42_02_2_MySQL基于SSL进行主从复制

2015-10-02
所有的服务器应该时间同步：
ntpdate ntp.api.bz
##这个在已经实现半同步的基础上实验的
在master.test.com操作： 
 
cd /etc/pki/CA 
(umask 077;openssl genrsa -out private/cakey.pem 2048) 
 
vim /etc/pki/tls/openssl.cnf 
countyName_default = CN 
stateOrProvinceName_default     = HN 
localityName_default    = ZZ 
0.organizationName_default      = MY 
organizationalUnitName_default  = Tech 
 
openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655 
touch index.txt 
echo 01 > serial 
 
为主MySQL创建证书 
mkdir /usr/local/mysql/ssl 
chown -R root.mysql /usr/local/mysql/ssl 
cd /usr/local/mysql/ssl 
(umask 077; openssl genrsa -out master.key 2048) 
openssl req -new -key master.key -out master.csr 
openssl ca -in master.csr -out master.crt -days 365 
chown -R mysql.mysql ./* 
chmod 600 ./* 
 
vim /etc/my.cnf 
 ssl_ca                  = /usr/local/mysql/ssl/cacrt.pem 
 ssl_cert                = /usr/local/mysql/ssl/master.crt 
 ssl_key                 = /usr/local/mysql/ssl/master.key 
 
为从MySQL创建证书 
mkdir /usr/local/mysql/ssl 
chown -R root.mysql /usr/local/mysql/ssl 
cd /usr/lcoal/mysql/ssl 
(umask 077;openssl genrsa -out slave.key 2048) 
openssl req -new slave.key -out slave.csr 
scp slave.csr root@master.test.com:/root 
openssl ca -in /root/slave.csr -out /root/slave.crt -days 365 
scp root@master.test.com:/root/slave.crt /usr/local/mysql/ssl/slave.crt 
chown -R mysql.mysql ./* 
chmod 600 ./* 
 
  
 vim /etc/my.cnf 
  ssl_ca                  = /usr/local/mysql/ssl/cacrt.pem 
 ssl_cert                = /usr/local/mysql/ssl/slave.crt 
 ssl_key                 = /usr/local/mysql/ssl/slave.key 
  
  
> grant replication slave on *.* to repluser@'192.168.122.%' identified by 'replpass' require ssl; 
> flush privileges; 
 
 
    
change master to 
 master_host='192.168.122.220', 
 master_user='repluser', 
 master_password='replpass', 
 master_log_file='master_bin.000007', 
 master_log_pos=1015, 
 master_ssl=1, 
 master_ssl_ca=' /usr/local/mysql/ssl/cacrt.pem', 
 master_ssl_cert='/usr/local/mysql/ssl/slave.crt', 
 master_ssl_key='/usr/local/mysql/ssl/slave.key'; 
 
 start slave; 
 
 
show global variables like '%ssl%'; 
在主从MySQL上可以看到SSL已经启用；； 
 
show slave status \G 
 
可以看到SSL已经启用；；； 
 
 
参考文档： 
http://www.ttlsa.com/mysql/mysql-replication-base-on-ssl/