vault backup: 2026-01-05 13:03:55
This commit is contained in:
windyboy
@@ -0,0 +1,125 @@
|
||||
|
||||
|
||||
# install
|
||||
## prepare
|
||||
|
||||
### user and group
|
||||
```bash
|
||||
groupadd dinstall -g 2001
|
||||
useradd -G dinstall -m -d /home/dmdba -s /bin/bash -u 2001 dmdba
|
||||
passwd dmdba
|
||||
```
|
||||
|
||||
### limit
|
||||
|
||||
```bash
|
||||
vi /etc/security/limits.conf
|
||||
```
|
||||
|
||||
```limits.conf
|
||||
dmdba soft nice 0
|
||||
dmdba hard nice 0
|
||||
dmdba soft as unlimited
|
||||
dmdba hard as unlimited
|
||||
dmdba soft fsize unlimited
|
||||
dmdba hard fsize unlimited
|
||||
dmdba soft nproc 65536
|
||||
dmdba hard nproc 65536
|
||||
dmdba soft nofile 65536
|
||||
dmdba hard nofile 65536
|
||||
dmdba soft core unlimited
|
||||
dmdba hard core unlimited
|
||||
dmdba soft data unlimited
|
||||
dmdba hard data unlimited
|
||||
```
|
||||
|
||||
restart
|
||||
|
||||
```bash
|
||||
restart
|
||||
```
|
||||
|
||||
check
|
||||
```bash
|
||||
su - dmdba
|
||||
ulimit -a
|
||||
```
|
||||
|
||||
### database directories
|
||||
|
||||
```bash
|
||||
mkdir /opt/dmdata
|
||||
chown dmdba:dinstall /opt/dmdata
|
||||
mkdir data arch backup
|
||||
chown dmdba:dinstall data
|
||||
chown dmdba:dinstall arch
|
||||
chown dmdba:dinstall backup
|
||||
chmod 755 data
|
||||
chmod 755 arch
|
||||
chmod 755 backup
|
||||
```
|
||||
|
||||
## mount iso
|
||||
|
||||
```bash
|
||||
cd /opt
|
||||
mkdir iso
|
||||
mount -o loop dm8_20240712_HWarm920_kylin10_64.iso /opt/iso
|
||||
```
|
||||
|
||||
## command line install
|
||||
|
||||
```bash
|
||||
cd /opt/iso
|
||||
./DMInstall.bin -i
|
||||
```
|
||||
|
||||
按需求选择安装语言，
|
||||
没有 key 文件选择 "n"，
|
||||
时区按需求选择一般选择 “21”，
|
||||
安装类型选择“1”，
|
||||
安装目录按实际情况配置，这里示例使用默认安装位置 /home/dmdba/dmdbms
|
||||
|
||||
### execute as root
|
||||
```bash
|
||||
/home/dmdba/dmdbms/script/root/root_installer.sh
|
||||
```
|
||||
|
||||
|
||||
## dmdba env
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba
|
||||
vim .bash_profile
|
||||
```
|
||||
|
||||
```.bash_profile
|
||||
export DM_HOME=/home/dmdba/dmdbms
|
||||
export LD_LIBRARY_PATH=$LD_LIBRARY_PD:$DM_HOME/bin
|
||||
export PATH=$PATH:$DM_HOME/bin:$DM_HOME/tool
|
||||
```
|
||||
|
||||
|
||||
## create instance
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
source ~/.bash_profile
|
||||
dminit path=/optdmdata/data PAGE_SIZE=32 EXTENT_SIZE=32 CASE_SENSITIVE=y CHARSET=1 DB_NAME=DM8 INSTANCE_NAME=DBSERVER PORT_NUM=5236
|
||||
```
|
||||
|
||||
## install service
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/script/root
|
||||
./dm_service_uninstaller.sh -t dmserver -dm_ini /opt/dmdata/data/DMDB/dm.ini -p 8
|
||||
```
|
||||
|
||||
uninstall
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/script/root
|
||||
./dm_service_uninstaller.sh -t dmserver -dm_ini /opt/dmdata/data/DMDB/dm.ini -p 8
|
||||
```
|
||||
@@ -0,0 +1,405 @@
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
# 🧭 GCC 13.3.0 从源码构建指南（适用于 Kylin Linux Advanced Server V10 / RHEL 系）
|
||||
|
||||
目标：在 `/opt/gcc-13` 构建一套完全独立的新 GCC，不覆盖系统自带版本。
|
||||
附带可选 `/opt/binutils-2.40`，用于提升链接器兼容性。
|
||||
|
||||
---
|
||||
|
||||
## 一、系统准备
|
||||
|
||||
### 1️⃣ 更新系统并安装构建依赖
|
||||
|
||||
```bash
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y \
|
||||
gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel \
|
||||
gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
```
|
||||
|
||||
> 若系统仓库的 `gmp/mpfr/mpc/isl` 太旧，也没关系，下面会采用 **内联构建**。
|
||||
|
||||
---
|
||||
|
||||
## 二、可选但推荐：升级 binutils (2.40)
|
||||
|
||||
### 2️⃣ 构建并安装
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/binutils/binutils-2.40.tar.gz
|
||||
tar -xzf binutils-2.40.tar.gz
|
||||
mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
|
||||
../binutils-2.40/configure \
|
||||
--prefix=/usr/local/binutils-2.40 \
|
||||
--disable-multilib \
|
||||
--enable-gold \
|
||||
--enable-ld=default \
|
||||
--enable-plugins
|
||||
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
### 3️⃣ 激活新版 binutils
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/binutils-2.40/bin:$PATH
|
||||
```
|
||||
|
||||
验证：
|
||||
|
||||
```bash
|
||||
ld --version | head -1
|
||||
as --version | head -1
|
||||
```
|
||||
|
||||
输出应含 “2.40”。
|
||||
|
||||
> ✅ 若系统已有较新 binutils，可跳过本节。
|
||||
|
||||
---
|
||||
|
||||
## 三、下载并准备 GCC 13.3.0 源码
|
||||
|
||||
### 4️⃣ 获取源码
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0
|
||||
```
|
||||
|
||||
### 5️⃣ 下载依赖库（推荐）
|
||||
|
||||
```bash
|
||||
./contrib/download_prerequisites
|
||||
```
|
||||
|
||||
该脚本会自动下载合适的：
|
||||
|
||||
- GMP
|
||||
|
||||
- MPFR
|
||||
|
||||
- MPC
|
||||
|
||||
- ISL
|
||||
|
||||
|
||||
> 若离线环境，可在其他机器下载后放到以下目录：
|
||||
>
|
||||
> ```
|
||||
> gcc-13.3.0/gmp/
|
||||
> gcc-13.3.0/mpfr/
|
||||
> gcc-13.3.0/mpc/
|
||||
> gcc-13.3.0/isl/
|
||||
> ```
|
||||
|
||||
---
|
||||
|
||||
```
|
||||
cat > contrib/download_prerequisites <<'EOF'
|
||||
#!/bin/sh
|
||||
# Modified for Aliyun GNU mirror + official ISL source (SourceForge)
|
||||
# Author: windyboy setup helper
|
||||
|
||||
set -e
|
||||
|
||||
gmp='gmp-6.2.1.tar.bz2'
|
||||
mpfr='mpfr-4.1.0.tar.bz2'
|
||||
mpc='mpc-1.2.1.tar.gz'
|
||||
isl='isl-0.24.tar.bz2'
|
||||
|
||||
fetch='wget -c --no-check-certificate'
|
||||
|
||||
# 阿里云 GNU 镜像基础路径
|
||||
base="https://mirrors.aliyun.com/gnu"
|
||||
|
||||
download() {
|
||||
pkg=$1
|
||||
url=$2
|
||||
echo "==> Downloading $pkg"
|
||||
${fetch} "$url" -O "$pkg" || {
|
||||
echo "❌ Failed: $pkg"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
download "$gmp" "$base/gmp/$gmp"
|
||||
download "$mpfr" "$base/mpfr/$mpfr"
|
||||
download "$mpc" "$base/mpc/$mpc"
|
||||
download "$isl" "https://libisl.sourceforge.io/$isl"
|
||||
|
||||
echo "==> Extracting..."
|
||||
for ar in $gmp $mpfr $mpc $isl; do
|
||||
tar -xf "$ar"
|
||||
ln -sf "${ar%.tar*}" "${ar%-*}"
|
||||
done
|
||||
|
||||
echo "✅ All prerequisites downloaded and extracted successfully (Aliyun + SourceForge)."
|
||||
EOF
|
||||
|
||||
chmod +x contrib/download_prerequisites
|
||||
```
|
||||
|
||||
|
||||
## 四、构建并安装 GCC 13.3.0
|
||||
|
||||
### 6️⃣ 创建构建目录（out-of-tree）
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
mkdir build-gcc-13 && cd build-gcc-13
|
||||
```
|
||||
|
||||
### 7️⃣ 配置参数
|
||||
|
||||
```bash
|
||||
../gcc-13.3.0/configure \
|
||||
--prefix=/usr/local/gcc-13 \
|
||||
--enable-languages=c,c++ \
|
||||
--disable-multilib \
|
||||
--enable-checking=release \
|
||||
--enable-lto \
|
||||
--enable-threads=posix \
|
||||
--with-system-zlib
|
||||
```
|
||||
|
||||
|
||||
说明：
|
||||
|
||||
- `--disable-multilib`：仅构建 64 位版，节省空间、避免冲突
|
||||
|
||||
- `--enable-lto`：启用 Link Time Optimization
|
||||
|
||||
- `--enable-threads=posix`：标准线程支持
|
||||
|
||||
- `--with-system-zlib`：若安装了 zlib-devel
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 8️⃣ 编译与安装
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
💡 **提示：**
|
||||
|
||||
- 首次编译耗时较久（15–60 分钟）。
|
||||
|
||||
- 若出现 OOM，可降并行度：
|
||||
|
||||
```bash
|
||||
sudo make -j4
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 五、启用与测试新 GCC
|
||||
|
||||
### 9️⃣ 临时启用
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/usr/local/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
### 🔟 验证版本
|
||||
|
||||
```bash
|
||||
gcc -v
|
||||
g++ -v
|
||||
```
|
||||
|
||||
应显示：
|
||||
|
||||
```
|
||||
gcc version 13.3.0 (GCC)
|
||||
```
|
||||
|
||||
测试代码：
|
||||
|
||||
```bash
|
||||
cat > hello.cpp <<'EOF'
|
||||
#include <iostream>
|
||||
int main() { std::cout << "Hello GCC " << __VERSION__ << std::endl; }
|
||||
EOF
|
||||
g++ -std=c++20 hello.cpp -O2 -o hello
|
||||
./hello
|
||||
```
|
||||
|
||||
输出应为：
|
||||
|
||||
```
|
||||
Hello GCC 13.3.0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、长期使用与并存管理
|
||||
|
||||
### 11️⃣ 持久化环境变量
|
||||
|
||||
**用户级：**
|
||||
|
||||
```bash
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' >> ~/.bashrc
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
**系统级（所有用户生效）：**
|
||||
|
||||
```bash
|
||||
sudo tee /etc/profile.d/gcc13.sh <<'EOF'
|
||||
export PATH=/opt/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
EOF
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 12️⃣ 运行时库兼容性（关键）
|
||||
|
||||
若运行你的程序时报：
|
||||
|
||||
```
|
||||
GLIBCXX_3.x.y not found
|
||||
```
|
||||
|
||||
说明运行期加载了系统旧版 libstdc++。
|
||||
解决办法：
|
||||
|
||||
1. 临时解决：
|
||||
|
||||
```bash
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
2. 编译期内嵌 rpath：
|
||||
|
||||
```bash
|
||||
g++ main.cpp -Wl,-rpath=/opt/gcc-13/lib64 -O2 -o app
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 七、常见问题与修复要点
|
||||
|
||||
|问题|原因|解决方案|
|
||||
|---|---|---|
|
||||
|`configure: error: GMP/MPFR/MPC not found`|系统库过旧或缺失|使用 `contrib/download_prerequisites`|
|
||||
|`collect2: error: ld returned 1 exit status`|binutils 太旧|启用 `/opt/binutils-2.40` 并确认 PATH|
|
||||
|`checking for sufficient default stack space... no`|栈空间不足|执行 `ulimit -s unlimited`|
|
||||
|`cc1plus: out of memory`|并行过高或 swap 不足|降低并行度、添加 swap|
|
||||
|
||||
---
|
||||
|
||||
## 八、验证构建质量（可选）
|
||||
|
||||
自检：
|
||||
|
||||
```bash
|
||||
cd /usr/local/src/build-gcc-13
|
||||
sudo make -k check > test.log 2>&1
|
||||
grep -A2 "Summary" test.log
|
||||
```
|
||||
|
||||
成功率通常 > 99%，剩余测试多为非致命的浮点容差差异。
|
||||
|
||||
---
|
||||
|
||||
## ✅ 总结：完整流程一览
|
||||
|
||||
```bash
|
||||
# 一次性复现构建流程 (示例版)
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/binutils/binutils-2.40.tar.xz
|
||||
sudo tar -xf binutils-2.40.tar.xz
|
||||
sudo mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
sudo ../binutils-2.40/configure --prefix=/opt/binutils-2.40 --disable-multilib --enable-gold --enable-ld=default --enable-plugins
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
export PATH=/opt/binutils-2.40/bin:$PATH
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
sudo tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0 && ./contrib/download_prerequisites
|
||||
|
||||
cd /usr/local/src && sudo mkdir build-gcc-13 && cd build-gcc-13
|
||||
sudo ../gcc-13.3.0/configure --prefix=/opt/gcc-13 --enable-languages=c,c++ --disable-multilib \
|
||||
--enable-checking=release --enable-lto --enable-threads=posix --with-system-zlib
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' | sudo tee /etc/profile.d/gcc13.sh
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' | sudo tee -a /etc/profile.d/gcc13.sh
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
source /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
是否希望我把上述完整命令整理成 **一键可执行的 build-gcc13.sh 脚本**（带错误检查、日志输出、并自动检测是否已安装 binutils）？
|
||||
这样你只需运行一行命令即可完成全部流程。
|
||||
|
||||
|
||||
openssl
|
||||
|
||||
```
|
||||
./Configure --prefix=/usr/local/openssl-3 \
|
||||
--openssldir=/usr/local/openssl-3/ssl \
|
||||
shared zlib \
|
||||
enable-ec_nistp_64_gcc_128 \
|
||||
enable-tls1_3
|
||||
```
|
||||
|
||||
```
|
||||
make -j$(nproc)
|
||||
make install
|
||||
```
|
||||
|
||||
```
|
||||
export CC=/usr/local/gcc-13/bin/gcc
|
||||
export CXX=/usr/local/gcc-13/bin/g++
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib64"
|
||||
```
|
||||
|
||||
```
|
||||
echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl-3.conf
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib -Wl,-rpath=/usr/local/openssl-3/lib"
|
||||
export PKG_CONFIG_PATH="/usr/local/openssl-3/lib/pkgconfig"
|
||||
export LD_LIBRARY_PATH="/usr/local/openssl-3/lib:$LD_LIBRARY_PATH"
|
||||
export PATH="/usr/local/openssl-3/bin:$PATH"
|
||||
|
||||
./configure \
|
||||
--prefix=/usr/local/openssh-10 \
|
||||
--sysconfdir=/usr/local/openssh-10/etc \
|
||||
--with-ssl-dir=/usr/local/openssl-3 \
|
||||
--with-pam \
|
||||
--with-md5-passwords
|
||||
|
||||
```
|
||||
@@ -0,0 +1,16 @@
|
||||
|
||||
|
||||
服务器IP 应用服务
|
||||
10.160.20.112 zookeeper
|
||||
10.160.20.113 Prometheus grafana
|
||||
10.160.20.114 minio
|
||||
10.160.20.115 minio
|
||||
10.160.20.116 minio
|
||||
10.160.20.117 docker swarm
|
||||
10.160.20.118 docker swarm
|
||||
10.160.20.119 docker swarm
|
||||
10.160.20.102 达梦数据库
|
||||
10.160.20.107 达梦数据库
|
||||
10.160.20.176（VIP：10.160.20.110） nginx、keepalived
|
||||
10.160.20.177（VIP：10.160.20.110） nginx、keepalived
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
|
||||
问题 5：
|
||||
```
|
||||
（1）缺乏对通信设备可信验证方面的安全设计要求；
|
||||
（2）现有的通信设备存在未能实现操作系统到上层应用的信任链的情况，系统运行过程中的可信检验不全面；
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程
|
||||
（3）未采用第三方工具实现相关系统的可信验证。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）建议在管理规范文档内对通信设备可信验证方面的安全设计提出要求；
|
||||
（2）建议系统实现对所有可执行环节进行可信验证，包括：
|
||||
运行过程中的可信检验：
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程；
|
||||
（3）本身设备不支持的情况下，可采用第三方工具实现可信的验证功能；
|
||||
（4）对整体的可信验证措施做到：
|
||||
■对可信性破坏报警
|
||||
■将可信性验证结果形成审计记录
|
||||
■对可信性审计的动态关联感知。
|
||||
```
|
||||
|
||||
|
||||
|
||||
(31 条)问题 7,12,16,28,34,45,51：
|
||||
```
|
||||
（1）系统未采取完整性保护措施保证重要业务数据在存储过程中的完整性。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统配置使用加密算法对重要数据在存储过程中采取完整性保护措施。
|
||||
```
|
||||
|
||||
|
||||
|
||||
问题 9,13,17:
|
||||
```
|
||||
（1）系统未采取加密措施对重要业务数据的存储实现加密保障。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统使用加密算法对重要数据在存储过程中采取保密性保护措施；
|
||||
（2）在存储过程中需要加密保护的数据类型包括（不限于）鉴别数据、配置数据、重要业务数据、重要个人信息数据。
|
||||
```
|
||||
|
||||
|
||||
(32条)问题 25,33,42,50,59,71,79,88,97,102,107,112,118,125,133...:
|
||||
```
|
||||
（1）未采取措施对所有主体和客体设置敏感标记。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）建议对数据库系统应对重要信息资源设置敏感标记，数据库不支持敏感标记的，应在系统级生成敏感标记，使系统整体支持强制访问控制机制；
|
||||
（2）依据安全策略严格控制用户对有敏感标记重要信息资源的操作。
|
||||
```
|
||||
|
||||
|
||||
问题 26:
|
||||
```
|
||||
（1）数据库系统未设定有效的终端接入方式及范围限制措施；
|
||||
■数据库系统未对账号进行IP限制，host = %
|
||||
（2）数据库系统未对登录用户数量进行限制。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）数据库系统针设定有效的终端接入策略，对通过网络进行管理的终端进行限制。 ■数据库系统对账号进行IP限制，host ≠ %，限制固定IP段登录
|
||||
数据库系统对登录用户数量进行限制，如配置max_connections为50（具体数值需根据实际业务需求调整）。
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,636 @@
|
||||
|
||||
|
||||
