复制概述
MySQL的内建的复制功能是构建大型，高性能应用程序的基础。将MySQL的的数据分布到多个系统上去，这种分布的机制，是通过将MySQL的的某一台主机的数据复制到其它主机（从站）上，并重新执行一遍来实现的。复制过程中一个服务器充当主服务器，而一个或多个其它服务器充当从服务器。主服务器将更新写入二进制日志文件，并维护文件的一个索引以跟踪日志循环。这些日志可以记录发送到从服务器的更新。当一个从服务器连接主服务器时，它通知主服务器从服务器在日志中读取的最后一次成功更新的位置。从服务器接收从那时起发生的任何更新，然后封锁并等待主服务器通知新的更新。
请注意当你进行复制时，所有对复制中的表的更新必须在主服务器上进行。否则，你必须要小心，以避免用户对主服务器上的表进行的更新与对从服务器上的表所进行的 新之间的冲突。
以下实验环境在centos7.3下完成，数据库为MariaDB的5.5
时间同步。
一：主从复制架构
主从复制可以一主一从，也可以是一主多从
架构角色
主服务器mysql-master：172.16.252.192
从服务器mysql-slave：172.16.252.190
主数据库和从数据库需提前安装好mariadb数据库
[root@mysql-master ~]# yum -y install mariadb-server
[root@mysql-master ~]# iptables -F
1、主服务器配置
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf //编辑mysql配置文件
[mysqld]
server-id = 1 //设置服务器ID
log_bin = master-log //开启二进制日志
innodb_file_per_table = ON //使用每表单独空间
skip_name_resolve = ON //跳过名称解析
[root@centos7 ~]#systemctl start mariadb.service
2、从服务器配置
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf //编辑mysql配置文件
[mysqld]
server-id = 2 //从服务器的ID
relay-log = relay-log //开启从节点的中继日志文件
skip_name_resolve = ON //跳过名称解析
innodb_file_per_table = ON //使用每表单独空间
read-only = 1 //开启只读模式
[root@centos7 ~]#systemctl start mariadb.service
3、在主节点创建有复制权限的用户账号
MariaDB [(none)]> show master status; 查看二进制日志节点位置
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 245 | | |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252 .%' IDENTIFIED BY 'replpass'; //创建拥有复制用户账号 （最小权限法则）
MariaDB [(none)]> flush privileges; //刷新
MariaDB [(none)]> show master status;
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 424 | | |
+-------------------+----------+--------------+------------------+
从服务器如果不创建用户，就从主节点创建用户后的424位置开始复制。
4、开启从服务器复制线程：
MariaDB [(none)]> show slave status;
Empty set (0.00 sec) //没有配置为空，
MariaDB [(none)]> show processlist; //从服务器还没有启动复制线程
+----+------+-----------+------+---------+------+-------+------------------+----------+
| Id | User | Host | db | Command | Time | State | Info | Progress |
+----+------+-----------+------+---------+------+-------+------------------+----------+
| 2 | root | localhost | NULL | Query | 0 | NULL | show processlist | 0.000 |
+----+------+-----------+------+---------+------+-------+------------------+----------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=424;
//使用有复制权限的用户账号连接至主服务器，并启动复制线程
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State:
Master_Host: 172.16.252.192 //主服务器IP
Master_User: repluser //授权的用户
Master_Port: 3306 //主服务器端口
Connect_Retry: 60 //重试时间
Master_Log_File: master-log.000003 //从哪个二进制的文件开启读取
Read_Master_Log_Pos: 424 //读取二进制的开始位置
Relay_Log_File: relay-log.000001 //读取的中继日志文件
Relay_Log_Pos: 4 //读取的中继日志位置
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: No // I/O Thread启动情况 现在是没有开启
Slave_SQL_Running: No //SQL Thread启动情况 现在是没有开启
Replicate_Do_DB:
......
