init
This commit is contained in:
zhiqiang feng
@@ -0,0 +1,26 @@
|
||||
CATALINA_OPTS:
|
||||
|
||||
```bash
|
||||
export JAVA_HOME="/Users/windy/.sdkman/candidates/java/8.0.292-zulu"
|
||||
export JAVA_OPTS="-server"
|
||||
export CATALINA_OPTS="-Dwebconsole.type=properties -Dwebconsole.jms.url=tcp://localhost:61618?wireFormat.maxInactivityDuration=0 -Dwebconsole.jmx.url=service:jmx:rmi:///jndi/rmi://localhost:1099/jmxrmi -Dwebconsole.jmx.role=admin -Dwebconsole.jmx.password=pass -Dactivemq.base=/Users/windy/Projects/airport/changde/apache-tomcat-7.0.30-ciims"
|
||||
|
||||
export CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.management.jmxremote
|
||||
-Dcom.sun.management.jmxremote.port=1099
|
||||
-Dcom.sun.management.jmxremote.ssl=false
|
||||
-Dcom.sun.management.jmxremote.authenticate=false"
|
||||
```
|
||||
|
||||
|
||||
activemq.xml:
|
||||
```xml
|
||||
<broker xmlns="http://activemq.org/config/1.0" brokerName="localhost" dataDirectory="${catalina.base}/data" persistent="true" useShutdownHook="false">
|
||||
|
||||
<transportConnectors>
|
||||
<transportConnector name="openwire" uri="tcp://localhost:61618" />
|
||||
</transportConnectors>
|
||||
<managementContext>
|
||||
<managementContext jmxDomainName="org.apache.activemq" createConnector="true" connectorPort="1199" connectorPath="/jmxrmi"/>
|
||||
</managementContext>
|
||||
|
||||
```
|
||||
@@ -0,0 +1,163 @@
|
||||
|
||||
|
||||
# elastic search
|
||||
index stats:
|
||||
GET /<index_name>/_stats/store
|
||||
|
||||
cluster stats:
|
||||
GET /_cluster/stats?human&pretty
|
||||
|
||||
get index:
|
||||
GET /_cat/indices?v&s=store.size:desc
|
||||
|
||||
|
||||
---
|
||||
|
||||
### **仅通过 SSH 服务端设置超时（方案一）**
|
||||
|
||||
#### **步骤说明**：
|
||||
1. **修改 SSH 服务端配置文件**：
|
||||
```bash
|
||||
sudo vim /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
2. **添加或修改以下参数**：
|
||||
```ini
|
||||
# 客户端空闲超时设置（单位：秒）
|
||||
ClientAliveInterval 300 # 每 300 秒（5分钟）检查一次客户端是否存活
|
||||
ClientAliveCountMax 0 # 如果客户端无响应，立即断开连接（总超时时间 = 300秒=5分钟）
|
||||
```
|
||||
**或**
|
||||
```ini
|
||||
ClientAliveInterval 600 # 每 600 秒（10分钟）检查一次
|
||||
ClientAliveCountMax 3 # 允许3次无响应（总超时时间 = 600x3=1800秒=30分钟）
|
||||
```
|
||||
|
||||
3. **重启 SSH 服务**：
|
||||
```bash
|
||||
# 大多数现代系统（Ubuntu/CentOS/RHEL等）：
|
||||
sudo systemctl restart sshd
|
||||
|
||||
# 旧版系统（如Debian 7）：
|
||||
sudo service ssh restart
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **参数解释**：
|
||||
- `ClientAliveInterval`：
|
||||
服务器每隔 N 秒向客户端发送一次保活信号，若客户端无响应，触发超时计数。
|
||||
**示例**：`300` 表示每5分钟检查一次。
|
||||
|
||||
- `ClientAliveCountMax`：
|
||||
允许客户端连续无响应的次数，超过后断开连接。
|
||||
**示例**：
|
||||
- 若设为 `0`，客户端一次无响应立即断开（总超时时间 = `ClientAliveInterval` 值）。
|
||||
- 若设为 `3`，总超时时间 = `ClientAliveInterval × 3`。
|
||||
|
||||
---
|
||||
|
||||
### **验证配置**：
|
||||
1. **检查配置文件**：
|
||||
```bash
|
||||
grep ClientAlive /etc/ssh/sshd_config
|
||||
```
|
||||
输出应包含你设置的参数值。
|
||||
|
||||
2. **测试超时**：
|
||||
登录 SSH 后保持会话空闲，观察是否在预期时间内自动断开。
|
||||
|
||||
---
|
||||
|
||||
### **注意事项**：
|
||||
1. **优先级**：服务端配置对所有通过 SSH 登录的用户生效，覆盖客户端设置。
|
||||
2. **安全建议**：
|
||||
- 生产环境建议设置 `ClientAliveInterval=300` + `ClientAliveCountMax=0`（严格超时5分钟）。
|
||||
- 避免设置过长的超时（如几小时），以防会话被恶意利用。
|
||||
3. **备份配置**：
|
||||
修改前建议备份原文件：
|
||||
```bash
|
||||
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **总结**
|
||||
通过服务端配置 `ClientAliveInterval` 和 `ClientAliveCountMax`，即可强制所有 SSH 会话在空闲超时后自动断开，无需用户端额外操作。
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
以下是设置Linux用户密码策略的**极简步骤**：
|
||||
|
||||
---
|
||||
|
||||
### **1. 设置密码有效期**
|
||||
- **新用户**：修改全局配置
|
||||
```bash
|
||||
sudo vim /etc/login.defs
|
||||
```
|
||||
修改以下值：
|
||||
```ini
|
||||
PASS_MAX_DAYS 90 # 密码90天后过期
|
||||
PASS_MIN_DAYS 7 # 修改密码后至少7天才能再改
|
||||
PASS_WARN_AGE 14 # 过期前14天提醒
|
||||
```
|
||||
|
||||
- **现有用户**：使用 `chage` 命令
|
||||
```bash
|
||||
sudo chage -M 90 -m 7 -W 14 用户名
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. 设置密码复杂度**
|
||||
- 编辑PAM配置文件（Ubuntu为例）：
|
||||
```bash
|
||||
sudo vim /etc/pam.d/common-password
|
||||
```
|
||||
- 修改以下行：
|
||||
```ini
|
||||
password requisite pam_pwquality.so minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
|
||||
```
|
||||
参数说明：
|
||||
- `minlen=12`：密码至少12位
|
||||
- `ucredit=-1`：需1个大写字母
|
||||
- `lcredit=-1`：需1个小写字母
|
||||
- `dcredit=-1`：需1个数字
|
||||
- `ocredit=-1`：需1个特殊符号
|
||||
|
||||
---
|
||||
|
||||
### **3. 禁止重复使用旧密码**
|
||||
在PAM配置文件中添加：
|
||||
```ini
|
||||
password required pam_unix.so remember=5 # 禁止使用最近5次用过的密码
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. 强制用户立即修改密码**
|
||||
```bash
|
||||
sudo chage -d 0 用户名 # 用户下次登录时必须改密码
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **5. 验证配置**
|
||||
```bash
|
||||
sudo chage -l 用户名 # 查看用户的密码策略
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **总结**
|
||||
1. 修改 `/etc/login.defs` 设置全局策略
|
||||
2. 用 `chage` 调整现有用户
|
||||
3. 通过PAM配置密码复杂度和历史
|
||||
4. 强制关键用户立即更新密码
|
||||
|
||||
完成后，用户密码会定期过期并满足复杂度要求。
|
||||
@@ -0,0 +1,5 @@
|
||||
|
||||
|
||||
program note:
|
||||
springboot version: 1.5.17.RELEASE
|
||||
|
||||
@@ -0,0 +1,202 @@
|
||||
|
||||
|
||||
## Server
|
||||
|
||||
| server name | ip address | components |
|
||||
| ----------------------- | -------------- | ------------------- |
|
||||
| hz015.int.it2000.com.cn | 10.100.100.181 | docker swarm leader |
|
||||
| hz016.int.it2000.com.cn | 10.100.100.182 | docker swarm worker |
|
||||
| hz018.int.it2000.com.cn | 10.100.100.184 | database |
|
||||
|
||||
|
||||
## Component
|
||||
- 基础设施
|
||||
- 数据库
|
||||
- oracle
|
||||
- mysql
|
||||
- redis
|
||||
- elastic search
|
||||
- 消息服务
|
||||
- apache zookeeper
|
||||
- apache kafka
|
||||
- 应用程序注册
|
||||
- eureka
|
||||
- 网关
|
||||
- spring cloud
|
||||
- 监控服务
|
||||
- 日志集中
|
||||
- logstash
|
||||
- grafana
|
||||
- promethues
|
||||
- 管理工具
|
||||
- portainer
|
||||
- kafka
|
||||
- 应用程序
|
||||
- adminapi - 管理接口
|
||||
- kafkawsproxyapi - kafka消息websocket代理
|
||||
- msgexchangeapi - 消息处理
|
||||
- servicecenter - eureka消息注册
|
||||
- sysapi
|
||||
|
||||
## Deployment
|
||||
|
||||
### App Stack
|
||||
[local git](https://gitea.int.it2000.com.cn/cdia/app-stack)
|
||||
|
||||
- adminapi （管理程序）
|
||||