login jump server: 10.160.20.112
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
ssh -V
|
||||
OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
uname -a
|
||||
Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
uname -m
|
||||
aarch64
|
||||
getenforce
|
||||
Disabled
|
||||
```
|
||||
|
||||
|
||||
|
||||
备份配置
|
||||
|
||||
```bash
|
||||
cp -a /etc/ssh /etc/ssh.bak-$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
依赖安装
|
||||
|
||||
```bash
|
||||
dnf groupinstall "Development Tools" -y
|
||||
```
|
||||
```bash
|
||||
dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel
|
||||
```
|
||||
|
||||
|
||||
编译
|
||||
|
||||
```bash
|
||||
wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
unzip openssh-portable-V_10_2.zip
|
||||
cd openssh-portable-V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
./configure --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin --with-pam --with-privsep-path=/var/lib/sshd
|
||||
```
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
```
|
||||
|
||||
```bash
|
||||
make install
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
- 找到对应行，前面加 #，或直接删除。例如：
|
||||
```bash
|
||||
vi /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
- # GSSAPIAuthentication no
|
||||
|
||||
- # GSSAPICleanupCredentials yes
|
||||
|
||||
- # RSAAuthentication no
|
||||
|
||||
- # RhostsRSAAuthentication no
|
||||
|
||||
```bash
|
||||
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
systemctl enable --now sshd
|
||||
```
|
||||
|
||||
```
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
```
|
||||
journalctl -u sshd -b
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
vi /etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
```
|
||||
dnf install -y rpm-build rpmlint
|
||||
```
|
||||
|
||||
制作安装包
|
||||
|
||||
```
|
||||
dnf install -y ruby ruby-devel gcc make rpm-build
|
||||
```
|
||||
|
||||
```
|
||||
mkdir -p ~/buildroot
|
||||
```
|
||||
|
||||
```
|
||||
install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd
|
||||
install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh
|
||||
install -D /usr/bin/scp ~/buildroot/usr/bin/scp
|
||||
install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp
|
||||
install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen
|
||||
install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent
|
||||
install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add
|
||||
install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan
|
||||
rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true
|
||||
install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config
|
||||
install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true
|
||||
```
|
||||
|
||||
~/rpmbuild/SPECS/openssh-custom.spec
|
||||
|
||||
```
|
||||
Name: openssh
|
||||
Version: 10.2
|
||||
Release: 1%{?dist}
|
||||
Summary: An open source implementation of SSH protocol version 2
|
||||
|
||||
License: BSD
|
||||
URL: https://www.openssh.com/
|
||||
Source0: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: make
|
||||
BuildRequires: openssl-devel >= 1.1.1
|
||||
BuildRequires: zlib-devel
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: systemd
|
||||
BuildRequires: libselinux-devel
|
||||
|
||||
%description
|
||||
SSH (Secure SHell) is a program for logging into and executing
|
||||
commands on a remote machine. SSH is intended to replace rlogin and
|
||||
rsh, and to provide secure encrypted communications between two
|
||||
untrusted hosts over an insecure network. This package includes the
|
||||
core files necessary for both the OpenSSH client and server.
|
||||
|
||||
%package clients
|
||||
Summary: SSH client applications
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description clients
|
||||
OpenSSH clients, including ssh, scp, and sftp.
|
||||
|
||||
%package server
|
||||
Summary: SSH server daemon
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
%description server
|
||||
OpenSSH server daemon (sshd) with support for the new sshd-session
|
||||
and sshd-auth architecture introduced in OpenSSH 9.8+.
|
||||
|
||||
%prep
|
||||
%setup -q -n openssh-portable-V_10_2
|
||||
|
||||
%build
|
||||
%configure \
|
||||
--sysconfdir=%{_sysconfdir}/ssh \
|
||||
--libexecdir=%{_libexecdir}/openssh \
|
||||
--datadir=%{_datadir}/openssh \
|
||||
--with-pam \
|
||||
--with-selinux \
|
||||
--with-privsep-path=/var/empty/sshd \
|
||||
--with-pid-dir=/run \
|
||||
--with-ssl-engine \
|
||||
--disable-strip
|
||||
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
make install DESTDIR=%{buildroot}
|
||||
|
||||
# Install systemd unit files
|
||||
install -d %{buildroot}%{_unitdir}
|
||||
|
||||
# Create sshd.service file
|
||||
cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH server daemon
|
||||
Documentation=man:sshd(8) man:sshd_config(5)
|
||||
After=network.target sshd-keygen.target
|
||||
Wants=sshd-keygen.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
EnvironmentFile=-/etc/sysconfig/sshd
|
||||
ExecStart=/usr/sbin/sshd -D $OPTIONS
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
RestartSec=42s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
SVCEOF
|
||||
|
||||
# Create sshd-keygen service
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/ssh-keygen -A
|
||||
RemainAfterExit=yes
|
||||
KEYGENEOF
|
||||
|
||||
# Create sshd-keygen target
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
Documentation=man:sshd(8) man:ssh-keygen(1)
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
KEYTAREOF
|
||||
|
||||
# Create empty sshd privsep directory
|
||||
install -d -m 0711 %{buildroot}/var/empty/sshd
|
||||
|
||||
# Install PAM configuration
|
||||
install -d %{buildroot}%{_sysconfdir}/pam.d
|
||||
cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF'
|
||||
#%PAM-1.0
|
||||
auth substack password-auth
|
||||
auth include postlogin
|
||||
account required pam_sepermit.so
|
||||
account required pam_nologin.so
|
||||
account include password-auth
|
||||
password include password-auth
|
||||
session required pam_selinux.so close
|
||||
session required pam_loginuid.so
|
||||
session required pam_selinux.so open env_params
|
||||
session required pam_namespace.so
|
||||
session optional pam_keyinit.so force revoke
|
||||
session optional pam_motd.so
|
||||
session include password-auth
|
||||
session include postlogin
|
||||
PAMEOF
|
||||
|
||||
# Modify sshd_config to enable root login
|
||||
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
|
||||
%{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
# Ensure PermitRootLogin is set
|
||||
if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
fi
|
||||
|
||||
# Create sysconfig directory
|
||||
install -d %{buildroot}%{_sysconfdir}/sysconfig
|
||||
cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF'
|
||||
# Configuration file for the sshd service.
|
||||
|
||||
# Options for sshd
|
||||
OPTIONS=""
|
||||
SYSCONFIGEOF
|
||||
|
||||
%files
|
||||
%license LICENCE
|
||||
%doc ChangeLog CREDITS OVERVIEW PROTOCOL* README*
|
||||
%dir %{_sysconfdir}/ssh
|
||||
%config(noreplace) %{_sysconfdir}/ssh/moduli
|
||||
%config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
||||
%{_mandir}/man5/moduli.5*
|
||||
%{_mandir}/man5/ssh_config.5*
|
||||
%{_mandir}/man5/sshd_config.5*
|
||||
|
||||
%files clients
|
||||
%{_bindir}/ssh
|
||||
%{_bindir}/scp
|
||||
%{_bindir}/sftp
|
||||
%{_bindir}/ssh-add
|
||||
%{_bindir}/ssh-agent
|
||||
%{_bindir}/ssh-keygen
|
||||
%{_bindir}/ssh-keyscan
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/ssh-keysign
|
||||
%{_libexecdir}/openssh/ssh-pkcs11-helper
|
||||
%{_libexecdir}/openssh/ssh-sk-helper
|
||||
%{_mandir}/man1/scp.1*
|
||||
%{_mandir}/man1/sftp.1*
|
||||
%{_mandir}/man1/ssh.1*
|
||||
%{_mandir}/man1/ssh-add.1*
|
||||
%{_mandir}/man1/ssh-agent.1*
|
||||
%{_mandir}/man1/ssh-keygen.1*
|
||||
%{_mandir}/man1/ssh-keyscan.1*
|
||||
%{_mandir}/man8/ssh-keysign.8*
|
||||
%{_mandir}/man8/ssh-pkcs11-helper.8*
|
||||
%{_mandir}/man8/ssh-sk-helper.8*
|
||||
|
||||
%files server
|
||||
%{_sbindir}/sshd
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/sftp-server
|
||||
%{_libexecdir}/openssh/sshd-session
|
||||
%{_libexecdir}/openssh/sshd-auth
|
||||
%{_unitdir}/sshd.service
|
||||
%{_unitdir}/sshd-keygen@.service
|
||||
%{_unitdir}/sshd-keygen.target
|
||||
%dir %attr(0711,root,root) /var/empty/sshd
|
||||
%config(noreplace) %{_sysconfdir}/ssh/sshd_config
|
||||
%config(noreplace) %{_sysconfdir}/pam.d/sshd
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/sshd
|
||||
%{_mandir}/man8/sshd.8*
|
||||
%{_mandir}/man8/sftp-server.8*
|
||||
|
||||
%pre server
|
||||
# Create sshd user if it doesn't exist
|
||||
getent group sshd >/dev/null || groupadd -r sshd
|
||||
getent passwd sshd >/dev/null || \
|
||||
useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \
|
||||
-c "Privilege-separated SSH" sshd
|
||||
exit 0
|
||||
|
||||
%post server
|
||||
%systemd_post sshd.service
|
||||
# Generate host keys if they don't exist
|
||||
/usr/bin/ssh-keygen -A >/dev/null 2>&1 || :
|
||||
|
||||
%preun server
|
||||
%systemd_preun sshd.service
|
||||
|
||||
%postun server
|
||||
%systemd_postun_with_restart sshd.service
|
||||
|
||||
%changelog
|
||||
* Wed Oct 22 2025 System Administrator <admin@example.com> - 10.2-1
|
||||
- Update to OpenSSH 10.2
|
||||
- Enable PermitRootLogin by default
|
||||
- Add support for sshd-session and sshd-auth
|
||||
- Include systemd service files
|
||||
- Add PAM configuration
|
||||
- Create privilege separation user and directory
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
处理完：
|
||||
117
|
||||
177
|
||||
|
||||
不能ssh
|
||||
102
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
处理102:
|
||||
|
||||
1. 下载新编译的openssh
|
||||
```
|
||||
-rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
2. 修改 /etc/ssh/sshd_config
|
||||
注释选项
|
||||
|
||||
```
|
||||
GSSAPIAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
GSSAPICleanupCredentials
|
||||
```
|
||||
|
||||
```
|
||||
RSAAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
RhostsRSAAuthentication
|
||||
```
|
||||
|
||||
注释
|
||||
|
||||
```
|
||||
/etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
|
||||
3. 修改
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_*
|
||||
```
|
||||
|
||||
|
||||
|
||||
3. 安装
|
||||
```
|
||||
dnf install ./openssh-*
|
||||
```
|
||||
|
||||
4. 测试
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -D -d
|
||||
```
|
||||
|
||||
```
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now sshd
|
||||
systemctl start sshd
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
112:
|
||||
安装 openssh 10 with openssl 3
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107
|
||||
|
||||
|
||||
|
||||
```
|
||||
export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64
|
||||
```
|
||||
|
||||
```
|
||||
/usr/local/openssl-3/bin/openssl version -a
|
||||
/usr/local/openssh-10/bin/ssh -V
|
||||
```
|
||||
|
||||
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
|
||||
|
||||
### 13
|
||||
10.201.31.13
|
||||
|
||||
```
|
||||
Apache Flink 远程代码执行漏洞【原理扫描】
|
||||
```
|
||||
|
||||
可能有客户端，无服务端
|
||||
|
||||
|
||||
### 14
|
||||
10.201.31.13
|
||||
```
|
||||
Apache Flink 任意文件写入(CVE-2020-17518)【原理扫描】
|
||||
```
|
||||
|
||||
```
|
||||
CVE-2020-17518
|
||||
While all versions before `1.11.3` are affected the related vulnerability, Apache Flink has been fixed vulnerability for versions `1.11.3` and above.
|
||||
```
|
||||
|
||||
|
||||
### 38
|
||||
10.201.31.10
|
||||
```
|
||||
Nacos Namespace 未授权访问漏洞【原理扫描】
|
||||
```
|
||||
误报
|
||||
|
||||
|
||||
### 39
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2018-1060）
|
||||
```
|
||||
|
||||
|
||||
### 40
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2018-20406）
|
||||
```
|
||||
|
||||
|
||||
### 41
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2019-9674）
|
||||
```
|
||||
|
||||
### 42
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2021-28861）
|
||||
```
|
||||
|
||||
### 44
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2022-45061）
|
||||
```
|
||||
|
||||
|
||||
### 45
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2023-24329）
|
||||
```
|
||||
|
||||
### 46
|
||||
10.201.31.10
|
||||
```
|
||||
Python 安全漏洞（CVE-2023-36632）
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
升级 arm64v8/mofcom_spider_api:v2 的python > 3.11.4
|
||||
```
|
||||
@@ -0,0 +1,17 @@
|
||||
|
||||
## 主机漏洞：
|
||||
### 13，14，21，23，30，31：
|
||||
都是flink问题：
|
||||
如果是软件是在本地启动服务，则需要升级软件中flink的版本
|
||||
如果只是客户端，则是误报
|
||||
|
||||
### 39，40，41，42，44，45，46，56，58，60，61，62，64，65，66，67
|
||||
都是python版本升级：
|
||||
需要获得运行容器的源码，把python 3.6升级到python 3.11以上
|
||||
|
||||
|
||||
### 22，38
|
||||
nacos 漏洞：
|
||||
目前厂商没有发布解决问题的新版本
|
||||
|
||||
|
||||
@@ -0,0 +1,385 @@
|
||||
```sql
|
||||
|
||||
SELECT
|
||||
column_name,
|
||||
comments
|
||||
FROM
|
||||
all_col_comments
|
||||
WHERE
|
||||
owner = 'ZC'
|
||||
AND table_name = 'BASE_USER';
|
||||
```
|
||||
|
||||
|
||||
|
||||
To close all sessions associated with the user `'zc'` in an Oracle database, you need to identify those sessions and then terminate them. This process requires administrative privileges. Below are the steps to accomplish this:
|
||||
|
||||
1. **Connect to the Database as an Administrator**
|
||||
|
||||
Open SQL*Plus or your preferred SQL client and connect as a user with administrative privileges (such as `SYSDBA`):
|
||||
|
||||
```sql
|
||||
sqlplus / as sysdba
|
||||
```
|
||||
|
||||
2. **Identify the Sessions Belonging to User 'zc'**
|
||||
|
||||
Execute the following query to retrieve the `SID` and `SERIAL#` of all sessions for user `'zc'`:
|
||||
|
||||
```sql
|
||||
SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC';
|
||||
```
|
||||
|
||||
*Note*: Oracle usernames are usually stored in uppercase unless created with double quotes.
