MySQL架构之主从复制、双主复制、半同步复制及基于SSL复制的实现

复制概述

MySQL的内建的复制功能是构建大型，高性能应用程序的基础。将MySQL的的数据分布到多个系统上去，这种分布的机制，是通过将MySQL的的某一台主机的数据复制到其它主机（从站）上，并重新执行一遍来实现的。复制过程中一个服务器充当主服务器，而一个或多个其它服务器充当从服务器。主服务器将更新写入二进制日志文件，并维护文件的一个索引以跟踪日志循环。这些日志可以记录发送到从服务器的更新。当一个从服务器连接主服务器时，它通知主服务器从服务器在日志中读取的最后一次成功更新的位置。从服务器接收从那时起发生的任何更新，然后封锁并等待主服务器通知新的更新。
请注意当你进行复制时，所有对复制中的表的更新必须在主服务器上进行。否则，你必须要小心，以避免用户对主服务器上的表进行的更新与对从服务器上的表所进行的新之间的冲突。
以下实验环境在centos7.3下完成，数据库为MariaDB的5.5
时间同步。

一：主从复制架构

主从复制可以一主一从，也可以是一主多从

架构角色

主服务器mysql-master：172.16.252.192
从服务器mysql-slave：172.16.252.190

主数据库和从数据库需提前安装好mariadb数据库

[root@mysql-master ~]# yum -y install mariadb-server
[root@mysql-master ~]# iptables -F

1、主服务器配置

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf //编辑mysql配置文件
[mysqld]
server-id = 1  //设置服务器ID
log_bin = master-log  //开启二进制日志
innodb_file_per_table = ON   //使用每表单独空间
skip_name_resolve = ON  //跳过名称解析
[root@centos7 ~]#systemctl start mariadb.service

2、从服务器配置

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf //编辑mysql配置文件
[mysqld]
server-id = 2    //从服务器的ID
relay-log = relay-log   //开启从节点的中继日志文件
skip_name_resolve = ON    //跳过名称解析
innodb_file_per_table = ON  //使用每表单独空间
read-only = 1  //开启只读模式

[root@centos7 ~]#systemctl start mariadb.service

3、在主节点创建有复制权限的用户账号

MariaDB [(none)]> show master status; 查看二进制日志节点位置
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      245 |              |                  |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252 .%' IDENTIFIED BY 'replpass';   //创建拥有复制用户账号 （最小权限法则）
MariaDB [(none)]> flush privileges;  //刷新
MariaDB [(none)]> show master status;  
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      424 |              |                  |
+-------------------+----------+--------------+------------------+
从服务器如果不创建用户，就从主节点创建用户后的424位置开始复制。

4、开启从服务器复制线程：

MariaDB [(none)]> show slave status;
Empty set (0.00 sec)  //没有配置为空，
MariaDB [(none)]> show processlist; //从服务器还没有启动复制线程
+----+------+-----------+------+---------+------+-------+------------------+----------+
| Id | User | Host      | db   | Command | Time | State | Info             | Progress |
+----+------+-----------+------+---------+------+-------+------------------+----------+
|  2 | root | localhost | NULL | Query   |    0 | NULL  | show processlist |    0.000 |
+----+------+-----------+------+---------+------+-------+------------------+----------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=424;  
//使用有复制权限的用户账号连接至主服务器，并启动复制线程
MariaDB [(none)]> show slave status\G; 
*************************** 1. row ***************************
               Slave_IO_State: 
                  Master_Host: 172.16.252.192  //主服务器IP
                  Master_User: repluser      //授权的用户
                  Master_Port: 3306       //主服务器端口
                Connect_Retry: 60       //重试时间
              Master_Log_File: master-log.000003    //从哪个二进制的文件开启读取
          Read_Master_Log_Pos: 424     //读取二进制的开始位置
               Relay_Log_File: relay-log.000001  //读取的中继日志文件
                Relay_Log_Pos: 4   //读取的中继日志位置
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: No    // I/O Thread启动情况  现在是没有开启
            Slave_SQL_Running: No    //SQL Thread启动情况 现在是没有开启
              Replicate_Do_DB: 
      ......
MariaDB [(none)]> start slave; //启动两线程
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.252.192
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-log.000003
          Read_Master_Log_Pos: 499
               Relay_Log_File: relay-log.000002    //这里中继做了初始化
                Relay_Log_Pos: 605
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: Yes     //已开启
            Slave_SQL_Running: Yes   //已开启
              Replicate_Do_DB: 
MariaDB [(none)]> show processlist;
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
| Id | User        | Host      | db   | Command | Time | State                                                                       | Info             | Progress |
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
|  2 | root        | localhost | NULL | Query   |    0 | NULL                                                                        | show processlist |    0.000 |
|  3 | system user |           | NULL | Connect |   20 | Waiting for master to send event                                            | NULL             |    0.000 |
|  4 | system user |           | NULL | Connect |  791 | Slave has read all relay log; waiting for the slave I/O thread to update it | NULL             |    0.000 |
+----+-------------+-----------+------+---------+------+-----------------------------------------------------------------------------+------------------+----------+
//可以看到启动了两个线程，一个时等待主服务器发送的时间，一个是读取中继日志做同步
[root@cnetos7 ~]#ll /var/lib/mysql/master.info
//这个文件保存了主服务器的链接信息，包括账号密码等，下次重启服务会自动通过此文件连接主服务器
[root@cnetos7 ~]#ll /var/lib/mysql/relay-log.info
//此文件保存从服务器使用的中继日志、POS和主服务器使用的二进制日志、POS，服务器启动也会读取此文件

