To tylko jedna z 2 stron tej notatki. Zaloguj się aby zobaczyć ten dokument.
Zobacz
całą notatkę
Setting Up Replication Using SSL
To use SSL for encrypting the transfer of the binary log required during replication, both the master
and the slave must support SSL network connections. If either host does not support SSL connections
(because it has not been compiled or configured for SSL), replication through an SSL connection is not
possible.
Setting up replication using an SSL connection is similar to setting up a server and client using SSL.
You must obtain (or create) a suitable security certificate that you can use on the master, and a similar
certificate (from the same certificate authority) on each slave.
For more information on setting up a server and client for SSL connectivity, see Section 6.3.9.2,
“Configuring MySQL for SSL”.
To enable SSL on the master you must create or obtain suitable certificates, and then add the following
configuration options to the master's configuration within the [mysqld] section of the master's
my.cnf file:
[mysqld]
ssl-ca=cacert.pem
ssl-cert=server-cert.pem
ssl-key=server-key.pem
The paths to the certificates may be relative or absolute; we recommend that you always use complete
paths for this purpose.
The options are as follows:
• ssl-ca identifies the Certificate Authority (CA) certificate.
• ssl-cert identifies the server public key. This can be sent to the client and authenticated against
the CA certificate that it has.
• ssl-key identifies the server private key.
On the slave, you have two options available for setting the SSL information. You can either add the
slave certificates to the [client] section of the slave's my.cnf file, or you can explicitly specify the
SSL information using the CHANGE MASTER TO statement:
• To add the slave certificates using an option file, add the following lines to the [client] section of
the slave's my.cnf file:
[client]
ssl-ca=cacert.pem
ssl-cert=client-cert.pem
ssl-key=client-key.pem
Restart the slave server, using the --skip-slave-start [2019] option to prevent the slave from
connecting to the master. Use CHANGE MASTER TO to specify the master configuration, using the
MASTER_SSL option to enable SSL connectivity
... zobacz całą notatkę
Komentarze użytkowników (0)