|
||||
|
||||
3. **Terminate the Sessions**
|
||||
|
||||
You can terminate each session individually using the `ALTER SYSTEM KILL SESSION` command:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM KILL SESSION 'SID,SERIAL#';
|
||||
```
|
||||
|
||||
Replace `SID` and `SERIAL#` with the values obtained from the previous query.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the query returns `SID` = 123 and `SERIAL#` = 4567, execute:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM KILL SESSION '123,4567';
|
||||
```
|
||||
|
||||
4. **Automate the Termination of All Sessions**
|
||||
|
||||
To kill all sessions for user `'zc'` in one step, you can use a PL/SQL block:
|
||||
|
||||
```sql
|
||||
BEGIN
|
||||
FOR rec IN (SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC') LOOP
|
||||
EXECUTE IMMEDIATE 'ALTER SYSTEM KILL SESSION ''' || rec.SID || ',' || rec.SERIAL# || ''' IMMEDIATE';
|
||||
END LOOP;
|
||||
END;
|
||||
/
|
||||
```
|
||||
|
||||
This script loops through each session and issues the kill command.
|
||||
|
||||
5. **Verify the Sessions Are Closed**
|
||||
|
||||
Run the initial query again to ensure all sessions have been terminated:
|
||||
|
||||
```sql
|
||||
SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC';
|
||||
```
|
||||
|
||||
If no rows are returned, all sessions have been successfully closed.
|
||||
|
||||
**Important Considerations**:
|
||||
|
||||
- **Transactions**: Killing a session that is in the middle of a transaction can cause that transaction to be rolled back. Ensure that terminating these sessions won't negatively impact your database integrity.
|
||||
- **Privileges**: You must have the necessary privileges (`ALTER SYSTEM` privilege) to kill sessions.
|
||||
- **Immediate Termination**: Adding the `IMMEDIATE` clause forces the session to terminate without waiting for ongoing transactions to complete.
|
||||
- **Oracle Versions**: In Oracle 12c and newer, you can use `ALTER SYSTEM DISCONNECT SESSION` for immediate termination:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM DISCONNECT SESSION 'SID,SERIAL#' IMMEDIATE;
|
||||
```
|
||||
|
||||
By following these steps, you can close all sessions associated with the user `'zc'` in your Oracle database.
|
||||
|
||||
|
||||
|
||||
|
||||
When the source and target databases have different character sets (NLS settings), exporting and importing data in Oracle requires careful handling to ensure data integrity. Incorrect handling can lead to character corruption, loss of data, or import errors. Below, I'll guide you through the steps to perform `exp` (export) and `imp` (import) when the source and target `NLS_LANG` settings are not the same.
|
||||
|
||||
---
|
||||
|
||||
### **Understanding NLS_LANG and Character Sets**
|
||||
|
||||
- **`NLS_LANG` Environment Variable**: Determines the language, territory, and character set settings for Oracle client applications.
|
||||
- **Character Set Conversion**: Oracle performs character set conversion between the client (as specified by `NLS_LANG`) and the database character set.
|
||||
|
||||
**Key Principle**: To prevent unwanted character set conversion and potential data corruption, set `NLS_LANG` to match the **database character set** when using `exp` and `imp` utilities.
|
||||
|
||||
---
|
||||
|
||||
### **Steps for Exporting and Importing Between Different NLS_LANG Settings**
|
||||
|
||||
#### **1. Determine the Character Sets**
|
||||
|
||||
**Source Database**:
|
||||
|
||||
```sql
|
||||
SELECT value FROM nls_database_parameters WHERE parameter = 'NLS_CHARACTERSET';
|
||||
```
|
||||
|
||||
**Target Database**:
|
||||
|
||||
```sql
|
||||
SELECT value FROM nls_database_parameters WHERE parameter = 'NLS_CHARACTERSET';
|
||||
```
|
||||
|
||||
#### **2. Set NLS_LANG for Export**
|
||||
|
||||
- **Objective**: Prevent character set conversion during export.
|
||||
- **Action**: Set `NLS_LANG` to match the **source database character set**.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the source database character set is `WE8MSWIN1252`:
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
```
|
||||
|
||||
#### **3. Perform the Export (`exp`)**
|
||||
|
||||
Run the `exp` command after setting `NLS_LANG`:
|
||||
|
||||
```cmd
|
||||
exp userid=username/password@source_db file=export.dmp log=export.log [other options]
|
||||
```
|
||||
|
||||
- **No Character Set Conversion**: Since `NLS_LANG` matches the database character set, Oracle doesn't perform character set conversion during export.
|
||||
|
||||
#### **4. Transfer the Dump File**
|
||||
|
||||
Copy `export.dmp` to the target machine if necessary.
|
||||
|
||||
#### **5. Set NLS_LANG for Import**
|
||||
|
||||
- **Objective**: Ensure correct character set conversion during import.
|
||||
- **Action**: Set `NLS_LANG` to match the **target database character set**.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the target database character set is `AL32UTF8`:
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
#### **6. Perform the Import (`imp`)**
|
||||
|
||||
Run the `imp` command:
|
||||
|
||||
```cmd
|
||||
imp userid=username/password@target_db file=export.dmp log=import.log [other options]
|
||||
```
|
||||
|
||||
- **Character Set Conversion**: Oracle converts character data from the dump file's character set (source database character set) to the target database character set.
|
||||
|
||||
#### **7. Verify the Imported Data**
|
||||
|
||||
After import, check the data integrity, especially for special characters or multilingual data.
|
||||
|
||||
---
|
||||
|
||||
### **Detailed Explanation**
|
||||
|
||||
#### **Why Set NLS_LANG to the Database Character Set?**
|
||||
|
||||
- **During Export**:
|
||||
- Setting `NLS_LANG` to match the source database character set ensures that no character set conversion occurs between the database and the export utility.
|
||||
- Data is exported exactly as it is stored in the database.
|
||||
|
||||
- **During Import**:
|
||||
- Setting `NLS_LANG` to match the target database character set allows Oracle to correctly interpret the character data from the dump file and convert it to the target database's character set if necessary.
|
||||
- This prevents character corruption due to incorrect character set conversion.
|
||||
|
||||
#### **Understanding Character Set Conversion**
|
||||
|
||||
- **Export Process**:
|
||||
- **Database → Client (`exp` utility)**: If `NLS_LANG` matches the database character set, no conversion occurs.
|
||||
|
||||
- **Import Process**:
|
||||
- **Dump File → Client (`imp` utility)**: The `imp` utility reads data in the dump file's character set.
|
||||
- **Client (`imp` utility) → Target Database**: Oracle converts character data from the client character set (specified by `NLS_LANG`) to the target database character set.
|
||||
|
||||
---
|
||||
|
||||
### **Example Scenario**
|
||||
|
||||
**Source Database**:
|
||||
|
||||
- **Character Set**: `WE8ISO8859P1`
|
||||
- **NLS_LANG**: `AMERICAN_AMERICA.WE8ISO8859P1`
|
||||
|
||||
**Target Database**:
|
||||
|
||||
- **Character Set**: `AL32UTF8`
|
||||
- **NLS_LANG**: `AMERICAN_AMERICA.AL32UTF8`
|
||||
|
||||
#### **Export Steps**
|
||||
|
||||
1. **Set NLS_LANG**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8ISO8859P1
|
||||
```
|
||||
|
||||
2. **Run Export**:
|
||||
|
||||
```cmd
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
#### **Import Steps**
|
||||
|
||||
1. **Set NLS_LANG**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
2. **Run Import**:
|
||||
|
||||
```cmd
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **Additional Considerations**
|
||||
|
||||
#### **Character Set Compatibility**
|
||||
|
||||
- Ensure the target character set can represent all characters from the source character set.
|
||||
- **Superset Character Sets**: If the target character set is a superset of the source, conversion should be lossless (e.g., importing from `WE8ISO8859P1` to `AL32UTF8`).
|
||||
|
||||
#### **Testing**
|
||||
|
||||
- **Test Import**: Before full-scale import, test with a small dataset to verify character data integrity.
|
||||
|
||||
#### **Data Pump Utilities**
|
||||
|
||||
- **`expdp` and `impdp`**: For Oracle 10g and later, consider using Data Pump utilities which handle character set conversions more efficiently.
|
||||
- **Note**: Data Pump utilities run on the server side and generally require less attention to `NLS_LANG`, but it's still good practice to set it appropriately if your parameters include non-ASCII characters.
|
||||
|
||||
#### **Locale-Specific Data**
|
||||
|
||||
- **Date Formats, Numeric Formats**: Other NLS parameters (like `NLS_DATE_FORMAT`, `NLS_NUMERIC_CHARACTERS`) may need to be set if your data depends on locale-specific formats.
|
||||
|
||||
---
|
||||
|
||||
### **Common Mistakes to Avoid**
|
||||
|
||||
#### **Setting NLS_LANG to the Wrong Character Set**
|
||||
|
||||
- **Do Not**: Set `NLS_LANG` to the operating system character set unless it matches the database character set.
|
||||
- **Result**: Misalignment can cause Oracle to perform unwanted character set conversions, leading to data corruption.
|
||||
|
||||
#### **Ignoring NCHAR and NVARCHAR Data**
|
||||
|
||||
- **Note**: `NLS_NCHAR_CHARACTERSET` may also need to be considered if your databases use NCHAR, NVARCHAR2, or NCLOB data types.
|
||||
|
||||
---
|
||||
|
||||
### **Frequently Asked Questions**
|
||||
|
||||
**Q1: Can I set `NLS_LANG` to the same value during both export and import?**
|
||||
|
||||
- **A**: While possible, it's not recommended unless the source and target databases have the same character set. Setting `NLS_LANG` to match the respective database character sets at each stage ensures proper handling.
|
||||
|
||||
**Q2: What if I can't match `NLS_LANG` to the database character set?**
|
||||
|
||||
- **A**: If you cannot set `NLS_LANG` to match the database character set, you risk character data corruption. It's crucial to find out the correct character set and set `NLS_LANG` accordingly.
|
||||
|
||||
**Q3: How do I handle data that includes special or non-English characters?**
|
||||
|
||||
- **A**: Use Unicode character sets (e.g., `AL32UTF8`) for the target database if possible, and ensure `NLS_LANG` is correctly set to handle these characters.
|
||||
|
||||
---
|
||||
|
||||
### **Summary of Steps**
|
||||
|
||||
1. **Determine Character Sets**:
|
||||
|
||||
- Source and target database character sets.
|
||||
|
||||
2. **Set NLS_LANG for Export**:
|
||||
|
||||
- Match to source database character set.
|
||||
|
||||
3. **Export Data**:
|
||||
|
||||
- Use `exp` utility.
|
||||
|
||||
4. **Set NLS_LANG for Import**:
|
||||
|
||||
- Match to target database character set.
|
||||
|
||||
5. **Import Data**:
|
||||
|
||||
- Use `imp` utility.
|
||||
|
||||
6. **Verify Data Integrity**:
|
||||
|
||||
- Check for character corruption or data loss.
|
||||
|
||||
---
|
||||
|
||||
### **Example Commands**
|
||||
|
||||
#### **Export Command**
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
#### **Import Command**
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **Final Tips**
|
||||
|
||||
- **Backup**: Always backup your databases before performing import/export operations.
|
||||
- **Documentation**: Keep records of your `NLS_LANG` settings and character sets for future reference.
|
||||
- **Consult Oracle Documentation**: For complex scenarios, refer to Oracle's Globalization Support Guide.
|
||||
|
||||
---
|
||||
|
||||
By carefully setting the `NLS_LANG` environment variable to match the database character sets during export and import, you can safely transfer data between databases with different NLS_LANG settings. This approach ensures proper character set conversion and maintains data integrity across different environments.
|
||||
|
||||
If you have further questions or encounter specific issues during the process, feel free to ask for more assistance!
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,199 @@
|
||||
|
||||
# XtraDB Cluster install
|
||||
|
||||
## requirement
|
||||
### docker
|
||||
|
||||
### host
|
||||
|
||||
```hosts
|
||||
10.194.64.102 gzii-db-3
|
||||
10.194.64.103 gzii-db-4
|
||||
10.194.64.104 gzii-app-2
|
||||
```
|
||||
|
||||
### sysctl
|
||||
```bash
|
||||
modprobe br_netfilter
|
||||
lsmod | grep br_netfilter
|
||||
echo "br_netfilter" | sudo tee -a /etc/modules-load.d/br_netfilter.conf
|
||||
sysctl -w net.bridge.bridge-nf-call-iptables=1
|
||||
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
|
||||
```
|
||||
|
||||
### iptables
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 33060 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 4567 -j ACCEPT
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
systemctl restart iptables
|
||||
```
|
||||
|
||||
### firewalld
|
||||
|
||||
```bash
|
||||
firewall-cmd --get-active-zones
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
firewall-cmd --zone=public --add-port=3306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4567/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=33060/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=2379/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4568/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4444/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=13306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=6032/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
```
|
||||
|
||||
## cluster
|
||||
## node 1
|
||||
|
||||
### image
|
||||
```bash
|
||||
gunzip -c percorna.tgz | docker load
|
||||
```
|
||||
### ssl
|
||||
```bash
|
||||
mkdir /opt/percorna/config
|
||||
```
|
||||
|
||||
|
||||
```my.cnf
|
||||
[client]
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/client-cert.pem
|
||||
ssl-key = /cert/client-key.pem
|
||||
|
||||
[sst]
|
||||
encrypt = 4
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/server-cert.pem
|
||||
ssl-key = /cert/server-key.pem
|
||||
|
||||
[mysqld]
|
||||
ssl-ca=/cert/ca.pem
|
||||
ssl-cert=/cert/server-cert.pem
|
||||
ssl-key=/cert/server-key.pem
|
||||
skip_name_resolve
|
||||
log-error = /var/lib/mysql/error.log
|
||||
wsrep_provider_options="socket.ssl_cert=/cert/server-cert.pem;socket.ssl_key=/cert/server-key.pem;socket.ssl_ca=/cert/ca.pem"
|
||||
```
|
||||
|
||||
|
||||
|
||||
### etcd
|
||||
```bash
|
||||
ETCD_HOST=10.192.64.102
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-p 4001:4001 -p 2380:2380 -p 2379:2379 \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--name etcd0 \
|
||||
--advertise-client-urls=http://${ETCD_HOST}:2379,http://${ETCD_HOST}:4001 \
|
||||
--listen-client-urls=http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--initial-advertise-peer-urls=http://${ETCD_HOST}:2380 \
|
||||
--listen-peer-urls=http://0.0.0.0:2380 \
|
||||
--initial-cluster-token=etcd-cluster-1 \
|
||||
--initial-cluster=etcd0=http://${ETCD_HOST}:2380 \
|
||||
--initial-cluster-state=new
|
||||
```
|
||||
|
||||
|
||||
|
||||
### bootstrap
|
||||
|
||||
|
||||
```bash
|
||||
mkpasswd -l 16
|
||||
```
|
||||
|
||||
root password:
|
||||
```
|
||||
wc97fjvDg:Ywgyad
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
gzii-db-3:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
--name=gzii-db-3 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
gzii-db-4:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
-e CLUSTER_JOIN=gzii-db-3 \
|
||||
--name=gzii-db-4 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
|
||||
monitor pass:
|
||||
```
|
||||
0nz&lzDAxcxet5ta
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
ALTER USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
GRANT SELECT, PROCESS, REPLICATION CLIENT ON *.* TO 'monitor'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'operator'@'%' IDENTIFIED BY 'operator';
|
||||
GRANT SELECT, REPLICATION CLIENT ON *.* TO 'operator'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup, active)
|
||||
VALUES ('monitoring', '0nz&lzDAxcxet5ta', 0, 1);
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup) VALUES ('monitor', '0nz&lzDAxcxet5ta', 0);
|
||||
LOAD MYSQL USERS TO RUNTIME;
|
||||
SAVE MYSQL USERS TO DISK;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
proxysql-admin --config-file=/var/lib/proxysql/proxysql-admin.cnf --enable
|
||||
```
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
@@ -0,0 +1,103 @@
|
||||
|
||||
Great! Since you're using `root`, there's no need to prepend commands with `sudo`. Here's how to configure `iptables` to allow all traffic on `10.194.64.0/24` without `sudo`:
|
||||
|
||||
---
|
||||
|
||||
### **1. Check Current iptables Rules**
|
||||
|
||||
To inspect the current rules:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Add Rules to Allow All Traffic on the Subnet**
|
||||
|
||||
#### **2.1. Allow Incoming Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -s 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.2. Allow Outgoing Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A OUTPUT -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.3. Allow Forwarded Traffic (if needed)**
|
||||
|
||||
If this system acts as a router or forwards traffic:
|
||||
|
||||
```bash
|
||||
iptables -A FORWARD -s 10.194.64.0/24 -j ACCEPT
|
||||
iptables -A FORWARD -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **3. Save the iptables Configuration**
|
||||
|
||||
To persist these rules across reboots:
|
||||
|
||||
#### **3.1. Save Rules (Legacy Method)**
|
||||
|
||||
Use `iptables-save` to save the rules into a configuration file:
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
#### **3.2. For Systems Using `netfilter-persistent`**
|
||||
|
||||
If `netfilter-persistent` is installed:
|
||||
|
||||
```bash
|
||||
netfilter-persistent save
|
||||
```
|
||||
|
||||
#### **3.3. For RHEL-Based Systems**
|
||||
|
||||
If you're on a RHEL-based system:
|
||||
|
||||
```bash
|
||||
service iptables save
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify Rules**
|
||||
|
||||
To confirm the rules are applied:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **5. Optional: Test Connectivity**
|
||||
|
||||
Test traffic to and from the `10.194.64.0/24` subnet:
|
||||
|
||||
```bash
|
||||
ping 10.194.64.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **6. Debugging (if needed)**
|
||||
|
||||
If traffic is still blocked:
|
||||
|
||||
- Look for conflicting `DROP` rules in the `INPUT`, `OUTPUT`, or `FORWARD` chains:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
- Ensure the system's network interface is properly configured.