5、测试：

主服务器：
MariaDB [(none)]> create database testdb;
从服务器：
MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| test               |
| testdb             |
+--------------------+

二：实现双主复制

双主复制容易产生数据不一致，请慎用

1、在两台服务器上设置

server 1
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
server-id = 1  
log_bin = master-log 
relay_log = relay-log
innodb_file_per_table = ON   
skip_name_resolve = ON  
auto_increment_offset = 1     //1开始，
auto_increment_increment = 2  //自动增长2
server 2
[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
server-id = 2 
log_bin = master-log 
relay_log = relay-log
innodb_file_per_table = ON   
skip_name_resolve = ON  
auto_increment_offset = 2     //2开始，
auto_increment_increment = 2  //自动增长2

要实现双主复制，这时每台主机上都要开启二进制日志、中继日志以及每台主机的唯一的server-id

2、开启服务器复制线程

server1

MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      509 |              |                  |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=509;
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.252.192
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-log.000003
          Read_Master_Log_Pos: 509
               Relay_Log_File: relay-log.000002
                Relay_Log_Pos: 530
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes

server2

MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      509 |              |                  |
+-------------------+----------+--------------+------------------+
MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=509;
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.252.192
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-log.000003
          Read_Master_Log_Pos: 509
               Relay_Log_File: relay-log.000002
                Relay_Log_Pos: 530
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes

3、测试

server1

MariaDB [(none)]> create database mydb;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> use mydb;
Database changed
MariaDB [mydb]> create table tb1(id int unsigned auto_increment primary key,name varchar(200));
Query OK, 0 rows affected (0.01 sec)

MariaDB [mydb]> insert into tb1 (name) values ('xiaoming'),('xiaohua'),('xiaogang');
Query OK, 3 rows affected (0.00 sec)
Records: 3  Duplicates: 0  Warnings: 0

MariaDB [mydb]> select * from tb1;
+----+----------+
| id | name     |
+----+----------+
|  1 | xiaoming |
|  3 | xiaohua  |
|  5 | xiaogang |
+----+----------+

server2

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mydb               |
| mysql              |
| performance_schema |
| test               |
+--------------------+
5 rows in set (0.00 sec)

MariaDB [(none)]> use mydb;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [mydb]> insert into tb1 (name) values ('xiaodong'),('xiaoli'),('xiaoghong');
Query OK, 3 rows affected (0.00 sec)
Records: 3  Duplicates: 0  Warnings: 0

MariaDB [mydb]> select * from tb1;
+----+-----------+
| id | name      |
+----+-----------+
|  1 | xiaoming  |
|  3 | xiaohua   |
|  5 | xiaogang  |
|  6 | xiaodong  |
|  8 | xiaoli    |
| 10 | xiaoghong |
+----+-----------+

server1

MariaDB [mydb]> select * from tb1;
+----+----------+
| id | name     |
+----+----------+
|  1 | xiaoming |
|  3 | xiaohua  |
|  5 | xiaogang |
+----+----------+
3 rows in set (0.01 sec)