2 个数据库配置，一个mysql, 一个oracle
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
jpa:
|
||||
show-sql: true
|
||||
datasource:
|
||||
primary:
|
||||
username: root
|
||||
password: admingzzn
|
||||
url: >-
|
||||
jdbc:mysql://hz018.int.it2000.com.cn:3306/cdairport?useSSL=false&useUnicode=true&characterEncoding=utf-8&allowMultiQueries=true&autoReconnect=true
|
||||
max-active: 30
|
||||
test-on-borrow: true
|
||||
validation-query: SELECT 1
|
||||
initialSize: 5
|
||||
min-idle: 1
|
||||
max-wait: 60000
|
||||
time-between-eviction-runs-millis: 60000
|
||||
min-evictable-idle-time-millis: 300000
|
||||
test-while-idle: true
|
||||
test-on-return: true
|
||||
pool-prepared-statements: false
|
||||
max-pool-prepared-statement-per-connection-size: 20
|
||||
secondary:
|
||||
username: omms
|
||||
password: omms
|
||||
url: 'jdbc:oracle:thin:@hz018.int.it2000.com.cn:1521/orcl'
|
||||
driver: oracle.jdbc.driver.OracleDriver
|
||||
max-active: 30
|
||||
test-on-borrow: true
|
||||
validation-query: SELECT 1 FROM dual
|
||||
initial-size: 10
|
||||
min-idle: 1
|
||||
max-wait: 60000
|
||||
time-between-eviction-runs-millis: 60000
|
||||
min-evictable-idle-time-millis: 300000
|
||||
test-while-idle: true
|
||||
test-on-return: true
|
||||
pool-prepared-statements: false
|
||||
max-pool-prepared-statement-per-connection-size: 20
|
||||
eureka:
|
||||
client:
|
||||
service-url:
|
||||
defaultZone: 'http://hz015.int.it2000.com.cn:94/eureka/'
|
||||
instance:
|
||||
prefer-ip-address: false
|
||||
hostName: adminapi
|
||||
sysApi:
|
||||
host: hz015.int.it2000.com.cn
|
||||
port: 80
|
||||
schema: http
|
||||
baseUrl: '${sysApi.schema}://SYSAPI'
|
||||
getOpLogSwitchByLevleAndNameUrl: '${sysApi.baseUrl}/oplog/getOpLogSwitch/{level}/{name}'
|
||||
logstash:
|
||||
host: 'hz015.int.it2000.com.cn:5000'
|
||||
elasticsearch:
|
||||
ip: hz016.int.it2000.com.cn
|
||||
port: 9300
|
||||
pool: 5
|
||||
cluster:
|
||||
name: docker-cluster
|
||||
nodes: 'hz016.int.it2000.com.cn:9300'
|
||||
maxSize: 10000
|
||||
|
||||
```
|
||||
|
||||
gatewayapi （api gateway）
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
application:
|
||||
name: gatewayapi
|
||||
redis:
|
||||
cluster:
|
||||
nodes:
|
||||
- 'hz018.int.it2000.com.cn:7000'
|
||||
- 'hz018.int.it2000.com.cn:7001'
|
||||
- 'hz018.int.it2000.com.cn:7002'
|
||||
- 'hz018.int.it2000.com.cn:7003'
|
||||
- 'hz018.int.it2000.com.cn:7004'
|
||||
- 'hz018.int.it2000.com.cn:7005'
|
||||
pool:
|
||||
max-idle: 10
|
||||
min-idle: 0
|
||||
max-active: 200
|
||||
max-wait: -1
|
||||
timeout: 1000
|
||||
cloud:
|
||||
gateway:
|
||||
default-filters:
|
||||
- PermissionCheckFilter
|
||||
routes:
|
||||
- id: host_adminapi
|
||||
uri: 'lb://ADMINAPI'
|
||||
predicates:
|
||||
- Path=/adminapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_sysapi
|
||||
uri: 'lb://SYSAPI'
|
||||
predicates:
|
||||
- Path=/sysapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_msgexchangeapi
|
||||
uri: 'lb://MSGEXCHANGEAPI'
|
||||
predicates:
|
||||
- Path=/msgexchangeapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_kafkawsproxyapi
|
||||
uri: 'lb://KAFKAWSPROXYAPI'
|
||||
predicates:
|
||||
- Path=/v2/broker
|
||||
- id: host_adminweb
|
||||
uri: 'http://10.100.100.181:96'
|
||||
predicates:
|
||||
- Path=/adminweb/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_redirect
|
||||
uri: 'http://10.100.100.181/adminweb/'
|
||||
predicates:
|
||||
- Path=/
|
||||
filters:
|
||||
- 'RedirectTo=302, http://10.100.100.181/adminweb/'
|
||||
gateway:
|
||||
loginUrl: '/adminweb/#/login'
|
||||
sysApi:
|
||||
schema: http
|
||||
baseUrl: '${sysApi.schema}://SYSAPI'
|
||||
getUserByLoginName: '${sysApi.baseUrl}/setting/user/detail/{loginName}'
|
||||
publicurlsServiceUrl: '${sysApi.baseUrl}/setting/permission/publicurls'
|
||||
privateurlsServiceUrl: '${sysApi.baseUrl}/setting/permission/privateurls/{uid}'
|
||||
getOpLogSwitchByLevleAndNameUrl: '${sysApi.baseUrl}/oplog/getOpLogSwitch/{level}/{name}'
|
||||
eureka:
|
||||
client:
|
||||
service-url:
|
||||
defaultZone: 'http://hz015.int.it2000.com.cn:94/eureka/'
|
||||
instance:
|
||||
prefer-ip-address: false
|
||||
hostName: gatewayapi
|
||||
logstash:
|
||||
host: 'hz015.int.it2000.com.cn:5000'
|
||||
elasticsearch:
|
||||
ip: hz016.int.it2000.com.cn
|
||||
port: 9300
|
||||
pool: 5
|
||||
password: changeme
|
||||
username: elastic
|
||||
cluster:
|
||||
name: docker-cluster
|
||||
nodes: 'hz016.int.it2000.com.cn:9300'
|
||||
|
||||
```
|
||||
@@ -0,0 +1,10 @@
|
||||
|
||||
|
||||
## 基础设施
|
||||
* 日志服务
|
||||
* 使用graylog 代替elk
|
||||
hz011.int.it2000.com.cn
|
||||
130.120.3.128
|
||||
http://hz011.int.it2000.com.cn:9000
|
||||
admin/admingzzn
|
||||
|
||||
Executable
+22
@@ -0,0 +1,22 @@
|
||||
|
||||
主机名：xjc-app
|
||||
账号：devman
|
||||
登录方式：密钥id_devman
|
||||
账号密码：Ipower2024
|
||||
IP：10.100.101.186（动态IP）
|
||||
|
||||
```id_devman
|
||||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
||||
QyNTUxOQAAACBIahgzOtvIiFs9sYakfuvDBVDyWTOpJ2mFJ9UHKTWPOwAAAJCr8Cxoq/As
|
||||
aAAAAAtzc2gtZWQyNTUxOQAAACBIahgzOtvIiFs9sYakfuvDBVDyWTOpJ2mFJ9UHKTWPOw
|
||||
AAAEBBdD+wjI107ItWAvtejiFNF9fpXXn4kj9PKyzEguRwEkhqGDM628iIWz2xhqR+68MF
|
||||
UPJZM6knaYUn1QcpNY87AAAAC2Rldm1hbkBnenpuAQI=
|
||||
-----END OPENSSH PRIVATE KEY-----
|
||||
```
|
||||
|
||||
```
|
||||
Host xjc-app
|
||||
User devman
|
||||
IdentityFile ~/.ssh/id_devman
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
+584
@@ -0,0 +1,584 @@
|
||||
|
||||
|
||||
# 技术选型
|
||||
### 串口数据接收
|
||||
1. 串口模拟器
|
||||
1. socat
|
||||
1. **Create Virtual Serial Port Pair** Use `socat` to create two linked virtual serial ports. This example creates two virtual serial ports: `/dev/ttyV0` and `/dev/ttyV1`.
|
||||
```bash
|
||||
socat -d -d PTY,link=./dev/ttyV0,raw,echo=0 PTY,link=./dev/ttyV1,raw,echo=0
|
||||
```
|
||||
**Explanation:**
|
||||
- `-d -d`: Enables debug output to see the details of the operations.
|
||||
- `PTY,link=/dev/ttyV0,raw,echo=0`: Creates a pseudo-terminal (PTY) with a symbolic link `/dev/ttyV0`, in raw mode with no echo.
|
||||
- `PTY,link=/dev/ttyV1,raw,echo=0`: Creates another PTY with a symbolic link `/dev/ttyV1`, in raw mode with no echo.