MariaDB [(none)]> start slave; //启动两线程
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 172.16.252.192
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: master-log.000003
Read_Master_Log_Pos: 499
Relay_Log_File: relay-log.000002 //这里中继做了初始化
Relay_Log_Pos: 605
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: Yes //已开启
Slave_SQL_Running: Yes //已开启
Replicate_Do_DB:
MariaDB [(none)]> show processlist;
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
| Id | User | Host | db | Command | Time | State | Info | Progress |
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
| 2 | root | localhost | NULL | Query | 0 | NULL | show processlist | 0.000 |
| 3 | system user | | NULL | Connect | 20 | Waiting for master to send event | NULL | 0.000 |
| 4 | system user | | NULL | Connect | 791 | Slave has read all relay log; waiting for the slave I/O thread to update it | NULL | 0.000 |
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
//可以看到启动了两个线程，一个时等待主服务器发送的时间，一个是读取中继日志做同步
[root@cnetos7 ~]#ll /var/lib/mysql/master.info
//这个文件保存了主服务器的链接信息，包括账号密码等，下次重启服务会自动通过此文件连接主服务器
[root@cnetos7 ~]#ll /var/lib/mysql/relay-log.info
//此文件保存从服务器使用的中继日志、POS和主服务器使用的二进制日志、POS，服务器启动也会读取此文件
5、测试：
主服务器：
MariaDB [(none)]> create database testdb;
从服务器：
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| test |
| testdb |
+--------------------+
二：实现双主复制
双主复制容易产生数据不一致，请慎用
1、在两台服务器上设置
server 1
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
server-id = 1
log_bin = master-log
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
auto_increment_offset = 1 //1开始，
auto_increment_increment = 2 //自动增长2
server 2
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
server-id = 2
log_bin = master-log
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
auto_increment_offset = 2 //2开始，
auto_increment_increment = 2 //自动增长2
要实现双主复制，这时每台主机上都要开启二进制日志、中继日志以及每台主机的唯一的server-id
2、开启服务器复制线程
server1
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 509 | | |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=509;
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 172.16.252.192
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: master-log.000003
Read_Master_Log_Pos: 509
Relay_Log_File: relay-log.000002
Relay_Log_Pos: 530
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
server2
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 509 | | |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=509;
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 172.16.252.192
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: master-log.000003
Read_Master_Log_Pos: 509
Relay_Log_File: relay-log.000002
Relay_Log_Pos: 530
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
3、测试
server1
MariaDB [(none)]> create database mydb;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> use mydb;
Database changed
MariaDB [mydb]> create table tb1(id int unsigned auto_increment primary key,name varchar(200));
Query OK, 0 rows affected (0.01 sec)
MariaDB [mydb]> insert into tb1 (name) values ('xiaoming'),('xiaohua'),('xiaogang');
Query OK, 3 rows affected (0.00 sec)
Records: 3 Duplicates: 0 Warnings: 0
MariaDB [mydb]> select * from tb1;
+----+----------+
| id | name |
+----+----------+
| 1 | xiaoming |
| 3 | xiaohua |
| 5 | xiaogang |
+----+----------+
server2
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mydb |
| mysql |
| performance_schema |
| test |
+--------------------+
5 rows in set (0.00 sec)
MariaDB [(none)]> use mydb;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
MariaDB [mydb]> insert into tb1 (name) values ('xiaodong'),('xiaoli'),('xiaoghong');
Query OK, 3 rows affected (0.00 sec)
Records: 3 Duplicates: 0 Warnings: 0
MariaDB [mydb]> select * from tb1;
+----+-----------+
| id | name |
+----+-----------+
| 1 | xiaoming |
| 3 | xiaohua |
| 5 | xiaogang |
| 6 | xiaodong |
| 8 | xiaoli |
| 10 | xiaoghong |
+----+-----------+
server1
MariaDB [mydb]> select * from tb1;
+----+----------+
| id | name |
+----+----------+
| 1 | xiaoming |
| 3 | xiaohua |
| 5 | xiaogang |
+----+----------+
3 rows in set (0.01 sec)
MariaDB [mydb]> select * from tb1;
+----+-----------+
| id | name |
+----+-----------+
| 1 | xiaoming |
| 3 | xiaohua |
| 5 | xiaogang |
| 6 | xiaodong |
| 8 | xiaoli |
| 10 | xiaoghong |
+----+-----------+
6 rows in set (0.00 sec)
三，半同步复制的实现
基于插件实现，亦支持多种插件：在/ usr / lib64下/ MySQL的/插件/
[root@cnetos7 mysql]#rpm -ql mariadb-server
......
