GBase 8a 安全配置

已于 2023-06-15 17:43:50 修改
阅读量1k 收藏 2
点赞数
分类专栏： GBase8a 文章标签： linux centos ubuntu
于 2022-11-01 01:03:18 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_34479012/article/details/127624080
版权

目录

密码复杂度

修改root的默认密码

登录失败尝试次数

重鉴别

开启审计日志

客户端SSL加密连接

密码复杂度

修改密码策略之前，记得先修改用户密码符合新的规则，不然重启后 旧的用户密码将无法登录使用

修改coordinator 节点的配置文件 gbase_8a_gcluster.cnf（每个节点都需要改，不改的节点密码策略不生效，可以继续使用简单密码）
修改node 节点的配置文件gbase_8a_gbase.cnf（每个节点都需要改，不改的节点密码策略不生效，可以继续使用简单密码）

对相同变量配置相同的值

[gbase@VM-8-10-centos gbase]$ cd $GCLUSTER_BASE/config
[gbase@VM-8-10-centos config]$ vi gbase_8a_gcluster.cnf 

[gbase@VM-8-10-centos gnode]$ cd $GBASE_BASE/config
[gbase@VM-8-10-centos config]$ vi gbase_8a_gbase.cnf

[gbase@VM-8-10-centos config]$ gcluster_services gcluster restart

gbase> set password for user_1 = password('111');
ERROR 1809 (HY000): Invalid password format,length should > 8 and contain 'number' 'small letter' 'captital letter' 'special character'.

[gbased]

password_format_option = '15'       #包含数字大小写其他字符
password_min_length = '8'             #最小长度为8
password_life_time = '90'               #90天过期

修改root的默认密码

[root@gba01 opt]# su - gbase
 
$ gccli –uroot
GBase client 9.5.3.17.117651. Copyright (c) 2004-2020, GBase. All Rights Reserved.
gbase> SET PASSWORD FOR root = PASSWORD('H133%_h');

登录失败尝试次数

达到失败次数后 该用户会被锁定禁止登录，解锁后可正常使用

[gbase@VM-8-10-centos gcluster]$ cd $GCLUSTER_BASE/config
[gbase@VM-8-10-centos config]$ vi gbase_8a_gcluster.cnf 
[gbase@VM-8-10-centos config]$ gcluster_services gcluster restart

[gbase@VM-8-10-centos config]$ gccli -uroot -p
Enter password: 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
[gbase@VM-8-10-centos config]$ gccli -uroot -p
Enter password: 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
[gbase@VM-8-10-centos config]$ gccli -uroot -p
Enter password: 
ERROR 1825 (HY000): Access denied for user 'root'@'%'. Account is locked.

[gbased]
login_attempt_max = '3' 

用户解锁

[gbase@VM-8-10-centos gbase]$ gccli -ugbase -p

gbase> alter user root identified by 'gBase20333333#';
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

gbase> alter user root account unlock;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

重鉴别

10分钟空闲需要重新登录

修改每个 coordinator 节点的配置文件 gbase_8a_gcluster.cnf
修改每个 node 节点的配置文件gbase_8a_gbase.cnf

[gbase@VM-8-10-centos gbase]$ cd $GCLUSTER_BASE/config
[gbase@VM-8-10-centos config]$ vi gbase_8a_gcluster.cnf 

[gbase@VM-8-10-centos gnode]$ cd $GBASE_BASE/config
[gbase@VM-8-10-centos config]$ vi gbase_8a_gbase.cnf

[gbase@VM-8-10-centos config]$ gcluster_services gcluster restart

[gbased]

interactive_timeout  = 600     #单位为秒  这个参数默认是开启的 默认1000000

wait_timeout = 600                #单位为秒  这个参数默认是开启的 默认1000000

开启审计日志

gbase> set global audit_log = 1 ;
gbase> set global log_output = 'table';