|
||||
-
|
||||
```bash
|
||||
screen ./dev/ttyV0 9600
|
||||
|
||||
echo "hello" > ./dev/ttyV1
|
||||
```
|
||||
### 消息队列
|
||||
nats-server
|
||||
|
||||
|
||||
# 架构设计
|
||||
|
||||
micrioprofile
|
||||
openliberty
|
||||
|
||||
|
||||
micronaut
|
||||
|
||||
|
||||
1. 串口读取
|
||||
2. 报文拆分
|
||||
3. 动态解析
|
||||
4. 计划解析
|
||||
5. 总线消息生成
|
||||
6. 动态信息转发
|
||||
7. 计划转发
|
||||
|
||||
串口 => 消息流原始 => 已分离电报消息 => 待发送 => 消息总线
|
||||
|
||||
### 系统总线适配
|
||||
日计划处理
|
||||
季度计划处理
|
||||
航班主要信息同步
|
||||
动态消息转发
|
||||
### 串口转消息队列
|
||||
命令行工具
|
||||
1. 串口参数
|
||||
2. 消息队列参数
|
||||
|
||||
### 电报存储
|
||||
postgresql
|
||||
pocketbase
|
||||
|
||||
nats
|
||||
nui
|
||||
pocketbase
|
||||
meilisearch
|
||||
|
||||
compose.yml
|
||||
```yaml
|
||||
services:
|
||||
nats:
|
||||
container_name: nats
|
||||
image: nats
|
||||
ports:
|
||||
- "4222:4222"
|
||||
- "6222:6222"
|
||||
- "8222:8222"
|
||||
restart: unless-stopped
|
||||
|
||||
nui:
|
||||
container_name: nui
|
||||
image: ghcr.io/nats-nui/nui
|
||||
volumes:
|
||||
- ./db:/db
|
||||
- ./creds:/nats-creds:ro
|
||||
ports:
|
||||
- "31311:31311"
|
||||
restart: unless-stopped
|
||||
|
||||
pocketbase:
|
||||
image: ghcr.io/muchobien/pocketbase:latest
|
||||
container_name: pocketbase
|
||||
restart: unless-stopped
|
||||
command:
|
||||
#- --encryptionEnv #optional
|
||||
#- ENCRYPTION #optional
|
||||
environment:
|
||||
ENCRYPTION: example #optional
|
||||
ports:
|
||||
- "8090:8090"
|
||||
volumes:
|
||||
- ./data:/pb_data
|
||||
- ./public:/pb_public #optional
|
||||
- ./hooks:/pb_hooks #optional
|
||||
|
||||
healthcheck: #optional (recommended) since v0.10.0
|
||||
test: wget --no-verbose --tries=1 --spider http://localhost:8090/api/health || exit 1
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
meilisearch:
|
||||
container_name: meilisearch
|
||||
image: getmeili/meilisearch:v1.8
|
||||
environment:
|
||||
- http_proxy
|
||||
- https_proxy
|
||||
- MEILI_MASTER_KEY=${MEILI_MASTER_KEY:-masterKey}
|
||||
- MEILI_NO_ANALYTICS=${MEILI_NO_ANALYTICS:-true}
|
||||
- MEILI_ENV=${MEILI_ENV:-development}
|
||||
ports:
|
||||
- ${MEILI_PORT:-7700}:7700
|
||||
volumes:
|
||||
- ./meili_data:/meili_data
|
||||
restart: unless-stopped
|
||||
```
|
||||
|
||||
|
||||
nat with monitor:
|
||||
```docker-compose.yml
|
||||
networks:
|
||||
monitor-net:
|
||||
driver: bridge
|
||||
|
||||
services:
|
||||
nats:
|
||||
image: nats
|
||||
container_name: nats
|
||||
restart: always
|
||||
command: -c /etc/nats/nats.conf
|
||||
ports:
|
||||
- "4222:4222" # client port
|
||||
- "6222:6222" # cluster port
|
||||
- "8222:8222" # monitoring port
|
||||
volumes:
|
||||
- ./nats.conf:/etc/nats/nats.conf
|
||||
- $JETSTREAM_STORAGE:/data
|
||||
networks:
|
||||
- monitor-net
|
||||
|
||||
exporter:
|
||||
image: natsio/prometheus-nats-exporter
|
||||
container_name: nats-exporter
|
||||
restart: always
|
||||
command:
|
||||
# see https://github.com/nats-io/prometheus-nats-exporter/blob/main/main.go#L87
|
||||
# "-connz", # connection metrics
|
||||
- -connz_detailed # advanced connection metrics
|
||||
- -jsz
|
||||
- all # jetstream metrics
|
||||
- -routez # route metrics
|
||||
- -subz # subscription metrics
|
||||
- -varz # general metrics
|
||||
- -prefix=nats # prefix for all metrics
|
||||
- -use_internal_server_id # using serverID from /varz
|
||||
- http://nats:8222/
|
||||
networks:
|
||||
- monitor-net
|
||||
labels:
|
||||
org.label-schema.group: "nats-monitoring"
|
||||
depends_on:
|
||||
- nats
|
||||
|
||||
# ports:
|
||||
# - "7777:7777"
|
||||
|
||||
surveyor:
|
||||
image: natsio/nats-surveyor
|
||||
container_name: nats-surveyor
|
||||
restart: always
|
||||
volumes:
|
||||
- ./observations:/observations
|
||||
- $JETSTREAM_STORAGE:/data
|
||||
command: |
|
||||
-s "${NATS_SURVEYOR_SERVERS}" --accounts --observe /observations --jetstream /data
|
||||
networks:
|
||||
- monitor-net
|
||||
labels:
|
||||
org.label-schema.group: "nats-monitoring"
|
||||
depends_on:
|
||||
- nats
|
||||
|
||||
prometheus:
|
||||
image: prom/prometheus
|
||||
container_name: prometheus
|
||||
restart: always
|
||||
volumes:
|
||||
- ./prometheus/:/etc/prometheus/
|
||||
- $PROMETHEUS_STORAGE:/usr/local/share/prometheus
|
||||
command: --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/usr/local/share/prometheus
|
||||
networks:
|
||||
- monitor-net
|
||||
labels:
|
||||
org.label-schema.group: "nats-monitoring"
|
||||
ports:
|
||||
- "9090:9090"
|
||||
depends_on:
|
||||
- surveyor
|
||||
- exporter
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana
|
||||
container_name: grafana
|
||||
restart: always
|
||||
ports:
|
||||
- "3000:3000"
|
||||
volumes:
|
||||
- ./grafana/dashboards:/var/lib/grafana/dashboards
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
networks:
|
||||
- monitor-net
|
||||
labels:
|
||||
org.label-schema.group: "nats-monitoring"
|
||||
depends_on:
|
||||
- prometheus
|
||||
```
|
||||
|
||||
```dash
|
||||
```
|
||||
|
||||
### 电报解析，电报存储，电报转发
|
||||
管理界面接口
|
||||
|
||||
### 管理界面
|
||||
电报界面
|
||||
日计划界面
|
||||
全文检索
|
||||
typesense
|
||||
meli
|
||||
|
||||
nextjs shadcn
|
||||
svelte
|
||||
shadcn
|
||||
melt-ui: https://melt-ui.com
|
||||
flowbite: [Flowbite Svelte](https://flowbite-svelte.com/)
|
||||
|
||||
htmx:
|
||||
go:
|
||||
chi htmx tailwindcss
|
||||
echo htmx tailwindcss
|
||||
python:
|
||||
|
||||
deno:
|
||||
fresh
|
||||
|
||||
|
||||
Telegram Message Body Expression:
|
||||
|
||||
FPL:
|
||||
```regex
|
||||
|
||||
\((?P<category>[A-Z]{3})-(?P<number>[A-Z]+\d+)-(?P<indicator>[A-Z]{2})\n-(?P<aircraft>[A-Z]+\d+\/?[A-Z]?)\n?-(?P<surve>.*)\n?-(?P<departure>[A-Z]{4})(?P<departure_time>\d{4})\n?-(?P<speed>[A-Z]+\d+)(?P<level>[A-Z0-9]+)\s+(?P<route>(.|\n)+)\n-(?P<destination>[A-Z]{4})(?P<estt>\d{4})\s+(?P<alter>[A-Z]{4})\n?-([A-Z]{3}\/(?:[A-Z]{4}\d{4}\s?)+)?(?P<other>(?m)[A-Z]{3}\/(.|\n)*)\)$
|
||||
|
||||
```
|
||||
|
||||
ARR:
|
||||
```regex
|
||||
|
||||
\\((?P<type>[A-Z]{3})\\-(?P<number>([A-Z]+\\d+))\\/?(?P<ssr>[A-Z]+\\d+)\\-(?P<departure>[A-Z]{4})\\-(?P<arrival>[A-Z]{4})(?P<time>\\d{4})\\)
|
||||
|
||||
```
|
||||
|
||||
DEP:
|
||||
```regex
|
||||
|
||||
^\\((?P<type>[A-Z]{3})\\-(?P<number>([A-Z]+\\d+))\\/?(?P<ssr>[A-Z]+\\d+)\\-(?P<departure>[A-Z]{4})(?P<departure_time>\\d{4})\\-(?P<destination>[A-Z]{4})(?P<destination_time>\\d{4})?\\-?(?P<alter>[A-Z]{4})?\\-?(?P<other>.*)?\\)$
|
||||
```
|
||||
|
||||
NEW FPL:
|
||||
```regex
|
||||
\((?P<category>[A-Z]{3})-(?P<number>[A-Z]+\d+)-(?P<indicator>[A-Z]{2})\n-(?P<aircraft>[A-Z]+\d+\/?[A-Z]?)\n?-(?P<surve>.*)\n?-(?P<departure>[A-Z]{4})(?P<departure_time>\d{4})\n?-(?P<speed>[A-Z]+\d+)(?P<level>[A-Z0-9]+)\s+(?P<route>(.|\n)+)\n-(?P<destination>[A-Z]{4})(?P<estt>\d{4})\s?(?P<alter>(\s[A-Z]{4})+)\n?-([A-Z]{3}\/(?:[A-Z]{4}\d{4}\s?)+)?(?P<other>(?m)[A-Z]{3}\/(.|\n)*)\)$
|
||||
```
|
||||
|
||||
CNL:
|
||||
```regex
|
||||
^\((?P<category>[A-Z]{3})-(?P<number>\w+\d+)-?(?P<departure>[A-Z]{4})?-?(?<destination>[A-Z]{4})\)$
|
||||
```
|
||||
|
||||
DLA:
|
||||
```regex
|
||||
^\((?P<category>[A-Z]{3})-(?P<number>\w+\d+)-?(?P<departure>[A-Z]{4})(?P<departure_time>\d{4})?-?(?<destination>[A-Z]{4})(?<destination_time>\d{4})?\)$
|
||||
```
|
||||
|
||||
|
||||
|
||||
```CA
|
||||
ZCZC TMQ1067 150518
|
||||
|
||||
|
||||
QU TSNZPCA
|
||||
|
||||
.