MariaDB [mydb]> select * from tb1;
+----+-----------+
| id | name      |
+----+-----------+
|  1 | xiaoming  |
|  3 | xiaohua   |
|  5 | xiaogang  |
|  6 | xiaodong  |
|  8 | xiaoli    |
| 10 | xiaoghong |
+----+-----------+
6 rows in set (0.00 sec)

三，半同步复制的实现

基于插件实现，亦支持多种插件：在/ usr / lib64下/ MySQL的/插件/

[root@cnetos7 mysql]#rpm -ql mariadb-server
......
/usr/lib64/mysql/plugin/auth_0x0100.so
/usr/lib64/mysql/plugin/auth_pam.so
/usr/lib64/mysql/plugin/auth_socket.so
/usr/lib64/mysql/plugin/auth_test_plugin.so
/usr/lib64/mysql/plugin/daemon_example.ini
/usr/lib64/mysql/plugin/dialog_examples.so
/usr/lib64/mysql/plugin/ha_innodb.so
/usr/lib64/mysql/plugin/ha_sphinx.so
/usr/lib64/mysql/plugin/handlersocket.so
/usr/lib64/mysql/plugin/libdaemon_example.so
/usr/lib64/mysql/plugin/mypluglib.so
/usr/lib64/mysql/plugin/qa_auth_client.so
/usr/lib64/mysql/plugin/qa_auth_interface.so
/usr/lib64/mysql/plugin/qa_auth_server.so
/usr/lib64/mysql/plugin/query_cache_info.so
/usr/lib64/mysql/plugin/semisync_master.so   //半同步复制使用插件
/usr/lib64/mysql/plugin/semisync_slave.so    //半同步复制使用插件
/usr/lib64/mysql/plugin/server_audit.so
/usr/lib64/mysql/plugin/sphinx.so
/usr/lib64/mysql/plugin/sql_errlog.so
......

主服务器：

1.编辑配置文件

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 1
log_bin = master-log
innodb_file_per_table = ON
skip_name_resolve = ON
[root@centos7 ~]#systemctl start mariadb

2.创建复制用户

MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      499 |              |                  |
+-------------------+----------+--------------+------------------+