|
||||
|
||||
Let me know if you need help troubleshooting further or additional features like logging specific traffic!
|
||||
@@ -0,0 +1,559 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
要修改 ProxySQL 的**全局**默认查询超时（`mysql-default_query_timeout`），你可以通过 Admin 接口在线调整，也可以修改配置文件后重启或重加载。下面分别介绍这两种方法。
|
||||
|
||||
---
|
||||
|
||||
## 一、通过 Admin 接口在线修改
|
||||
|
||||
1. **登录到 ProxySQL Admin 界面**
|
||||
|
||||
```bash
|
||||
mysql -u admin -padmin -h 127.0.0.1 -P 6032
|
||||
```
|
||||
|
||||
将 `admin`/`admin` 替换成你的管理员用户名和密码。
|
||||
|
||||
2. **设置新的默认查询超时**（单位：毫秒）
|
||||
比如将超时改为 **60 000 ms（60 秒）**：
|
||||
|
||||
```sql
|
||||
SET mysql-default_query_timeout = 60000;
|
||||
```
|
||||
|
||||
3. **将变量加载到运行时配置**
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
```
|
||||
|
||||
4. **将当前运行时配置保存到磁盘**
|
||||
|
||||
```sql
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
> 默认情况下，`mysql-default_query_timeout` 的值是 `86400000`（24 小时）([proxysql.com](https://proxysql.com/documentation/global-variables/mysql-variables/?utm_source=chatgpt.com "MySQL Variables - ProxySQL"))。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 二、修改配置文件
|
||||
|
||||
1. 打开你的 ProxySQL 配置文件（常见路径 `/etc/proxysql.cnf` 或者 `/etc/proxysql/proxysql.cnf`）
|
||||
|
||||
2. 找到 `mysql_variables` 段落，添加或修改 `default_query_timeout`，例如：
|
||||
|
||||
```ini
|
||||
mysql_variables = {
|
||||
# … 其他变量 …
|
||||
default_query_timeout = 60000
|
||||
}
|
||||
```
|
||||
|
||||
3. 重启 ProxySQL 服务以使配置生效：
|
||||
|
||||
```bash
|
||||
systemctl restart proxysql
|
||||
```
|
||||
|
||||
或者如果你希望不中断服务，可以先启动 ProxySQL，然后执行：
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 三、针对单条规则定制超时
|
||||
|
||||
如果你只想对特定的查询模式设定更严格或更宽松的超时，可以在 **查询规则** 中使用 `timeout` 字段（单位同样为毫秒）：
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (
|
||||
rule_id, active, match_pattern, destination_hostgroup, timeout
|
||||
) VALUES (
|
||||
100, 1, '^SELECT .* FOR UPDATE$', 10, 30000
|
||||
);
|
||||
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
> 如果某条规则未指定 `timeout`，就会回退使用全局 `mysql-default_query_timeout`。([proxysql.com](https://proxysql.com/documentation/main-runtime/?utm_source=chatgpt.com "Main (runtime tables definition) - ProxySQL"))
|
||||
|
||||
---
|
||||
|
||||
以上就是修改 ProxySQL 默认查询超时的方式。根据你的场景选择「全局修改」或「单条规则覆盖」，并记得 `LOAD … TO RUNTIME` + `SAVE … TO DISK` 才能保证即时生效且持久保存。
|
||||
|
||||
|
||||
探针
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
内存：
|
||||
```
|
||||
free | awk '/^Mem:/ { printf("Memory Usage: %.2f%%\n", $3/$2 * 100) }'
|
||||
```
|
||||
|
||||
|
||||
nginx 加代理
|
||||
/dcwj to https://10.205.29.3:8081
|
||||
|
||||
```
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
#keepalive_timeout 65;
|
||||
|
||||
upstream form_api_backend {
|
||||
server 10.194.64.17:8180 max_fails=3 fail_timeout=30s;
|
||||
}
|
||||
|
||||
upstream dcwj_backend {
|
||||
server 10.205.29.3:8081;
|
||||
}
|
||||
|
||||
# 重定向HTTP请求到HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
server_name data.gxj.gz.gov.cn;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS服务器配置
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name data.gxj.gz.gov.cn 10.194.64.17 _;
|
||||
|
||||
# SSL证书配置
|
||||
ssl_certificate /etc/nginx/ssl/nginx.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/nginx.key;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:\
|
||||
ECDHE-RSA-AES128-GCM-SHA256:\
|
||||
ECDHE-ECDSA-AES256-GCM-SHA384:\
|
||||
ECDHE-RSA-AES256-GCM-SHA384:\
|
||||
ECDHE-ECDSA-CHACHA20-POLY1305:\
|
||||
ECDHE-RSA-CHACHA20-POLY1305:\
|
||||
DHE-RSA-AES128-GCM-SHA256:\
|
||||
DHE-RSA-AES256-GCM-SHA384:\
|
||||
DHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
client_max_body_size 30m;
|
||||
|
||||
# 默认根路径代理
|
||||
location / {
|
||||
proxy_pass http://form_api_backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# /dcwj 上的反向代理到 HTTPS 后端
|
||||
location /dcwj/ {
|
||||
access_log /var/log/nginx/dcwj_access.log main;
|
||||
proxy_pass https://dcwj_backend$request_uri;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# 可选：健康检查
|
||||
location /healthcheck {
|
||||
return 200 "OK";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
curl -I -k -v https://10.205.29.3:8081
|
||||
```
|
||||
|
||||
|
||||
nginx logrotate
|
||||
|
||||
/etc/logrotate.d/nginx-docker
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0640 root root
|
||||
sharedscripts
|
||||
postrotate
|
||||
# signal the nginx in the container to reopen logs
|
||||
docker kill --signal=USR1 nginx_container_name
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
|
||||
new config with gz compress
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
|
||||
# enable gzip compression of rotated logs
|
||||
compress
|
||||
compresscmd /bin/gzip
|
||||
uncompresscmd /bin/gunzip
|
||||
compressoptions -9
|
||||
extension .gz
|
||||
delaycompress
|
||||
|
||||
notifempty
|
||||
create 0640 root root
|
||||
|
||||
sharedscripts
|
||||
postrotate
|
||||
# tell the nginx master in the “nginx” container to reopen its logs
|
||||
docker kill --signal=USR1 nginx
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
@@ -0,0 +1,342 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
安装探测器：
|
||||
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
traceroute -T -p 9000 10.207.33.1
|
||||
```
|
||||
|
||||
backup etcd
|
||||
```
|
||||
docker exec etcd etcdctl \
|
||||
--endpoints=http://10.194.64.102:2379 \
|
||||
--user=root:IeGheikae.Woo5ph \
|
||||
snapshot save /etcd-data/backup-$(date +%Y%m%d-%H%M%S).db
|
||||
|
||||
```
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,627 @@
|
||||
Apologies for the confusion caused by the deprecated commands in the MinIO Client (`mc`). The MinIO team periodically updates `mc` to enhance functionality and improve usability, which sometimes leads to changes in command syntax. To ensure compatibility and take advantage of the latest features, it's essential to use the updated commands.
|
||||
|
||||
Below is the **updated guide** for creating an **API user** with **read and write** permissions equivalent to the **root user** using the latest `mc` commands: `mc admin policy create` and `mc admin policy attach`.
|
||||
|
||||
---
|
||||
|
||||
## **Table of Contents**
|
||||
|
||||
1. [Prerequisites](#prerequisites)
|
||||
2. [Understanding MinIO Users and Policies](#understanding-minio-users-and-policies)
|
||||
3. [Installing and Configuring MinIO Client (`mc`)](#installing-and-configuring-minio-client-mc)
|
||||
4. [Creating a Full Access Policy](#creating-a-full-access-policy)
|
||||
5. [Creating the API User and Assigning the Policy](#creating-the-api-user-and-assigning-the-policy)
|
||||
6. [Verifying the API User](#verifying-the-api-user)
|
||||
7. [Best Practices](#best-practices)
|
||||
8. [Example: Creating an API User with Full Access](#example-creating-an-api-user-with-full-access)
|
||||
9. [Additional Resources](#additional-resources)
|
||||
|
||||
---
|
||||
|
||||
## **1. Prerequisites**
|
||||
|
||||
Ensure you have the following before proceeding:
|
||||
|
||||
- **MinIO Server**: Installed and running in production.
|
||||
- **Root Access**: Administrative privileges to manage MinIO users and policies.
|
||||
- **MinIO Client (`mc`)**: Installed on your local machine or a management server.
|
||||
- **Network Access**: Ability to connect to the MinIO server from where `mc` is installed.
|
||||
|
||||
---
|
||||
|
||||
## **2. Understanding MinIO Users and Policies**
|
||||
|
||||
### **a. Users**
|
||||
|
||||
In MinIO, users are entities (applications, services, or individuals) that interact with the MinIO server. Each user has a unique **Access Key** and **Secret Key** used for authentication.
|
||||
|
||||
### **b. Policies**
|
||||
|
||||
Policies define the permissions associated with users. They determine what actions a user can perform and on which resources (buckets or objects). Policies can be **predefined** or **custom**.
|
||||
|
||||
- **Read-Only**: Allows users to read objects but not modify or delete them.
|
||||
- **Write-Only**: Allows users to upload objects but not read or delete them.
|
||||
- **Full Access**: Grants all permissions, including read, write, and delete.
|
||||
|
||||
---
|
||||
|
||||
## **3. Installing and Configuring MinIO Client (`mc`)**
|
||||
|
||||
The MinIO Client (`mc`) is a command-line tool that simplifies managing MinIO servers and performing administrative tasks.
|
||||
|
||||
### **a. Download and Install `mc`**
|
||||
|
||||
1. **Download the Latest Release:**
|
||||
|
||||
```bash
|
||||
wget https://dl.min.io/client/mc/release/linux-amd64/mc
|
||||
```
|
||||
|
||||
2. **Make the Binary Executable:**
|
||||
|
||||
```bash
|
||||
chmod +x mc
|
||||
```
|
||||
|
||||
3. **Move `mc` to a Directory in Your PATH:**
|
||||
|
||||
```bash
|
||||
sudo mv mc /usr/local/bin/
|
||||
```
|
||||
|
||||
4. **Verify Installation:**
|
||||
|
||||
```bash
|
||||
mc --version
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
mc version RELEASE.2023-07-24T16-40-29Z
|
||||
```
|
||||
|
||||
### **b. Configure `mc` to Connect to Your MinIO Server**
|
||||
|
||||
1. **Set Up an Alias for Your MinIO Server:**
|
||||
|
||||
Replace `<ALIAS>`, `<MINIO_ENDPOINT>`, `<YOUR-ACCESS-KEY>`, and `<YOUR-SECRET-KEY>` with your actual details.
|
||||
|
||||
```bash
|
||||
mc alias set <ALIAS> <MINIO_ENDPOINT> <YOUR-ACCESS-KEY> <YOUR-SECRET-KEY> --api S3v4
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc alias set myminio https://minio.example.com Ab3dE6fG9hJkLmN0 Pq8Rs5Tu7Vw9Xy1Z2a3Bc4De5Fg6Hi7J --api S3v4
|
||||
```
|
||||
|
||||
2. **Verify Connection:**
|
||||
|
||||
```bash
|
||||
mc ls myminio
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
If you encounter errors, ensure that:
|
||||
|
||||
- The MinIO server is accessible from your machine.
|
||||
- The access and secret keys are correct.
|
||||
- Network firewalls or security groups allow traffic on MinIO ports (default: 9000 for S3 API).
|
||||
|
||||
---
|
||||
|
||||
## **4. Creating a Full Access Policy**
|
||||
|
||||
To replicate the root user's permissions, you'll need to create a policy that grants **full access** to all resources.
|
||||
|
||||
### **a. Define the Policy JSON**
|
||||
|
||||
1. **Create a File Named `full-access.json`:**
|
||||
|
||||
```bash
|
||||
nano full-access.json
|
||||
```
|
||||
|
||||
2. **Add the Following Content:**
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Policy Breakdown:**
|
||||
|
||||
- **`s3:*`**: Grants all S3 actions (create, read, update, delete).
|
||||
- **`arn:aws:s3:::*`**: Applies to all buckets and objects.
|
||||
|
||||
**_Caution:_** This policy grants **full access**. Ensure that it's only assigned to trusted users.
|
||||
|
||||
3. **Save and Exit:**
|
||||
- Press `CTRL + O`, then `ENTER` to save.
|
||||
- Press `CTRL + X` to exit.
|
||||
|
||||
### **b. Validate the Policy JSON**
|
||||
|
||||
Ensure that the JSON syntax is correct. You can use tools like [JSONLint](https://jsonlint.com/) or run:
|
||||
|
||||
```bash
|
||||
jq empty full-access.json
|
||||
```
|
||||
|
||||
If the command executes without errors, the JSON is valid.
|
||||
|
||||
### **c. Create the Policy in MinIO**
|
||||
|
||||
Use the updated `mc admin policy create` command instead of the deprecated `add` command.
|
||||
|
||||
```bash
|
||||
mc admin policy create <ALIAS> <POLICY_NAME> <POLICY_FILE>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin policy create myminio full-access full-access.json
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access created successfully
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **5. Creating the API User and Assigning the Policy**
|
||||
|
||||
Now that the **full access** policy is defined, you can create a new API user and assign this policy to them.
|
||||
|
||||
### **a. Create the API User**
|
||||
|
||||
Use the `mc` client to create a new user. You will need to generate an **Access Key** and **Secret Key** for the user.
