mysql主从复制实现SSL加密和半同步复制

sdsk

MySQL支持单向、异步复制，复制过程中一个服务器充当主服务器，而一个或多个其它服务器充当从服务器。这与同步复制可以进行对比，同步复制是MySQL的一个特征。主服务器将更新写入二进制日志文件，并维护文件的一个索引以跟踪日志循环。这些日志可以记录发送到从服务器的更新。当一个从服务器连接主服务器时，它通知主服务器从服务器在日志中读取的最后一次成功更新的位置。从服务器接收从那时起发生的任何更新，然后并等待主服务器通知新的更新。

------------------------------------------------------------------------------------------------------
实验环境在redhat6.4 ▎ 安装包使用的mysql-5.5.33版本的。
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1.下载完mysq安装包到主服务器上
mysql-5.5.33-linux2.6-x86_64.tar.gz

2.复制安装包到从服务器上
[iyunv@yulong ~]# scp mysql-5.5.33-linux2.6-x86_64.tar.gz root@172.16.8.11:/root
3.解压包到指定路径下
tar xf mysql-5.5.33-linux2.6-x86_64.tar.gz -C /usr/local
4.新建一个mysql用户和mysql的数据库目录,修改创建的目录属主和属组为mysql


[iyunv@yulong local]# useradd -r -u 306mysql
[iyunv@yulong local]# mkdir -pv /mydata/data
[iyunv@yulong local]# chown -R mysql:mysql /mydata/data/
[iyunv@yulong local]# ls -ld /mydata/data/
drwxr-xr-x 2mysql mysql 4096Aug 2611:52/mydata/data/
5.创建一个软连接为mysql,并把mysql里面的文件属主改为root属组为mysql


[iyunv@yulong local]# ln -sv mysql-5.5.33-linux2.6-x86_64 mysql
`mysql' -> `mysql-5.5.33-linux2.6-x86_64'
[iyunv@yulong local]# cd /usr/local/mysql
[iyunv@yulong mysql]# chown -R root:mysql *
6.初始化数据库一些准备


[iyunv@yulong ]# cd /usr/local/mysql
[iyunv@yulong mysql]# cp support-files/my-large.cnf /etc/my.cnf
[iyunv@yulong mysql]# cp support-files/mysql.server /etc/rc.d/init.d/mysqld
[iyunv@yulong mysql]# echo 'export PATH=/usr/local/mysql/bin:$PATH'> /etc/profile.d/mysql.sh
[iyunv@yulong mysql]# . /etc/profile.d/mysql.sh
cp主配置文件
cpmysq.server脚本到启动路径下
输出环境变量
重读下环境变量配置文件
7.初始化mysql数据库


[iyunv@yulong mysql]# vim /etc/my.cnf
datadir=/mydata/data
innodb_file_per_table = 1
[iyunv@yulong mysql]# scripts/mysql_install_db --user=mysql --datadir=/mydata/data/
Installing MySQL system tables...
OK
Filling help tables...
OK
8.启动mysql服务


[iyunv@yulong mysql]# service mysqld start
[iyunv@yulong mysql]# netstat -tnlp
tcp 000.0.0.0:33060.0.0.0:* LISTEN 3018/mysqld
9.下面配置主服务的一些参数，使从服务器可以同步数据


[iyunv@yulong mysql]# mysql
mysql> grant replication slave,replication client on *.* to tom@'172.16.%.%'identified by'redhat';
mysql> flush privileges;
Query OK, 0rows affected (0.00sec)
mysql> show master status;
+------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000003| 351| | |
+------------------+----------+--------------+------------------+
1row inset(0.00sec)
10.从服务器上配置步骤和1-8的步骤一样这里就不再次配置了
11.编辑从服务器上主配置文件


[iyunv@localhost mysql]# vim /etc/my.cnf
server-id = 20
relay-log = /mydata/data/relay-bin
添加上面这两项
12.启动复制线程

mysql> CHANGE MASTER TO MASTER_HOST='172.16.8.10', MASTER_USER='tom', MASTER_PASSWORD='redhat'
13.在主服务器上添加一个数据，看看主从是不是一样的


mysql> create database qq;
mysql> create database taobao;
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| qq |
| taobao |
| test |
+--------------------+
6rows inset(0.01sec)
14.在从服务器上查看


mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| qq |
| taobao |
| test |
+--------------------+
6rows inset(0.00sec)
从上面的对比看出数据是一样的
二.下面来实现增量复制
1.先把从服务器数据库停掉


[iyunv@localhost data]# service mysqld stop
Shutting down MySQL.... [ OK ]
2.删除数据库目录中的数据和重新初始化


