MySQL(二):主從複製結構、半同步複製、雙主複製結構、利用SSL實現安全的MySQL主從複製

技術小阿哥發表於2017-11-26

主從複製結構、半同步複製、雙主複製結構、利用SSL實現安全的MySQL主從複製


一、主從複製結構實驗


1.主伺服器配置

可以先更改server_id


在/etc/my.cnf檔案中,新增

server_id=11


重啟服務,在mysql命令列檢視


MariaDB [(none)]> select @@server_id;

+————-+

| @@server_id |

+————-+

|        11 |

+————-+

1 row in set (0.00 sec)


授權從伺服器

MariaDB [(none)]> grant replication slave,replication client on *.* to `repluser`@`172.16.1.10`identified by `replpass`;

Query OK, 0 rows affected (0.00 sec)


重新整理

MariaDB [(none)]> flush privileges;

Query OK, 0 rows affected (0.00 sec)


2.從伺服器配置

在[mysqld]段落新增


server_id=22

relay_log=/var/log/mariadb/relay-log

skip_name_resolve=ON

innodb_file_per_table=ON


重啟服務,在mysql命令列檢視


MariaDB [(none)]> select @@server_id;

+————-+

| @@server_id |

+————-+

|        22 |

+————-+

1 row in set (0.00 sec)


指定主伺服器

MariaDB [(none)]> change master to master_host=`172.16.1.4`,master_user=`repluser`,master_password=`replpass`,master_log_file=`binlog.000001`,master_log_pos=245;


檢視相關資訊

MariaDB [(none)]> show slave statusG;


開啟io執行緒

MariaDB [(none)]> start slave io_thread;


開啟sql執行緒

MariaDB [(none)]> start slave sql_thread;


於是就可以在主伺服器上插入資訊,在從伺服器上看到了。

—————————————————————————————————————————————–


二、半同步複製結構實驗

從MySQL5.5開始,MySQL以外掛的形式支援半同步複製。如何理解半同步呢?首先我們來看看非同步,全同步的概念


非同步複製(Asynchronous replication)

MySQL預設的複製即是非同步的,主庫在執行完客戶端提交的事務後會立即將結果返給給客戶端,並不關心從庫是否已經接收並處理,這樣就會有一個問題,主如果crash掉了,此時主上已經提交的事務可能並沒有傳到從上,如果此時,強行將從提升為主,可能導致新主上的資料不完整。


全同步複製(Fully synchronous replication)

指當主庫執行完一個事務,所有的從庫都執行了該事務才返回給客戶端。因為需要等待所有從庫執行完該事務才能返回,所以全同步複製的效能必然會收到嚴重的影響。


半同步複製(Semisynchronous replication)

介於非同步複製和全同步複製之間,主庫在執行完客戶端提交的事務後不是立刻返回給客戶端,而是等待至少一個從庫接收到並寫到relay log中才返回給客戶端。相對於非同步複製,半同步複製提高了資料的安全性,同時它也造成了一定程度的延遲,這個延遲最少是一個TCP/IP往返的時間。所以,半同步複製最好在低延時的網路中使用。


在主從複製搭建的基礎上,做配置修改


1.主伺服器:配置檔案


[root@zrs6 ~]# vim /etc/my.cnf

server_id=11

relay_log=/var/log/mariadb/relay-log

skip_name_resolve=ON

innodb_file_per_table=ON

log_bin=/var/log/mariadb/binlog


重啟

[root@zrs6 ~]# systemctl restart mariadb


安裝外掛

MariaDB [(none)]> install plugin rpl_semi_sync_master soname `semisync_master`;


檢視相應變數

MariaDB [(none)]> show global variables like `%rpl_semi%`;

+————————————+——-+

| Variable_name                      | Value |

+————————————+——-+

| rpl_semi_sync_master_enabled       | OFF   |

| rpl_semi_sync_master_timeout       | 10000 |

| rpl_semi_sync_master_trace_level   | 32    |

| rpl_semi_sync_master_wait_no_slave | ON    |

+————————————+——-+


檢視半同步的狀態

MariaDB [(none)]> show global status like `%rpl_semi%`;