3.安装半同步复制主节点插件

MariaDB [(none)]> INSTALL PLUGIN rpl_semi_sync_master SONAME 'semisync_master.so';    //安装插件
MariaDB [(none)]> SHOW PLUGINS;   //查看是否完成
+--------------------------------+----------+--------------------+--------------------+---------+
| Name                           | Status   | Type               | Library            | License |
+--------------------------------+----------+--------------------+--------------------+---------+
| binlog                         | ACTIVE   | STORAGE ENGINE     | NULL               | GPL     |
......
| partition                      | ACTIVE   | STORAGE ENGINE     | NULL               | GPL     |
| rpl_semi_sync_master           | ACTIVE   | REPLICATION        | semisync_master.so | GPL     |
+--------------------------------+----------+--------------------+--------------------+---------+
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';  //查看半同步复制相关信息
+------------------------------------+-------+
| Variable_name                      | Value |
+------------------------------------+-------+
| rpl_semi_sync_master_enabled       | OFF   |     //半同步复制的主节点(ON|OFF)
| rpl_semi_sync_master_timeout       | 10000 |     //等待从节点的超时时间，10s
| rpl_semi_sync_master_trace_level   | 32    |     //跟踪级别
| rpl_semi_sync_master_wait_no_slave | ON    |    //在没有从节点的时候是否等待
+------------------------------------+-------+
MariaDB [(none)]> SET GLOBAL rpl_semi_sync_master_enabled = ON;     //开启半同步复制为主节点
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';
+------------------------------------+-------+
| Variable_name                      | Value |
+------------------------------------+-------+
| rpl_semi_sync_master_enabled       | ON    |
| rpl_semi_sync_master_timeout       | 10000 |
| rpl_semi_sync_master_trace_level   | 32    |
| rpl_semi_sync_master_wait_no_slave | ON    |
+------------------------------------+-------+
MariaDB [(none)]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name                              | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients               | 0     |     //有多少个半同步节点
| Rpl_semi_sync_master_net_avg_wait_time     | 0     |     //平均等待时间 （非事物型）
| Rpl_semi_sync_master_net_wait_time         | 0     |    //等待时间多长（非事物型）
| Rpl_semi_sync_master_net_waits             | 0     |       //等待发生多少次（非事物型）
| Rpl_semi_sync_master_no_times              | 0     |
| Rpl_semi_sync_master_no_tx                 | 0     |
| Rpl_semi_sync_master_status                | ON    |
| Rpl_semi_sync_master_timefunc_failures     | 0     |
| Rpl_semi_sync_master_tx_avg_wait_time      | 0     |     /平均等待时间 （事物型） 
| Rpl_semi_sync_master_tx_wait_time          | 0     |      //等待时间多长（事物型）
| Rpl_semi_sync_master_tx_waits              | 0     |      //等待发生多少次（事物型）
| Rpl_semi_sync_master_wait_pos_backtraverse | 0     |
| Rpl_semi_sync_master_wait_sessions         | 0     |
| Rpl_semi_sync_master_yes_tx                | 0     |
+--------------------------------------------+-------+
等从服务器开启半同步复制作为从节点，在查询一次
MariaDB [(none)]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name                              | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients               | 1     |     //这里显示为1
| Rpl_semi_sync_master_net_avg_wait_time     | 0     |
| Rpl_semi_sync_master_net_wait_time         | 0     |
| Rpl_semi_sync_master_net_waits             | 0     |
| Rpl_semi_sync_master_no_times              | 0     |
| Rpl_semi_sync_master_no_tx                 | 0     |
| Rpl_semi_sync_master_status                | ON    |
| Rpl_semi_sync_master_timefunc_failures     | 0     |
| Rpl_semi_sync_master_tx_avg_wait_time      | 0     |
| Rpl_semi_sync_master_tx_wait_time          | 0     |
| Rpl_semi_sync_master_tx_waits              | 0     |
| Rpl_semi_sync_master_wait_pos_backtraverse | 0     |
| Rpl_semi_sync_master_wait_sessions         | 0     |
| Rpl_semi_sync_master_yes_tx                | 0     |
+--------------------------------------------+-------+

从服务器：

1.编辑配置文件

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 2
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
[root@centos7 ~]#systemctl start mariadb

2、安装半同步复制从节点插件

MariaDB [(none)]> INSTALL PLUGIN rpl_semi_sync_slave SONAME 'semisync_slave.so';      //安装插件
MariaDB [(none)]>  SHOW PLUGINS;    //查看是否完成
+--------------------------------+----------+--------------------+-------------------+---------+
| Name                           | Status   | Type               | Library           | License |
+--------------------------------+----------+--------------------+-------------------+---------+
| binlog                         | ACTIVE   | STORAGE ENGINE     | NULL              | GPL     |
......
| partition                      | ACTIVE   | STORAGE ENGINE     | NULL              | GPL     |
| rpl_semi_sync_slave            | ACTIVE   | REPLICATION        | semisync_slave.so | GPL     |
+--------------------------------+----------+--------------------+-------------------+---------+
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';   //查看半同步复制相关信息
+---------------------------------+-------+
| Variable_name                   | Value |
+---------------------------------+-------+
| rpl_semi_sync_slave_enabled     | OFF   |
| rpl_semi_sync_slave_trace_level | 32    |
+---------------------------------+-------+
MariaDB [(none)]> SET GLOBAL rpl_semi_sync_slave_enabled = ON;  /开启半同步复制为从节点
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%semi%';
+---------------------------------+-------+
| Variable_name                   | Value |
+---------------------------------+-------+
| rpl_semi_sync_slave_enabled     | ON    |
| rpl_semi_sync_slave_trace_level | 32    |
+---------------------------------+-------+

3.连接主节点

MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=499;   //连接主节点
MariaDB [(none)]> start slave;  //开启从节点
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.252.192
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-log.000003
          Read_Master_Log_Pos: 499
               Relay_Log_File: relay-log.000002
                Relay_Log_Pos: 530
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes

测试：

MariaDB [(none)]> create database medb;
MariaDB [(none)]> use medb;
MariaDB [medb]> create table tb1(id int unsigned auto_increment primary key,name varchar(200));
MariaDB [medb]> insert into tb1 (name) values ('hong'),('yan'),('L');
MariaDB [medb]> select * from tb1;
+----+------+
| id | name |
+----+------+
|  1 | hong |
|  2 | yan  |
|  3 | L    |
+----+------+

MariaDB [medb]> SHOW GLOBAL STATUS LIKE '%semi%';
+--------------------------------------------+-------+
| Variable_name                              | Value |
+--------------------------------------------+-------+
| Rpl_semi_sync_master_clients               | 1     |
| Rpl_semi_sync_master_net_avg_wait_time     | 724   |
| Rpl_semi_sync_master_net_wait_time         | 2174  |
| Rpl_semi_sync_master_net_waits             | 3     |
| Rpl_semi_sync_master_no_times              | 0     |
| Rpl_semi_sync_master_no_tx                 | 0     |
| Rpl_semi_sync_master_status                | ON    |
| Rpl_semi_sync_master_timefunc_failures     | 0     |
| Rpl_semi_sync_master_tx_avg_wait_time      | 1169  |
| Rpl_semi_sync_master_tx_wait_time          | 2339  |
| Rpl_semi_sync_master_tx_waits              | 2     |
| Rpl_semi_sync_master_wait_pos_backtraverse | 0     |
| Rpl_semi_sync_master_wait_sessions         | 0     |
| Rpl_semi_sync_master_yes_tx                | 3     |
+--------------------------------------------+-------+

四、实现基于SSL的复制

主服务器：

1.配置CA

[root@centos7 ~]#cd /etc/pki/CA   
[root@centos7 CA]#touch index.txt   //生成证书索引数据库文件(默认没有）
[root@centos7 CA]#echo  01 > serial  //指定第一个颁发证书的序列号（默认也没有 这里01两位采用的是十六进制）

2.生成自签证书

[root@centos7 CA]#(umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@centos7 CA]#openssl req -new -x509 -key private/cakey.pem  -out cacert.pem -days 3650

3.生成用于MySQL的的SSL文件及修改权限权限

[root@centos7 CA]#mkdir /var/lib/mysql/ssl
[root@centos7 CA]#cd /var/lib/mysql/ssl
[root@centos7 ssl]#(umask 077;openssl genrsa -out master.key 2048)
[root@centos7 ssl]#openssl req -new -key master.key -out master.csr
[root@centos7 ssl]#openssl ca -in master.csr  -out master.crt -days 365
[root@centos7 ssl]#cp /etc/pki/CA/cacert.pem /var/lib/mysql/ssl/
[root@centos7 ssl]#ll
total 20
-rw-r--r-- 1 root root 1257 Sep 14 16:10 cacert.pem
-rw-r--r-- 1 root root 4353 Sep 14 16:09 master.crt
-rw-r--r-- 1 root root  972 Sep 14 16:06 master.csr
-rw------- 1 root root 1675 Sep 14 16:05 master.key
[root@centos7 ssl]#chown -R mysql.mysql /var/lib/mysql/ssl/*    
[root@centos7 ssl]#ll
total 20
-rw-r--r-- 1 mysql mysql 1257 Sep 14 16:10 cacert.pem
-rw-r--r-- 1 mysql mysql 4353 Sep 14 16:09 master.crt
-rw-r--r-- 1 mysql mysql  972 Sep 14 16:06 master.csr
-rw------- 1 mysql mysql 1675 Sep 14 16:05 master.key

从服务器：

1.生成私钥

[root@cnetos7 mysql]#mkdir /var/lib/mysql/ssl
[root@cnetos7 mysql]#cd /var/lib/mysql/ssl
[root@cnetos7 ssl]#(umask 077;openssl genrsa -out slave.key 2048)
[root@cnetos7 ssl]#openssl req -new -key slave.key -out slave.csr
[root@cnetos7 ssl]#scp slave.csr 172.16.252.192:/etc/pki/CA/csr  //传给主服务器