|
||||
|
||||
#### **Method 1: Manual Key Generation**
|
||||
|
||||
1. **Generate an Access Key:**
|
||||
|
||||
```bash
|
||||
ACCESS_KEY=$(openssl rand -hex 8)
|
||||
echo "Access Key: $ACCESS_KEY"
|
||||
```
|
||||
|
||||
2. **Generate a Secret Key:**
|
||||
|
||||
```bash
|
||||
SECRET_KEY=$(openssl rand -hex 16)
|
||||
echo "Secret Key: $SECRET_KEY"
|
||||
```
|
||||
|
||||
**_Sample Output:_**
|
||||
|
||||
```
|
||||
Access Key: a1b2c3d4e5f6g7h8
|
||||
Secret Key: i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
#### **Method 2: Using MinIO Client (`mc`) to Create User with Keys**
|
||||
|
||||
Alternatively, you can let `mc` generate the keys for you.
|
||||
|
||||
```bash
|
||||
mc admin user add <ALIAS> <USERNAME> <SECRET_KEY>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin user add myminio apiuser1 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
**_Note:_** Replace `<USERNAME>` and `<SECRET_KEY>` with your desired username and a strong secret key.
|
||||
|
||||
**_Recommendation:_** Use **Method 1** to generate strong, random keys.
|
||||
|
||||
### **b. Attach the Policy to the User**
|
||||
|
||||
Assign the previously created **full-access** policy to the new user.
|
||||
|
||||
```bash
|
||||
mc admin policy attach <ALIAS> <POLICY_NAME> user=<USERNAME>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin policy attach myminio full-access user=apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access attached to user apiuser1 successfully
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **6. Verifying the API User**
|
||||
|
||||
Ensure that the new user has been created and has the correct permissions.
|
||||
|
||||
### **a. List Users**
|
||||
|
||||
```bash
|
||||
mc admin user list <ALIAS>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin user list myminio
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
ACCESSKEY USERNAME
|
||||
Ab3dE6fG9hJkLmN0 minioadmin
|
||||
a1b2c3d4e5f6g7h8 apiuser1
|
||||
```
|
||||
|
||||
### **b. Test Access with API User Credentials**
|
||||
|
||||
To confirm that the user has the correct permissions:
|
||||
|
||||
1. **Configure `mc` with the New User:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser myminio https://minio.example.com <ACCESS_KEY> <SECRET_KEY> --api S3v4
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser myminio https://minio.example.com a1b2c3d4e5f6g7h8 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4 --api S3v4
|
||||
```
|
||||
|
||||
2. **List All Buckets:**
|
||||
|
||||
```bash
|
||||
mc ls apiuser
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
3. **Create a New Bucket:**
|
||||
|
||||
```bash
|
||||
mc mb apiuser/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Bucket created successfully `new-bucket`.
|
||||
```
|
||||
|
||||
4. **Upload an Object:**
|
||||
|
||||
```bash
|
||||
mc cp example.txt apiuser/new-bucket/
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Upload Success: example.txt to new-bucket/example.txt
|
||||
```
|
||||
|
||||
5. **Download an Object:**
|
||||
|
||||
```bash
|
||||
mc cp apiuser/new-bucket/example.txt ./example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Download Success: new-bucket/example.txt to example.txt
|
||||
```
|
||||
|
||||
6. **Delete an Object:**
|
||||
|
||||
```bash
|
||||
mc rm apiuser/new-bucket/example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket/example.txt`
|
||||
```
|
||||
|
||||
7. **Remove the Bucket:**
|
||||
|
||||
```bash
|
||||
mc rb apiuser/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket`.
|
||||
```
|
||||
|
||||
**_Note:_** Since the API user has **full access**, all these operations should succeed, mirroring the root user's capabilities.
|
||||
|
||||
---
|
||||
|
||||
## **7. Best Practices**
|
||||
|
||||
To maintain a secure and efficient MinIO environment, adhere to the following best practices when managing API users:
|
||||
|
||||
### **a. Principle of Least Privilege**
|
||||
|
||||
- **Assign Minimal Permissions**: Only grant users the permissions they strictly need.
|
||||
- **Avoid Over-Permissioning**: Do not assign full access unless absolutely necessary.
|
||||
|
||||
**_Note:_** While you're setting up an API user with full access, ensure that this is truly required and that the credentials are handled securely.
|
||||
|
||||
### **b. Regularly Rotate Credentials**
|
||||
|
||||
- **Change Access and Secret Keys Periodically**: Minimizes the risk of compromised credentials.
|
||||
- **Update Dependent Applications**: Ensure that applications using these keys are updated accordingly.
|
||||
|
||||
### **c. Use Strong, Unique Credentials**
|
||||
|
||||
- **High Entropy**: Use long and randomly generated keys.
|
||||
- **Avoid Reuse**: Ensure that each user has unique credentials.
|
||||
|
||||
### **d. Monitor and Audit User Activities**
|
||||
|
||||
- **Enable Logging**: Keep track of user actions for auditing purposes.
|
||||
- **Set Up Alerts**: Notify administrators of unusual activities or access patterns.
|
||||
|
||||
### **e. Secure Storage of Credentials**
|
||||
|
||||
- **Use Secret Management Tools**: Tools like [HashiCorp Vault](https://www.vaultproject.io/), [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/), or [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) can securely store and manage credentials.
|
||||
- **Avoid Hardcoding Credentials**: Do not embed access keys in application code or configuration files.
|
||||
|
||||
### **f. Limit User Lifespans**
|
||||
|
||||
- **Temporary Access**: For users that need temporary access, set expiration policies or regularly review and deactivate unused users.
|
||||
|
||||
---
|
||||
|
||||
## **8. Example: Creating an API User with Full Access**
|
||||
|
||||
Let's walk through a practical example where we create an API user named `apiuser1` with **full access** to all buckets and objects, mirroring the root user's permissions.
|
||||
|
||||
### **Step 1: Define the Full Access Policy**
|
||||
|
||||
1. **Create `full-access.json`:**
|
||||
|
||||
```bash
|
||||
nano full-access.json
|
||||
```
|
||||
|
||||
2. **Add the Following Content:**
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
3. **Save and Exit:**
|
||||
- Press `CTRL + O`, then `ENTER` to save.
|
||||
- Press `CTRL + X` to exit.
|
||||
|
||||
4. **Validate the Policy JSON:**
|
||||
|
||||
```bash
|
||||
jq empty full-access.json
|
||||
```
|
||||
|
||||
**No output means the JSON is valid.**
|
||||
|
||||
### **Step 2: Add the Policy to MinIO**
|
||||
|
||||
```bash
|
||||
mc admin policy create myminio full-access full-access.json
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access created successfully
|
||||
```
|
||||
|
||||
### **Step 3: Create the API User**
|
||||
|
||||
1. **Generate Access and Secret Keys:**
|
||||
|
||||
```bash
|
||||
ACCESS_KEY=$(openssl rand -hex 8)
|
||||
SECRET_KEY=$(openssl rand -hex 16)
|
||||
echo "Access Key: $ACCESS_KEY"
|
||||
echo "Secret Key: $SECRET_KEY"
|
||||
```
|
||||
|
||||
**Sample Output:**
|
||||
|
||||
```
|
||||
Access Key: a1b2c3d4e5f6g7h8
|
||||
Secret Key: i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
2. **Add the User with the Policy:**
|
||||
|
||||
```bash
|
||||
mc admin user add myminio apiuser1 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
mc admin policy attach myminio full-access user=apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
User apiuser1 added successfully
|
||||
Policy full-access attached to user apiuser1 successfully
|
||||
```
|
||||
|
||||
### **Step 4: Test the API User**
|
||||
|
||||
1. **Configure `mc` with the New User:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser1 myminio https://minio.example.com a1b2c3d4e5f6g7h8 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4 --api S3v4
|
||||
```
|
||||
|
||||
2. **List All Buckets:**
|
||||
|
||||
```bash
|
||||
mc ls apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
3. **Create a New Bucket:**
|
||||
|
||||
```bash
|
||||
mc mb apiuser1/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Bucket created successfully `new-bucket`.
|
||||
```
|
||||
|
||||
4. **Upload an Object:**
|
||||
|
||||
```bash
|
||||
mc cp example.txt apiuser1/new-bucket/
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Upload Success: example.txt to new-bucket/example.txt
|
||||
```
|
||||
|
||||
5. **Download an Object:**
|
||||
|
||||
```bash
|
||||
mc cp apiuser1/new-bucket/example.txt ./example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Download Success: new-bucket/example.txt to example.txt
|
||||
```
|
||||
|
||||
6. **Delete an Object:**
|
||||
|
||||
```bash
|
||||
mc rm apiuser1/new-bucket/example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket/example.txt`
|
||||
```
|
||||
|
||||
7. **Remove the Bucket:**
|
||||
|
||||
```bash
|
||||
mc rb apiuser1/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket`.
|
||||
```
|
||||
|
||||
**_Note:_** Since the API user has **full access**, all these operations should succeed, mirroring the root user's capabilities.
|
||||
|
||||
---
|
||||
|
||||
## **9. Additional Resources**
|
||||
|
||||
- **MinIO Official Documentation:**
|
||||
- [MinIO Client (`mc`) Quickstart Guide](https://docs.min.io/docs/minio-client-quickstart-guide.html)
|
||||
- [MinIO Admin API](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [MinIO Policy Documentation](https://docs.min.io/docs/minio-policy-guide.html)
|
||||
|
||||
- **Security Best Practices:**
|
||||
- [MinIO Security Best Practices](https://docs.min.io/docs/minio-security.html)
|
||||
|
||||
- **Secret Management:**
|
||||
- [HashiCorp Vault](https://www.vaultproject.io/)
|
||||
- [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)
|
||||
- [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
|
||||
|
||||
- **MinIO Community and Support:**
|
||||
- [MinIO GitHub Repository](https://github.com/minio/minio)
|
||||
- [MinIO Community Slack](https://slack.min.io/)
|
||||
|
||||
---
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
By following the updated steps outlined above, you can create an API user in MinIO with **read and write** permissions equivalent to the **root user** using the latest `mc admin policy create` and `mc admin policy attach` commands. This setup allows your applications or services to interact with MinIO seamlessly while maintaining secure and controlled access.
|
||||
|
||||
**_Important Considerations:_**
|
||||
|
||||
- **Security Risks**: Granting full access poses significant security risks. Ensure that the API user's credentials are stored securely and are only accessible to authorized applications.
|
||||
|
||||
- **Audit and Monitoring**: Regularly monitor the API user's activities to detect any unauthorized or unusual behaviors.
|
||||
|
||||
- **Credential Management**: Implement robust credential management practices, including regular rotation and secure storage.
|
||||
|
||||
Always tailor your MinIO user policies to align with your organization's security policies and operational requirements.
|
||||
|
||||
If you encounter any issues or need further assistance, consider reaching out to the [MinIO community](https://min.io/community.html) or consulting the official [MinIO documentation](https://docs.min.io/).
|
||||
@@ -0,0 +1,280 @@
|
||||
|
||||
太好了 — 你已经贴出了 `password-auth` 的当前内容，基于它我会直接给出**可复制的、安全步骤**：先备份，再替换为建议的密码策略（使用 `pam_pwquality`，最小长度 12、`difok=3`、至少 3 类字符、并在 `pam_unix` 上启用密码历史 `remember=5`）。同时我会说明为什么这样改、如何测试，以及如何回滚。
|
||||
|
||||
> 说明：我保留 `pam_pwquality` 为 `requisite`（与你当前一致），因为这会在强度检查失败时立即终止并拒绝密码更改，减少后续模块运行。但如果你希望即使强度检查失败也执行后续模块（例如记录历史或其它处理），可以把它改成 `required`。我在下面也给出小备注。
|
||||
|
||||
---
|
||||
|
||||
## 一步一步来（复制黏贴即可）
|
||||
|
||||
1. 先备份原文件：
|
||||
|
||||
|
||||
```bash
|
||||
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
```
|
||||
|
||||
2. 将下面内容写入临时文件并做替换（安全写入）：
|
||||
|
||||
|
||||
```bash
|
||||
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||||
# /etc/pam.d/password-auth - modified recommended settings
|
||||
auth required pam_kysec.so
|
||||
#%PAM-1.0
|
||||
|
||||
auth required pam_env.so
|
||||
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||||
#auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_unix.so nullok try_first_pass
|
||||
#auth sufficient pam_sss.so use_first_pass
|
||||
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||||
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||||
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||||
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
# Password quality: enforce length, classes, difok
|
||||
# - minlen=12 : minimal length (increase if you want stronger)
|
||||
# - difok=3 : new password must differ in at least 3 characters from old
|
||||
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||||
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||||
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||||
|
||||
# UNIX module performs the actual password change and supports history
|
||||
# remember=5 : prevent reuse of last 5 passwords
|
||||
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||||
|
||||
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||||
#password sufficient pam_sss.so use_authtok
|
||||
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
#session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
#session optional pam_sss.so
|
||||
EOF
|
||||
```
|
||||
|
||||
```bash
|
||||
mv /etc/pam.d/password-auth /etc/pam.d/password-auth.orig.$(date +%F_%T)
|
||||
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||||
chmod 644 /etc/pam.d/password-auth
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 为什么这样改（要点）
|
||||
|
||||
- `pam_pwquality.so minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0`
|
||||
|
||||
- 最短 12 个字符、至少 3 类字符、与旧密码至少 3 个字符不同。`ocredit=0` 表示**特殊字符非强制但建议**（若你要强制特殊字符，将 `ocredit=-1`）。
|
||||
|
||||
- `pam_unix.so ... remember=5`
|
||||
|
||||
- 实际写入 `/etc/shadow` 的模块，`remember=5` 阻止重复最近 5 个密码（提升安全性）。
|
||||
|
||||
- 保留 `pam_faillock`：继续防暴力破解（失败 3 次锁 60 秒）。
|
||||
|
||||
- `pam_deny.so` 保持在最后以确保策略失败时拒绝。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 测试（非常重要）
|
||||
|
||||
在替换后不要立刻登出 root。先用一个普通用户或测试账号验证：
|
||||
|
||||
1. 创建测试用户（如果没有）：
|
||||
|
||||
|
||||
```bash
|
||||
sudo useradd -m testpwuser || true
|
||||
sudo passwd testpwuser # 按提示设置一个弱密码测试（应被拒绝）
|
||||
```
|
||||
|
||||
2. 测试几种密码：
|
||||
|
||||
|
||||
- 尝试 `abc123`（应失败）
|
||||
|
||||
- 尝试 `Abcdef12345`（若满足 minlen & classes 应通过）
|
||||
|
||||
- 尝试重复旧密码（应被 `remember=5` 拒绝）
|
||||
|
||||
|
||||
3. 查看认证日志：
|
||||
|
||||
|
||||
```bash
|
||||
sudo tail -n 200 /var/log/auth.log # 或 /var/log/secure，视系统而定
|
||||
# 或实时监测：
|
||||
sudo tail -f /var/log/auth.log
|
||||
```
|
||||
|
||||
4. 如果你使用 SSH，需要测试 `passwd` 改密是否与 SSH 有影响（通常没有），但如果你的环境有集中认证（SSSD/LDAP），请特别测试这些路径。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 回滚（若出现问题）
|
||||
|
||||
如果验证失败或导致登录异常，立刻恢复备份：