+——————————————–+——-+

| Variable_name                              | Value |

+——————————————–+——-+

| Rpl_semi_sync_master_clients               | 0     |

| Rpl_semi_sync_master_net_avg_wait_time     | 0     |

| Rpl_semi_sync_master_net_wait_time         | 0     |

| Rpl_semi_sync_master_net_waits             | 0     |

| Rpl_semi_sync_master_no_times              | 0     |

| Rpl_semi_sync_master_no_tx                 | 0     |

| Rpl_semi_sync_master_status                | OFF   |

| Rpl_semi_sync_master_timefunc_failures     | 0     |

| Rpl_semi_sync_master_tx_avg_wait_time      | 0     |

| Rpl_semi_sync_master_tx_wait_time          | 0     |

| Rpl_semi_sync_master_tx_waits              | 0     |

| Rpl_semi_sync_master_wait_pos_backtraverse | 0     |

| Rpl_semi_sync_master_wait_sessions         | 0     |

| Rpl_semi_sync_master_yes_tx                | 0     |

+——————————————–+——-+


開啟半同步複製

MariaDB [(none)]> set @@global.rpl_semi_sync_master_enabled=ON;



2.從伺服器:配置檔案


[root@zrs5 ~]# vim /etc/my.cnf

server_id=22

relay_log=/var/log/mariadb/relay-log

skip_name_resolve=ON

innodb_file_per_table=ON

log_bin=/var/log/mariadb/bin-log


重啟

[root@zrs5 ~]# systemctl restart mariadb


安裝外掛

MariaDB [(none)]> install plugin rpl_semi_sync_slave soname `semisync_slave.so`;


檢視相應變數

MariaDB [(none)]> show global variables like `%rpl_semi%`;

+———————————+——-+

| Variable_name                   | Value |

+———————————+——-+

| rpl_semi_sync_slave_enabled     | OFF   |

| rpl_semi_sync_slave_trace_level | 32    |

+———————————+——-+


開啟半同步

MariaDB [(none)]> set @@global.rpl_semi_sync_slave_enabled=ON;


3.檢視主伺服器的狀態

MariaDB [(none)]> show global status like `%rpl_semi%`;

+——————————————–+——-+

| Variable_name                              | Value |

+——————————————–+——-+

| Rpl_semi_sync_master_clients               | 1     |

| Rpl_semi_sync_master_net_avg_wait_time     | 0     |

| Rpl_semi_sync_master_net_wait_time         | 0     |

| Rpl_semi_sync_master_net_waits             | 0     |

| Rpl_semi_sync_master_no_times              | 0     |

| Rpl_semi_sync_master_no_tx                 | 0     |

| Rpl_semi_sync_master_status                | ON    |

| Rpl_semi_sync_master_timefunc_failures     | 0     |

| Rpl_semi_sync_master_tx_avg_wait_time      | 0     |

| Rpl_semi_sync_master_tx_wait_time          | 0     |

| Rpl_semi_sync_master_tx_waits              | 0     |

| Rpl_semi_sync_master_wait_pos_backtraverse | 0     |

| Rpl_semi_sync_master_wait_sessions         | 0     |

| Rpl_semi_sync_master_yes_tx                | 0     |

+——————————————–+——-+


4.當在主伺服器新增資料時

MariaDB [(none)]> use zrs05;

MariaDB [zrs05]> insert into tb1 (Username,Age) values (`Zhang san`,30),(`Li si`,27);

MariaDB [zrs05]> select * from tb1;

+—–+———–+——+

| UID | Username  | Age  |

+—–+———–+——+

|   1 | Zhang san |   30 |

|   2 | Li si     |   27 |

+—–+———–+——+


在從伺服器檢視,資料已經同步了。

MariaDB [(none)]> use zrs05;

MariaDB [zrs05]> select * from tb1;

+—–+———–+——+

| UID | Username  | Age  |

+—–+———–+——+

|   1 | Zhang san |   30 |

|   2 | Li si     |   27 |

+—–+———–+——+


5.驗證半同步

需要在從伺服器上先停止slave io_thread

MariaDB [zrs05]> stop slave io_thread;


