MySQL 8.0配置手册

snow chuai汇总、整理、撰写---2020/7/25


1. 安装及配置MySQL
1) 安装MySQL 8.0
[root@node1 ~]# yum install yum-plugin-priorities centos-release-scl-rh centos-release-scl -y
[root@node1 ~]# sed -i -e "s/\]$/\]\npriority=10/g" /etc/yum.repos.d/CentOS-SCLo-scl.repo [root@node1 ~]# sed -i -e "s/\]$/\]\npriority=10/g" /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo
[root@node1 ~]# sed -i -e "s/enabled=1/enabled=0/g" /etc/yum.repos.d/CentOS-SCLo-scl.repo [root@node1 ~]# sed -i -e "s/enabled=1/enabled=0/g" /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo
[root@node1 ~]# yum --enablerepo=centos-sclo-rh install rh-mysql80-mysql-server -y
[root@node1 ~]# vim /etc/opt/rh/rh-mysql80/my.cnf.d/mysql-server.cnf # 于[mysqld]最尾部追加如下内容: character-set-server=utf8mb4
[root@node1 ~]# systemctl enable --now rh-mysql80-mysqld
2) 加载Mysql 8.0的shell环境 [root@node1 ~]# scl enable rh-mysql80 bash [root@node1 ~]# mysql -V mysql Ver 8.0.17 for Linux on x86_64 (Source distribution)
[root@node1 ~]# vim /etc/profile.d/rh-mysql80.sh source /opt/rh/rh-mysql80/enable export X_SCLS="`scl enable rh-mysql80 'echo $X_SCLS'`"
3) 初始化MySQL 8.0 [root@node1 ~]# mysql_secure_installation
Securing the MySQL server deployment.
Connecting to MySQL using a blank password.
VALIDATE PASSWORD COMPONENT can be used to test passwords and improve security. It checks the strength of password and allows the users to set only those passwords which are secure enough. Would you like to setup VALIDATE PASSWORD component?
# 是否启用密码验证策略 Press y|Y for Yes, any other key for No: y
# 选择密码验证策略 There are three levels of password validation policy:
LOW Length >= 8 MEDIUM Length >= 8, numeric, mixed case, and special characters STRONG Length >= 8, numeric, mixed case, special characters and dictionary file
Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 0
# 设置MySQL的密码 New password:
Re-enter new password:
# 验证你所输入的密码 Estimated strength of the password: 50 Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y By default, a MySQL installation has an anonymous user, allowing anyone to log into MySQL without having to have a user account created for them. This is intended only for testing, and to make the installation go a bit smoother. You should remove them before moving into a production environment.
# 移除匿名账户 Remove anonymous users? (Press y|Y for Yes, any other key for No) : y Success.
Normally, root should only be allowed to connect from 'localhost'. This ensures that someone cannot guess at the root password from the network.
# 禁止root远程登录 Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y Success.
By default, MySQL comes with a database named 'test' that anyone can access. This is also intended only for testing, and should be removed before moving into a production environment.
# 移除test数据库 Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y - Dropping test database... Success.
- Removing privileges on test database... Success.
Reloading the privilege tables will ensure that all changes made so far will take effect immediately.
# reload privilege tables Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y Success.
All done!
