name (eg, your name or your server's hostname) []:master.sina.com
Email Address []:
[root@master CA]# touch index.txt serial crlnumber
[root@master CA]# echo 01 > serial

3、为master（172.16.7.202）签发证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
[root@master CA]# mkdir /usr/local/mysql/ssl
[root@master CA]# cd /usr/local/mysql/ssl
[root@master ssl]# (umask 077;openssl genrsa -out master.key 2048)
Generating RSA private key, 2048 bit long modulus
..........+++
............................................................+++
e is 65537 (0x10001)
[root@master ssl]#
[root@master ssl]# openssl req -new -key master.key -out master.csr -days 36500
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:sina
Organizational Unit Name (eg, section) []:mysql
Common Name (eg, your name or your server's hostname) []:master.sina.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@master ssl]#
[root@master ssl]# openssl ca -in master.csr -out master.crt -days 36500
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: May  3 13:34:58 2014 GMT
            Not After : Apr  9 13:34:58 2114 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Beijing
            organizationName          = sina
            organizationalUnitName    = mysql
            commonName                = master.sina.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                62:EF:37:1D:96:FF:8A:89:47:09:2D:93:74:42:14:BF:8E:AC:51:49
            X509v3 Authority Key Identifier:
                keyid:6B:73:D6:FE:81:13:2C:0E:EC:61:EE:F7:6F:92:91:6D:82:37:A0:11
Certificate is to be certified until Apr  9 13:34:58 2114 GMT (36500 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

4、slave生成证书申请请求

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
[root@slave ~]# mkdir /usr/local/mysql/ssl
[root@slave ~]# cd /usr/local/mysql/ssl
[root@slave ssl]# (umask 077;openssl genrsa -out slave.key 2048)
Generating RSA private key, 2048 bit long modulus
.....................................................+++
........................................+++
e is 65537 (0x10001)
[root@slave ssl]#
[root@slave ssl]# openssl req -new -key slave.key -out slave.csr -days 36500
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:sina
Organizational Unit Name (eg, section) []:mysql
Common Name (eg, your name or your server's hostname) []:slave.sina.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@slave ssl]#
[root@slave ssl]#
[root@slave ssl]# scp slave.csr root@172.16.7.202:/root

5、为slave（172.16.7.250）签发证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
[root@master ~]# openssl ca -in slave.csr -out slave.crt -days 36500
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 2 (0x2)
        Validity
            Not Before: May  3 13:43:28 2014 GMT
            Not After : Apr  9 13:43:28 2114 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Beijing
            organizationName          = sina
            organizationalUnitName    = mysql
            commonName                = slave.sina.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                20:CB:55:9C:D0:7A:F0:25:70:AC:84:2B:8E:F4:24:FB:1F:51:48:9D
            X509v3 Authority Key Identifier:
                keyid:6B:73:D6:FE:81:13:2C:0E:EC:61:EE:F7:6F:92:91:6D:82:37:A0:11
Certificate is to be certified until Apr  9 13:43:28 2114 GMT (36500 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@master ~]#
[root@master ~]#
[root@master ~]# scp slave.crt root@172.16.7.250:/usr/local/mysql/ssl/

6、为master及slave提供CA的证书

1
2
[root@master ~]# cp /etc/pki/CA/cacert.pem /usr/local/mysql/ssl/
[root@master ~]# scp /etc/pki/CA/cacert.pem root@172.16.7.250:/usr/local/mysql/ssl/

7、修改master和slave的属主、属组为"mysql"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[root@master ~]# chown -R mysql.mysql /usr/local/mysql/ssl/
[root@master ~]# ll /usr/local/mysql/ssl/
total 20
-rw-r--r-- 1 mysql mysql 1330 May  3 21:48 cacert.pem
-rw-r--r-- 1 mysql mysql 4465 May  3 21:35 master.crt
-rw-r--r-- 1 mysql mysql 1009 May  3 21:33 master.csr
-rw------- 1 mysql mysql 1675 May  3 21:32 master.key
###
###
[root@slave ssl]# chown -R mysql.mysql /usr/local/mysql/ssl/
[root@slave ssl]# ll /usr/local/mysql/ssl/
total 20
-rw-r--r-- 1 mysql mysql 1330 May  3 21:49 cacert.pem
-rw-r--r-- 1 mysql mysql 4460 May  3 21:44 slave.crt
-rw-r--r-- 1 mysql mysql 1005 May  3 21:40 slave.csr
-rw------- 1 mysql mysql 1679 May  3 21:38 slave.key