/usr/lib64/mysql/plugin/auth_0x0100.so
/usr/lib64/mysql/plugin/auth_pam.so
/usr/lib64/mysql/plugin/auth_socket.so
/usr/lib64/mysql/plugin/auth_test_plugin.so
/usr/lib64/mysql/plugin/daemon_example.ini
/usr/lib64/mysql/plugin/dialog_examples.so
/usr/lib64/mysql/plugin/ha_innodb.so
/usr/lib64/mysql/plugin/ha_sphinx.so
/usr/lib64/mysql/plugin/handlersocket.so
/usr/lib64/mysql/plugin/libdaemon_example.so
/usr/lib64/mysql/plugin/mypluglib.so
/usr/lib64/mysql/plugin/qa_auth_client.so
/usr/lib64/mysql/plugin/qa_auth_interface.so
/usr/lib64/mysql/plugin/qa_auth_server.so
/usr/lib64/mysql/plugin/query_cache_info.so
/usr/lib64/mysql/plugin/semisync_master.so //半同步复制使用插件
/usr/lib64/mysql/plugin/semisync_slave.so //半同步复制使用插件
/usr/lib64/mysql/plugin/server_audit.so
/usr/lib64/mysql/plugin/sphinx.so
/usr/lib64/mysql/plugin/sql_errlog.so
......
主服务器：
1.编辑配置文件
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 1
log_bin = master-log
innodb_file_per_table = ON
skip_name_resolve = ON
[root@centos7 ~]#systemctl start mariadb
2.创建复制用户
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 499 | | |
+-------------------+----------+--------------+------------------+
3.安装半同步复制主节点插件
MariaDB [(none)]> INSTALL PLUGIN rpl_semi_sync_master SONAME 'semisync_master.so'; //安装插件
MariaDB [(none)]> SHOW PLUGINS; //查看是否完成
+--------------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+--------------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
......
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| rpl_semi_sync_master | ACTIVE | REPLICATION | semisync_master.so | GPL |
+--------------------------------+----------+--------------------+--------------------+---------+
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%'; //查看半同步复制相关信息
+------------------------------------+-------+
| Variable_name | Value |
+------------------------------------+-------+
| rpl_semi_sync_master_enabled | OFF | //半同步复制的主节点(ON|OFF)
| rpl_semi_sync_master_timeout | 10000 | //等待从节点的超时时间，10s
| rpl_semi_sync_master_trace_level | 32 | //跟踪级别
| rpl_semi_sync_master_wait_no_slave | ON | //在没有从节点的时候是否等待
+------------------------------------+-------+
MariaDB [(none)]> SET GLOBAL rpl_semi_sync_master_enabled = ON; //开启半同步复制为主节点
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';
+------------------------------------+-------+
| Variable_name | Value |
+------------------------------------+-------+
| rpl_semi_sync_master_enabled | ON |
| rpl_semi_sync_master_timeout | 10000 |
| rpl_semi_sync_master_trace_level | 32 |
| rpl_semi_sync_master_wait_no_slave | ON |
+------------------------------------+-------+
MariaDB [(none)]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients | 0 | //有多少个半同步节点
| Rpl_semi_sync_master_net_avg_wait_time | 0 | //平均等待时间 （非事物型）
| Rpl_semi_sync_master_net_wait_time | 0 | //等待时间多长（非事物型）
| Rpl_semi_sync_master_net_waits | 0 | //等待发生多少次（非事物型）
| Rpl_semi_sync_master_no_times | 0 |
| Rpl_semi_sync_master_no_tx | 0 |
| Rpl_semi_sync_master_status | ON |
| Rpl_semi_sync_master_timefunc_failures | 0 |
| Rpl_semi_sync_master_tx_avg_wait_time | 0 | /平均等待时间 （事物型）
| Rpl_semi_sync_master_tx_wait_time | 0 | //等待时间多长（事物型）
| Rpl_semi_sync_master_tx_waits | 0 | //等待发生多少次（事物型）
| Rpl_semi_sync_master_wait_pos_backtraverse | 0 |
| Rpl_semi_sync_master_wait_sessions | 0 |