|
||||
|
||||
QU SZXZPCA TAOZPCA WNZZPCA SHATZCR PEKZPCA WUHZPCA TSNZPCA
|
||||
|
||||
.TNAUOSC 150519
|
||||
|
||||
PLN 16MAY
|
||||
|
||||
01) SC4731/4732/4667/4668 B2968/B733 ILS I (7) TAO/2340 WNZ/0225
|
||||
|
||||
SZX/
|
||||
|
||||
0500 WNZ/0725 TAO/1000 SHA/1210
|
||||
|
||||
SI:AWY/TAO WNZ SZX WNZ TAO SHA TAO
|
||||
|
||||
02) SC4617/4618/4655/4656/4087/4088/4669/4670 B2996/B733 ILS I (8)
|
||||
|
||||
TA
|
||||
|
||||
O/0030 WUH/0255 TAO/0520 PEK/0730 TAO/0945 ICN/1155 TAO/1350
|
||||
|
||||
SHA/1550
|
||||
|
||||
SI:AWY/TAO WUH TAO PEK TAO ICN TAO SHA TAO
|
||||
|
||||
03) SC4621/4622/4733/4734 B3005/CRJ2 ILS I (5) TAO/0005 DLC/0130
|
||||
|
||||
TAO/
|
||||
|
||||
0300 XIY/0545 KWE/0745 XIY/0950
|
||||
|
||||
SI:AWY/TAO DLC TAO XIY KWE XIY TAO
|
||||
|
||||
04) SC4607/4608/4623/4880/4879/4624 B3007/CRJ2 ILS I (5) TAO/2355
|
||||
|
||||
TY
|
||||
|
||||
N/0150 ZGC/0350 TYN/0545 TAO/0745 DLC/0900 YNT/1015 HGH/1225
|
||||
|
||||
YNT/1435 DLC
|
||||
|
||||
/1550
|
||||
|
||||
SI:AWY/TAO TYN ZGC TYN TAO DLC YNT HGH YNT DLC TAO
|
||||
|
||||
05) SC4679/4680/4711/4712 B3079/CRJ7 ILS I (5) TAO/0001 HGH/0210
|
||||
|
||||
FOC/
|
||||
|
||||
0350 HGH/0530 TAO/0735 HGH/0940 NNG/1255 HGH/1525
|
||||
|
||||
SI:AWY/TAO HGH FOC HGH TAO HGH NNG HGH TAO
|
||||
|
||||
06) SC4717/4817/4818/4718 B3080/CRJ7 ILS I (5) TAO/0005 TSN/0135
|
||||
|
||||
HET/
|
||||
|
||||
0320 TGO/0535 HET/0750 TSN/0930
|
||||
|
||||
SI:AWY/TAO TSN HET TGO HET TSN TAO
|
||||
|
||||
07) SC4709/4981/4982 B5065/B733 ILS I (7) TAO/2355 NGB/0155
|
||||
|
||||
XMN/0430
|
||||
|
||||
TNA/0725 HET/0950 TNA/1200
|
||||
|
||||
SI:AWY/TAO NGB XMN TNA HET TNA XMN
|
||||
|
||||
08) SC4651/1152/1155/1156/1165/1166/1167/1168 B5205/B737 ILS I (7)
|
||||
|
||||
TA
|
||||
|
||||
O/2340 PEK/0140 TNA/0320 PEK/0510 TNA/0715 SHA/0925 TNA/1135
|
||||
|
||||
SHA/1340
|
||||
|
||||
SI:AWY/TAO PEK TNA PEK TNA SHA TNA SHA TNA
|
||||
|
||||
09) SC4695/4696/4657/4658 B5331/B738 ILS I (8) TAO/2350 NKG/0145
|
||||
|
||||
KMG/
|
||||
|
||||
0505 NKG/0830 TAO/1045 PEK/1300
|
||||
|
||||
SI:AWY/TAO NKG KMG NKG TAO PEK TAO
|
||||
|
||||
10) SC4601/4602/4675/4672 B5348/B738 ILS I (10) TAO/2330 TNA/0055
|
||||
|
||||
CTU
|
||||
|
||||
/0405 TNA/0645 TAO/0830 CAN/1225 LYI/1515
|
||||
|
||||
SI:AWY/TAO TNA CTU TNA TAO CAN LYI TAO
|
||||
|
||||
11) SC4705/4706/4751/4752 B5349/B738 ILS I (8) TAO/2340 HFE/0135
|
||||
|
||||
HHA/
|
||||
|
||||
0335 HFE/0530 TAO/0720 CGO/0930 KWL/1210 CGO/1440
|
||||
|
||||
SI:AWY/TAO HFE HHA HFE TAO CGO KWL CGO TAO
|
||||
|
||||
12) SC4671/4676/4665/4666/4659/4660 B5350/B738 ILS I (8) TAO/2350
|
||||
|
||||
LYI
|
||||
|
||||
/0105 CAN/0415 TAO/0745 SHA/0950 TAO/1155 PEK/1400
|
||||
|
||||
SI:AWY/TAO LYI CAN TAO SHA TAO
|
||||
|
||||
PART ONE CONTINUED
|
||||
|
||||
=
|
||||
|
||||
|
||||
|
||||
|
||||
NNNN
|
||||
|
||||
```
|
||||
|
||||
|
||||
```fpl
|
||||
ZCZC TMQ2544 141652
|
||||
|
||||
|
||||
FF ZBTJZXZX
|
||||
|
||||
|
||||
141652 ZBTJZPZX
|
||||
|
||||
|
||||
(FPL-JAE7433-IS
|
||||
|
||||
|
||||
-B744/H-SXIRPZJWY/S
|
||||
|
||||
|
||||
-ZBTJ1755
|
||||
|
||||
|
||||
-K0926S0920
|
||||
|
||||
|
||||
-EDDF0948 EDDK
|
||||
|
||||
|
||||
-EET/ZMUB0100 UNKL0236 UNWW0332 UNNT0332 USRR0447 USHH0507
|
||||
|
||||
|
||||
USSS0535 UUYY0602 ULKK0634 ULWW0653 ULLL0720 EETT0748 EVRR0815
|
||||
|
||||
|
||||
ESAA0821 EPWW0848 EDUU0900
|
||||
|
||||
|
||||
REG/B2422 SEL/JLAD OPR/JADE CARGO DAT/S RVR/200
|
||||
|
||||
|
||||
NAV/RNAV1 RNAV5 RNP4
|
||||
|
||||
|
||||
RMK/AGCS EQUIPPED
|
||||
|
||||
|
||||
ACARS EQUIPPED/TCAS EQUIPPED/FOREIGN PILOT
|
||||
|
||||
|
||||
E/1148 P/TBN R/UV S/M J/LF D/1 15 C YELLOW
|
||||
|
||||
|
||||
A/WHITE GREEN)
|
||||
|
||||
NNNN
|
||||
|
||||
```
|
||||
|
||||
|
||||
计划：
|
||||
|
||||
airway：
|
||||
```regex
|
||||
(?P<arr_time>\d{4}(\(\d{2}\w{3}\))?)(?P<airport>\w{3})\/?(?P<dep_time>\d{4}(\(\d{2}\w{3}\))?)