4) 测试MySQL [root@node1 ~]# mysql -u root -p Enter password: # 输入密码 Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 10 Server version: 8.0.17 Source distribution
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
# 显示用户列表 mysql> select user,host from mysql.user; +------------------+-----------+ | user | host | +------------------+-----------+ | mysql.infoschema | localhost | | mysql.session | localhost | | mysql.sys | localhost | | root | localhost | +------------------+-----------+ 4 rows in set (0.01 sec)
# 显示数据库列表 mysql> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | performance_schema | | sys | +--------------------+ 4 rows in set (0.01 sec)
# 创建一个test_database数据库 mysql> create database test_database; Query OK, 1 row affected (0.11 sec)
# 在test_database数据库创建一个test表 mysql> create table test_database.test_table (id int, name varchar(50), address varchar(50), primary key (id)); Query OK, 0 rows affected (0.42 sec)
# 对test表插入一个数据 mysql> insert into test_database.test_table(id, name, address) values("001", "CentOS", "BeiJing"); Query OK, 1 row affected (0.04 sec)
# 查看表 mysql> select * from test_database.test_table; +----+--------+---------+ | id | name | address | +----+--------+---------+ | 1 | CentOS | BeiJing | +----+--------+---------+ 1 row in set (0.00 sec)
# 删除数据库 mysql> drop database test_database; Query OK, 1 row affected (0.27 sec)
mysql> exit Bye [root@node1 ~]#
5) 防火墙规则设定 [root@node1 ~]# firewall-cmd --add-service=mysql --permanent success [root@node1 ~]# firewall-cmd --reload success
2. 为MySQL增加SSL/TSL
1) 生成SSL证书
[root@node1 ~]# cd /etc/pki/tls/certs
[root@node1 certs]# make mysql.key
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > mysql.key
Generating RSA private key, 2048 bit long modulus
.........................................................................................+++
..................+++
e is 65537 (0x10001)
Enter pass phrase:                  # 输入口令
Verifying - Enter pass phrase:      # 输入口令
[root@node1 certs]# openssl rsa -in mysql.key -out mysql.key Enter pass phrase for mysql.key: # 将私钥的保护口令移除
writing RSA key
[root@node1 certs]# make mysql.csr umask 77 ; \ /usr/bin/openssl req -utf8 -new -key mysql.key -out mysql.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BeiJing Locality Name (eg, city) [Default City]:BeiJing Organization Name (eg, company) [Default Company Ltd]:1000cc.net Organizational Unit Name (eg, section) []:tech Common Name (eg, your name or your server's hostname) []:node1.1000cc.net Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
[root@node1 certs]# openssl x509 -in mysql.csr -out mysql.crt -req -signkey mysql.key -days 3650 Signature ok subject=/C=CN/ST=BeiJing/L=BeiJing/O=1000cc.net/OU=tech/CN=node1.1000cc.net Getting Private key
2) 配置mysql [root@node1 ]# cp /etc/pki/tls/certs/mysql.key /etc/pki/tls/certs/mysql.crt /etc/pki/tls/certs/ca-bundle.crt /etc/opt/rh/rh-mysql80/pki/ [root@node1 ~]# chown -R mysql. /etc/opt/rh/rh-mysql80/pki
[root@node1 ~]# vim /etc/opt/rh/rh-mysql80/my.cnf.d/mysql-server.cnf # 于[mysqld]区段最后追加如下内容 ssl-ca=/etc/opt/rh/rh-mysql80/pki/ca-bundle.crt ssl-cert=/etc/opt/rh/rh-mysql80/pki/mysql.crt ssl-key=/etc/opt/rh/rh-mysql80/pki/mysql.key
[root@node1 ~]# systemctl restart rh-mysql80-mysqld
3) 验证 (1) 验证SSL状态 [root@node1 ~]# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 8 Server version: 8.0.17 Source distribution
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show variables like '%ssl%'; +--------------------+-----------------------------------------+ | Variable_name | Value | +--------------------+-----------------------------------------+ | have_openssl | YES | | have_ssl | YES | | mysqlx_ssl_ca | | | mysqlx_ssl_capath | | | mysqlx_ssl_cert | | | mysqlx_ssl_cipher | | | mysqlx_ssl_crl | | | mysqlx_ssl_crlpath | | | mysqlx_ssl_key | | | ssl_ca | /etc/opt/rh/rh-mysq80/pki/ca-bundle.crt | | ssl_capath | | | ssl_cert | /etc/opt/rh/rh-mysql80/pki/mysql.crt | | ssl_cipher | | | ssl_crl | | | ssl_crlpath | | | ssl_fips_mode | OFF | | ssl_key | /etc/opt/rh/rh-mysql80/pki/mysql.key | +--------------------+-----------------------------------------+ 17 rows in set (0.01 sec)