2.主服务器上的CA颁发证书

[root@centos7 ssl]#cd /etc/pki/CA/csr
[root@centos7 csr]#openssl ca -in slave.csr  -out ../certs/slave.crt -days 365
[root@centos7 csr]#scp ../certs/slave.crt  172.16.252.190:/var/lib/mysql/ssl
[root@centos7 csr]#scp /etc/pki/CA/cacert.pem  172.16.252.190:/var/lib/mysql/ssl

3.改权限权限

[root@cnetos7 ssl]#ll
总用量 20
-rw-r--r--. 1 root root 1257 9月  14 16:27 cacert.pem
-rw-r--r--. 1 root root 4394 9月  14 16:26 slave.crt
-rw-r--r--. 1 root root  997 9月  14 16:24 slave.csr
-rw-------. 1 root root 1675 9月  14 16:15 slave.key
[root@cnetos7 ssl]#chown -R mysql.mysql /var/lib/mysql/ssl/*
[root@cnetos7 ssl]#ll
总用量 20
-rw-r--r--. 1 mysql mysql 1257 9月  14 16:27 cacert.pem
-rw-r--r--. 1 mysql mysql 4394 9月  14 16:26 slave.crt
-rw-r--r--. 1 mysql mysql  997 9月  14 16:24 slave.csr
-rw-------. 1 mysql mysql 1675 9月  14 16:15 slave.key

主服务器的MySQL配置

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 1
log_bin = master-log
innodb_file_per_table = ON
skip_name_resolve = ON
ssl
ssl-ca = /var/lib/mysql/ssl/cacert.pem
ssl-cert = /var/lib/mysql/ssl/master.crt
ssl-key = /var/lib/mysql/ssl/master.key
[root@centos7 ~]#systemctl start mariadb
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%ssl%';  //验证主节点配置文件是否成功
+---------------+-------------------------------+
| Variable_name | Value                         |
+---------------+-------------------------------+
| have_openssl  | YES                           |
| have_ssl      | YES                           |
| ssl_ca        | /var/lib/mysql/ssl/cacert.pem |
| ssl_capath    |                               |
| ssl_cert      | /var/lib/mysql/ssl/master.crt |
| ssl_cipher    |                               |
| ssl_key       | /var/lib/mysql/ssl/master.key |
+---------------+-------------------------------+
出现以上信息表示成功

从服务器的MySQL配置

[root@centos7 ~]#vim /etc/my.cnf.d/server.cnf
[mysqld]
server-id = 2
relay_log = relay-log
innodb_file_per_table = ON
skip_name_resolve = ON
ssl
ssl-ca = /var/lib/mysql/ssl/cacert.pem
ssl-cert = /var/lib/mysql/ssl/slave.crt
ssl-key = /var/lib/mysql/ssl/slave.key
[root@centos7 ~]#systemctl start mariadb
MariaDB [(none)]> SHOW GLOBAL VARIABLES LIKE '%ssl%'; //验证从节点配置文件是否成功
+---------------+-------------------------------+
| Variable_name | Value                         |
+---------------+-------------------------------+
| have_openssl  | YES                           |
| have_ssl      | YES                           |
| ssl_ca        | /var/lib/mysql/ssl/cacert.pem |
| ssl_capath    |                               |
| ssl_cert      | /var/lib/mysql/ssl/slave.crt  |
| ssl_cipher    |                               |
| ssl_key       | /var/lib/mysql/ssl/slave.key  |
+---------------+-------------------------------+
出现以上信息表示成功，

创建复制用户

MariaDB [(none)]> GRANT REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'repluser'@'172.16.252.%' IDENTIFIED BY 'replpass';
MariaDB [(none)]> flush privileges;
MariaDB [(none)]> SHOW MASTER STATUS;
+-------------------+----------+--------------+------------------+
| File              | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+-------------------+----------+--------------+------------------+
| master-log.000003 |      499 |              |                  |
+-------------------+----------+--------------+------------------+