|
||||
|
||||
```bash
|
||||
# 恢复最初备份
|
||||
sudo cp /etc/pam.d/password-auth.bak.* /etc/pam.d/password-auth
|
||||
# 或恢复刚做的原始文件
|
||||
sudo mv /etc/pam.d/password-auth.orig.* /etc/pam.d/password-auth
|
||||
```
|
||||
|
||||
然后重启相关服务或直接重启机器（如果需要）。
|
||||
|
||||
---
|
||||
|
||||
## 额外建议（可选）
|
||||
|
||||
- 若你希望强制所有四类字符（UPPER+lower+digit+special），把 `ocredit=0` 改成 `ocredit=-1`（并把 `minclass=3` 可留或删）。
|
||||
|
||||
- 如果你更希望**即使强度检查失败也执行后续模块**（例如记录历史、通知或其它逻辑），可把 `password requisite pam_pwquality.so ...` 改为 `password required ...`。
|
||||
|
||||
- 如果系统使用 SSSD/LDAP，请确认是否需要在 `password` 区块保留 `pam_sss.so use_authtok`（我在建议中注释了它，避免在没有 SSSD 测试的系统上造成问题）。若你确实使用 SSSD，请取消注释并测试。
|
||||
|
||||
|
||||
---
|
||||
|
||||
如果你愿意，我可以：
|
||||
|
||||
- 直接检查你当前 `/etc/pam.d/system-auth` 或 `/etc/pam.d/common-password`（如果存在）并给出一致化建议；
|
||||
|
||||
- 或根据你的偏好（更严格：强制特殊字符 / 更宽松：允许 passphrase）把上面的配置调成两个不同的“严格度模板”供你选择并直接生成替换命令。
|
||||
|
||||
|
||||
现在我已经把一个安全性较好的建议给出——要我继续把 `system-auth` / `common-password` 一并对齐吗？
|
||||
|
||||
|
||||
|
||||
项目：4
|
||||
|
||||
|
||||
```bash
|
||||
|
||||
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
```
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
|
||||
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||||
# /etc/pam.d/password-auth - modified recommended settings
|
||||
auth required pam_kysec.so
|
||||
#%PAM-1.0
|
||||
|
||||
auth required pam_env.so
|
||||
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||||
#auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_unix.so nullok try_first_pass
|
||||
#auth sufficient pam_sss.so use_first_pass
|
||||
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||||
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||||
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||||
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
# Password quality: enforce length, classes, difok
|
||||
# - minlen=12 : minimal length (increase if you want stronger)
|
||||
# - difok=3 : new password must differ in at least 3 characters from old
|
||||
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||||
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||||
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||||
|
||||
# UNIX module performs the actual password change and supports history
|
||||
# remember=5 : prevent reuse of last 5 passwords
|
||||
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||||
|
||||
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||||
#password sufficient pam_sss.so use_authtok
|
||||
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
#session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
#session optional pam_sss.so
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
|
||||
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
ip addr | grep en
|
||||
|
||||
cat /etc/pam.d/password-auth | grep pwq
|
||||
|
||||
```
|
||||
|
||||
|
||||
达梦：
|
||||
```
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSDBA/'"Hn@dameng123"':35236
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
SELECT ROLE$ FROM V$DATABASE;
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SELECT PARA_NAME, PARA_VALUE
|
||||
FROM V$DM_INI
|
||||
WHERE PARA_NAME='ENABLE_AUDIT';
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SP_SET_PARA_VALUE(1, 'ENABLE_AUDIT', 2);
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSAUDITOR/SYSAUDITOR@localhost:35239
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SP_SET_ENABLE_AUDIT(2);
|
||||
SELECT PARA_NAME, PARA_VALUE, PARA_TYPE
|
||||
FROM V$DM_INI WHERE PARA_NAME='ENABLE_AUDIT';
|
||||
|
||||
```
|
||||
@@ -0,0 +1,340 @@
|
||||
a）应对登录的用户进行身份标识和鉴别，身份标识具有唯一性，身份鉴别信息具有复杂度要求并定期更换；
|
||||
"建议该操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
建议该应用系统设置密码定期更换策略（密码定期更换时间：90天）
|
||||
121.8.227.238
|
||||
|
||||
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时自动退出时间30分钟）。
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（部分用户需要设置登录失败次数和锁定时间FAILED_ATTEMPS=5，LOCK_TIME=5，用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（所有的用户需要设置超时功能CONN_IDLE_TIME=1800，超时退出时间不大于30分钟）。
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录（部分用户的登录失败次数和锁定时间未设置（SYSDBA、SYS、SYSSSO和SYSAUDITOR、FGW_V3、FGW_SECURITY、FGW_IEJMS））；未配置登录连接超时自动退出功能。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能（timeout 0）。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（timeout 30）。
|
||||
|
||||
|
||||
|
||||
该中间件设置登录失败处理功能，未限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（登录连接超时时间：30分钟）。
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
该操作系统涉及到的重要审计数据、重要配置数据未定期进行本地备份，备份策略设置未合理、备份配置设置未正确，备份结果与备份策略未一致，在发生数据丢失时未能够进行数据恢复
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该操作系统涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
该操作系统涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该操作系统涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该操作系统未安装防恶意代码软件，未能对新型的入侵和病毒行为及时进行识别并有效阻断，防恶意代码库未更新至最新版本。
|
||||
建议该操作系统安装防恶意代码软件（云平台提供的青藤云），能对新型的入侵和病毒行为及时进行识别并有效阻断，防恶意代码库更新至最新版本。
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
|
||||
|
||||
该操作系统未合理设置密码复杂度策略
|
||||
"建议该操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该管理终端涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该管理终端涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
|
||||
业务管理终端（172.16.28.233）
|
||||
运维管理终端（172.16.28.239）
|
||||
|
||||
|
||||
该数据库鉴别数据未保证存储空间被释放或重新分配前得到完全清除
|
||||
建议该数据库鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份策略与备份结果未一致，在发生数据丢失时未能够进行数据恢复，近期恢复测试记录未能够进行正常的数据恢复
|
||||
建议该数据库涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份策略与备份结果未一致，在发生数据丢失时未能够进行数据恢复，近期恢复测试记录未能够进行正常的数据恢复
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库审计记录未定期进行备份（dmsql_GRP1_DW_02_SYSDBA），审计记录保存时间未满足6个月
|
||||
建议该数据库审计记录定期进行备份（dmsql_GRP1_DW_02_SYSDBA），审计记录保存时间满足6个月
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库审计记录未定期进行备份，审计记录保存时间未满足6个月
|
||||
建议该数据库审计记录定期进行备份，审计记录保存时间满足6个月
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
该数据库未采用ssl安全传输协议进行远程管理，未能避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该数据库采用ssl安全传输协议进行远程管理，避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未采用安全传输协议，未采用加密安全方式进行远程管理，未能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该数据库采用安全传输协议（如ssl），采用加密安全方式进行远程管理，能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
|
||||
|
||||
|
||||
该数据库未开启密码复杂度功能，未设置密码定期更换策略。
|
||||
建议该数据库启用密码复杂度功能（密码长度大于8位，由数字、字母和特殊字符3种组成），设置定期更换口令周期（定期更换周期不大于90天）。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未开启审计功能，审计范围未覆盖每个用户，未对重要的用户行为和重要安全事件进行审计。 该数据库未开启审计功能
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
该数据库未启用安全审计功能（ENABLE_AUDIT=0）
|
||||
建议该数据库启用安全审计功能（ENABLE_AUDIT=2）
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录（部分用户的登录失败次数和锁定时间未设置（SYSDBA、SYS、SYSSSO和SYSAUDITOR、FGW_V3、FGW_SECURITY、FGW_IEJMS））；未配置登录连接超时自动退出功能。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（部分用户需要设置登录失败次数和锁定时间FAILED_ATTEMPS=5，LOCK_TIME=5，用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（所有的用户需要设置超时功能CONN_IDLE_TIME=1800，超时退出时间不大于30分钟）。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能（timeout 0）。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（timeout 30）。
|
||||
|
||||
redis（10.209.42.15）
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时自动退出时间30分钟）。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
|
||||
该应用系统涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份
|
||||
建议该应用系统涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息定期进行本地备份
|
||||
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
该应用系统涉及的鉴别数据未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该应用系统涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统审计记录未定期进行备份（未备份登录日志），审计记录保存时间未满足6个月
|
||||
建议该应用系统审计记录定期进行备份（备份登录日志）
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
|
||||
|
||||
该应用系统审计记录未定期进行备份（未备份登录日志，未备份操作日志），审计记录保存时间未满足6个月
|
||||
建议该应用系统审计记录定期进行备份（备份登录日志，备份操作日志）
|
||||
测评对象
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该中间件未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能。 该中间件设置登录失败处理功能，未限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（登录连接超时时间：30分钟）。该中间件未设置密码复杂度策略，未设置密码定期更换策略。
|
||||
建议该中间件设置密码复杂度策略（密码长度大于8位，由数字、字母和特殊字符三种组成），设置密码定期更换策略（定期更换密码策略：90天）
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
|
||||
该中间件未开启审计功能（未具有catalina和localhost-access.log）
|
||||
建议该中间件开启审计功能（具有catalina和localhost-access.log）
|
||||
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
|
||||
|
||||
|
||||
该中间件所在操作系统未合理设置密码复杂度策略
|
||||
"建议该中间件所在操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
测评对象
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
该中间件所在操作系统涉及的鉴别数据未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该中间件所在操作系统涉及的鉴别数据保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
该中间件涉及到的重要审计数据、重要配置数据未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份结果与备份策略未一致，在发生数据丢失时未能够进行数据恢复。
|
||||
建议该中间件涉及到的重要审计数据、重要配置数据定期进行本地备份，备份策略设置合理、备份配置设置正确，备份结果与备份策略一致，在发生数据丢失时能够进行数据恢复。
|
||||
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
nacos（10.209.42.21）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
该中间件采用http传输协议，未采用加密安全方式进行远程管理，未能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该中间件采用https传输协议，采用加密安全方式进行远程管理，能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
该应用系统未设置密码复杂度功能，未设置密码定期更换策略
|
||||
建议该应用系统设置密码复杂度功能（密码长度8位以上，由字母、数字、特殊字符三种组成），设置密码定期更换策略（密码定期更换时间：90天）
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
|
||||
|
||||
该应用系统未设置密码定期更换策略
|
||||
建议该应用系统设置密码定期更换策略（密码定期更换时间：90天）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能
|
||||
建议该应用系统设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时退出时间：30分钟）
|
||||
测评对象
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
该应用系统未开启审计功能（未能区分手机端登录日志，未有操作日志），审计范围未覆盖每个用户，未对重要的用户行为和重要安全事件进行审计。
|
||||
建议该应用系统开启审计功能（区分手机端登录日志，具有操作日志）
|
||||
测评对象
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统未采用https传输协议
|
||||
建议该应用系统采用https传输协议测评对象
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,372 @@
|
||||
|
||||
|
||||
## 一、远程桌面
|
||||
|
||||
### Office Windows Desktop
|
||||
|
||||
- **TeamViewer 设备号**
|
||||
|
||||
```
|
||||
299 885 389
|
||||
```
|
||||
|
||||
- **密码**
|
||||
|
||||
```
|
||||
Admingzzn@1
|
||||
```
|
||||
|
||||
|
||||
|
||||
### VM Windows 10
|
||||
|
||||
- **rdesk**
|
||||
|
||||
```
|
||||
1 269 698 093
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
a4pvYPW2YO3aER
|
||||
```
|
||||
|
||||
todesk
|
||||
|
||||
```
|
||||
487 821 301
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
a4pvYPW2YO3aER=
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### GZZN Opensuse Desktop
|
||||
|
||||
rustdesk
|
||||
```
|
||||
1135993583
|
||||
```
|
||||
|
||||
```
|
||||
4ZZzxrAfwFj5q1
|
||||
```
|
||||
|
||||
rustdesk 中继密码
|
||||
```
|
||||
4BWKesxFCiKVPj7j6Zm7qV4JW8FtvRXZY1Zejv4nGxk=
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 二、服务器信息
|
||||
|
||||
### 服务器密码
|
||||
|
||||
```
|
||||
8VLtg#ZYA@AJSFJcPM
|
||||
```
|
||||
|
||||
### 服务器使用
|
||||
|
||||
- 主机：103
|
||||
|
||||
- 调整内存：100GB
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 三、二期资源
|
||||
|
||||
### 主机 10.194.62.26
|
||||
|
||||
```
|
||||
Gzzwy@%2020$
|
||||
```
|
||||
|
||||
### 内存百分比脚本
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
free -h
|
||||
echo "内存使用百分比： $(free | awk 'NR==2{printf "%.2f%%", $3*100/$2 }')"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 四、工具与探针
|
||||
|
||||
### 工具下载
|
||||
|
||||
```bash
|
||||
curl -k http://10.205.205.26:9092/tools/sh | bash
|
||||
```
|
||||
|
||||
### 探针安装
|
||||
|
||||
```bash
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
### 安装失败节点
|
||||
|
||||
- 10.209.42.14
|
||||
|
||||
- 10.209.42.15
|
||||
|
||||
- 10.209.42.18
|
||||
|
||||
- 10.209.42.20
|
||||
|
||||
- 10.209.42.21
|
||||
|
||||
- 10.209.42.22
|
||||
|
||||
|
||||
### 探针测试
|
||||
|
||||
```bash
|
||||
nc -uvz 10.207.33.1 12201
|
||||
systemctl status uniprobe
|
||||
```
|
||||
|
||||
### 手动运行探针
|
||||
|
||||
```bash
|
||||
bash -x /usr/local/bin/uniprobe-worker.sh -n 10.207.33.1:9000 \
|
||||
-a 1qgmg9koe1v2s998jsceikklontia2v9nact3gumfk6mkcd02251 \
|
||||
> /tmp/uniprobe/test.txt 2>&1
|
||||
```
|
||||
|
||||
上传日志：
|
||||
|
||||
```bash
|
||||
rz /tmp/uniprobe/test.txt
|
||||
```
|
||||
|
||||
### 抓包验证
|
||||
|
||||
```bash
|
||||
tcpdump -i any port 12201 -w a.pcap
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 五、数据迁移生产环境
|
||||
|
||||
### 1. MinIO 迁移
|
||||
|
||||
- 迁移桶：**fgw-law**
|
||||
|
||||
- URL: `http://130.120.3.126:9000`
|
||||
|
||||
- key: `GZZNEXAMPLE`
|
||||
|
||||
- secret: `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`
|
||||
|
||||
- bucketName: `fgw-law`
|
||||
|
||||
|
||||
MinIO 客户端配置：
|
||||
|
||||
```bash
|
||||
mc alias set src http://130.120.3.126:9000 GZZNEXAMPLE wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Elasticsearch 迁移
|
||||
|
||||
- 索引：**fgw_law_file_index**
|
||||
|
||||
- uris: `10.100.100.187:9200,10.100.100.188:9200,10.100.100.189:9200`
|
||||
|
||||
- 用户名: `elastic`
|
||||
|
||||
- 密码: `yjj@2022EmS,12`
|
||||
|
||||
|
||||
#### elasticdump 工具
|
||||
|
||||
```bash
|
||||
docker pull elasticdump/elasticsearch-dump
|
||||
```
|
||||
|
||||
**导出 Mapping**
|
||||
|
||||
```bash
|
||||
docker run --rm --network host -v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input=http://elastic:yjj%402022EmS%2C12@localhost:9200/my_index \
|
||||
--output=/dump/my_index_mapping.json \
|
||||
--type=mapping --debug
|
||||
```
|
||||
|
||||
**导出 Mapping + Data**
|
||||
|
||||
```bash
|
||||
# Mapping
|
||||
sudo docker run --rm --network host \
|
||||
-e NODE_TLS_REJECT_UNAUTHORIZED=0 \
|
||||
-v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input="https://elastic:yjj%402022EmS%2C12@127.0.0.1:9200/fgw_law_file_index" \
|
||||
--output="/dump/fgw_law_file_index_mapping.json" \
|
||||
--type=mapping --timeout=300000
|
||||
|
||||
# Data
|
||||
sudo docker run --rm --network host \
|
||||
-e NODE_TLS_REJECT_UNAUTHORIZED=0 \
|
||||
-v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input="https://elastic:yjj%402022EmS%2C12@127.0.0.1:9200/fgw_law_file_index" \
|
||||
--output="/dump/fgw_law_file_index_data.json" \
|
||||
--type=data --limit=2000 --concurrency=4 --fileSize=100mb --timeout=300000
|
||||
```
|
||||
|
||||
#### Snapshot 方式
|
||||
|
||||
**注册仓库**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X PUT 'http://127.0.0.1:8200/_snapshot/local_backup' \
|
||||
-d '{"type":"fs","settings":{"location":"/snapshots","compress":true}}'
|
||||
```
|
||||
|
||||
**创建快照**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X PUT 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03?wait_for_completion=true' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"ignore_unavailable": true,
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
**校验快照**
|
||||
|
||||
```bash
|
||||
curl -s 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03?pretty'
|
||||
```
|
||||
|
||||
**打包快照**
|
||||
|
||||
```bash
|
||||
tar czf /opt/elastic/fgw_law_snapshot_2025-09-03.tgz -C /opt/elastic/snapshots .