mysql> exit
(2) 使用SSL登录 [root@node1 ~]# mysql -u root -p --ssl-mode=required --protocol=tcp Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 8 Server version: 8.0.17 Source distribution
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show status like 'ssl_cipher'; +---------------+---------------------------+ | Variable_name | Value | +---------------+---------------------------+ | Ssl_cipher | DHE-RSA-AES128-GCM-SHA256 | +---------------+---------------------------+ 1 row in set (0.01 sec)
# 如果没有使用ssl [root@node1 ~]# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 8 Server version: 8.0.17 Source distribution
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show status like 'ssl_cipher'; +---------------+-------+ | Variable_name | Value | +---------------+-------+ | Ssl_cipher | | +---------------+-------+ 1 row in set (0.01 sec)
4) 指定账户强制使用SSL [root@node1 ~]# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 9 Server version: 8.0.17 Source distribution
Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
(1) 对新建账户强制使用SSL mysql> set global validate_password.policy=LOW; Query OK, 0 rows affected (0.00 sec)
mysql> create user snow identified by 'password' require ssl; Query OK, 0 rows affected (0.00 sec)
mysql> select user,host,ssl_type from mysql.user; +------------------+-----------+----------+ | user | host | ssl_type | +------------------+-----------+----------+ | snow | % | ANY | | mysql.infoschema | localhost | | | mysql.session | localhost | | | mysql.sys | localhost | | | root | localhost | | +------------------+-----------+----------+ 5 rows in set (0.00 sec)
(2) 对现有账户强制使用SSL mysql> alter user 'thomas'@'%' require ssl; Query OK, 0 rows affected (0.00 sec)
mysql> sselect user,host,ssl_type from mysql.user; +------------------+-----------+----------+ | user | host | ssl_type | +------------------+-----------+----------+ | snow | % | ANY | | thomas | % | ANY | | mysql.infoschema | localhost | | | mysql.session | localhost | | | mysql.sys | localhost | | | root | localhost | | +------------------+-----------+----------+ 6 rows in set (0.00 sec)
3. 使用mysqldump备份
1) 运行Mysqldump对MySQL数据进行转储
# 锁定所有表并转储MySQL中的所有数据 # 在转储数据期间,读取也被锁定,因此绝对无法使用数据库 [root@node1 ~]# mysqldump -u root -p --lock-all-tables --all-databases --events > mysql_dump.sql Enter password:
# 转储所有数据而没有锁定,但带有事务。可通过--single-transaction确保数据的完整性 [root@node1 ~]# mysqldump -u root -p --single-transaction --all-databases --events > mysql_dump.sql Enter password:
# 指定转储的数据库 [root@node1 ~]# mysqldump -u root -p test_database --single-transaction --events > mysql_dump.sql Enter password:
2) 恢复所备份的数据
# 恢复所有的数据库中的数据 [root@node1 ~]# mysql -u root -p < mysql_dump.sql Enter password:
# 恢复指定的数据库中的数据(但需要提前在数据库创建一个与之相同数据库名字的空库) [root@localhost ~]# mysql -u root -p test_database < mysql_dump.sql Enter password:
4. 使用Clone特性
1) 确认MySQL版本
[root@node1 ~]# /opt/rh/rh-mysql80/root/usr/libexec/mysqld --version
/opt/rh/rh-mysql80/root/usr/libexec/mysqld  Ver 8.0.17 for Linux on x86_64 (Source distribution)
2) 添加clone模块 [root@node1 ~]# vim /etc/opt/rh/rh-mysql80/my.cnf.d/mysql-server.cnf # 于[mysqld]区段最后追加如下内容 ..... ..... plugin-load=mysql_clone.so
[root@node1 ~]# systemctl restart rh-mysql80-mysqld
# 显示插件 [root@node1 ~]# mysql -u root -p -e "select plugin_name, plugin_status, plugin_type from information_schema.plugins where plugin_name = 'clone';" Enter password: +-------------+---------------+-------------+ | plugin_name | plugin_status | plugin_type | +-------------+---------------+-------------+ | clone | ACTIVE | CLONE | +-------------+---------------+-------------+
3) 在本地主机上将数据克隆到一个目录 [root@node1 ~]# mkdir -p /backup/mysql_backup [root@node1 ~]# chown mysql. /backup/mysql_backup