| Rpl_semi_sync_master_yes_tx | 0 |
+--------------------------------------------+-------+
等从服务器开启半同步复制作为从节点，在查询一次
MariaDB [(none)]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients | 1 | //这里显示为1
| Rpl_semi_sync_master_net_avg_wait_time | 0 |
| Rpl_semi_sync_master_net_wait_time | 0 |
| Rpl_semi_sync_master_net_waits | 0 |
| Rpl_semi_sync_master_no_times | 0 |
| Rpl_semi_sync_master_no_tx | 0 |
| Rpl_semi_sync_master_status | ON |
| Rpl_semi_sync_master_timefunc_failures | 0 |
| Rpl_semi_sync_master_tx_avg_wait_time | 0 |
| Rpl_semi_sync_master_tx_wait_time | 0 |
| Rpl_semi_sync_master_tx_waits | 0 |
| Rpl_semi_sync_master_wait_pos_backtraverse | 0 |
| Rpl_semi_sync_master_wait_sessions | 0 |
| Rpl_semi_sync_master_yes_tx | 0 |
+--------------------------------------------+-------+
从服务器：
1.编辑配置文件
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 2
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
[root@centos7 ~]#systemctl start mariadb
2、安装半同步复制从节点插件
MariaDB [(none)]> INSTALL PLUGIN rpl_semi_sync_slave SONAME 'semisync_slave.so'; //安装插件
MariaDB [(none)]> SHOW PLUGINS; //查看是否完成
+--------------------------------+----------+--------------------+-------------------+---------+
| Name | Status | Type | Library | License |
+--------------------------------+----------+--------------------+-------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
......
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| rpl_semi_sync_slave | ACTIVE | REPLICATION | semisync_slave.so | GPL |
+--------------------------------+----------+--------------------+-------------------+---------+
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%'; //查看半同步复制相关信息
+---------------------------------+-------+
| Variable_name | Value |
+---------------------------------+-------+
| rpl_semi_sync_slave_enabled | OFF |
| rpl_semi_sync_slave_trace_level | 32 |
+---------------------------------+-------+
MariaDB [(none)]> SET GLOBAL rpl_semi_sync_slave_enabled = ON; /开启半同步复制为从节点
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';
+---------------------------------+-------+
| Variable_name | Value |
+---------------------------------+-------+
| rpl_semi_sync_slave_enabled | ON |
| rpl_semi_sync_slave_trace_level | 32 |
+---------------------------------+-------+
3.连接主节点
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=499; //连接主节点
MariaDB [(none)]> start slave; //开启从节点
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 172.16.252.192
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: master-log.000003
Read_Master_Log_Pos: 499
Relay_Log_File: relay-log.000002
Relay_Log_Pos: 530
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
测试：
MariaDB [(none)]> create database medb;
MariaDB [(none)]> use medb;
MariaDB [medb]> create table tb1(id int unsigned auto_increment primary key,name varchar(200));
MariaDB [medb]> insert into tb1 (name) values ('hong'),('yan'),('L');
MariaDB [medb]> select * from tb1;
+----+------+
| id | name |
+----+------+
| 1 | hong |
| 2 | yan |
| 3 | L |
+----+------+
MariaDB [medb]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients | 1 |
| Rpl_semi_sync_master_net_avg_wait_time | 724 |
| Rpl_semi_sync_master_net_wait_time | 2174 |
| Rpl_semi_sync_master_net_waits | 3 |
| Rpl_semi_sync_master_no_times | 0 |