|
||||
```
|
||||
|
||||
|
||||
## Store
|
||||
|
||||
nats:
|
||||
serial to nats
|
||||
```yaml
|
||||
services:
|
||||
nats:
|
||||
container_name: nats
|
||||
image: nats
|
||||
ports:
|
||||
- "4222:4222"
|
||||
- "6222:6222"
|
||||
- "8222:8222"
|
||||
restart: unless-stopped
|
||||
|
||||
nui:
|
||||
container_name: nui
|
||||
image: ghcr.io/nats-nui/nui
|
||||
volumes:
|
||||
- ./db:/db
|
||||
- ./creds:/nats-creds:ro
|
||||
ports:
|
||||
- "31311:31311"
|
||||
restart: unless-stopped
|
||||
```
|
||||
|
||||
|
||||
|
||||
python:
|
||||
```
|
||||
|
||||
f:\D\DEV\lang\python3.13\python.exe -m site
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
nats browser websocket client
|
||||
|
||||
```html
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<title>NATS WebSocket Example</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>NATS WebSocket Example</h1>
|
||||
|
||||
<!-- A button to send a message -->
|
||||
<button id="sendMessageBtn">Send Message</button>
|
||||
|
||||
<!-- An area to display received messages -->
|
||||
<pre id="messages"></pre>
|
||||
|
||||
<!-- Use a JavaScript module to import the NATS WebSocket client -->
|
||||
<script type="module">
|
||||
// Import the NATS WebSocket client from a CDN (Skypack is used as an example)
|
||||
import { connect, StringCodec } from "https://cdn.skypack.dev/nats.ws";
|
||||
|
||||
// A simple string codec for encoding/decoding message data
|
||||
const sc = StringCodec();
|
||||
|
||||
async function runNATS() {
|
||||
try {
|
||||
// Connect to the NATS WebSocket server (adjust URL as needed)
|
||||
const nc = await connect({ servers: "ws://fzq-pc:7070" });
|
||||
|
||||
// Subscribe to a subject (e.g., "mySubject") to receive messages
|
||||
const sub = nc.subscribe("Telegram.Serial");
|
||||
(async () => {
|
||||
for await (const msg of sub) {
|
||||
const messageText = sc.decode(msg.data);
|
||||
document.getElementById("messages").textContent +=
|
||||
`\nReceived: ${messageText}`;
|
||||
}
|
||||
})().then(() => {
|
||||
console.log("Subscription closed");
|
||||
});
|
||||
|
||||
// Bind our "Send Message" button to publish messages
|
||||
document
|
||||
.getElementById("sendMessageBtn")
|
||||
.addEventListener("click", () => {
|
||||
const payload = "Hello from the browser!";
|
||||
nc.publish("mySubject", sc.encode(payload));
|
||||
document.getElementById("messages").textContent +=
|
||||
`\nSent: ${payload}`;
|
||||
});
|
||||
} catch (err) {
|
||||
console.error("Error connecting to NATS:", err);
|
||||
}
|
||||
}
|
||||
|
||||
// Start the NATS connection on page load
|
||||
runNATS();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
```
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
|
||||
|
||||
|
||||
| 电报组成 |
|
||||
| ------ |
|
||||
| （脉冲信号） |
|
||||
| 报头 |
|
||||
| 收报地址 |
|
||||
| 发报地址 |
|
||||
| 报文内容 |
|
||||
| 报尾 |
|
||||
|
||||
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
|
||||
install
|
||||
```yaml
|
||||
services:
|
||||
meilisearch:
|
||||
container_name: meilisearch
|
||||
image: getmeili/meilisearch:v1.8
|
||||
environment:
|
||||
- MEILI_MASTER_KEY=${MEILI_MASTER_KEY:-W8mBr4_a5CfQgk9tbAHbGz1YF71t7_GT7fD1hp7prOY}
|
||||
ports:
|
||||
- ${MEILI_PORT:-7700}:7700
|
||||
networks:
|
||||
- meilisearch
|
||||
volumes:
|
||||
- ./meili_data:/meili_data
|
||||
restart: unless-stopped
|
||||
|
||||
networks:
|
||||
meilisearch:
|
||||
driver: bridge
|
||||
```
|
||||
|
||||
master key:
|
||||
```text
|
||||
W8mBr4_a5CfQgk9tbAHbGz1YF71t7_GT7fD1hp7prOY
|
||||
```
|
||||
|
||||
```bash
|
||||
curl \
|
||||
-X POST 'http://localhost:7700/indexes/movies/documents?primaryKey=id' \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H 'Authorization: Bearer W8mBr4_a5CfQgk9tbAHbGz1YF71t7_GT7fD1hp7prOY' \
|
||||
--data-binary @movies.json
|
||||
```
|
||||
|
||||
```bash
|
||||
http POST \
|
||||
'http://localhost:7700/indexes/movies/documents?primaryKey=id' \
|
||||
Content-Type: application/json
|
||||
-A W8mBr4_a5CfQgk9tbAHbGz1YF71t7_GT7fD1hp7prOY < movies.json
|
||||
```
|
||||
@@ -0,0 +1,213 @@
|
||||
|
||||
|
||||
# Implementing XML Response Formatting in Micronaut Applications
|
||||
|
||||
Micronaut provides robust support for XML response formatting through the Jackson XML module. This report outlines how to configure your Micronaut application to return data classes formatted as XML responses.
|
||||
|
||||
## Adding Required Dependencies
|
||||
|
||||
The first step in enabling XML response formatting is adding the necessary dependency to your project. The Jackson XML support for Micronaut allows for seamless serialization and deserialization of XML for both client and server sides.
|
||||
|
||||
### Maven Configuration
|
||||
|
||||
```xml
|
||||
|
||||
io.micronaut.xml
|
||||
micronaut-jackson-xml
|
||||
|
||||
```
|
||||
|
||||
This dependency adds the Jackson XML module to your project, enabling XML conversion capabilities[1][2][5]. Once added, Micronaut will automatically create the beans necessary for XML serialization and deserialization.
|
||||
|
||||
### Gradle Configuration
|
||||
|
||||
```
|
||||
implementation("io.micronaut.xml:micronaut-jackson-xml")
|
||||
```
|
||||
|
||||
## Creating XML-Compatible Data Classes
|
||||
|
||||
After adding the dependency, you need to create data classes properly annotated for XML serialization.
|
||||
|
||||
### Java Implementation
|
||||
|
||||
```java
|
||||
package com.example;
|
||||
|
||||
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
|
||||
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
|
||||
import io.micronaut.core.annotation.Introspected;
|
||||
|
||||
@Introspected
|
||||
@JacksonXmlRootElement(localName = "person")
|
||||
public class Person {
|
||||
@JacksonXmlProperty(isAttribute = true)
|
||||
private int id;
|
||||
|
||||
@JacksonXmlProperty(localName = "fullName")
|
||||
private String name;
|
||||
|
||||
@JacksonXmlProperty
|
||||
private int age;
|
||||
|
||||
// Constructors, getters, and setters
|
||||
}
|
||||
```
|
||||
|
||||
The `@JacksonXmlRootElement` annotation defines the root element name in the XML output, while `@JacksonXmlProperty` customizes how each field is serialized[2]. The `isAttribute = true` parameter converts a field to an XML attribute rather than a nested element.
|
||||
|
||||
### Kotlin Implementation
|
||||
|
||||
```kotlin
|
||||
package com.example
|
||||
|
||||
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement
|
||||
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty
|
||||
import io.micronaut.core.annotation.Introspected
|
||||
|
||||
@Introspected
|
||||
@JacksonXmlRootElement(localName = "person")
|
||||
data class Person(
|
||||
@field:JacksonXmlProperty(isAttribute = true)
|
||||
val id: Int,
|
||||
|
||||
@field:JacksonXmlProperty(localName = "fullName")
|
||||
val name: String,
|
||||
|
||||
@field:JacksonXmlProperty
|
||||
val age: Int
|
||||
)
|
||||
```
|
||||
|
||||
The `@field:` prefix is important in Kotlin to apply the annotation to the underlying field rather than the property accessor[1].
|
||||
|
||||
## Implementing Controllers for XML Responses
|
||||
|
||||
There are several approaches to returning XML from your controllers:
|
||||
|
||||
### Method 1: Content Negotiation Using @Produces
|
||||
|
||||
The simplest approach is to use Micronaut's content negotiation by specifying that your endpoint can produce XML:
|
||||
|
||||
```java
|
||||
import io.micronaut.http.MediaType;
|
||||
import io.micronaut.http.annotation.Controller;
|
||||
import io.micronaut.http.annotation.Get;
|
||||
import io.micronaut.http.annotation.Produces;
|
||||
|
||||
@Controller("/api")
|
||||
public class PersonController {
|
||||
|
||||
@Get("/person/{id}")
|
||||
@Produces({MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON})
|
||||
public Person getPerson(Long id) {
|
||||
return new Person(id, "John Doe", 30);
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
By including `MediaType.APPLICATION_XML` in the `@Produces` annotation, Micronaut will automatically convert the returned object to XML if the client's request includes an Accept header of `application/xml`[7].