[iyunv@localhost ~]# rm -rf /mydata/data/
[iyunv@localhost mysql]# scripts/mysql_install_db --user=mysql --datadir=/mydata/data/
3.在主数据库中添加一些数据在备份下数据库


mysql> create table zhongqiu ( id int,name varchar);
Query OK, 0rows affected (0.38sec)
mysql> insert into zhongqiu values (1,q),(2,n),(3,j);
mysql> select * from zhongqiu;
+------+------+
| id | name |
+------+------+
| 1| q |
| 2| n |
| 3| j |
| 1| l |
[iyunv@yulong data]# mysqldump -uroot --all-databases --lock-all-tables --events --master-data=2> /tmp/all.sql
4.把备份的数据导入到从服务器上


[iyunv@yulong data]# scp /tmp/all.sql root@172.16.8.11:/root/
[iyunv@localhost ~]# mysql < all.sql
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| qq |
| taobao |
| test |
+--------------------+
scp到从服务器上
导入数据
5.然后从导入数据之后开始复制主服务上的数据


[iyunv@localhost ~]# head -30all.sql
找到数据最后记录的位置大概就是下面这段
-- CHANGE MASTER TO MASTER_LOG_FILE='mysql-bin.000003', MASTER_LOG_POS=1034;
mysql> CHANGE MASTER TO MASTER_HOST='172.16.8.10', MASTER_USER='tom', MASTER_PASSWORD='redhat', MASTER_PORT=3306, MASTER_LOG_FILE='mysql-bin.000003', MASTER_LOG_POS=1034;
Query OK, 0rows affected (0.16sec)
mysql> start slave;
Query OK, 0rows affected (0.03sec)
mysql> show slave status\G
*************************** 1. row ***************************
Slave_IO_State: Waiting formaster to send event
Master_Host: 172.16.8.10
Master_User: tom
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mysql-bin.000003
Read_Master_Log_Pos: 1034
Relay_Log_File: ralay-bin.000002
Relay_Log_Pos: 253
Relay_Master_Log_File: mysql-bin.000003
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
6.在主服务器上添加数据看看从服务器是否同步


mysql> create database nihao;
主的：mysql> show databases; 从的：mysql> show databases;
+--------------------+ +--------------------+
| Database | | Database |
+--------------------+ +--------------------+
| information_schema | | information_schema |
| mysql | | mysql |
| nihao | | nihao |
| performance_schema | | performance_schema |
| qq | | qq |
| taobao | | taobao |
| test | | test |
+--------------------+ +--------------------+
7rows inset(0.03sec) 7rows inset(0.03sec)
三.实现半同步
1.在主服务器上安装master模块


mysql> install plugin rpl_semi_sync_master soname 'semisync_master.so';
Query OK, 0rows affected (0.06sec)
mysql> SET GLOBAL rpl_semi_sync_master_enabled = 1;
mysql> SET GLOBAL rpl_semi_sync_master_timeout = 1000;
2.在从服务器安装添加Slave模块


mysql> INSTALL PLUGIN rpl_semi_sync_slave SONAME 'semisync_slave.so';
mysql> SET GLOBAL rpl_semi_sync_slave_enabled = 1;
mysql> STOP SLAVE IO_THREAD; START SLAVE IO_THREAD;
3.查看主服务器上的semi_sync是否开启，注意clients 变为1，证明主从半同步复制连接成功:


mysql> SHOW GLOBAL STATUS LIKE 'rpl_semi%';
mysql> SHOW GLOBAL STATUS LIKE '%rpl_semi%';
+--------------------------------------------+-------+
| Variable_name | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients | 1|
| Rpl_semi_sync_master_net_avg_wait_time | 863|
| Rpl_semi_sync_master_net_wait_time | 863|
| Rpl_semi_sync_master_net_waits | 1|
| Rpl_semi_sync_master_no_times | 0|
| Rpl_semi_sync_master_no_tx | 0|
| Rpl_semi_sync_master_status | ON |
| Rpl_semi_sync_master_timefunc_failures | 0|
| Rpl_semi_sync_master_tx_avg_wait_time | 0|
| Rpl_semi_sync_master_tx_wait_time | 0|
| Rpl_semi_sync_master_tx_waits | 0|
| Rpl_semi_sync_master_wait_pos_backtraverse | 0|
| Rpl_semi_sync_master_wait_sessions | 0|
| Rpl_semi_sync_master_yes_tx | 1|
+--------------------------------------------+-------+
14rows inset(0.02sec)
正常滴
为mysql建立安全的SSL加密
1.在主服务器上为CA生成一个私钥


[iyunv@yulong CA]# (umask 077;openssl genrsa -out private/cakye.pem 2048)
Generating RSA privatekey, 2048bit long modulus
..........................................................................+++
..............................+++
2.在主服务器上生成自签证书