创建审计策略

gbase> CREATE AUDIT POLICY audit_policy_1 ( Enable = 'Y');
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

gbase> \q
Bye
[gbase@VM-8-10-centos gbase]$ gccli -uroot -p
Enter password: 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
[gbase@VM-8-10-centos gbase]$ gccli -uroot -p
Enter password: 
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
[gbase@VM-8-10-centos gbase]$ gccli -uroot -p
Enter password: 
ERROR 1825 (HY000): Access denied for user 'root'@'%'. Account is locked.
[gbase@VM-8-10-centos gbase]$ gccli -ugbase -p
Enter password: 

gbase> SELECT start_time,user_host,query_time,rows, LEFT(sql_text, 30), conn_type FROM gbase.audit_log;
gbase> SELECT * FROM gbase.audit_log;
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+-----------+-----------------+------+---------+----+--------------------------------------------------------+--------------------------------------------------------------------------+----------+-------------+-----------+---------+-----------+
| thread_id | taskid | start_time          | end_time            | user_host                   | uid | user  | host_ip   | query_time      | rows | vc_id   | db | table_list                                             | sql_text                                                                 | sql_type | sql_command | operators | status  | conn_type |
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+-----------+-----------------+------+---------+----+--------------------------------------------------------+--------------------------------------------------------------------------+----------+-------------+-----------+---------+-----------+
|        95 |      0 | 2022-10-31 22:47:27 | 2022-10-31 22:47:27 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000122 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | CREATE GCLUSTER_LOCAL AUDIT POLICY "audit_policy_1" (Enable='Y',User='') | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|        94 | 131152 | 2022-10-31 22:47:27 | 2022-10-31 22:47:27 | gbase[gbase] @ localhost [] |   2 | gbase |           | 00:00:00.002588 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | CREATE AUDIT POLICY audit_policy_1 ( Enable = 'Y',User = '' )            | DDL      | OTHERS      |           | SUCCESS | ODBC      |
|        94 |      0 | 2022-10-31 22:47:31 | 2022-10-31 22:47:31 | gbase[gbase] @ localhost [] |   2 | gbase |           | 00:00:00.000006 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | ODBC      |
|        95 |      0 | 2022-10-31 22:47:31 | 2022-10-31 22:47:31 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000003 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|        97 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000467 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|        98 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000433 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|        98 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000126 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | set  self gcluster_lock_timeout=0, gbase_fast_update=0                   | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|        98 | 131155 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000160 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET character_set_results = utf8mb4                                      | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|        98 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000066 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET SELF SCN = 0                                                         | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|        98 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000154 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | ALTER GCLUSTER_LOCAL USER "root"@"%" ACCOUNT ADD                         | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|        97 | 131154 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.007139 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | alter user "root"@"%" account add                                        | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|        97 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000001 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|        96 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | [root] @ localhost []       |   0 | root  |           | 00:00:00.013624 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | FAILED  | ODBC      |
|        98 |      0 | 2022-10-31 22:47:35 | 2022-10-31 22:47:35 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000001 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|       100 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000440 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|       101 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000467 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|       101 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000125 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | set  self gcluster_lock_timeout=0, gbase_fast_update=0                   | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       101 | 131157 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000148 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET character_set_results = utf8mb4                                      | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       101 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000080 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET SELF SCN = 0                                                         | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       101 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000174 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | ALTER GCLUSTER_LOCAL USER "root"@"%" ACCOUNT ADD                         | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|       100 | 131156 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.007594 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | alter user "root"@"%" account add                                        | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|       100 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000001 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|        99 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | [root] @ localhost []       |   0 | root  |           | 00:00:00.009110 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | FAILED  | ODBC      |
|       101 |      0 | 2022-10-31 22:47:39 | 2022-10-31 22:47:39 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000002 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|       103 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000436 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|       104 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000443 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | CAPI      |
|       104 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000125 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | set  self gcluster_lock_timeout=0, gbase_fast_update=0                   | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       104 | 131159 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000137 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET character_set_results = utf8mb4                                      | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       104 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000064 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | SET SELF SCN = 0                                                         | OTHERS   | OTHERS      |           | SUCCESS | CAPI      |
|       104 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000151 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | ALTER GCLUSTER_LOCAL USER "root"@"%" ACCOUNT ADD                         | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|       103 | 131158 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.007557 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: ;                              | alter user "root"@"%" account add                                        | DDL      | OTHERS      |           | SUCCESS | CAPI      |
|       103 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000001 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|       102 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | [root] @ localhost []       |   0 | root  |           | 00:00:00.009166 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | FAILED  | ODBC      |
|       104 |      0 | 2022-10-31 22:47:40 | 2022-10-31 22:47:40 | gbase[gbase] @  [10.0.8.10] |   2 | gbase | 10.0.8.10 | 00:00:00.000002 |    0 | vc00003 |    |                                                        | Quit                                                                     | OTHERS   | Quit        |           | SUCCESS | CAPI      |
|       105 |      0 | 2022-10-31 22:47:56 | 2022-10-31 22:47:56 | gbase[gbase] @ localhost [] |   2 | gbase |           | 00:00:00.000612 |    0 |         |    |                                                        | Connect                                                                  | OTHERS   | Connect     |           | SUCCESS | ODBC      |
|       105 | 131160 | 2022-10-31 22:48:04 | 2022-10-31 22:48:04 | gbase[gbase] @ localhost [] |   2 | gbase |           | 00:00:00.006332 |    0 | vc00003 |    | WRITE: ; READ: `vc00003`.`gbse`.`audit_log`; OTHER: ;  | select * from gbse.audit_log                                             | DQL      | SELECT      |           | FAILED  | ODBC      |
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+-----------+-----------------+------+---------+----+--------------------------------------------------------+--------------------------------------------------------------------------+----------+-------------+-----------+---------+-----------+
36 rows in set (Elapsed: 00:00:00.00)