|
||||
```
|
||||
|
||||
**恢复（相同索引名）**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X POST 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03/_restore' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
**恢复（新索引名）**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X POST 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03/_restore' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"rename_pattern": "fgw_law_file_index",
|
||||
"rename_replacement": "fgw_law_file_index_restored",
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3. MongoDB 迁移
|
||||
|
||||
- 数据库：**fgw_v3**
|
||||
|
||||
- host: `10.100.101.101`
|
||||
|
||||
- 用户名: `fgw_v3`
|
||||
|
||||
- 密码: `Fgw@2024`
|
||||
|
||||
- 端口: `27017`
|
||||
|
||||
|
||||
**导出**
|
||||
|
||||
```bash
|
||||
/opt/mongodb/mongodb-database-tools-100.9.4/bin/mongodump \
|
||||
--host 10.100.101.101 --port 27017 \
|
||||
-u 'fgw_v3' -p 'Fgw@2024' \
|
||||
--db fgw_v3 \
|
||||
--authenticationDatabase fgw_v3 \
|
||||
--authenticationMechanism SCRAM-SHA-256 \
|
||||
--archive=/opt/mongodb/export/fgw_v3_$(date +%F).archive.gz \
|
||||
--gzip
|
||||
```
|
||||
|
||||
**另一种导出方式**
|
||||
|
||||
```bash
|
||||
sudo mongodb-database-tools-100.9.4/bin/mongodump -u fgw_v3 -p Fgw@2024 -h localhost \
|
||||
--db fgw_v3 --archive=fgw_v3-$(date +%F).gz --gzip
|
||||
```
|
||||
|
||||
**导入**
|
||||
|
||||
```bash
|
||||
/data/soft/mongodb-database-tools-100.9.4/bin/mongorestore \
|
||||
--host localhost --port 27017 \
|
||||
-u 'fgw_v3' -p 'FgwV3@202403' \
|
||||
--authenticationDatabase fgw_v3 \
|
||||
--authenticationMechanism SCRAM-SHA-256 \
|
||||
--archive=/data/tmp/fgw_v3.archive.gz --gzip
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
10.209.42.20 mongo
|
||||
|
||||
```
|
||||
VOLUME_DB=$(docker inspect mongodb | jq -r '.[0].Mounts[] | select(.Destination=="/data/db") | .Source')
|
||||
echo $VOLUME_DB
|
||||
ls -l $VOLUME_DB
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
更新监控软件
|
||||
```bash
|
||||
curl -k http://10.205.205.26:9092/tools/sh | bash
|
||||
```
|
||||
|
||||
```bash
|
||||
systemctl status pp-monitor
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
服务器移交：
|
||||
10.209.42.19 （zookeeper）
|
||||
新密码:
|
||||
|
||||
```
|
||||
uve|ph7ro9bieCh#
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
echo -e 'uve|ph7ro9bieCh#\nuve|ph7ro9bieCh#' | passwd
|
||||
```
|
||||
@@ -0,0 +1,201 @@
|
||||
|
||||
|
||||
应用系统名称： 广州市投资项目信息化平台
|
||||
用户单位: 广州市发展和改革委员会
|
||||
使用架构（单机/主备/读写分离/其他） ：2节点主备（自动切换）
|
||||
正式or测试环境：正式环境
|
||||
物理机or虚拟机：物理机
|
||||
操作系统：Kylin Linux Advanced Server release V10 (Tercel)
|
||||
CPU信息：Kunpeng-920
|
||||
CPU(s): 96
|
||||
内存：254G
|
||||
备份是否独立磁盘：否
|
||||
备份策略 --暂未配置
|
||||
存储信息：
|
||||
|
||||
--主库
|
||||
文件系统 容量 已用 可用 已用% 挂载点
|
||||
/dev/mapper/data-data 1.0T 18G 1007G 2% /data
|
||||
|
||||
--备库
|
||||
文件系统 容量 已用 可用 已用% 挂载点
|
||||
/dev/mapper/data-data 1.0T 18G 1007G 2% /data
|
||||
|
||||
|
||||
2节点主备集群，自动切换模式
|
||||
10.201.23.102 主库
|
||||
10.201.23.103 备库
|
||||
10.209.42.16 监控
|
||||
|
||||
|
||||
1、数据库基本信息：
|
||||
数据库页大小：32K
|
||||
数据库簇大小：32K
|
||||
数据库字符集：UTF-8
|
||||
数据库大小写是否敏感：不敏感
|
||||
数据库实例名：GRP1_DW_01/GRP1_DW_02
|
||||
数据库名：dmdb
|
||||
数据库超级管理员账号/密码：SYSDBA/Hn@dameng123 #数据库系统用户密码修改后妥善保存，一旦丢失无法找回。
|
||||
数据库审计员账号/密码：SYSAUDITOR/SYSAUDITOR
|
||||
数据库安全员账号/密码：SYSSSO/SYSSSO
|
||||
数据库默认端口：35239
|
||||
数据库安装版本：
|
||||
---------- -----------------------------------------
|
||||
1 --05134284194-20240814-239099-20108 Pack10
|
||||
---------- ---------------------------------
|
||||
1 DM Database Server 64 V8
|
||||
2 8.4
|
||||
3 安全版
|
||||
4 DB Version: 0x7000c
|
||||
5 05134284194-20240814-239099-20108
|
||||
6 Msg Version: 12
|
||||
7 Gsu level(5) cnt: 0
|
||||
|
||||
|
||||
授权编号：2B01108287 (测试授权)
|
||||
产品有效期：2024-12-25
|
||||
数据库软件安装路径：/home/dmdba/dmdbms
|
||||
数据库数据文件路径：/data/dmdata/
|
||||
数据库归档文件路径：/data/dmdata/dmarch
|
||||
归档空间限制：100G #如果不够可调整
|
||||
数据库备份文件路径：暂未配置备份
|
||||
数据库驱动路径：/home/dmdba/dmdbms/drivers
|
||||
数据库文档路径：/home/dmdba/dmdbms/doc
|
||||
数据库日志路径：/home/dmdba/dmdbms/log
|
||||
dmdba用户密码: Hn@dameng123
|
||||
|
||||
|
||||
注意：请创建新的表空间和用户供业务使用，切勿使用系统默认的用户（SYSDBA）和表空间（main）。
|
||||
|
||||
2、数据库客户端命令工具:
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSDBA/'"Hn@dameng123"':5236
|
||||
说明：密码含特殊字符使用单引号+双引号包围起来
|
||||
|
||||
3、数据库图形化管理工具：
|
||||
客户端管理工具：manager
|
||||
cd /home/dmdba/dmdbms/tool
|
||||
./manager
|
||||
|
||||
4、数据库数据迁移工具：
|
||||
./dts
|
||||
|
||||
5、数据库服务重启步骤：
|
||||
切换至dmdba用户：
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
|
||||
关闭确认监视器（监视器服务器）： ./DmMonitorServiceGRP1 stop
|
||||
|
||||
关闭主库守护进程：./DmWatcherServiceGRP1 stop
|
||||
关闭备库守护进程：./DmWatcherServiceGRP1 stop
|
||||
关闭主库实例：./DmServicedmdb stop
|
||||
关闭备库实例：./DmServicedmdb stop
|
||||
|
||||
启动主库实例：./DmServicedmdb start
|
||||
启动备库实例：./DmServicedmdb start
|
||||
启动主库守护进程：./DmWatcherServiceGRP1 start
|
||||
启动备库守护进程：./DmWatcherServiceGRP1 start
|
||||
|
||||
启动确认监视器（监视器服务器）： ./DmMonitorServiceGRP1 start
|
||||
|
||||
|
||||
查看数据库服务进程
|
||||
ps -ef|grep dmserver
|
||||
|
||||
|
||||
6，管理工具的安装使用（管理工具可跟商务申请）
|
||||
##管理工具下载（WIN）
|
||||
https://eco.dameng.com/download/
|
||||
##管理工具的安装使用（安装选择组件，只安装客户端就行）
|
||||
https://eco.dameng.com/document/dm/zh-cn/start/install-dm-windows-prepare.html
|
||||
|
||||
7、应用配置链接主备集群的配置：
|
||||
方法一：
|
||||
在中间件或者应用服务器上，新建/etc/dm_svc.conf配置文件。
|
||||
|
||||
①文件存放：
|
||||
Linux：将dm_svc.conf文件放在应用服务器和中间件服务器/etc目录下。
|
||||
Windows32位：将dm_svc.conf文件放在应用服务器system32目录下。
|
||||
Windows64位：将dm_svc.conf文件放在应用服务器system32和syswow64目录下。
|
||||
|
||||
vi /etc/dm_svc.conf
|
||||
|
||||
TIME_ZONE=(480)
|
||||
LANGUAGE=(cn)
|
||||
DMDW=(10.201.23.102:35239,10.201.23.103:35239)
|
||||
[DMDW]
|
||||
LOGIN_ENCRYPT=(0)
|
||||
LOGIN_MODE=(1)
|
||||
|
||||
说明：客户端程序连接数据库时，需要指定 IP 端口处替换为服务名即可，
|
||||
例如：disql SYSDBA/'"Hn@dameng123"'@DMDW。jdbc的url为：jdbc:dm://DMDW
|
||||
|
||||
注意：
|
||||
1)当修改了 dm_svc.conf 内容后，需要重启客户端程序，修改的配置才能生效。
|
||||
2)请把该文件路径授予666权限。
|
||||
|
||||
|
||||
方法二：
|
||||
集群连接服务名和ip配置参数直接配置在URL连接串
|
||||
JDBC服务连接配置说明
|
||||
配置应用连接串：（JDBC连接串选项请参考《DM程序员手册》中的4.5.4 DM 扩展连接属性的使用）
|
||||
|
||||
主备集群：
|
||||
非xml文件：
|
||||
jdbc:dm://DMDW?DMDW=(10.201.23.102:35239,10.201.23.103:35239)&LOGIN_MODE=(1)
|
||||
xml文件：
|
||||
jdbc:dm://DMDW?DMDW=(10.201.23.102:35239,10.201.23.103:35239)&LOGIN_MODE=(1)
|
||||
|
||||
|
||||
|
||||
8，创建用户和表空间，禁止使用系统默认的用户（SYSDBA）和表空间（main）存放业务数据。
|
||||
示例：
|
||||
- 创建用户
|
||||
create user test identified by "Hn@dameng123";
|
||||
|
||||
- 用户角色分配，管理工具上看有什么角色，根据具体情况而定，DBA角色应该是不用分配给应用账号的。
|
||||
grant resource,public,soi,vti,svi to test;
|
||||
|
||||
select * from dba_role_privs where grantee='TEST';
|
||||
|
||||
|
||||
-创建表空间，指定用户的默认表空间
|
||||
（数据文件存放在跟其他数据文件一样的就行，注意文件名不能一样，以下指定每个数据文件10G，视实际情况而定，不够再加数据文件，要留意空间是否足够）
|
||||
|
||||
select * from v$tablespace;
|
||||
select path from v$datafile;
|
||||
|
||||
//数据表空间
|
||||
create tablespace test datafile '/data/dmdata/dmdb/test01.dbf' size 1024 autoextend on next 128 maxsize 10240;
|
||||
alter tablespace test add datafile '/data/dmdata/dmdb/test02.dbf' size 128 autoextend on next 128 maxsize 10240;
|
||||
|
||||
//索引表空间
|
||||
create tablespace test_index datafile '/data/dmdata/dmdb/test_index01.dbf' size 128 autoextend on next 128 maxsize 10240;
|
||||
|
||||
//设置用户的默认表空间
|
||||
alter user test default tablespace test;
|
||||
alter user test default index tablespace test_index;
|
||||
|
||||
//查询用户表空间信息
|
||||
select username,user_id,default_tablespace,default_index_tablespace
|
||||
from dba_users;
|
||||
|
||||
====普通监视器查看集群状态
|
||||
在主备节点均部署普通监视器，可以用于日常查看集群状态
|
||||
|
||||
切换dmdba用户
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
dmmonitor /data/dmdata/dmdb/dmmonitor_GRP1.ini
|
||||
|
||||
=== 手动切换主库（打开监视器后）
|
||||
示例：
|
||||
dmmonitor /data/dmdata/dmdb/dmmonitor_GRP1.ini
|
||||
|
||||
login
|
||||
用户名:SYSDBA
|
||||
密码:Hn@dameng123
|
||||
|
||||
switchover GRP1.GRP1_DW_02
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,99 @@
|
||||
|
||||
堡垒机：
|
||||
https://10.160.32.248
|
||||
gwjh
|
||||
1@qwaSzx202407
|
||||
|
||||
| | | |
|
||||
|---|---|---|
|
||||
|
||||
VPN：
|
||||
|[https://218.20.201.210](https://218.20.201.210/)
|
||||
gwjhgzzn
|
||||
gzpy135.com
|
||||
new:
|
||||
```
|
||||
Pygwjh@202409
|
||||
```
|
||||
|
||||
|
||||
|
||||
114:
|
||||
root
|
||||
114gZgw$jH0510M
|
||||
|
||||
115:
|
||||
root
|
||||
gZg115w$jH0510M
|
||||
|
||||
116:
|
||||
root
|
||||
gZgw116$jH0510M
|
||||
|
||||
176:
|
||||
root
|
||||
g@W2024.Jh
|
||||
|
||||
177:
|
||||
Gw@Jh2023.K
|
||||
|
||||
|
||||
|
||||
|
||||
三台minio服务，端口9000
|
||||
10.160.20.114、10.160.20.115、10.160.20.116
|
||||
三台NGINX，端口80和443
|
||||
10.160.20.176、10.160.20.177
|
||||
|
||||
|
||||
|
||||
firewalld whitelist
|
||||
|
||||
```bash
|
||||
|
||||
firewall-cmd --new-zone=whitelist --permanent
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
14 firewall:
|
||||
```
|
||||
firewall-cmd --permanent --add-port=9000/tcp
|
||||
firewall-cmd --permanent --add-port=9001/tcp
|
||||
firewall-cmd --permanent --add-port=9100/tcp
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
|
||||
176/177:
|
||||
```bash
|
||||
|
||||
firewall-cmd --permanent --add-service=http
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --reload
|
||||
|
||||
```
|
||||
|
||||
|
||||
new white list:
|
||||
ip list:
|
||||
10.160.20.112-119
|
||||
10.160.20.102
|
||||
10.160.20.107
|
||||
10.160.20.110
|
||||
10.160.20.176
|
||||
10.160.20.177
|
||||
|
||||
```bash
|
||||
firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.160.20.0/24" accept' --permanent
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
|
||||
remove:
|
||||
|
||||
```shell
|
||||
firewall-cmd --zone=public --list-rich-rules --permanent
|
||||
firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="10.160.20.0/24" accept' --permanent
|
||||
firewall-cmd --reload
|
||||
firewall-cmd --list-all
|
||||
```
|
||||
@@ -0,0 +1,64 @@
|
||||
|
||||
|
||||
mysql:
|
||||
|
||||
```
|
||||
CREATE USER 'tduck'@'172.25.%' IDENTIFIED BY 'Tduck@20220725/';
|
||||
GRANT ALL PRIVILEGES ON *.* to 'tduck'@'172.25.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
create user 'iflow'@'172.25.242.%' identified by 'Gzzn@2024';
|
||||
grant all privileges on *.* to 'iflow'@'172.25.242.%';
|
||||
flush privileges;
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
select name from mysql.proc where db = 'tduck_pre' and `type` = 'PROCEDURE';
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
SHOW CREATE PROCEDURE 'schedule_del_status_230417'
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
|
||||
SHOW PROCEDURE STATUS;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
GRANT SYSTEM_USER ON *.* TO 'root'@'172.25.242.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
SELECT EVENT_SCHEMA, EVENT_NAME, DEFINER
|
||||
FROM information_schema.EVENTS
|
||||
WHERE EVENT_SCHEMA = 'tduck_pre' AND EVENT_NAME = 'schedule_del_status_230417';
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
ALTER DEFINER = 'root'@'172.25.242.%' EVENT `tduck_pre`.`schedule_del_status_230417`
|
||||
ON SCHEDULE EVERY 1 DAY STARTS '2023-04-20 00:10:00'
|
||||
DO
|
||||
DELETE FROM py_car_cnclxx
|
||||
WHERE S_STATUS = 2 AND TO_DAYS(NOW()) - TO_DAYS(s_last_updated) > 1;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
CREATE USER 'pypc'@'172.25.%' IDENTIFIED BY 'PyPc@20220722.';
|
||||
GRANT ALL PRIVILEGES ON pypc.* to 'pypc'@'172.25.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
@@ -0,0 +1,54 @@
|
||||
# 番禺城中城服务器登陆流程
|
||||
|
||||
### vpn
|
||||
|
||||
```sh
|
||||
https://218.20.201.210
|
||||
|
||||
znkj
|
||||
|
||||
znkj@panyu.com
|
||||
```
|
||||
|
||||
|
||||
|
||||
### 堡垒机
|
||||
|
||||
```sh
|
||||
https://10.160.32.248/#/login
|
||||
|
||||
yanggj
|
||||
|
||||
89@ghrw#2A1wq
|
||||
|
||||
# 手机验证码需找技术经理陆旋支持
|
||||
```
|
||||
|
||||
```
|
||||
89@ghrw#2A1wq
|
||||
```
|
||||
|
||||
|
||||
### 服务器
|
||||
|
||||
| ip地址 | 密码 |
|
||||
| --------------------------------------- | -------------------- |
|
||||
| 172.25.242.178 （nginx、redis、mysql） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.45 （tduck-api） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.46 （docker swarm（副）） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.47 （备份服务器） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.204 （docker swarm（主）） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.215 （minion） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.61 | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.101.16 （nginx、mysql、redis（车场专用）） | PYzsj@101.47*429 |
|
||||
|
||||
```
|
||||
1qaz@WSX3edc$RFV$#@!
