CAPTAINS - 2021年9月
type: channel
link: https://www.captains.top/index.php/2021/09/
description: 啦啦啦。。。
items: 01-ETCD集群部署
items: MYSQL增加审计日志

01-ETCD集群部署
type: item
date: 2021-09-14T08:26:00+00:00
description: [TOC]部署ETCD集群1、概述- 大意： etcd 是兼具一致性和高可用性的键值数据库，可以作为保存 Kubernetes 所有集群数据的后台数据库。 - 官方网址： https://etcd.io/docs/ 2、服务器配置主机名cpu内存存储操作系统k8s0144100gUbuntu 18.04.5 LTSk8s0244100gUbuntu 18.04.5 LTSk8s0344100gUbuntu 18.04.5 LTS3、准备cfssl证书生成工具 cfssl是一个开源的证书管理工具，使用json文件生成证书. 在任意一台服务器上操作，这里选择k8s01wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64 mv cfssl_linux-amd64 /usr/local/bin/cfssl mv cfssljson_linux-amd64 /usr/local/bin/cfssljson mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo4、创建etcd相关目录$ mkdir -pv /opt/kubernetes/etcd/{bin,cfg,ssl,date}5、创建证书5.1、创建ca证书json文件$ cd /opt/kubernetes/etcd/ssl # 创建ca-config $ vim ca-config.json { "signing": { "default": { "expiry": "87600h" }, "profiles": { "www": { "expiry": "87600h", "usages": [ "signing", "key encipherment", "server auth", "client auth" ] } } } } # 创建ca-csr $ vim ca-csr.json { "CN": "etcd CA", "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "Beijing", "ST": "Beijing" } ] }5.2、生成ca证书$ cfssl gencert -initca ca-csr.json | cfssljson -bare ca -5.3、使用自签ca签发etcd证书创建证书申请文件：$ cd /opt/kubernetes/etcd/ssl # 注意hosts内容，etcd集群内的ip都要写上，可以预留几个，为以后扩容使用 $ vim server-csr.json { "CN": "etcd", "hosts": [ "192.168.1.234", "192.168.1.235", "192.168.1.236" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "L": "BeiJing", "ST": "BeiJing" } ] }生成证书$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server # 会生成server.pem和server-key.pem文件 $ ll |grep server -rw-r--r-- 1 root root 1013 Sep 14 15:06 server.csr -rw-r--r-- 1 root root 290 Sep 14 15:05 server-csr.json -rw------- 1 root root 1679 Sep 14 15:06 server-key.pem -rw-r--r-- 1 root root 1338 Sep 14 15:06 server.pem6、下载etcd二进制文件下载地址 https://github.com/etcd-io/etcd/releases/download/v3.5.0/etcd-v3.5.0-linux-a…

MYSQL增加审计日志
type: item
date: 2021-09-10T01:52:00+00:00
description: [TOC]概述mysql5.7.32增加审计日志功能，记录数据库的操作获取审计功能插件下载5.5.68-MariaDB插件路径： /usr/lib64/mysql/plugin/server_audit.so 配置mysql5.7.321、获取mysql插件路径mysql> show global variables like '%plugin_dir%'; +---------------+--------------------------+ | Variable_name | Value | +---------------+--------------------------+ | plugin_dir | /usr/lib64/mysql/plugin/ | +---------------+--------------------------+ 1 row in set (0.01 sec)2、分发插件# 将插件放置此目录 $ cd /usr/lib64/mysql/plugin/ $ ll server_audit.so3、安装插件INSTALL PLUGIN server_audit SONAME 'server_audit.so';4、查看变量开启情况，默认都是关闭mysql> show variables like '%audit%';5、配置开启$ vim /etc/my.cnf # 新增以下配置 server_audit_logging=on server_audit_file_path =/hdata/mysql_data/log/server_audit.log server_audit_file_rotate_size=10000000 server_audit=FORCE_PLUS_PERMANEN6、重启mysql$ systemctl restart mysqld7、查看配置情况mysql> show variables like '%audit%'; +-------------------------------+----------------------------------------+ | Variable_name | Value | +-------------------------------+----------------------------------------+ | server_audit_events | | | server_audit_excl_users | | | server_audit_file_path | /hdata/mysql_data/log/server_audit.log | | server_audit_file_rotate_now | OFF | | server_audit_file_rotate_size | 10000000 | | server_audit_file_rotations | 9 | | server_audit_incl_users | | | server_audit_loc_info | | | server_audit_logging | ON | | server_audit_mode | 1 | | server_audit_output_type | file | | server_audit_query_log_limit | 1024 | | server_audit_syslog_facility | LOG_USER | | server_audit_syslog_ident | mysql-server_auditing | | server_audit_syslog_info | | | server_audit_syslog_priority | LOG_INFO | +-------------------------------+----------------------------------------+ 16 rows in set (0.00 sec)