當在主伺服器上再次插入一條資訊的時候,可以看到並不能立即插入成功,過了十秒鐘後,才成功,主伺服器被阻塞一段時間,說明半同步複製已經正常工作。

MariaDB [zrs05]> insert into tb1 (Username,Age) values (`Wang wu`,33);

Query OK, 1 row affected (10.01 sec)


在從伺服器上檢視,並沒有剛才插入的資訊

MariaDB [zrs05]> select * from tb1;

+—–+———–+——+

| UID | Username  | Age  |

+—–+———–+——+

|   1 | Zhang san |   30 |

|   2 | Li si     |   27 |

+—–+———–+——+


當開啟slave io_thread後,那條資訊就出現了

MariaDB [zrs05]> start slave io_thread;


MariaDB [zrs05]> select * from tb1;

+—–+———–+——+

| UID | Username  | Age  |

+—–+———–+——+

|   1 | Zhang san |   30 |

|   2 | Li si     |   27 |

|   3 | Wang wu   |   33 |

+—–+———–+——+

—————————————————————————————————————————————–


三、主主複製模型實驗


1.兩臺伺服器的配置檔案

Server1:/etc/my.cnf

[mysqld]


innodb-file-per-table = ON

skip-name-resolve=ON

log_bin=/var/log/mariadb/binlog

server_id=11

relay_log=/var/log/mariadb/relaylog

auto_increment_offset=1

auto_increment_increment=2


Server2:/etc/my.cnf

[mysqld]


innodb-file-per-table = ON

skip-name-resolve=ON

log_bin=/var/log/mariadb/binlog

server_id=22

relay_log=/var/log/mariadb/relaylog

auto_increment_offset=2

auto_increment_increment=2


2.兩臺伺服器的SQL語句

Server1:

 mysql> grant replication slave,replication client on *.* to `repluser`@`172.16.1.3` identified by `replpass`;

 mysql> change master to master_host=`172.16.1.3`,master_user=`repluser`,master_password=`replpass`,master_log_file=`bin-log.000001`,master_log_pos=427;

 mysql> start slave [io_thread|sql_thread];


Server2:

 mysql> grant replication slave,replication client on *.* to `repluser`@`172.16.1.2` identified by `replpass`;

 mysql> change master to master_host=`172.16.1.2`,master_user=`repluser`,master_password=`replpass`,master_log_file=`bin-log.000024`,master_log_pos=245;

 mysql> start slave [io_thread|sql_thread];

————————————————————————————————————————————–


四、利用SSL實現安全的MySQL主從複製


MySQL的主從複製是直接利用明文傳輸的,如果我們在生產環境下,跨網路傳輸會非常不安全,所以就需要基於SSL加密傳輸,提高安全性。


1.修改配置檔案

  在Master上:

vim /etc/my.cnf

[mysqld]

log-bin=master-bin

binlog_format=mixed

server-id=1

ssl

  

[root@zj07 ~]# systemctl restart mariadb


   在Slave上:

vim /etc/my.cnf

[mysqld]

log-bin=slave-bin

binlog_format=mixed

server-id=10

ssl


[root@zj08 ~]# systemctl restart mariadb


2.將master伺服器自己做成CA伺服器

[root@zj07 ~]# cd /etc/pki/CA/

[root@zj07 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)

Generating RSA private key, 2048 bit long modulus

………..+++

……………………………………………………….+++

e is 65537 (0x10001)

[root@zj07 CA]# 

[root@zj07 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter `.`, the field will be left blank.

—–

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:HeBei

Locality Name (eg, city) [Default City]:QinHuangdao

Organization Name (eg, company) [Default Company Ltd]:zrs.com

Organizational Unit Name (eg, section) []:tech

Common Name (eg, your name or your server`s hostname) []:master.zrs.com

Email Address []:

[root@zj07 CA]# touch index.txt

[root@zj07 CA]# echo 01 > serial


3.為master建立證照申請並由CA伺服器簽發證照

[root@zj07 CA]# mkdir -pv /usr/local/mysql/ssl

mkdir: 已建立目錄 “/usr/local/mysql”

mkdir: 已建立目錄 “/usr/local/mysql/ssl”

[root@zj07 CA]# 

[root@zj07 CA]# cd /usr/local/mysql/ssl/

[root@zj07 ssl]# (umask 077;openssl genrsa -out master.key 2048)

Generating RSA private key, 2048 bit long modulus

………………………………………………………………………………………………………………………….+++

…………..+++

e is 65537 (0x10001)

[root@zj07 ssl]# openssl req -new -key master.key -out master.csr -days 365

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter `.`, the field will be left blank.