| Rpl_semi_sync_master_no_tx | 0 |
| Rpl_semi_sync_master_status | ON |
| Rpl_semi_sync_master_timefunc_failures | 0 |
| Rpl_semi_sync_master_tx_avg_wait_time | 1169 |
| Rpl_semi_sync_master_tx_wait_time | 2339 |
| Rpl_semi_sync_master_tx_waits | 2 |
| Rpl_semi_sync_master_wait_pos_backtraverse | 0 |
| Rpl_semi_sync_master_wait_sessions | 0 |
| Rpl_semi_sync_master_yes_tx | 3 |
+--------------------------------------------+-------+
四、实现基于SSL的复制
主服务器：
1.配置CA
[root@centos7 ~]#cd /etc/pki/CA
[root@centos7 CA]#touch index.txt //生成证书索引数据库文件(默认没有）
[root@centos7 CA]#echo 01 > serial //指定第一个颁发证书的序列号（默认也没有 这里01两位采用的是十六进制）
2.生成自签证书
[root@centos7 CA]#(umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@centos7 CA]#openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
3.生成用于MySQL的的SSL文件及修改权限权限
[root@centos7 CA]#mkdir /var/lib/mysql/ssl
[root@centos7 CA]#cd /var/lib/mysql/ssl
[root@centos7 ssl]#(umask 077;openssl genrsa -out master.key 2048)
[root@centos7 ssl]#openssl req -new -key master.key -out master.csr
[root@centos7 ssl]#openssl ca -in master.csr -out master.crt -days 365
[root@centos7 ssl]#cp /etc/pki/CA/cacert.pem /var/lib/mysql/ssl/
[root@centos7 ssl]#ll
total 20
-rw-r--r-- 1 root root 1257 Sep 14 16:10 cacert.pem
-rw-r--r-- 1 root root 4353 Sep 14 16:09 master.crt
-rw-r--r-- 1 root root 972 Sep 14 16:06 master.csr
-rw------- 1 root root 1675 Sep 14 16:05 master.key
[root@centos7 ssl]#chown -R mysql.mysql /var/lib/mysql/ssl/*
[root@centos7 ssl]#ll
total 20
-rw-r--r-- 1 mysql mysql 1257 Sep 14 16:10 cacert.pem
-rw-r--r-- 1 mysql mysql 4353 Sep 14 16:09 master.crt
-rw-r--r-- 1 mysql mysql 972 Sep 14 16:06 master.csr
-rw------- 1 mysql mysql 1675 Sep 14 16:05 master.key
从服务器：
1.生成私钥
[root@cnetos7 mysql]#mkdir /var/lib/mysql/ssl
[root@cnetos7 mysql]#cd /var/lib/mysql/ssl
[root@cnetos7 ssl]#(umask 077;openssl genrsa -out slave.key 2048)
[root@cnetos7 ssl]#openssl req -new -key slave.key -out slave.csr
[root@cnetos7 ssl]#scp slave.csr 172.16.252.192:/etc/pki/CA/csr //传给主服务器
2.主服务器上的CA颁发证书
[root@centos7 ssl]#cd /etc/pki/CA/csr
[root@centos7 csr]#openssl ca -in slave.csr -out ../certs/slave.crt -days 365
[root@centos7 csr]#scp ../certs/slave.crt 172.16.252.190:/var/lib/mysql/ssl
[root@centos7 csr]#scp /etc/pki/CA/cacert.pem 172.16.252.190:/var/lib/mysql/ssl
3.改权限权限
[root@cnetos7 ssl]#ll
总用量 20
-rw-r--r--. 1 root root 1257 9月 14 16:27 cacert.pem
-rw-r--r--. 1 root root 4394 9月 14 16:26 slave.crt
-rw-r--r--. 1 root root 997 9月 14 16:24 slave.csr
-rw-------. 1 root root 1675 9月 14 16:15 slave.key
[root@cnetos7 ssl]#chown -R mysql.mysql /var/lib/mysql/ssl/*
[root@cnetos7 ssl]#ll
总用量 20
-rw-r--r--. 1 mysql mysql 1257 9月 14 16:27 cacert.pem
-rw-r--r--. 1 mysql mysql 4394 9月 14 16:26 slave.crt
-rw-r--r--. 1 mysql mysql 997 9月 14 16:24 slave.csr
-rw-------. 1 mysql mysql 1675 9月 14 16:15 slave.key
主服务器的MySQL配置
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 1
log_bin = master-log
innodb_file_per_table = ON
skip_name_resolve = ON
ssl
ssl-ca = /var/lib/mysql/ssl/cacert.pem
ssl-cert = /var/lib/mysql/ssl/master.crt
ssl-key = /var/lib/mysql/ssl/master.key
[root@centos7 ~]#systemctl start mariadb
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%ssl%'; //验证主节点配置文件是否成功
+---------------+-------------------------------+
| Variable_name | Value |