清空审计日志

gbase> TRUNCATE SELF gbase.audit_log;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

gbase> select * from gbase.audit_log;
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+---------+-----------------+------+---------+----+---------------------------------------------------------+-------------------------------+----------+-------------+-----------+---------+-----------+
| thread_id | taskid | start_time          | end_time            | user_host                   | uid | user  | host_ip | query_time      | rows | vc_id   | db | table_list                                              | sql_text                      | sql_type | sql_command | operators | status  | conn_type |
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+---------+-----------------+------+---------+----+---------------------------------------------------------+-------------------------------+----------+-------------+-----------+---------+-----------+
|       105 |      0 | 2022-10-31 22:52:17 | 2022-10-31 22:52:17 | gbase[gbase] @ localhost [] |   2 | gbase |         | 00:00:00.000603 |    0 | vc00003 |    | WRITE: ; READ: ; OTHER: `vc00000`.`gbase`.`audit_log`;  | TRUNCATE SELF gbase.audit_log | DDL      | TRUNCATE    |           | SUCCESS | ODBC      |
+-----------+--------+---------------------+---------------------+-----------------------------+-----+-------+---------+-----------------+------+---------+----+---------------------------------------------------------+-------------------------------+----------+-------------+-----------+---------+-----------+
1 row in set (Elapsed: 00:00:00.00)

审计日志高可用

开启审计后，审计日志默认存在audit_log表中， audit_log是当前一段时间的日志，需要定时将一些历史日志转储到audit_log_express 表中，每60分钟转存储一次。

