MySQL Real Time Single DB Replication & SSL Encryption on CENTOS 6.3

Transcription

1 Alternate Titles: MYSQL SSL Encryption Based Replication Setup Author: Muhammad Zeeshan Bhatti [LPI, VCP, OCP (DBA), MCSA, SUSE CLA,] ( MySQL Real Time Single DB Replication & SSL Encryption on CENTOS 6.3 Node1.prod.mysql = Node2.prod.mysql = Let move on installation packages on both nodes. [root@node1 ~]# yum install mysql mysql-devel mysql-server openssl [root@node1 ~]# chkconfig --levels 235 mysqld on [root@node1 ~]# /etc/init.d/mysqld start [root@node1 ~]# mysqladmin -u root password redhat [root@node1 ~]# mysql -u root -p Variable_name Value have_openssl DISABLED have_ssl DISABLED ssl_ca ssl_capath ssl_cert ssl_cipher ssl_key rows in set (0.01 sec) Node 2 [root@node2 ~]# yum install mysql mysql-devel mysql-server openssl [root@node2 ~]# chkconfig --levels 235 mysqld on [root@node2 ~]# /etc/init.d/mysqld start [root@node2 ~]# mysqladmin -u root password redhat [root@node2 ~]# mysql -u root -p Variable_name Value have_openssl DISABLED have_ssl DISABLED

2 ssl_ca ssl_capath ssl_cert ssl_cipher ssl_key rows in set (0.01 sec) (Please Insert SSL directive in mysql conf file) [root@node1 ~]#vi /etc/my.cnf [mysqld] Ssl [root@node1 ~]# service mysqld restart && mysql -u root -p Node 2 (Please Insert SSL directive in mysql conf file) [root@node2 ~]#vi /etc/my.cnf [mysqld] Ssl [root@node2 ~]#service mysqld restart && mysql -u root -p

3 (Let s Move To Configuration of Master Node) Please Do That only on Master First we create a log directory for the MySQL bin-logs: [root@node1 ~]# mkdir /var/log/mysql [root@node1 ~]# chown mysql:mysql /var/log/mysql I Create the CA, server and client certificates that I need for the SSL connections Certificates in the directory path /etc/mysql/newcerts which I have [root@node1 ~]# mkdir -p /etc/mysql/newcerts && cd /etc/mysql/newcerts Create CA certificate: (Step-1) [root@node1 ~]# openssl genrsa 2048 > ca-mysqlkey.pem [root@node1 ~]# openssl req -new -x509 -nodes -days key ca-mysqlkey.pem > camysqlcert.pem Create server certificate: (Step-2) [root@node1 ~]# openssl req -newkey rsa:2048 -days nodes -keyout mysql-key.pem > mysql-req.pem [root@node1 ~]# openssl x509 -req -in mysql-req.pem -days CA ca-mysqlcert.pem -CAkey ca-mysqlkey.pem -set_serial 01 > mysqlcert.pem Create client certificate: (Step-3) [root@node1 ~]# openssl req -newkey rsa:2048 -days nodes -keyout client-key.pem > client-req.pem [root@node1 ~]# openssl x509 -req -in client-req.pem -days CA ca-cert.pem -CAkey cakey.pem -set_serial 01 > client-cert.pem That is all for SSL on Master Node etc.

4 Now I transfer ca-cert.pem, client-cert.pem, and client-key.pem to the slave before doing that let s create directory on slave server. Let s move to Configuration on Slave Node. Node 2 (Let s Move To Configuration of Slave Node) [root@node2 ~]#mkdir -p /etc/mysql/newcerts Let me back to on Master Node & Transfer Data on Slave. [root@node1 ~]# scp /etc/mysql/newcerts/ca-cert.pem root@ :/etc/mysql/newcerts [root@node1 ~]# scp /etc/mysql/newcerts/client-cert.pem root@ :/etc/mysql/newcerts [root@node1 ~]# scp /etc/mysql/newcerts/client-key.pem root@ :/etc/mysql/newcerts (Add the following ssl-ca, ssl-cert, and ssl-key lines [root@node1 ~]#vi /etc/my.cnf server-id = 1 log_bin = /var/log/mysql/mysql-bin.log expire_logs_days = 10 max_binlog_size = 100M binlog_do_db = zeeshandb ssl ssl-ca=/etc/mysql/newcerts/ca-cert.pem ssl-cert=/etc/mysql/newcerts/server-cert.pem ssl-key=/etc/mysql/newcerts/server-key.pem [root@node1 ~]#/etc/init.d/mysqld restart Now I set up a replication user zbhatti that can be used by Node2 to access the MySQL database on Node1: [root@node1 ~]# Mysql u root p MYSQL> GRANT REPLICATION SLAVE ON *.* TO 'zbhatti'@'%' IDENTIFIED BY 'redhat' REQUIRE SSL; MYSQL> GRANT USAGE ON *.* TO 'zbhatti'@''%' REQUIRE SSL; MYSQL> select user,host,password from mysql.user;