+---------------+-------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /var/lib/mysql/ssl/cacert.pem |
| ssl_capath | |
| ssl_cert | /var/lib/mysql/ssl/master.crt |
| ssl_cipher | |
| ssl_key | /var/lib/mysql/ssl/master.key |
+---------------+-------------------------------+
出现以上信息表示成功
从服务器的MySQL配置
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 2
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
ssl
ssl-ca = /var/lib/mysql/ssl/cacert.pem
ssl-cert = /var/lib/mysql/ssl/slave.crt
ssl-key = /var/lib/mysql/ssl/slave.key
[root@centos7 ~]#systemctl start mariadb
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%ssl%'; //验证从节点配置文件是否成功
+---------------+-------------------------------+
| Variable_name | Value |
+---------------+-------------------------------+
| have_openssl | YES |
| have_ssl | YES |
| ssl_ca | /var/lib/mysql/ssl/cacert.pem |
| ssl_capath | |
| ssl_cert | /var/lib/mysql/ssl/slave.crt |
| ssl_cipher | |
| ssl_key | /var/lib/mysql/ssl/slave.key |
+---------------+-------------------------------+
出现以上信息表示成功，
创建复制用户
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 | 499 | | |
+-------------------+----------+--------------+------------------+
从节点连接主节点
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=499,MASTER_SSL=1,MASTER_SSL_CA='/var/lib/mysql/ssl/cacert.pem',MASTER_SSL_CERT='/var/lib/mysql/ssl/slave.crt',MASTER_SSL_KEY='/var/lib/mysql/ssl/slave.key';
//可（MariaDB [(none)]> help change master to）查看连接配置帮助
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
Slave_IO_State: Waiting for master to send event
Master_Host: 172.16.252.192
Master_User: repluser
Master_Port: 3306
Connect_Retry: 60
Master_Log_File: master-log.000003
Read_Master_Log_Pos: 499
Relay_Log_File: relay-log.000002
Relay_Log_Pos: 530
Relay_Master_Log_File: master-log.000003
Slave_IO_Running: Yes
Slave_SQL_Running: Yes
Replicate_Do_DB:
Replicate_Ignore_DB:
Replicate_Do_Table:
Replicate_Ignore_Table:
Replicate_Wild_Do_Table:
Replicate_Wild_Ignore_Table:
Last_Errno: 0
Last_Error:
Skip_Counter: 0
Exec_Master_Log_Pos: 499
Relay_Log_Space: 818
Until_Condition: None
Until_Log_File:
Until_Log_Pos: 0
Master_SSL_Allowed: Yes //连接成功
Master_SSL_CA_File: /var/lib/mysql/ssl/cacert.pem
Master_SSL_CA_Path:
Master_SSL_Cert: /var/lib/mysql/ssl/slave.crt
Master_SSL_Cipher:
Master_SSL_Key: /var/lib/mysql/ssl/slave.key
Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
Last_IO_Errno: 0
Last_IO_Error:
Last_SQL_Errno: 0
Last_SQL_Error:
Replicate_Ignore_Server_Ids:
Master_Server_Id: 1
1 row in set (0.00 sec)
验证是否使用了SSL加密
[root@cnetos7 ssl]#mysql --ssl （可mysql --help查看连接帮助）
MariaDB [(none)]> status;
--------------
mysql Ver 15.1 Distrib 5.5.52-MariaDB, for Linux (x86_64) using readline 5.1
Connection id: 8
Current database:
Current user: root@localhost
SSL: Cipher in use is DHE-RSA-AES256-GCM-SHA384 //可以看到是于SSL加密
Current pager: stdout
Using outfile: ''
Using delimiter: ;
Server: MariaDB
Server version: 5.5.52-MariaDB MariaDB Server
Protocol version: 10
Connection: Localhost via UNIX socket
Server characterset: latin1
Db characterset: latin1
Client characterset: utf8
Conn. characterset: utf8
UNIX socket: /var/lib/mysql/mysql.sock
Uptime: 20 min 21 sec
Threads: 2 Questions: 24 Slow queries: 0 Opens: 4 Flush tables: 2 Open tables: 30 Queries per second avg: 0.019
--------------
网友评论