|
||||
|
||||
### Method 2: Manual Content Type Selection
|
||||
|
||||
You can also manually check the Accept header and determine the response format:
|
||||
|
||||
```java
|
||||
import io.micronaut.http.HttpHeaders;
|
||||
import io.micronaut.http.HttpResponse;
|
||||
import io.micronaut.http.MediaType;
|
||||
import io.micronaut.http.annotation.Controller;
|
||||
import io.micronaut.http.annotation.Get;
|
||||
|
||||
@Controller("/api")
|
||||
public class PersonController {
|
||||
|
||||
@Get("/person/{id}")
|
||||
public HttpResponse getPerson(Long id, HttpHeaders headers) {
|
||||
Person person = new Person(id, "John Doe", 30);
|
||||
|
||||
if (headers.accept().contains(MediaType.APPLICATION_XML_TYPE)) {
|
||||
return HttpResponse.ok(person)
|
||||
.contentType(MediaType.APPLICATION_XML_TYPE);
|
||||
}
|
||||
|
||||
return HttpResponse.ok(person);
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
This approach gives you more control over the response format based on the request headers[4].
|
||||
|
||||
## Handling Nested Objects
|
||||
|
||||
When working with nested objects, ensure all classes are properly annotated and instantiated:
|
||||
|
||||
```java
|
||||
@Introspected
|
||||
@JacksonXmlRootElement(localName = "settings")
|
||||
public class Settings {
|
||||
private SettingsBlock settingsBlock = new SettingsBlock(); // Initialize nested object
|
||||
private int test1 = 10;
|
||||
private int test2;
|
||||
|
||||
// Getters and setters
|
||||
}
|
||||
|
||||
@Introspected
|
||||
@JacksonXmlRootElement(localName = "settingsBlock")
|
||||
public class SettingsBlock {
|
||||
private Boolean block1 = true;
|
||||
private Boolean block2 = false;
|
||||
|
||||
// Getters and setters
|
||||
}
|
||||
```
|
||||
|
||||
Without proper initialization of nested objects, the XML output won't include their properties[3].
|
||||
|
||||
## Testing XML Responses
|
||||
|
||||
To test that your application correctly returns XML:
|
||||
|
||||
```bash
|
||||
curl -H "Accept: application/xml" http://localhost:8080/api/person/1
|
||||
```
|
||||
|
||||
This should return a response like:
|
||||
|
||||
```xml
|
||||
|
||||
John Doe
|
||||
30
|
||||
|
||||
```
|
||||
|
||||
## Conclusion
|
||||
|
||||
Implementing XML responses in Micronaut is straightforward thanks to the Jackson XML integration. By adding the appropriate dependency, annotating your data classes, and configuring your controllers, you can easily support both JSON and XML formats in your Micronaut applications.
|
||||
|
||||
For applications that need to support multiple response formats, Micronaut's content negotiation provides a clean approach, automatically selecting the appropriate format based on the client's Accept header. This flexibility makes Micronaut an excellent choice for building APIs that need to interact with diverse client requirements.
|
||||
|
||||
Citations:
|
||||
[1] https://micronaut-projects.github.io/micronaut-jackson-xml/latest/guide/
|
||||
[2] https://mkyong.com/micronaut/return-xml-in-a-micronaut-controller/
|
||||
[3] https://stackoverflow.com/questions/75351099/convert-object-to-xml-using-jackson-dataformat-xml-with-default-values/75351212
|
||||
[4] https://dzone.com/articles/micronaut-mastery-return-response-based-on-http-ac
|
||||
[5] https://guides.micronaut.io/latest/micronaut-produces-xml-maven-java.html
|
||||
[6] https://stackoverflow.com/questions/79230827/how-to-convert-xml-response-with-retrofit-to-data-classes
|
||||
[7] https://stackoverflow.com/questions/64698424/micronaut-ignores-content-type-that-a-client-accepts
|
||||
[8] https://stackoverflow.com/questions/75277353/converting-a-data-class-to-a-mappedentity-data-class-in-micronaut-using-kotlin
|
||||
[9] https://github.com/micronaut-projects/micronaut-core/issues/5907
|
||||
[10] https://guides.micronaut.io/latest/micronaut-data-jdbc-repository-maven-kotlin.html
|
||||
[11] https://github.com/apache/jmeter/issues/5980
|
||||
[12] https://micronaut-projects.github.io/micronaut-data/latest/guide/
|
||||
[13] https://stackoverflow.com/questions/79361607/xml-deserialization-in-micronaut-4-x-is-failing-when-same-pojos-work-fine-in-spr
|
||||
[14] https://github.com/micronaut-projects/micronaut-core/issues/10016
|
||||
[15] https://www.baeldung.com/kotlin/csv-files
|
||||
[16] https://guides.micronaut.io/latest/micronaut-java-records-gradle-java.html
|
||||
[17] https://docs.oracle.com/en/engineered-systems/oracle-database-appliance/19.23/cmtrx/faqs-micronaut-oracle-database-appliance.html
|
||||
[18] https://jasondl.ee/2019/micronaut-jpa-jwt-kotlin
|
||||
[19] https://github.com/micronaut-projects/micronaut-core/issues/10895
|
||||
|
||||
---
|
||||
来自 Perplexity 的回答: pplx.ai/share
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
|
||||
|
||||
## Dev
|
||||
|
||||
### Windows COM Simulator
|
||||
|
||||
==
|
||||
|
||||
亲！久等了哦。这就给您发过来了
|
||||
您购买的订单号：4197674126108532620
|
||||
|
||||
链接: https://pan.baidu.com/s/1BkU5_FAVzvAgRw96mBi_gw?pwd=xs2q 提取码: xs2q 复制这段内容后打开百度网盘手机App，操作更方便哦
|
||||
--来自百度网盘超级会员v10的分享
|
||||
记得再来哦~
|
||||
|
||||
==
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
|
||||
export ANT_OPTS="-Dhttp.proxyHost=localhost -Dhttp.proxyPort=8080"
|
||||
@@ -0,0 +1,2 @@
|
||||
|
||||
# 根据路由
|
||||
@@ -0,0 +1,161 @@
|
||||
|
||||
**Summary of the Problem and Solution**
|
||||
|
||||
---
|
||||
|
||||
### **Problem Overview**
|
||||
|
||||
You were attempting to run an Oracle 11g Docker container using the command:
|
||||
|
||||
```bash
|
||||
docker run -idt --name oracle -h oracle --privileged=true -p 1521:1521 -p 2222:22 \
|
||||
lhrbest/oracle_11g_ee_lhr_11.2.0.4:2.0 init
|
||||
```
|
||||
|
||||
- **Issue Experienced:**
|
||||
- The Docker container exited immediately after starting, without any error messages.
|
||||
- The exit code was **139**, indicating a **segmentation fault (SIGSEGV)**.
|
||||
- The issue occurred on a **Debian** system but not on **OpenSUSE**.
|
||||
|
||||
---
|
||||
|
||||
### **Root Cause**
|
||||
|
||||
The segmentation fault was due to the way modern Linux kernels handle **`vsyscall`** (virtual system call):
|
||||
|
||||
- **`vsyscall` Deprecation:**
|
||||
- Modern kernels have deprecated `vsyscall` in favor of **vDSO** (virtual dynamic shared object) for security reasons.
|
||||
- By default, `vsyscall` might be disabled or set to a mode incompatible with older applications.
|
||||
|
||||
- **Impact on Oracle 11g:**
|
||||
- Oracle 11g, being legacy software, relies on the old `vsyscall` mechanism for certain operations.
|
||||
- Without proper `vsyscall` support, Oracle binaries can crash with a segmentation fault.
|
||||
|
||||
- **Difference Between Systems:**
|
||||
- **OpenSUSE** may have `vsyscall` support enabled or set to emulate by default.
|
||||
- **Debian**, especially with newer kernels, has `vsyscall` disabled or set to a mode that doesn't support the required legacy behavior.
|
||||
|
||||
---
|
||||
|
||||
### **Solution**
|
||||
|
||||
**Enable `vsyscall` Emulation on the Debian System:**
|
||||
|
||||
1. **Verify Current `vsyscall` Mapping:**
|
||||
|
||||
```bash
|
||||
sudo grep vsyscall /proc/self/maps
|
||||
```
|
||||
|
||||
- If no output is returned, `vsyscall` is not currently mapped.
|
||||
|
||||
2. **Edit GRUB Configuration:**
|
||||
|
||||
- Open the GRUB configuration file:
|
||||
|
||||
```bash
|
||||
sudo nano /etc/default/grub
|
||||
```
|
||||
|
||||
- Locate the line starting with `GRUB_CMDLINE_LINUX_DEFAULT`.
|
||||
|
||||
- Append `vsyscall=emulate` to the existing parameters within the quotes.