gbase> use test;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

gbase> show events \G;
Empty set (Elapsed: 00:00:00.00)
[gbase@h4 opt]$ vi /opt/audit.sql 
[gbase@h4 opt]$ gccli -uroot -p -D test < /opt/audit.sql
delimiter // 
CREATE EVENT import_audit_log
ON SCHEDULE EVERY 60 MINUTE
ON COMPLETION NOT PRESERVE
ENABLE
LOCAL
DO
begin
	declare errno int;
	declare msg text;
	declare exit handler for sqlexception
	begin
		get diagnostics condition 1 errno = gbase_errno, msg = message_text;
		create table if not exists import_audit_log_errors(
		err_time datetime,
		hostname varchar(64),
		err_no int,
		msg_txt varchar(1024)
		) CHARSET=utf8mb4;
		insert into import_audit_log_errors values (now(), @@hostname, errno, substr(msg, 0, 1024));
	end;
	create table if not exists audit_log_express (
	hostname varchar(64),
	thread_id int,
	taskid bigint,
	start_time datetime,
	uid bigint, user varchar(16),
	host_ip varchar(32),
	query_time time, rows bigint,
	table_list varchar(4096),
	sql_text varchar(8191),
	ql_type varchar(16),
	sql_command varchar(32),
	operators varchar(256),
	status varchar(16),
	conn_type varchar(16)
	) CHARSET=utf8mb4;
	set self sql_mode = '';
	create self table gbase.audit_log_bak2 like gbase.audit_log;
	set self sql_mode = default;
    rename self table gbase.audit_log to gbase.audit_log_bak1,  
	gbase.audit_log_bak2 to gbase.audit_log;
	set _gbase_query_path = on;
	insert into audit_log_express select
	@@hostname as hostname,
	thread_id,
	taskid,
	start_time,
	uid,
	user,
	host_ip,
	query_time,
	rows,
	substr(table_list, 0, 4096),
	substr(sql_text, 0, 8191),
	sql_type,
	sql_command,
	operators,
	status,
	conn_type
	from gbase.audit_log_bak1;
	drop self table gbase.audit_log_bak1;
end//
delimiter ;
[gbase@h4 opt]$ gccli -uroot -p
gbase> use test;
gbase> show events;
+--------------+------------------------------------------------------------------+------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------+-----------+------------+----------------+----------------+---------------------+------+---------+--------------+----------------------+----------------------+--------------------+
| Vc           | Db                                                               | Name                                                             | Definer                                                                                                                                                                                           | Time zone | Type      | Execute at | Interval value | Interval field | Starts              | Ends | Status  | Execute mode | character_set_client | collation_connection | Database Collation |
+--------------+------------------------------------------------------------------+------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------+-----------+------------+----------------+----------------+---------------------+------+---------+--------------+----------------------+----------------------+--------------------+
| vcname000002 | test                                                             | import_audit_log                                                 | root@%                                                                                                                                                                                            | +08:00    | RECURRING | NULL       | 60             | MINUTE         | 2022-12-17 00:31:18 | NULL | ENABLED |            0 | utf8                 | utf8_general_ci      | utf8_general_ci    |
+--------------+------------------------------------------------------------------+------------------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------+-----------+------------+----------------+----------------+---------------------+------+---------+--------------+----------------------+----------------------+--------------------+
1 row in set (Elapsed: 00:00:00.00)

客户端SSL加密连接

生成服务端、客户端证书文件

[root@hw-00 gcinstall]# su - root
[root@hw-00 gcinstall]# mkdir -p /usr/local/ssl
[root@hw-00 gcinstall]# cd /usr/local/ssl/
[root@hw-00 ssl]# openssl req -sha1 -new -x509 -nodes -days 3650 -keyout ca-key.pem >ca-cert.pem
[root@hw-00 ssl]# openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout server-key.pem > server-req.pem
[root@hw-00 ssl]# openssl rsa -in server-key.pem -out server-key.pem
[root@hw-00 ssl]# openssl x509 -sha1 -req -in server-req.pem -days 730 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
Signature ok
subject=/C=11/ST=1/L=1/O=1/OU=1/CN=1/emailAddress=1
Getting CA Private Key
[root@hw-00 ssl]# openssl req -sha1 -newkey rsa:2048 -days 730 -nodes -keyout client-key.pem > client-req.pem
[root@hw-00 ssl]# openssl rsa -in client-key.pem -out client-key.pem
[root@hw-00 ssl]# openssl x509 -sha1 -req -in client-req.pem -days 730 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > client-cert.pem
Signature ok
subject=/C=11/ST=1/L=1/O=1/OU=1/CN=1/emailAddress=1
Getting CA Private Key
[root@hw-00 ssl]# ll
-rw-r--r-- 1 root root 1285 Nov 14 18:14 ca-cert.pem
-rw-r--r-- 1 root root 1708 Nov 14 18:14 ca-key.pem
-rw-r--r-- 1 root root 1159 Nov 14 18:22 client-cert.pem
-rw-r--r-- 1 root root 1679 Nov 14 18:21 client-key.pem
-rw-r--r-- 1 root root 1041 Nov 14 18:21 client-req.pem
-rw-r--r-- 1 root root 1159 Nov 14 18:19 server-cert.pem
-rw-r--r-- 1 root root 1679 Nov 14 18:18 server-key.pem
-rw-r--r-- 1 root root 1041 Nov 14 18:16 server-req.pem