—–

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:HeBei

Locality Name (eg, city) [Default City]:QinHuangdao

Organization Name (eg, company) [Default Company Ltd]:zrs.com

Organizational Unit Name (eg, section) []:tech

Common Name (eg, your name or your server`s hostname) []:master.zrs.com

Email Address []:


Please enter the following `extra` attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@zj07 ssl]# 


[root@zj07 ssl]# openssl ca -in master.csr -out master.crt -days 365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: Jan 15 13:35:39 2018 GMT

            Not After : Jan 15 13:35:39 2019 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = HeBei

            organizationName          = zrs.com

            organizationalUnitName    = tech

            commonName                = master.zrs.com

        X509v3 extensions:

            X509v3 Basic Constraints: 

                CA:FALSE

            Netscape Comment: 

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier: 

                31:F0:A8:85:CD:6C:29:EF:3A:70:E6:C8:BB:5F:B4:04:61:32:86:48

            X509v3 Authority Key Identifier: 

                keyid:66:56:36:59:90:6D:94:DC:4E:19:A3:BA:2C:1E:53:DC:1A:8A:58:AE


Certificate is to be certified until Jan 15 13:35:39 2019 GMT (365 days)

Sign the certificate? [y/n]:y



1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

[root@zj07 ssl]# 


4.為slave伺服器建立證照申請

[root@zrs08 ~]# mkdir -pv /usr/local/mysql/ssl

mkdir: 已建立目錄 “/usr/local/mysql”

mkdir: 已建立目錄 “/usr/local/mysql/ssl”

[root@zrs08 ~]# cd /usr/local/mysql/ssl/

[root@zrs08 ssl]# (umask 077;openssl genrsa -out slave.key 2048)

Generating RSA private key, 2048 bit long modulus

….+++

………………………………………………………………………………………+++

e is 65537 (0x10001)

[root@zrs08 ssl]# openssl req -new -key slave.key -out slave.csr -days 365

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter `.`, the field will be left blank.

—–

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:HeBei

Locality Name (eg, city) [Default City]:QinHuangdao

Organization Name (eg, company) [Default Company Ltd]:zrs.com

Organizational Unit Name (eg, section) []:tech

Common Name (eg, your name or your server`s hostname) []:slave.zrs.com

Email Address []:


Please enter the following `extra` attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@zrs08 ssl]# 


5.為slave伺服器簽署證照

將證照申請請求拷貝到CA伺服器簽署


在slave上

[root@zrs08 ssl]# scp slave.csr 172.16.1.7:/tmp/


在master上

[root@zj07 ssl]# openssl ca -in /tmp/slave.csr -out /tmp/slave.crt -days 365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 2 (0x2)

        Validity

            Not Before: Jan 15 13:41:19 2018 GMT

            Not After : Jan 15 13:41:19 2019 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = HeBei

            organizationName          = zrs.com

            organizationalUnitName    = tech

            commonName                = slave.zrs.com

        X509v3 extensions:

            X509v3 Basic Constraints: 

                CA:FALSE

            Netscape Comment: 

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier: 

                90:B1:B5:44:92:99:24:4A:50:A7:AB:3F:36:B9:CD:C7:87:1E:CE:4A

            X509v3 Authority Key Identifier: 

                keyid:66:56:36:59:90:6D:94:DC:4E:19:A3:BA:2C:1E:53:DC:1A:8A:58:AE


Certificate is to be certified until Jan 15 13:41:19 2019 GMT (365 days)

Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated


6.簽署好證照申請拷貝到slave伺服器

[root@zj07 ssl]# scp /tmp/slave.crt 172.16.1.8:/usr/local/mysql/ssl


7.將CA證照拷貝到slave伺服器一份併為master拷貝一份

[root@zj07 ssl]# scp /etc/pki/CA/cacert.pem 172.16.1.8:/usr/local/mysql/ssl/   

[root@zj07 ssl]# cp /etc/pki/CA/cacert.pem /usr/local/mysql/ssl/


8.修改master和slave伺服器證照屬主、屬組為”mysql”使用者

在master上

[root@zj07 ssl]# chown -R mysql.mysql /usr/local/mysql/ssl/

[root@zj07 ssl]# ll /usr/local/mysql/ssl/

總用量 20

-rw-r–r–. 1 mysql mysql 1334 1月  15 21:45 cacert.pem

-rw-r–r–. 1 mysql mysql 4471 1月  15 21:36 master.crt

-rw-r–r–. 1 mysql mysql 1013 1月  15 21:34 master.csr

-rw——-. 1 mysql mysql 1679 1月  15 21:33 master.key


在slave上

[root@zrs08 ssl]# chown -R mysql.mysql /usr/local/mysql/ssl/

[root@zrs08 ssl]# ll /usr/local/mysql/ssl/

總用量 20

-rw-r–r–. 1 mysql mysql 1334 1月  15 21:45 cacert.pem

-rw-r–r–. 1 mysql mysql 4466 1月  15 21:43 slave.crt

-rw-r–r–. 1 mysql mysql 1009 1月  15 21:38 slave.csr

-rw——-. 1 mysql mysql 1679 1月  15 21:37 slave.key


9.在master與slave伺服器修改主配置檔案開啟SSL加密功能

修改master資料庫配置檔案

[root@zj07 ssl]# vim /etc/my.cnf

ssl_ca=/usr/local/mysql/ssl/cacert.pem

ssl_cert=/usr/local/mysql/ssl/master.crt

ssl_key=/usr/local/mysql/ssl/master.key


[root@zj07 ssl]# systemctl restart mariadb


修改slave資料庫配置檔案

[root@zrs08 ssl]# vim /etc/my.cnf

ssl_ca=/usr/local/mysql/ssl/cacert.pem

ssl_cert=/usr/local/mysql/ssl/slave.crt

ssl_key=/usr/local/mysql/ssl/slave.key


[root@zrs08 ssl]# systemctl restart mariadb


10.在master伺服器檢視SSL加密是否開啟,然後建立授權一個基於金鑰認證的使用者


MariaDB [(none)]> show variables like `%ssl%`;

+—————+———————————+

| Variable_name | Value                    |

+—————+———————————+

| have_openssl  | YES                      |

| have_ssl     | YES                      |

| ssl_ca       | /usr/local/mysql/ssl/cacert.pem |

| ssl_capath    |                        |

| ssl_cert      | /usr/local/mysql/ssl/master.crt |

| ssl_cipher    |                      |

| ssl_key       | /usr/local/mysql/ssl/master.key |

+—————+———————————+


MariaDB [(none)]> grant replication client,replication slave on *.* to `slave`@`172.16.1.8` identified by `12345678` require ssl;


MariaDB [(none)]> flush privileges;


11.檢視master伺服器二進位制日誌檔案和事件位置用於的slave伺服器連結從這個位置開始複製

MariaDB [(none)]> show master status;

+——————-+———-+————–+——————+

| File          | Position | Binlog_Do_DB | Binlog_Ignore_DB |

+——————-+———-+————–+——————+

| master-bin.000002 |    502 |         |             |

+——————-+———-+————–+——————+


12.測試使用加密使用者指定的金鑰連結伺服器

在slave上


[root@zrs08 ~]# mysql -uroot -p12345678 -h 172.16.1.7 –ssl-ca=/usr/local/mysql/ssl/cacert.pem –ssl-cert=/usr/local/mysql/ssl/slave.crt –ssl-key=/usr/local/mysql/ssl/slave.key

Welcome to the MariaDB monitor.  Commands end with ; or g.

Your MariaDB connection id is 41

Server version: 5.5.56-MariaDB MariaDB Server


Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.


Type `help;` or `h` for help. Type `c` to clear the current input statement.