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash vsyscall=emulate"
|
||||
```
|
||||
|
||||
3. **Update GRUB Settings:**
|
||||
|
||||
- Apply the changes by updating GRUB:
|
||||
|
||||
```bash
|
||||
sudo update-grub
|
||||
```
|
||||
|
||||
4. **Reboot the System:**
|
||||
|
||||
- Restart your machine to apply the new kernel parameter:
|
||||
|
||||
```bash
|
||||
sudo reboot
|
||||
```
|
||||
|
||||
5. **Confirm `vsyscall` is Enabled:**
|
||||
|
||||
- After rebooting, check if `vsyscall` is now mapped:
|
||||
|
||||
```bash
|
||||
sudo grep vsyscall /proc/self/maps
|
||||
```
|
||||
|
||||
- You should see an output similar to:
|
||||
|
||||
```
|
||||
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
|
||||
```
|
||||
|
||||
6. **Run the Docker Container Again:**
|
||||
|
||||
- With `vsyscall` emulation enabled, attempt to start the Oracle container:
|
||||
|
||||
```bash
|
||||
docker run -idt --name oracle -h oracle --privileged=true --shm-size=2g \
|
||||
-p 1521:1521 -p 2222:22 lhrbest/oracle_11g_ee_lhr_11.2.0.4:2.0 init
|
||||
```
|
||||
|
||||
- The container should now start successfully without exiting.
|
||||
|
||||
---
|
||||
|
||||
### **Explanation of the Solution**
|
||||
|
||||
- **`vsyscall=emulate` Kernel Parameter:**
|
||||
- Tells the kernel to emulate the old `vsyscall` behavior, allowing legacy applications to function correctly.
|
||||
- Balances compatibility with security, as emulation is safer than direct mapping.
|
||||
|
||||
- **Why It Works:**
|
||||
- Restores the expected environment for Oracle 11g, preventing segmentation faults caused by missing `vsyscall` support.
|
||||
|
||||
---
|
||||
|
||||
### **Additional Considerations**
|
||||
|
||||
- **Security Implications:**
|
||||
- Enabling `vsyscall` emulation is generally safe but reintroduces some legacy code paths.
|
||||
- The risk is minimal for most users, but it's important to keep the system updated.
|
||||
|
||||
- **Alternate Solutions:**
|
||||
- **Upgrade Oracle Version:**
|
||||
- Consider using a newer version of Oracle that doesn't rely on `vsyscall`.
|
||||
- **Use an Older Kernel:**
|
||||
- Downgrading the kernel to a version where `vsyscall` is enabled by default.
|
||||
- Not recommended due to potential security vulnerabilities.
|
||||
|
||||
- **Documentation and References:**
|
||||
- Similar issues and solutions have been documented in various repositories:
|
||||
- [JiscSD/rdss-archivematica Issue #65](https://github.com/JiscSD/rdss-archivematica/issues/65)
|
||||
- [Enalean/docker-tuleap-aio Issue #57](https://github.com/Enalean/docker-tuleap-aio/issues/57)
|
||||
- [moby/moby Issue #28705](https://github.com/moby/moby/issues/28705)
|
||||
|
||||
---
|
||||
|
||||
### **Summary**
|
||||
|
||||
- **Problem:**
|
||||
- The Oracle 11g Docker container was exiting with a segmentation fault on Debian due to `vsyscall` being disabled in the kernel.
|
||||
|
||||
- **Solution:**
|
||||
- Enabling `vsyscall` emulation by adding `vsyscall=emulate` to the kernel boot parameters in GRUB.
|
||||
- Updating GRUB and rebooting the system applied the changes.
|
||||
- The container then started successfully.
|
||||
|
||||
---
|
||||
|
||||
**By adjusting the kernel parameter to enable `vsyscall` emulation, you resolved the compatibility issue between Oracle 11g and the modern Debian kernel, allowing the Docker container to run without errors.**
|
||||
|
||||
---
|
||||
|
||||
If you have any further questions or need assistance with other issues, feel free to ask!
|
||||
Executable
+372
@@ -0,0 +1,372 @@
|
||||
|
||||
http://211.23.61.114/ISO/OracleDB/Ora11g11.2.0.4/
|
||||
|
||||
|
||||
|
||||
```db_install.rsp
|
||||
oracle.install.responseFileVersion=/oracle/install/rspfmt_dbinstall_response_schema_v11_2_0
|
||||
oracle.install.option=INSTALL_DB_SWONLY
|
||||
ORACLE_HOSTNAME=oradb
|
||||
UNIX_GROUP_NAME=oinstall
|
||||
INVENTORY_LOCATION=/u01/app/oraInventory
|
||||
SELECTED_LANGUAGES=en,zh_CN
|
||||
ORACLE_HOME=/u01/app/oracle/product/11.2.0/db_1
|
||||
ORACLE_BASE=/u01/app/oracle
|
||||
oracle.install.db.InstallEdition=EE
|
||||
oracle.install.db.EEOptionsSelection=false
|
||||
oracle.install.db.optionalComponents=oracle.rdbms.partitioning:11.2.0.4.0,oracle.oraolap:11.2.0.4.0,oracle.rdbms.dm:11.2.0.4.0,oracle.rdbms.dv:11.2.0.4.0,oracle.rdbms.lbac:11.2.0.4.0,oracle.rdbms.rat:11.2.0.4.0
|
||||
oracle.install.db.DBA_GROUP=dba
|
||||
oracle.install.db.OPER_GROUP=dba
|
||||
oracle.install.db.CLUSTER_NODES=
|
||||
oracle.install.db.isRACOneInstall=
|
||||
oracle.install.db.racOneServiceName=
|
||||
oracle.install.db.config.starterdb.type=
|
||||
oracle.install.db.config.starterdb.globalDBName=
|
||||
oracle.install.db.config.starterdb.SID=
|
||||
oracle.install.db.config.starterdb.characterSet=AL32UTF8
|
||||
oracle.install.db.config.starterdb.memoryOption=true
|
||||
oracle.install.db.config.starterdb.memoryLimit=
|
||||
oracle.install.db.config.starterdb.installExampleSchemas=false
|
||||
oracle.install.db.config.starterdb.enableSecuritySettings=true
|
||||
oracle.install.db.config.starterdb.password.ALL=oracle
|
||||
oracle.install.db.config.starterdb.password.SYS=
|
||||
oracle.install.db.config.starterdb.password.SYSTEM=
|
||||
oracle.install.db.config.starterdb.password.SYSMAN=
|
||||
oracle.install.db.config.starterdb.password.DBSNMP=
|
||||
oracle.install.db.config.starterdb.control=DB_CONTROL
|
||||
oracle.install.db.config.starterdb.gridcontrol.gridControlServiceURL=
|
||||
oracle.install.db.config.starterdb.automatedBackup.enable=false
|
||||
oracle.install.db.config.starterdb.automatedBackup.osuid=
|
||||
oracle.install.db.config.starterdb.automatedBackup.ospwd=
|
||||
oracle.install.db.config.starterdb.storageType=
|
||||
oracle.install.db.config.starterdb.fileSystemStorage.dataLocation=
|
||||
oracle.install.db.config.starterdb.fileSystemStorage.recoveryLocation=
|
||||
oracle.install.db.config.asm.diskGroup=
|
||||
oracle.install.db.config.asm.ASMSNMPPassword=
|
||||
MYORACLESUPPORT_USERNAME=
|
||||
MYORACLESUPPORT_PASSWORD=
|
||||
SECURITY_UPDATES_VIA_MYORACLESUPPORT=
|
||||
DECLINE_SECURITY_UPDATES=true
|
||||
PROXY_HOST=
|
||||
PROXY_PORT=
|
||||
PROXY_USER=
|
||||
PROXY_PWD=
|
||||
PROXY_REALM=
|
||||
COLLECTOR_SUPPORTHUB_URL=
|
||||
oracle.installer.autoupdates.option=
|
||||
oracle.installer.autoupdates.downloadUpdatesLoc=
|
||||
AUTOUPDATES_MYORACLESUPPORT_USERNAME=
|
||||
AUTOUPDATES_MYORACLESUPPORT_PASSWORD=
|
||||
```
|
||||
|
||||
|
||||
Dockerfile-inst
|
||||
```Dockerfile
|
||||
FROM oralcelinux:6.10
|
||||
ARG NLS_LANG
|
||||
ARG ORACLE_SID
|
||||
ADD rlwrap-0.42.tar.gz /tmp/
|
||||
ADD p13390677_112040_Linux-x86-64_1of7.zip /tmp/
|
||||
ADD p13390677_112040_Linux-x86-64_2of7.zip /tmp/
|
||||
ADD db_install.rsp /tmp/
|
||||
RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle && \
|
||||
yum -y install oracle-rdbms-server-11gR2-preinstall unzip readline-devel.x86_64 lrzsz && \
|
||||
cd /tmp/rlwrap-0.42 && ./configure && make && make install && \
|
||||
echo "Create /u01/app dir..." && \
|
||||
mkdir -p -m 755 /u01/app/dumpdir && \
|
||||
mkdir -p -m 755 /u01/app/oradata && \
|
||||
mkdir -p -m 755 /u01/app/oraInventory && \
|
||||
mkdir -p -m 755 /u01/app/oracle && \
|
||||
mkdir -p -m 755 /u01/app/oracle/product/11.2.0/db_1 && \
|
||||
chown -R oracle:oinstall /u01 && \
|
||||
unzip -oq /tmp/p13390677_112040_Linux-x86-64_1of7.zip -d /tmp/ && \
|
||||
unzip -oq /tmp/p13390677_112040_Linux-x86-64_2of7.zip -d /tmp/ && \
|
||||
chown -R oracle:oinstall /tmp/database && \
|
||||
printf "%s\n" 'export ORACLE_SID=${ORACLE_SID:orcl}' \
|
||||
'export ORACLE_BASE=/u01/app/oracle' \
|
||||
'export ORACLE_HOME=$ORACLE_BASE/product/11.2.0/db_1' \
|
||||
'export LD_LIBRARY_PATH=$ORACLE_HOME/lib:$ORACLE_HOME/lib32' \
|
||||
'export PATH=$PATH:$ORACLE_HOME/bin:$ORACLE_HOME/OPatch' \
|
||||
'export NLS_LANG=${NLS_LANG:-AMERICAN_AMERICA.ZHS16GBK}' \
|
||||
'export NLS_DATE_FORMAT="yyyy-mm-dd hh24:mi:ss"' \
|
||||
'alias sqlplus="rlwrap sqlplus"' \
|
||||
'alias rman="rlwrap rman"' \
|
||||
>>/home/oracle/.bash_profile && \
|
||||
cat /etc/security/limits.conf | grep -v oracle | tee /etc/security/limits.conf && \
|
||||
su oracle -c "/tmp/database/runInstaller -ignorePrereq -ignoreSysPrereqs -waitforcompletion -silent -responseFile /tmp/db_install.rsp 2>&1" && \
|
||||
/u01/app/oraInventory/orainstRoot.sh && \
|
||||
/u01/app/oracle/product/11.2.0/db_1/root.sh && \
|
||||
yum clean all && \
|
||||
rm -rf /tmp/* && rm -rf /var/log/* && rm -rf /var/cache/*
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
build-inst.sh:
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
imagetag="oracle:11.2.0.4-inst"
|
||||
dockerfile="Dockerfile-inst"
|
||||
docker build --rm \
|
||||
--force-rm \
|
||||
--no-cache \
|
||||
--memory=4g \
|
||||
--shm-size=4g \
|
||||
-t ${imagetag} \
|
||||
-f ${dockerfile} .