8、修改mysql配置文件开启SSL加密功能

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[root@master ~]# vim /etc/my.cnf
[mysqld]
ssl
ssl_ca = /usr/local/mysql/ssl/cacert.pem
ssl_key = /usr/local/mysql/ssl/master.key
ssl_cert = /usr/local/mysql/ssl/master.crt
[root@master ~]# service mysqld restart
#
#
[root@slave ~]# vim /etc/my.cnf
[mysqld]
ssl
ssl_ca = /usr/local/mysql/ssl/cacert.pem
ssl_key = /usr/local/mysql/ssl/slave.key
ssl_cert = /usr/local/mysql/ssl/slave.crt
[root@slave ~]# service mysqld restart

9、在master上验证SSL加密功能开启并创建基于密钥认证用户

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[root@master ~]# mysql
MariaDB [(none)]> show variables like '%ssl%';
+---------------+---------------------------------+
| Variable_name | Value                           |
+---------------+---------------------------------+
| have_openssl  | NO                              |
| have_ssl      | YES                             |
| ssl_ca        | /usr/local/mysql/ssl/cacert.pem |
| ssl_capath    |                                 |
| ssl_cert      | /usr/local/mysql/ssl/master.crt |
| ssl_cipher    |                                 |
| ssl_crl       |                                 |
| ssl_crlpath   |                                 |
| ssl_key       | /usr/local/mysql/ssl/master.key |
+---------------+---------------------------------+
MariaDB [(none)]>
MariaDB [(none)]> grant replication slave,replication client on *.* to 'repluser'@'172.16.%.%' identified by 'repluser' require ssl;
MariaDB [(none)]> flush privileges;

10、查看master状态信息

1
2
3
4
5
6
MariaDB [(none)]> show master status;
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-bin.000002 |      652 |              |                  |
+-------------------+----------+--------------+------------------+

11、验证slave开启SSL加密功能

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[root@slave ~]# mysql
MariaDB [(none)]>
MariaDB [(none)]> show variables like '%ssl%';
+---------------+---------------------------------+
| Variable_name | Value                           |
+---------------+---------------------------------+
| have_openssl  | NO                              |
| have_ssl      | YES                             |
| ssl_ca        | /usr/local/mysql/ssl/cacert.pem |
| ssl_capath    |                                 |
| ssl_cert      | /usr/local/mysql/ssl/slave.crt  |
| ssl_cipher    |                                 |
| ssl_crl       |                                 |
| ssl_crlpath   |                                 |
| ssl_key       | /usr/local/mysql/ssl/slave.key  |
+---------------+---------------------------------+

12、slave连接master

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
MariaDB [(none)]> change master to master_host='172.16.7.202',master_user='repluser',master_password='repluser',master_log_file='master-bin.000002',master_log_pos=652,master_ssl=1,master_ssl_ca='/usr/local/mysql/ssl/cacert.pem',master_ssl_cert='/usr/local/mysql/ssl/slave.crt',master_ssl_key='/usr/local/mysql/ssl/slave.key';
Query OK, 0 rows affected (0.06 sec)
MariaDB [(none)]>
MariaDB [(none)]>
MariaDB [(none)]> start slave;
Query OK, 0 rows affected (0.04 sec)
MariaDB [(none)]>
MariaDB [(none)]>
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.7.202
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-bin.000002
          Read_Master_Log_Pos: 652
               Relay_Log_File: relay.000002
                Relay_Log_Pos: 536
        Relay_Master_Log_File: master-bin.000002
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes
              Replicate_Do_DB:
          Replicate_Ignore_DB:
           Replicate_Do_Table:
       Replicate_Ignore_Table:
      Replicate_Wild_Do_Table:
  Replicate_Wild_Ignore_Table:
                   Last_Errno: 0
                   Last_Error:
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 652
              Relay_Log_Space: 823
              Until_Condition: None
               Until_Log_File:
                Until_Log_Pos: 0
           Master_SSL_Allowed: Yes
           Master_SSL_CA_File: /usr/local/mysql/ssl/cacert.pem
           Master_SSL_CA_Path:
              Master_SSL_Cert: /usr/local/mysql/ssl/slave.crt
            Master_SSL_Cipher:
               Master_SSL_Key: /usr/local/mysql/ssl/slave.key
        Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 0
                Last_IO_Error:
               Last_SQL_Errno: 0
               Last_SQL_Error:
  Replicate_Ignore_Server_Ids:
             Master_Server_Id: 1
               Master_SSL_Crl: /usr/local/mysql/ssl/cacert.pem
           Master_SSL_Crlpath:
                   Using_Gtid: No
                  Gtid_IO_Pos:
1 row in set (0.00 sec)