# backup1的目录请不要建立。这个目录将会由clone过程自行完成。否则将会报错 [root@node1 ~]# mysql -u root -p -e "clone local data directory = '/backup/mysql_backup/backup1/';" [root@node1 ~]# ll /backup/mysql_backup/backup1/ total 154640 drwxr-x--- 2 mysql mysql 4096 Jul 26 00:38 #clone -rw-r----- 1 mysql mysql 3717 Jul 26 00:38 ib_buffer_pool -rw-r----- 1 mysql mysql 12582912 Jul 26 00:38 ibdata1 -rw-r----- 1 mysql mysql 50331648 Jul 26 00:38 ib_logfile0 -rw-r----- 1 mysql mysql 50331648 Jul 26 00:38 ib_logfile1 drwxr-x--- 2 mysql mysql 4096 Jul 26 00:38 mysql -rw-r----- 1 mysql mysql 24117248 Jul 26 00:38 mysql.ibd drwxr-x--- 2 mysql mysql 4096 Jul 26 00:38 sys -rw-r----- 1 mysql mysql 10485760 Jul 26 00:38 undo_001 -rw-r----- 1 mysql mysql 10485760 Jul 26 00:38 undo_002
4) SELinux设定 [root@node1 ~]# restorecon -v /home/mysql_backup [root@node1 ~]# vi mysqld-clone.te module mysqld-clone 1.0;
require { type mysqld_t; type user_home_dir_t; class dir { add_name create remove_name write }; class file { create getattr open read unlink write }; }
#============= mysqld_t ============== allow mysqld_t user_home_dir_t:dir { add_name create remove_name write }; allow mysqld_t user_home_dir_t:file { create getattr open read unlink write };

[root@node1 ~]# checkmodule -m -M -o mysqld-clone.mod mysqld-clone.te checkmodule: loading policy configuration from mysqld-clone.te checkmodule: policy configuration loaded checkmodule: writing binary representation (version 19) to mysqld-clone.mod [root@node1 ~]# semodule_package --outfile mysqld-clone.pp --module mysqld-clone.mod [root@node1 ~]# semodule -i mysqld-clone.pp
5) 从远程主机Clone # 术语: 远程主机===>Donor(捐赠) Host. 本地备份主机===>Recipient(接收) Host
(1) 在Donor主机上为Recipient主机创建一个账户,并给与BACKUP_ADMIN特权 [root@node1 ~]# mysql -u root -p Enter password:
mysql> create user 'clone_user'@'%' identified by 'password'; Query OK, 0 rows affected (0.09 sec)
mysql> grant BACKUP_ADMIN on *.* to 'clone_user'@'%'; Query OK, 0 rows affected (0.10 sec)
(2) 在Recipient主机上,创建一个用户并为克隆添加CLONE_ADMIN特权 [root@node01 ~]# mysql -u root -p Enter password:
mysql> create user 'clone_user'@'%' identified by 'password'; Query OK, 0 rows affected (0.11 sec)
mysql> grant CLONE_ADMIN on *.* to 'clone_user'@'%'; Query OK, 0 rows affected (0.04 sec)
(3) 在Recipient主机上,运行Clone任务 # 先设定Donor Host主机的IP及端口 mysql> set global clone_valid_donor_list = '192.168.10.12:3306'; Query OK, 0 rows affected (0.00 sec)
# clone会到远程主机的/var/opt/rh/rh-mysql80/lib/mysql mysql> clone instance from clone_user@192.168.10.12:3306 identified by 'password'; Query OK, 0 rows affected (2.64 sec)
# 如果要指定远程目标目录,可以这样执行 mysql> clone instance from clone_user@192.168.10.12:3306 identified by 'password' data directory = '/backup/mysql_backup/backup1/';
# 验证克隆状态 mysql> select STATE from performance_schema.clone_status; +-----------+ | STATE | +-----------+ | Completed | +-----------+ 1 row in set (0.00 sec)
5. MySQL 8.0主从复制
1) 所有节点均需安装MySQL 8.0
2) Master节点需要配置SSL/TLS
3) 配置Master环境
[root@node1 ~]# vim /etc/opt/rh/rh-mysql80/my.cnf.d/mysql-server.cnf
# 于[mysqld]区段最后添加如下内容
log-bin=mysql-bin
# 定义Master的ID,需要比Slave低
server-id=101
# 加载clone插件
plugin-load=mysql_clone.so
[root@node1 ~]# systemctl restart rh-mysql80-mysqld
[root@node1 ~]# mysql -u root -p Enter password: ...... ...... mysql> set global validate_password.policy=LOW; Query OK, 0 rows affected (0.00 sec)
创建一个账户,密码为password mysql> create user 'repl_user'@'%' identified by 'password'; Query OK, 0 rows affected (0.01 sec)
mysql> grant replication slave on *.* to repl_user@'%'; Query OK, 0 rows affected (0.05 sec)