从节点连接主节点

MariaDB [(none)]> CHANGE MASTER TO MASTER_HOST='172.16.252.192', MASTER_USER='repluser', MASTER_PASSWORD='replpass', MASTER_LOG_FILE='master-log.000003', MASTER_LOG_POS=499,MASTER_SSL=1,MASTER_SSL_CA='/var/lib/mysql/ssl/cacert.pem',MASTER_SSL_CERT='/var/lib/mysql/ssl/slave.crt',MASTER_SSL_KEY='/var/lib/mysql/ssl/slave.key'; 
 //可（MariaDB [(none)]> help change master to）查看连接配置帮助
MariaDB [(none)]> start slave;
MariaDB [(none)]> show slave status\G;
*************************** 1. row ***************************
               Slave_IO_State: Waiting for master to send event
                  Master_Host: 172.16.252.192
                  Master_User: repluser
                  Master_Port: 3306
                Connect_Retry: 60
              Master_Log_File: master-log.000003
          Read_Master_Log_Pos: 499
               Relay_Log_File: relay-log.000002
                Relay_Log_Pos: 530
        Relay_Master_Log_File: master-log.000003
             Slave_IO_Running: Yes
            Slave_SQL_Running: Yes
              Replicate_Do_DB: 
          Replicate_Ignore_DB: 
           Replicate_Do_Table: 
       Replicate_Ignore_Table: 
      Replicate_Wild_Do_Table: 
  Replicate_Wild_Ignore_Table: 
                   Last_Errno: 0
                   Last_Error: 
                 Skip_Counter: 0
          Exec_Master_Log_Pos: 499
              Relay_Log_Space: 818
              Until_Condition: None
               Until_Log_File: 
                Until_Log_Pos: 0
           Master_SSL_Allowed: Yes   //连接成功
           Master_SSL_CA_File: /var/lib/mysql/ssl/cacert.pem    
           Master_SSL_CA_Path: 
              Master_SSL_Cert: /var/lib/mysql/ssl/slave.crt
            Master_SSL_Cipher: 
               Master_SSL_Key: /var/lib/mysql/ssl/slave.key
        Seconds_Behind_Master: 0
Master_SSL_Verify_Server_Cert: No
                Last_IO_Errno: 0
                Last_IO_Error: 
               Last_SQL_Errno: 0
               Last_SQL_Error: 
  Replicate_Ignore_Server_Ids: 
             Master_Server_Id: 1
1 row in set (0.00 sec)

验证是否使用了SSL加密

[root@cnetos7 ssl]#mysql --ssl  （可mysql --help查看连接帮助）
MariaDB [(none)]> status;
--------------
mysql  Ver 15.1 Distrib 5.5.52-MariaDB, for Linux (x86_64) using readline 5.1

Connection id:      8
Current database:   
Current user:       root@localhost
SSL:            Cipher in use is DHE-RSA-AES256-GCM-SHA384    //可以看到是于SSL加密
Current pager:      stdout
Using outfile:      ''
Using delimiter:    ;
Server:         MariaDB
Server version:     5.5.52-MariaDB MariaDB Server
Protocol version:   10
Connection:     Localhost via UNIX socket
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    utf8
Conn.  characterset:    utf8
UNIX socket:        /var/lib/mysql/mysql.sock
Uptime:         20 min 21 sec

Threads: 2  Questions: 24  Slow queries: 0  Opens: 4  Flush tables: 2  Open tables: 30  Queries per second avg: 0.019
--------------

最后编辑于：2017.12.10 11:49:23

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 158,425评论 4赞 361
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 67,058评论 1赞 291
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 108,186评论 0赞 243
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 43,848评论 0赞 204
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 52,249评论 3赞 286
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 40,554评论 1赞 216
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 31,830评论 2赞 312
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 30,536评论 0赞 197
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 34,239评论 1赞 241
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 30,505评论 2赞 244
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 32,004评论 1赞 258
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 28,346评论 2赞 253
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 32,999评论 3赞 235
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 26,060评论 0赞 8
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 26,821评论 0赞 194
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 35,574评论 2赞 271
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 35,480评论 2赞 267

MySQL架构之主从复制、双主复制、半同步复制及基于SSL复制的实现

复制概述

一：主从复制架构

二：实现双主复制

三，半同步复制的实现

四、实现基于SSL的复制

推荐阅读更多精彩内容