四、同步验证

1、在master上新建数据库hlbrc

1
2
3
4
5
6
7
8
9
10
11
12
MariaDB [(none)]> create database hlbrc;
Query OK, 1 row affected (0.01 sec)
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| hlbrc              |
| information_schema |
| mysql              |
| performance_schema |
| test               |
+--------------------+

2、在slave上验证

1
2
3
4
5
6
7
8
9
10
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| hlbrc              |
| information_schema |
| mysql              |
| performance_schema |
| test               |
+--------------------+









本文转自 nmshuishui 51CTO博客，原文链接：http://blog.51cto.com/nmshuishui/1405856，如需转载请自行联系原作者

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.mzph.cn/news/256469.shtml

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

ANSYS——分析实例，平面对称问题

ANSYS——分析实例，平面对称问题

目录 一、问题描述 二、问题分析 三、单元类型设置、材料属性设置 四、建模
阅读更多...
Ubuntu16.04安装nginx

Ubuntu16.04安装nginx

//ubuntu //安装nginxcurl -LJO http://nginx.org/download/nginx-1.10.1.tar.gz tar zxvf nginx-1.10.1.tar.gz cd nginx-1.10.1.tar.gz sudo apt install gcc autoconf automake build-essential sudo apt-get install libpcre3 libpcre3-dev sudo apt-get install openssl s…
阅读更多...
【数据结构作业—02】双链表

【数据结构作业—02】双链表

2.实现下述要求的Locate运算的函数 问题描述 设有一个带表头结点的双向链表L，每个结点有4个数据成员：指向前驱结点的指针prior、指向后继结点的指针next、存放数据的成员data和访问频度freq。所有结点的freq初始时都为0。每当在链表上进行一次Locate (L,…
阅读更多...
ANSYS——对称模型对称边界的确定以及对称边界的约束施加问题

ANSYS——对称模型对称边界的确定以及对称边界的约束施加问题

目录 一、什么是对称模型（对称模型的特性）？ 二、利用模型的对称特性的目的？
阅读更多...
彻底明白Java语言中的IO系统

彻底明白Java语言中的IO系统

ava的核心库java.io提供了全面的IO接口，包括：文件读写，标准设备输出等等。Java中IO是以流为基础进行输入输出的，所有数据被串行化写入输出流，或者从输入流读入。在具体使用中很多初学者对Java.io包的使用非常含糊&…
阅读更多...
第9章 接口

第9章 接口

1、抽象类： 包含抽象方法的类叫抽象类，如果一个类包含一个或多个抽象方法(abstract void f();)，该类必须被限定为抽象的，否则编译出错。 1、抽象类不能被实例化，实例化的工作应该交由它的子类来完成，它只需…
阅读更多...
用node-webkit(NW.js)创建桌面程序

用node-webkit(NW.js)创建桌面程序

以往写windows桌面程序需要用MFC、C#之类的技术，那么如果你只会web开发技术呢？或者说你有一个网站，但是你想把你的网站打包成一个桌面应用程序，该如何做呢？ 答案就是用node-webkit这个开源框架，他封装了web…
阅读更多...
一头扎进Node系列 - 目录

一头扎进Node系列 - 目录

前言 本系列是属于初级教程。博主我也还只是一个node的新兵蛋子，想通过学习官网的API文档，慢慢的打好Node基础。当然后期这系列文档会慢慢完善，并且会添加一些项目实战中遇到的一些问题以及解决方案！如果你也是初学者，…
阅读更多...
ANSYS——“There is at least 1 small equation solver pivot term”问题的解决办法

ANSYS——“There is at least 1 small equation solver pivot term”问题的解决办法

目录 问题出现的原因 问题解决办法 1、根据提示对节点进行约束的添加
阅读更多...
JAVA中几个常用的方法

JAVA中几个常用的方法

类Object是类层次结构的根类&#xff0c;每一个类都使用Object作为超类&#xff0c;所有对象&#xff08;包括数组&#xff09;都实现这个类的方法。jdk1.5中&#xff0c;描述了该类中的11个方法 1.getClass public final Class<? extends Object> getClass() 返回一个对…
阅读更多...
ANSYS——载荷的方向