mysql> create user 'clone_user'@'%' identified by 'password'; Query OK, 0 rows affected (0.07 sec)
mysql> grant backup_admin on *.* to 'clone_user'@'%'; Query OK, 0 rows affected (0.06 sec)
mysql> flush privileges; Query OK, 0 rows affected (0.00 sec)
mysql> exit Bye
2) 为Slave节点安装并配置MariDB
3) 配置Slave节点主从复制环境 [root@node2 ~]# vim /etc/opt/rh/rh-mysql80/my.cnf.d/mysql-server.cnf # 在[server]区段追加如下内容 log-bin=mysql-bin # 定义Slave的ID,需要比Mater高 server-id=102 # 加载clone插件 plugin-load=mysql_clone.so # 定义Slave节点为只读 read_only=1 # 定义Master节点 report-host=node1.1000cc.net
[root@node2 ~]# systemctl restart rh-mysql80-mysqld
[root@node2 ~]# mysql -u root -p Enter password: ...... ...... mysql> set global validate_password.policy=LOW; Query OK, 0 rows affected (0.00 sec)
# 创建clone_user账户,密码为password mysql> create user 'clone_user'@'%' identified by 'password'; Query OK, 0 rows affected (0.07 sec)
mysql> grant clone_admin on *.* to 'clone_user'@'%'; Query OK, 0 rows affected (0.06 sec)
mysql> flush privileges; Query OK, 0 rows affected (0.00 sec)
mysql> exit Bye
4) 在Slave节点上运行Clone任务 [root@node2 ~]# mysql -u root -p Enter password: ...... ...... # 设定远程主机IP及端口 mysql> set global clone_valid_donor_list = '192.168.10.11:3306'; Query OK, 0 rows affected (0.00 sec)
# 开始clone mysql> clone instance from clone_user@192.168.10.11:3306 identified by 'password'; Query OK, 0 rows affected (3.01 sec)
# 验证状态 mysql> select ID,STATE,SOURCE,DESTINATION,BINLOG_FILE,BINLOG_POSITION from performance_schema.clone_status; +------+-----------+--------------------+----------------+------------------+-----------------+ | ID | STATE | SOURCE | DESTINATION | BINLOG_FILE | BINLOG_POSITION | +------+-----------+--------------------+----------------+------------------+-----------------+ | 1 | Completed | 192.168.10.11:3306 | LOCAL INSTANCE | mysql-bin.000001 | 1345 | +------+-----------+--------------------+----------------+------------------+-----------------+ 1 row in set (0.01 sec)
mysql> change master to -> master_host='192.168.10.11', -> master_ssl=1, -> master_log_file='mysql-bin.000001', -> master_log_pos=1345; Query OK, 0 rows affected (0.65 sec)
# 开始replication mysql> start slave user='repl_user' password='password'; Query OK, 0 rows affected, 1 warning (0.05 sec)
5) 验证状态 mysql> show slave status\G *************************** 1. row *************************** Slave_IO_State: Waiting for master to send event Master_Host: 192.168.10.11 Master_User: repl_user Master_Port: 3306 Connect_Retry: 60 Master_Log_File: mysql-bin.000001 Read_Master_Log_Pos: 1345 Relay_Log_File: node2-relay-bin.000002 Relay_Log_Pos: 319 Relay_Master_Log_File: mysql-bin.000001 Slave_IO_Running: Yes Slave_SQL_Running: Yes Replicate_Do_DB: Replicate_Ignore_DB: Replicate_Do_Table: Replicate_Ignore_Table: Replicate_Wild_Do_Table: Replicate_Wild_Ignore_Table: Last_Errno: 0 Last_Error: Skip_Counter: 0 Exec_Master_Log_Pos: 1345 Relay_Log_Space: 526 Until_Condition: None Until_Log_File: Until_Log_Pos: 0 Master_SSL_Allowed: Yes Master_SSL_CA_File: Master_SSL_CA_Path: Master_SSL_Cert: Master_SSL_Cipher: Master_SSL_Key: Seconds_Behind_Master: 0 Master_SSL_Verify_Server_Cert: No Last_IO_Errno: 0 Last_IO_Error: Last_SQL_Errno: 0 Last_SQL_Error: Replicate_Ignore_Server_Ids: Master_Server_Id: 1 Master_UUID: 29426105-ce8b-11ea-8269-525400f7fb9b Master_Info_File: mysql.slave_master_info SQL_Delay: 0 SQL_Remaining_Delay: NULL Slave_SQL_Running_State: Slave has read all relay log; waiting for more updates Master_Retry_Count: 86400 Master_Bind: Last_IO_Error_Timestamp: Last_SQL_Error_Timestamp: Master_SSL_Crl: Master_SSL_Crlpath: Retrieved_Gtid_Set: Executed_Gtid_Set: Auto_Position: 0 Replicate_Rewrite_DB: Channel_Name: Master_TLS_Version: Master_public_key_path: Get_master_public_key: 0 Network_Namespace: 1 row in set (0.00 sec)

 

如对您有帮助,请随缘打个赏。^-^

gold