[iyunv@yulong CA]# openssl req -new-x509 -key private/cakye.pem -out cacert.pem -days 365
Country Name (2letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:beijing
Organizational Unit Name (eg, section) []:beijing
Common Name (eg, your name or your server's hostname) []:172.16.8.10
3.主服务器上申请证书


[iyunv@yulong data]# mkdir ssl
[iyunv@yulong data]# chown mysql.mysql ssl
[iyunv@yulong data]# (umask 077; openssl genrsa -out /usr/local/mysql/ssl/master.key 2048)
[iyunv@yulong data]# openssl req -new-key /usr/local/mysql/ssl/master.key -out /usr/local/mysql/ssl/master.csr
[iyunv@yulong data]# openssl ca -in/usr/local/mysql/ssl/master.csr -out /usr/local/mysql/ssl/master.crt -days 365
4.编辑主服务器上的配置文件支持SSL功能


[iyunv@yulong data]# vim /etc/my.cnf
ssl
ssl-ca=/etc/pki/CA/cacert.pem
ssl-cert=/usr/local/mysql/ssl/master.crt
ssl-key=/usr/local/mysql/ssl/master.key
5.在从服务器上生成一个签署证书


[iyunv@yulong data]# mkdir ssl
[iyunv@yulong data]# chown mysql.mysql ssl
[iyunv@yulong data]# (umask 077; openssl genrsa -out /usr/local/mysql/ssl/mysql.key 2048)
[iyunv@yulong data]# openssl req -new-key /usr/local/mysql/ssl/master.key -out /usr/local/mysql/ssl/mysql.csr
6.把签署证书发送到主服务器上,在主服务器上签署证书后在发给从服务器


[iyunv@localhost ssl]# scp mysql.csr root@172.16.8.10:/etc/pki/CA
[iyunv@yulong CA]# openssl ca -inmysql.csr -out mysql.crt -days 365
[iyunv@yulong CA]# scp cacert.pem mysql.crt root@172.16.8.11:/usr/local/mysql/ssl
[iyunv@yulong ssl]## chown -R mysql.mysql * 把放秘钥的文件中的属主和属组调整为mysql
7.配置my.cnf文件在开启SSL重启服务


[iyunv@yulong data]# echo 'ssl'> /etc/cnf
[iyunv@yulong data]#service mysqld restart
8主上创建ssl链接的用户
mysql> grant replication client,replication slave on *.* to openssl@172.16.8.11identified by 'redhat';
9.从服务器上通过ssl链接主服务器
mysql > change master to master_host='172.16.8.10', master_user='openssl', master_password='redhat', master_log_file='mysql-bin.000007',master_port=3306,master_log_pos=430, master_ssl=1, master_ssl_ca='/usr/local/mysql/ssl/cacert.pem', master_ssl_cert='/usr/local/mysql/ssl/mysql.crt', master_ssl_key='/usr/local/mysql/ssl/mysql.key';
10.查看slave的状态


mysql> show slave status\G
*************************** 1. row ***************************
Slave_IO_State: Waiting formaster to send event
Master_Host: 172.16.8.10
Master_User: openssl
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: mysql-bin.000007
Read_Master_Log_Pos: 430
Relay_Log_File: ralay-bin.000002
Relay_Log_Pos: 253
Relay_Master_Log_File: mysql-bin.000007
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 430
Relay_Log_Space: 403
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes
Master_SSL_CA_File: /usr/local/mysql/ssl/cacert.pem
Master_SSL_CA_Path:
Master_SSL_Cert: /usr/local/mysql/ssl/mysql.crt
Master_SSL_Cipher:
Master_SSL_Key: /usr/local/mysql/ssl/mysql.key
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_SQL_Errno: 0
Last_SQL_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 1
1row inset(0.00sec)
11.通过命令看下链接状态


[iyunv@localhost ssl]# mysql --ssl-ca=/usr/local/mysql/ssl/cacert.pem --ssl-cert=/usr/local/mysql/ssl/mysql.crt --ssl-key=/usr/local/mysql/ssl/mysql.key -uopenssl -h172.16.8.10-predhat
mysql> \s
--------------
mysql Ver 14.14Distrib 5.5.33, forlinux2.6(x86_64) using readline 5.1
Connection id: 15
Current database:
Current user: openssl@172.16.8.11
SSL: Cipher inuseisDHE-RSA-AES256-SHA
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server version: 5.5.33-log MySQL Community Server (GPL)
Protocol version: 10
Connection: 172.16.8.10via TCP/IP
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
TCP port: 3306
Uptime: 9min 47sec

51qsx

别人再好，也是别人。自己再不堪，也是自己，独一无二的自己。

寂寞大萝卜

时间让我们认识了自己也肯定了对方//