ANSYS——载荷的方向

目录 一、压力的方向（FORCE） 1、为正的情况 2、为负的情况 二、压强的方向（PRESSURE）
阅读更多...
kindeditor用法简单介绍（转）

kindeditor用法简单介绍（转）

1&#xff0c;首先去官网下载http://www.kindsoft.net/ 2&#xff0c;解压之后如图所示&#xff1a; 由于本人做的是用的是JSP&#xff0c;所以ASP,PHP什么的就用不上了&#xff0c;直接把那些去掉然后将整个文件夹扔进Myeclipse&#xff0c;如图&#xff1a; 里面有个报错&am…
阅读更多...
hadoop 分片与分块，map task和reduce task的理解

hadoop 分片与分块，map task和reduce task的理解

分块&#xff1a;Block HDFS存储系统中&#xff0c;引入了文件系统的分块概念&#xff08;block&#xff09;&#xff0c;块是存储的最小单位&#xff0c;HDFS定义其大小为64MB。与单磁盘文件系统相似&#xff0c;存储在 HDFS上的文件均存储为多个块&#xff0c;不同的是&#…
阅读更多...
SOLIDWORKS——参数化建模

SOLIDWORKS——参数化建模

https://www.sohu.com/a/259742200_100042821 知识点&#xff1a;投影曲线、曲面填充、扫描、外观设置 建模步骤 1.先在工具——方程式里输入一个直径的变量A120 。 2.在前视基准面上草绘圆&#xff0c;画一条直径。直径等于变量A。 3.旋转&#xff0c;选择粉色区域。 4.上视…
阅读更多...
Arch 常用工具

Arch 常用工具

一、网络浏览pacman -S firefox firefox-i18n注&#xff1a;该命令中的前者为 Firefox 主程序,后者为语言包。pacman -S opera二、图像编辑pacman -S gimp #图像编辑软件首选 GIMPpacman -S inkscape #矢量图形编辑软件Inkscapepacman -S scrot #…
阅读更多...
Androd安全——反编译技术完全解析

Androd安全——反编译技术完全解析

0&#xff0e;前言单纯从技术角度上来讲&#xff0c;掌握反编译功能确实是一项非常有用的技能。另外既然别人可以反编译程序&#xff0c;我们当然有理由应该对程序进行一定的保护&#xff0c;因此代码混淆也是我们必须要掌握的一项技术。看完此篇如果对代码混淆也感兴趣&#x…
阅读更多...
python——shape 与reshape

python——shape 与reshape

转载自:https://blog.csdn.net/u010916338/article/details/84066369 shape()和reshape()都是数组array中的方法 numpy中reshape函数的三种常见相关用法 numpy.arange(n).reshape(a, b) 依次生成n个自然数&#xff0c;并且以a行b列的数组形式显示np.arange(16).reshape(2,…
阅读更多...
误删了microsoft visual c++后如何正常运行matlab

误删了microsoft visual c++后如何正常运行matlab

误删了microsoft visual c后如何正常运行matlab 本人在卸载visual studio2013的时候&#xff0c;因为这个软件卸载的过程中出现一些问题&#xff0c;误将visual c当成VS的组件一同删除了。但是在打开matlab 时发现出错&#xff0c;matlab打开后会出现下面的界面。 出现这个问题…
阅读更多...
iScreenLocker 3.1.8 安卓锁屏通知--苹果一样的体验

iScreenLocker 3.1.8 安卓锁屏通知--苹果一样的体验

*软件介绍:苹果锁屏通知(iScreenLocker)是一款android上ios风格的锁屏软件。它颠覆安智通知设计&#xff0c;将原来状态栏的通知搬到锁屏界面上来&#xff0c;能够在桌面轻松收发短信,微博,微信等消息。它独有的消息唤醒功能。能使手机从待机界面唤醒而消耗非常少的电量。手指轻…
阅读更多...
JSP慕课网阶段用户登录小例子(不用数据库)

JSP慕课网阶段用户登录小例子(不用数据库)

getAttribute和setAttribute一起使用&#xff0c;而getParameter用于取得如request传来的参数。 Web是请求/响应架构的使用&#xff0c;而request和response就是在服务器端生成的相应的两个对象&#xff0c;request能够获取客户端传递的参数及相关的一些信息&#xff0c;而resp…
阅读更多...
最新文章

Copyright @ 2022~2023