服务端配置

[root@hw-00 ~]# vi /opt/gbase/192.168.0.92/gcluster/config/gbase_8a_gcluster.cnf

[gbased]

ssl-ca=/usr/local/ssl/ca-cert.pem
ssl-cert=/usr/local/ssl/server-cert.pem
ssl-key=/usr/local/ssl/server-key.pem

重启集群验证是否配置成功

[root@hw-00 ~]# su - gbase
Last login: Mon Nov 14 18:10:52 CST 2022 from 192.168.0.92 on pts/2
[gbase@hw-00 ~]$ gcluster_services all restart
[gbase@hw-00 ~]$ gccli -uroot -p

gbase> show variables like 'have_%ssl';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_openssl  | YES   |
| have_ssl      | YES   |
+---------------+-------+
2 rows in set (Elapsed: 00:00:00.00)

客户端配置

如果有单独的客户端，需要将server 端生成的 ca-cert.pem，client-req.pem，client-key.pem，client-cert.pem 拷贝到 client 端 /usr/local/ssl 路径下，我们的客户端和服务端使用的是同一台机器，就不用拷贝了，直接修改配置文件即可

[gbase@hw-00 ~]$ vi /opt/gbase/192.168.0.92/gcluster/config/gbase_8a_gcluster.cnf

[client]

ssl-ca=/usr/local/ssl/ca-cert.pem
ssl-cert=/usr/local/ssl/client-cert.pem
ssl-key=/usr/local/ssl/client-key.pem

使用远程连接验证ssl是否开启

[gbase@hw-00 ~]$ gccli -h 123.249.11.137 -ugbase -pgba20*****
gbase> status
--------------
Connection id:		11
Current database:	
Current user:		gbase@123.249.11.137
SSL:			Cipher in use is DHE-RSA-AES256-SHA
TCP port:		5258
Uptime:			Elapsed: 00:16:29.00

Threads: 3  Questions: 11  Slow queries: 0  Opens: 28  Flush tables: 1  Open tables: 21  Queries per second avg: 0.11
--------------