|
||||
```
|
||||
|
||||
### 登陆顺序
|
||||
|
||||
> 服务器登陆顺序为：vpn --> 堡垒机 --> 172.25.242.178 --> 其他服务器（在178上面ssh过去）
|
||||
>
|
||||
> 注：因当前策略问题，178无法跳转至16服务器，需要先从178到204然后再跳转16 （策略需项目经理去开通）
|
||||
|
||||
@@ -0,0 +1,204 @@
|
||||
# 番禺政务中心配置信息
|
||||
|
||||
Maintainer：lizx
|
||||
|
||||
Date：2022-07-20
|
||||
|
||||
## VPN
|
||||
|
||||
> https://218.20.201.210
|
||||
>
|
||||
> 账号：znkj
|
||||
>
|
||||
> 密码：znkj@panyu.com
|
||||
|
||||
## 堡垒机
|
||||
|
||||
> https://10.160.20.248/#/login
|
||||
>
|
||||
> 账号：yanggj
|
||||
>
|
||||
> 密码：5@ghrw#2A1wq
|
||||
|
||||
## 服务器登录账号密码
|
||||
|
||||
> 172.25.242.178
|
||||
>
|
||||
> Account：root
|
||||
>
|
||||
> Password：1qaz@WSX3edc$RFV$#@!
|
||||
|
||||
## 数据库信息
|
||||
|
||||
> 数据库 172.25.242.178
|
||||
>
|
||||
> 端口：3306
|
||||
>
|
||||
> 本地DBA用户
|
||||
>
|
||||
> 用户：root
|
||||
>
|
||||
> 密码：gZZn@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：mbp
|
||||
>
|
||||
> 密码：mBp@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：pypc
|
||||
>
|
||||
> 密码：PyPc@20220722.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：tduck
|
||||
>
|
||||
> 密码：Tduck@20220725/
|
||||
>
|
||||
> +--------------------+
|
||||
> | Database |
|
||||
> +--------------------+
|
||||
> | information_schema |
|
||||
> | mbp |
|
||||
> | mysql |
|
||||
> | performance_schema |
|
||||
> | pypc |
|
||||
> | sys |
|
||||
> | tduck_pre |
|
||||
> | vincity |
|
||||
> +--------------------+
|
||||
|
||||
|
||||
|
||||
## Redis信息
|
||||
|
||||
>数据库 172.25.242.178
|
||||
>
|
||||
>端口：6879
|
||||
>
|
||||
>启动命令：redis-server /opt/redis/redis-7.0.4/redis.conf
|
||||
>
|
||||
>关闭命令：redis-cli -p 6879 --> auth 密码 --> shutdown
|
||||
>
|
||||
>客户端登录：redis-cli -p 6879
|
||||
>
|
||||
>密码：gZzn.2022A
|
||||
|
||||
|
||||
|
||||
## Naocs信息
|
||||
|
||||
> 172.25.242.178:8848/nacos
|
||||
>
|
||||
> 部署位置：/opt/nacos
|
||||
>
|
||||
> JDK位置：/opt/jdk1.8.0_311
|
||||
>
|
||||
> 启动命令：./startup.sh -m standalone
|
||||
>
|
||||
> 关闭命令：./shutdown.sh
|
||||
>
|
||||
> 端口：8848
|
||||
>
|
||||
> 用户名：nacos
|
||||
>
|
||||
> 密码：nacos
|
||||
>
|
||||
> H@rJ4cwnz5bydxyT
|
||||
>
|
||||
> 请配置时及时更改密码为强口令！！！！
|
||||
|
||||
## ES信息
|
||||
|
||||
> 172.25.242.178:9200
|
||||
>
|
||||
> 部署位置：/opt/soft/es
|
||||
>
|
||||
> JDK位置：es内置jdk
|
||||
>
|
||||
> 启动命令：./elasticsearch -d （启动时需要切换elastic用户，密码：Gzzn@20220725/）
|
||||
>
|
||||
> 端口：9200
|
||||
>
|
||||
> 账号：elastic
|
||||
>
|
||||
> 启动时自动生成的默认密码：7qOBYCqDrx_q3Ib*Vyb=
|
||||
|
||||
## nginx信息
|
||||
|
||||
> 172.25.242.178:80
|
||||
>
|
||||
> 部署位置：/usr/local/nginx
|
||||
>
|
||||
> 配置文件位置：/usr/local/nginx/conf/nginx.conf
|
||||
>
|
||||
> 启动命令：./nginx
|
||||
|
||||
## minio信息
|
||||
|
||||
> 172.25.242.215:9000
|
||||
>
|
||||
> 部署位置：/data/minio
|
||||
>
|
||||
> 管理用户：minioadmin/lRFG4YWitlthJQ+
|
||||
>
|
||||
> 容器启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> docker run -p 9000:9000 -p 9090:9090 \
|
||||
> --net=host \
|
||||
> --name minio \
|
||||
> -d --restart=always \
|
||||
> -e "MINIO_ROOT_USER=minioadmin" \
|
||||
> -e "MINIO_ROOT_PASSWORD=lRFG4YWitlthJQ+" \
|
||||
> -v /data/minio/data:/data \
|
||||
> -v /data/minio/config:/root/.minio \
|
||||
> minio/minio server \
|
||||
> /data --console-address ":9090" -address ":9000"
|
||||
> ```
|
||||
>
|
||||
>
|
||||
|
||||
## mongo信息
|
||||
|
||||
> ip: 172.25.242.47
|
||||
>
|
||||
> 端口：27017
|
||||
>
|
||||
> 部署位置：/data/mongodb
|
||||
>
|
||||
> 管理用户：root
|
||||
>
|
||||
> 密码：root/Pyczc@Root2023
|
||||
>
|
||||
> 启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> # 启动
|
||||
> service mongod start
|
||||
> # 停止
|
||||
> service mongod stop
|
||||
> # 重启
|
||||
> service mongod restart
|
||||
> ```
|
||||
>
|
||||
> 业务用户：data_quality
|
||||
|
||||
> 密码：Pyczc@data_quality2023
|
||||
|
||||
# 测试环境
|
||||
|
||||
## zookeeper
|
||||
|
||||
> ip :172.25.242.61
|
||||
>
|
||||
> 用户：zookeeper/Zook@admin2023
|
||||
>
|
||||
> post: 2181
|
||||
>
|
||||
> 部署位置：/opt/apache-zookeeper
|
||||
>
|
||||
> 数据位置：/data/zookeeper
|
||||
@@ -0,0 +1,130 @@
|
||||
# 虚拟数据中心总线测试环境_20240523
|
||||
|
||||
---
|
||||
|
||||
[TOC]
|
||||
|
||||
---
|
||||
|
||||
## 一、应用服务（zms、zmsm）
|
||||
|
||||
服务器IP：130.120.3.148
|
||||
|
||||
部署路径：`/opt/zms/`
|
||||
|
||||
配置文件：`/opt/zms/conf/application.conf`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/zms
|
||||
bash start.sh
|
||||
|
||||
#关闭命令
|
||||
cd /opt/zms
|
||||
bash killZms.sh
|
||||
```
|
||||
|
||||
|
||||
|
||||
服务器IP：10.100.100.152
|
||||
|
||||
部署路径：`/opt/apps/zmsm`
|
||||
|
||||
配置文件：`/opt/apps/zmsm/config/application-pro.yml`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
docker run -d -p 82:8080 --restart unless-stopped -v /opt/apps/zmsm:/opt/myapp --name zmsm gzzn/zmsm
|
||||
|
||||
#关闭命令
|
||||
docker stop zmsm
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 二、数据库
|
||||
|
||||
### MYSQL
|
||||
|
||||
服务器IP：130.120.3.158
|
||||
|
||||
端口：3306
|
||||
|
||||
账号：zmsm
|
||||
|
||||
密码：123456
|
||||
|
||||
|
||||
|
||||
### Redis
|
||||
|
||||
服务器IP：10.100.100.172
|
||||
|
||||
端口：6379
|
||||
|
||||
密码：Gzzn..2024
|
||||
|
||||
```bash
|
||||
systemctl start redis
|
||||
systemctl stop redis
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三、支撑组件（Kafka、Zookeeper）
|
||||
|
||||
### Kafka
|
||||
|
||||
服务器IP：130.120.3.133、130.120.3.134、130.120.3.135
|
||||
|
||||
端口：9092
|
||||
|
||||
部署路径：`/opt/kafka_2.12-1.0.0`
|
||||
|
||||
配置文件：`/opt/kafka_2.12-1.0.0/config/server.properties`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
nohup /opt/kafka_2.12-1.0.0/bin/kafka-server-start.sh /opt/kafka_2.12-1.0.0/config/server.properties > /dev/null 2>&1 &
|
||||
|
||||
#关闭命令
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
ps -ef|grep kafka|grep -v grep|awk '{print $2}'
|
||||
kill #上一步获取的PID
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
#start
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
bash start
|
||||
```
|
||||
|
||||
```bash
|
||||
#stop
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
bash stop
|
||||
```
|
||||
|
||||
### Zookeeper
|
||||
|
||||
服务器IP：130.120.3.133、130.120.3.134、130.120.3.135
|
||||
|
||||
端口：2181
|
||||
|
||||
部署路径：`/opt/apache-zookeeper-3.9.2-bin`
|
||||
|
||||
配置文件：`/opt/apache-zookeeper-3.9.2-bin/conf/zoo.cfg`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/apache-zookeeper-3.9.2-bin/bin
|
||||
bash zkServer.sh start
|
||||
|
||||
#关闭命令
|
||||
cd /opt/apache-zookeeper-3.9.2-bin/bin
|
||||
bash zkServer.sh stop
|
||||
```
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,5 @@
|
||||
|
||||
proxysql --version
|
||||
ProxySQL version 1.4.12-9-g216b872, codename Truls
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,190 @@
|
||||
# 番禺政务中心配置信息
|
||||
|
||||
## 服务器登录账号密码
|
||||
|
||||
> 172.25.242.178
|
||||
>
|
||||
> Account：root
|
||||
>
|
||||
> Password：1qaz@WSX3edc$RFV$#@!
|
||||
|
||||
## 数据库信息
|
||||
|
||||
## 数据库账号密码
|
||||
172.25.242.178 root/Pyczc@Admin2023
|
||||
172.25.242.61 root/Gzzn@2023
|
||||
|
||||
|
||||
> 数据库 172.25.242.178
|
||||
>
|
||||
> 端口：3306
|
||||
>
|
||||
> 本地DBA用户
|
||||
>
|
||||
> 用户：root
|
||||
>
|
||||
> 密码：gZZn@2022.
|
||||
> Gzzn@202406
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：mbp
|
||||
>
|
||||
> 密码：mBp@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：pypc
|
||||
>
|
||||
> 密码：PyPc@20220722.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：tduck
|
||||
>
|
||||
> 密码：Tduck@20220725/
|
||||
>
|
||||
> +--------------------+
|
||||
> | Database |
|
||||
> +--------------------+
|
||||
> | information_schema |
|
||||
> | mbp |
|
||||
> | mysql |
|
||||
> | performance_schema |
|
||||
> | pypc |
|
||||
> | sys |
|
||||
> | tduck_pre |
|
||||
> | vincity |
|
||||
> +--------------------+
|
||||
|
||||
|
||||
|
||||
## Redis信息
|
||||
|
||||
>数据库 172.25.242.178
|
||||
>
|
||||
>端口：6879
|
||||
>
|
||||
>启动命令：redis-server /opt/redis/redis-7.0.4/redis.conf
|
||||
>
|
||||
>关闭命令：redis-cli -p 6879 --> auth 密码 --> shutdown
|
||||
>
|
||||
>客户端登录：redis-cli -p 6879
|
||||
>
|
||||
>密码：gZzn.2022A
|
||||
|
||||
|
||||
|
||||
## Naocs信息
|
||||
|
||||
> 172.25.242.178:8848/nacos
|
||||
>
|
||||
> 部署位置：/opt/nacos
|
||||
>
|
||||
> JDK位置：/opt/jdk1.8.0_311
|
||||
>
|
||||
> 启动命令：./startup.sh -m standalone
|
||||
>
|
||||
> 关闭命令：./shutdown.sh
|
||||
>
|
||||
> 端口：8848
|
||||
>
|
||||
> 用户名：nacos
|
||||
>
|
||||
> 密码：nacos
|
||||
>
|
||||
> H@rJ4cwnz5bydxyT
|
||||
>
|
||||
> 请配置时及时更改密码为强口令！！！！
|
||||
|
||||
## ES信息
|
||||
|
||||
> 172.25.242.178:9200
|
||||
>
|
||||
> 部署位置：/opt/soft/es
|
||||
>
|
||||
> JDK位置：es内置jdk
|
||||
>
|
||||
> 启动命令：./elasticsearch -d （启动时需要切换elastic用户，密码：Gzzn@20220725/）
|
||||
>
|
||||
> 端口：9200
|
||||
>
|
||||
> 账号：elastic
|
||||
>
|
||||
> 启动时自动生成的默认密码：7qOBYCqDrx_q3Ib*Vyb=
|
||||
|
||||
## nginx信息
|
||||
|
||||
> 172.25.242.178:80
|
||||
>
|
||||
> 部署位置：/usr/local/nginx
|
||||
>
|
||||
> 配置文件位置：/usr/local/nginx/conf/nginx.conf
|
||||
>
|
||||
> 启动命令：./nginx
|
||||
|
||||
## minio信息
|
||||
|
||||
> 172.25.242.215:9000
|
||||
>
|
||||
> 部署位置：/data/minio
|
||||
>
|
||||
> 管理用户：minioadmin/lRFG4YWitlthJQ+
|
||||
>
|
||||
> 容器启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> docker run -p 9000:9000 -p 9090:9090 \
|
||||
> --net=host \
|
||||
> --name minio \
|
||||
> -d --restart=always \
|
||||
> -e "MINIO_ROOT_USER=minioadmin" \
|
||||
> -e "MINIO_ROOT_PASSWORD=lRFG4YWitlthJQ+" \
|
||||
> -v /data/minio/data:/data \
|
||||
> -v /data/minio/config:/root/.minio \
|
||||
> minio/minio server \
|
||||
> /data --console-address ":9090" -address ":9000"
|
||||
> ```
|
||||
>
|
||||
>
|
||||
|
||||
## mongo信息
|
||||
|
||||
> ip: 172.25.242.47
|
||||
>
|
||||
> 端口：27017
|
||||
>
|
||||
> 部署位置：/data/mongodb
|
||||
>
|
||||
> 管理用户：root
|
||||
>
|
||||
> 密码：root/Pyczc@Root2023
|
||||
>
|
||||
> 启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> # 启动
|
||||
> service mongod start
|
||||
> # 停止
|
||||
> service mongod stop
|
||||
> # 重启
|
||||
> service mongod restart
|
||||
> ```
|
||||
>
|
||||
> 业务用户：data_quality
|
||||
>
|
||||
> 密码：Pyczc@data_quality2023
|
||||
|
||||
# 测试环境
|
||||
|
||||
## zookeeper
|
||||
|
||||
> ip :172.25.242.61
|
||||
>
|
||||
> 用户：zookeeper/Zook@admin2023
|
||||
>
|
||||
> post: 2181
|
||||
>
|
||||
> 部署位置：/opt/apache-zookeeper
|
||||
>
|
||||
> 数据位置：/data/zookeeper
|
||||
Reference in New Issue
Block a user