5 MYSQL> FLUSH PRIVILEGES; MYSQL> USE zeeshandb; MYSQL> FLUSH TABLES WITH READ LOCK; MYSQL> SHOW MASTER STATUS; (Please Don t Close MySQL Session if you can quit this then databases will be locked) MYSQL> [root@node1 ~]#cd /tmp [root@node1 ~]# mysqldump -u root -predhat --opt zeeshandb > zeeshan.sql [root@node1 ~]# Scp zeeshan.sql root@ :/tmp Let my back to MYSQL Prompt MYSQL> UNLOCK TABLES; MYSQL> quit; (Let s Move To Configuration of Slave Node) Node 2 [root@node2 ~]#vi /etc/my.cnf [mysqld] datadir=/var/lib/mysql socket=/var/lib/mysql/mysql.sock user=mysql ssl

6 server-id=2 master-connect-retry=60 replicate-do-db=exampledb master-user=zbhatti master-password=redhat # Disabling symbolic-links is recommended to prevent assorted security risks symbolic-links=0 [mysqld_safe] log-error=/var/log/mysqld.log pid-file=/var/run/mysqld/mysqld.pid [root@node2 ~]#/etc/init.d/mysqld restart Before I started Replication create zeeshandb on Master Node. [root@node1 ~]# Mysql u root p MYSQL> CREATE DATABASE zeeshandb; MYSQL> quit; (Let s Move To Configuration of Slave Node) Node 2 [root@node2 ~]# cd /tmp [root@node2 ~]# mysql -u root predhat zeeshandb < zeeshan.sql [root@node2 ~]# Mysql u root predhat MYSQL> STOP SLAVE; MYSQL> CHANGE MASTER TO MASTER_HOST=' ', MASTER_USER='zbhatti', MASTER_PASSWORD='redhat', MASTER_LOG_FILE='mysql-bin ', MASTER_LOG_POS=106, MASTER_SSL=1, MASTER_SSL_CA = '/etc/mysql/newcerts/ca-cert.pem', MASTER_SSL_CERT = '/etc/mysql/newcerts/client-cert.pem', MASTER_SSL_KEY = '/etc/mysql/newcerts/clientkey.pem' MYSQL> START SLAVE; MYSQL> SHOW SLAVE STATUS \G *************************** 1. row *************************** Slave_IO_State: Waiting for master to send event Master_Host: Master_User: zbhatti Master_Port: 3306

7 Connect_Retry: 60 Master_Log_File: mysql-bin Read_Master_Log_Pos: 106 Relay_Log_File: mysqld-relay-bin Relay_Log_Pos: 251 Relay_Master_Log_File: mysql-bin Slave_IO_Running: Yes Slave_SQL_Running: Yes Replicate_Do_DB: zeeshandb Replicate_Ignore_DB: Replicate_Do_Table: Replicate_Ignore_Table: Replicate_Wild_Do_Table: Replicate_Wild_Ignore_Table: Last_Errno: 0 Last_Error: Skip_Counter: 0 Exec_Master_Log_Pos: 106 Relay_Log_Space: 552 Until_Condition: None Until_Log_File: Until_Log_Pos: 0 Master_SSL_Allowed: Yes Master_SSL_CA_File: /etc/mysql/newcerts/ca-cert.pem Master_SSL_CA_Path: Master_SSL_Cert: /etc/mysql/newcerts/client-cert.pem Master_SSL_Cipher: Master_SSL_Key: /etc/mysql/newcerts/client-key.pem Seconds_Behind_Master: 0 Master_SSL_Verify_Server_Cert: No Last_IO_Errno: 0 Last_IO_Error: Last_SQL_Errno: 0 Last_SQL_Error: 1 row in set (0.00 sec) That is All, Mashallah I Done MYSQL REAL TIME DB REPLICATION & SSL ENCRYPTION