GNAIXGNAHZ
关注
专栏目录
GBase 8a查看和清理故障恢复状态Failover的方法
jingjing1068的博客
03-25 2101
1 列存储和行列混存 数据在磁盘中按照列的方式进行组织和物理存储。行存储架构和列存储架构的数据库分别适用于不同的应用，具备各自的优劣势，如下图所示。列存储架构对查询、统计和分析类操作具备天然的优势。 例如，在分析系统中对100列的业务表进行分析查询，对该业务表列的引用一般不超过10个。对I/O是主要瓶颈的分析系统而言，相较于传统的行式数据库，列式存储技术可以很容易地带来一个数量级的性能提升。 面对海量数据分析的I/O瓶颈，分析型数据库把表数据按列的方式存储，其优势体现在以下几个方面。 降低I/O：只有访问
gbase 8a 配置手册
aisirea的博客
12-22 2058
1配置文件 在成功安装GBase 8a后，在安装路径的/GBase/config目录下， gbase_8a_gbase8a.cnf 是 GBase 8a 的配置参数文件。 通过对参数文件中相关参数的值进行合理的修改，可以使GBase 8a的性能 进一步得到提升。参数文件中的值均为全局性参数，需要在修改后，重新启动 GBase服务才能生效。 2配置参数 在GBase 8a的服务器配置参数文件中，参数如下表所示。 编号 参数名称 说明 ...
GBase 8s 关于用户相关操作
最新发布
weixin_48632512的博客
08-08 485
GBase 8s 用户相关操作，创建用户等
GBase 8c 配置账户安全参数（二）
qq_41614765的博客
09-14 354
postgres为需要连接的数据库名称，5600为数据库主节点的端口号。在GBase 8c 数据库中，配置password_lock_time参数。如果显示结果不为1，执行“\q”命令退出数据库。1、以操作系统用户gbase登录数据库主节点。4、执行如下命令设置成默认值1。2、使用如下命令连接数据库。3、查看已配置的参数。
GBase 8a 虚拟集群
GNAIXGNAHZ的博客
11-19 780
GBase 8a 虚拟集群
GBase 8a 数据库及应用性能检查
kevindaddy的博客
01-19 1133
检查数据库执行性能以及当前集群连接情况查看 1、 检查配置参数项 参数项主要包括两大部分，分布是操作系统参数和数据库参数，具体请参见附件内容，参数值在系统初始安装完成后，要备份一下。 配置文件对于GBase 8a MPP Cluster集群服务相当重要，建议一般情况不要进行修改，在修改之前最好要备份一份，改动的时候移动要添加注释。当发现数据库运行不正常，比如响应变慢，状态不一致，则考虑是否有人修改过配置文件。通过集群的配置管理工具可完成此工作。 2、 性能诊断检查 GBase 8a MPP Cluste
gbase8a单机免费版-8.6.2.zip
03-28
在本压缩包“gbase8a单机免费版-8.6.2.zip”中，包含的是GBase 8a的单机免费版本，适合个人学习和小型项目测试使用。用户可以从官方网站获取这个版本，以体验其功能和性能。 GBase 8a的主要特点和知识点包括： 1. ...
GBase8a数据库安装包,文档，驱动包.rar
05-10
这个压缩包“GBase8a数据库安装包,文档，驱动包.rar”包含了安装GBase 8a所需的主要组件以及相关的文档和驱动程序，特别是JDBC驱动，这对于Java开发者来说是非常关键的。 1. **GBase 8a数据库安装包**：这是安装...
GBase 8a 配置手册
06-20
《GBase 8a 配置手册》是针对GBase 8a数据库系统的一份详尽指导文档，主要面向IT专业人员，特别是那些负责数据库管理、配置和优化的技术人员。GBase 8a是由南大通用数据技术有限公司开发的一款高性能、高可用性的列...
GBase 8a MPP ClusterSQL参考手册
08-30
7. **安全性与权限管理**：讲解GBase 8a的用户管理和权限控制机制，包括用户认证、角色权限分配、对象权限管理等方面。 8. **集群管理**：涵盖集群的部署、扩展、监控和维护，包括节点的添加、删除，以及如何调整...
Gbase8A用户手册
05-06
Gbase8A用户手册，提供gbase所有操作的指南，用户可以根据这个使用
GBase 8a 数据库技术白皮书
09-26
数据库技术：在过去的十年里，数据的有效利用已经成为各单位议事日程上最优先的项目 之一。近几年来，企业和政府机构已经完成了信息化建设的初步阶段，即数据的 采集和事务应用。但是如何对已有海量数据进行有效利用，如何对数据进行挖掘、 分析，如何从历史数据中获取规律性，以指导公司的规划和决策，以及怎样支持 海量数据的即席查询、比对，这些方面是信息化建设新的阶段和发展方向。
GBase 8a 资源管理——环境配置
ljx123456666的博客
11-28 319
步骤3 查看cgroup服务是否启动成功。
GBase 8a 密码安全管理
Beyond_777的博客
07-24 265
为保证密码安全管理在整个集群环境的一致性，需要在各Coordinator节点的配置文件gbase_8a_gcluster.cnf中和各Data节点的配置文件gbase_8a_gbase.cnf中，对相同变量配置相同的值。控制密码的有效期，达到有效期后用户密码自动过期。用户密码过期后，允许用户登录，在执行SQL时提示用户修改密码。密码复杂度受只读参数password_format_option控制。用户可以配置密码复杂度和长度要求，在创建密码和修改密码时必须符合此强度要。...
国产数据库 GBase 8a 安装
水蜜桃桃桃的博客
02-06 2575
GBase 8a试用版安装，及客户端使用
南大通用GBase 8a 分布式数据库集群安装与基本使用操作
cdlcn
12-25 531
本文档是介绍南大通用GBase 8a 分布式数据库集群(简称GBase 8a MPP集群)的安装、简单使用等基本操作，目标人群是刚接触分布式数据库集群的DBA和数据库开发人员。此文档只介绍基本使用，部分功能的详细说明，请查看产品手册。本文档只包含GBase 8a MPP集群V8版本在redhat 7上的操作样例。
GBase8a--权限管理
xiarichuxun的博客
03-19 1383
gbase8a--权限管理
Linux安装GBase8a数据库
眠的博客
06-10 2396
创建用户名/密码 --> gbase/gbase的用户
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值