MariaDB [(none)]> 


13.檢視slave伺服器SSL是否開啟並連線master伺服器

檢視是否開啟SSL

MariaDB [(none)]> show variables like `%ssl%`;

+—————+———————————+

| Variable_name | Value                    |

+—————+———————————+

| have_openssl  | YES                     |

| have_ssl      | YES                    |

| ssl_ca        | /usr/local/mysql/ssl/cacert.pem |

| ssl_capath    |                       |

| ssl_cert      | /usr/local/mysql/ssl/master.crt |

| ssl_cipher    |                       |

| ssl_key       | /usr/local/mysql/ssl/master.key |

+—————+———————————+


連結master伺服器

MariaDB [(none)]> change master to

    -> master_host=`172.16.1.7`,master_user=`slave`,master_password=`12345678`,

    -> master_log_file=`master-bin.000002`,master_log_pos=502,master_ssl=1,

    -> master_ssl_ca=`/usr/local/mysql/ssl/cacert.pem`,

    -> master_ssl_cert=`/usr/local/mysql/ssl/slave.crt`,

    -> master_ssl_key=`/usr/local/mysql/ssl/slave.key`;

Query OK, 0 rows affected (0.04 sec)


幫助文件

MariaDB [(none)]> help change master to;

  | MASTER_SSL = {0|1}                     #是否使用SSL功能

  | MASTER_SSL_CA = `ca_file_name`            #CA證照位置

  | MASTER_SSL_CERT = `cert_file_name`        #指定自己的證照檔案

  | MASTER_SSL_KEY = `key_file_name`          #指定自己的金鑰檔案


14.檢視slave伺服器的狀態

MariaDB [(none)]> start slave;

Query OK, 0 rows affected (0.02 sec)


MariaDB [(none)]> show slave statusG;

*************************** 1. row ***************************

               Slave_IO_State: Waiting for master to send event

                  Master_Host: 172.16.1.7

                  Master_User: slave

                  Master_Port: 3306

                Connect_Retry: 60

              Master_Log_File: master-bin.000002

          Read_Master_Log_Pos: 2028

               Relay_Log_File: mariadb-relay-bin.000002

                Relay_Log_Pos: 2056

        Relay_Master_Log_File: master-bin.000002

             Slave_IO_Running: Yes

            Slave_SQL_Running: Yes

              Replicate_Do_DB: 

          Replicate_Ignore_DB: 

           Replicate_Do_Table: 

       Replicate_Ignore_Table: 

      Replicate_Wild_Do_Table: 

  Replicate_Wild_Ignore_Table: 

                   Last_Errno: 0

                   Last_Error: 

                 Skip_Counter: 0

          Exec_Master_Log_Pos: 2028

              Relay_Log_Space: 2352

              Until_Condition: None

               Until_Log_File: 

                Until_Log_Pos: 0

           Master_SSL_Allowed: Yes

           Master_SSL_CA_File: /usr/local/mysql/ssl/cacert.pem

           Master_SSL_CA_Path: 

              Master_SSL_Cert: /usr/local/mysql/ssl/slave.crt

            Master_SSL_Cipher: 

               Master_SSL_Key: /usr/local/mysql/ssl/slave.key

        Seconds_Behind_Master: 0

Master_SSL_Verify_Server_Cert: No

                Last_IO_Errno: 0

                Last_IO_Error: 

               Last_SQL_Errno: 0

               Last_SQL_Error: 

  Replicate_Ignore_Server_Ids: 

             Master_Server_Id: 1

1 row in set (0.00 sec)


15.利用SSL實現安全的MySQL主從複製

在master伺服器上建立資料庫

[root@zj07 ~]# mysql -uroot -p12345678 -e `create database this_is_a_test_db;`

[root@zj07 ~]# mysql -uroot -p12345678 -e `show databases`;

+——————–+

| Database        |

+——————–+

| information_schema |

| mysql          |

| performance_schema |

| this_is_a_test_db  |

+——————–+


登入slave伺服器驗證slave資料庫是否存在

[root@zrs08 ~]# mysql -uroot -p12345678 -e `show databases`;

+——————–+

| Database        |

+——————–+

| information_schema |

| mysql           |

| performance_schema |

| this_is_a_test_db  |

+——————–+

本文轉自 Runs_ 51CTO部落格,原文連結:http://blog.51cto.com/12667170/2061494,如需轉載請自行聯絡原作者


相關文章