|
||||
```
|
||||
|
||||
|
||||
Dockerfile-db
|
||||
```Dockerfile
|
||||
FROM oracle:11.2.0.4-inst
|
||||
|
||||
# Set environment variables
|
||||
ENV ORACLE_BASE=/u01/app/oracle
|
||||
ENV ORACLE_HOME=${ORACLE_BASE}/product/11.2.0/db_1
|
||||
ENV PATH=$PATH:${ORACLE_HOME}/bin
|
||||
|
||||
# Build arguments with default password values
|
||||
ARG SYSPASSWORD=admingzzn
|
||||
ARG SYSTEMPASSWORD=admingzzn
|
||||
ARG ORACLE_SID=orcl
|
||||
|
||||
# Set environment variables for oracle user
|
||||
RUN printf "%s\n" \
|
||||
'export ORACLE_BASE=/u01/app/oracle' \
|
||||
'export ORACLE_HOME=$ORACLE_BASE/product/11.2.0/db_1' \
|
||||
'export ORACLE_SID=$ORACLE_SID' \
|
||||
'export PATH=$PATH:$ORACLE_HOME/bin' \
|
||||
>> /home/oracle/.bash_profile
|
||||
|
||||
|
||||
RUN printf "%s\n" '[GENERAL]' \
|
||||
'RESPONSEFILE_VERSION="11.2"' \
|
||||
'CREATE_TYPE="CUSTOM"' \
|
||||
'[oracle.net.ca]' \
|
||||
'INSTALLED_COMPONENTS={"server","net8","javavm"}' \
|
||||
'INSTALL_TYPE=""typical""' \
|
||||
'LISTENER_NUMBER=1' \
|
||||
'LISTENER_NAMES={"LISTENER"}' \
|
||||
'LISTENER_PROTOCOLS={"TCP;1521"}' \
|
||||
'LISTENER_START=""LISTENER""' \
|
||||
'NAMING_METHODS={"TNSNAMES","ONAMES","HOSTNAME"}' \
|
||||
'NSN_NUMBER=1' \
|
||||
'NSN_NAMES={"EXTPROC_CONNECTION_DATA"}' \
|
||||
'NSN_SERVICE={"PLSExtProc"}' \
|
||||
'NSN_PROTOCOLS={"TCP;HOSTNAME;1521"}' \
|
||||
>>/tmp/netca.rsp && \
|
||||
su oracle -c "/u01/app/oracle/product/11.2.0/db_1/bin/netca -silent -responseFile /tmp/netca.rsp" && \
|
||||
printf "%s\n" '[GENERAL]' \
|
||||
'RESPONSEFILE_VERSION = "11.2.0"' \
|
||||
'OPERATION_TYPE = "createDatabase"' \
|
||||
'[CREATEDATABASE]' \
|
||||
'GDBNAME = "${ORACLE_SID}"' \
|
||||
'DATABASECONFTYPE = "SI"' \
|
||||
'SID = "orcl"' \
|
||||
'TEMPLATENAME = "General_Purpose.dbc"' \
|
||||
'SYSPASSWORD = \"${SYSPASSWORD}\"' \
|
||||
'SYSTEMPASSWORD = \"${SYSTEMPASSWORD}\"' \
|
||||
'DATAFILEDESTINATION=/u01/app/oradata' \
|
||||
'RECOVERYAREADESTINATION=/u01/app/oradata' \
|
||||
'STORAGETYPE=FS' \
|
||||
'CHARACTERSET="ZHS16GBK"' \
|
||||
'INITPARAMS = "java_jit_enabled=false,memory_target=0,sga_target=2048,pga_aggregate_target=300,processes=300,open_cursors=300"' \
|
||||
'AUTOMATICMEMORYMANAGEMENT="False"' \
|
||||
> /tmp/dbca.rsp && chown oracle:oinstall /tmp/dbca.rsp && chmod +x /tmp/dbca.rsp && \
|
||||
su oracle -c "/u01/app/oracle/product/11.2.0/db_1/bin/dbca -silent -responseFile /tmp/dbca.rsp" && \
|
||||
sed -i "s/#PermitRootLogin.*/PermitRootLogin yes/g" /etc/ssh/sshd_config && \
|
||||
echo "export LANG=en_US.utf8" >> /etc/profile
|
||||
|
||||
# Cleanup
|
||||
RUN yum clean all && \
|
||||
rm -rf /tmp/* /var/log/* /var/cache/*
|
||||
|
||||
```
|
||||
|
||||
build-db.sh
|
||||
```bash
|
||||
imagetag="oracle:11.2.0.4-db"
|
||||
dockerfile="Dockerfile-db"
|
||||
docker build --rm \
|
||||
--force-rm \
|
||||
--no-cache \
|
||||
--memory=4g \
|
||||
--shm-size=4g \
|
||||
-t ${imagetag} \
|
||||
-f ${dockerfile} .
|
||||
```
|
||||
|
||||
|
||||
entrypoint_oracle.sh:
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
source ~/.bashrc
|
||||
alert_log="$ORACLE_BASE/diag/rdbms/orcl/$ORACLE_SID/trace/alert_$ORACLE_SID.log"
|
||||
listener_log="$ORACLE_BASE/diag/tnslsnr/$HOSTNAME/listener/trace/listener.log"
|
||||
pfile=$ORACLE_HOME/dbs/init$ORACLE_SID.ora
|
||||
# monitor $logfile
|
||||
monitor() {
|
||||
tail -F -n 0 $1 | while read line; do echo -e "$2: $line"; done
|
||||
}
|
||||
trap_db() {
|
||||
trap "echo 'Caught SIGTERM signal, shutting down...'; stop_db" SIGTERM;
|
||||
trap "echo 'Caught SIGINT signal, shutting down...'; stop_db" SIGINT;
|
||||
}
|
||||
# Check shared memory
|
||||
check_shm() {
|
||||
echo ""
|
||||
echo "Checking shared memory..."
|
||||
df -h | grep "Mounted on" && df -h | egrep --color "^.*/dev/shm" || echo "Shared memory is not mounted."
|
||||
}
|
||||
# Reconfig listener
|
||||
reconfig_lsnr() {
|
||||
echo ""
|
||||
echo "Reconfig listener for hostname : [$HOSTNAME]..."
|
||||
sed -i "s/(HOST.*)(/(HOST = $HOSTNAME)(/g" /u01/app/oracle/product/11.2.0/db_1/network/admin/tnsnames.ora
|
||||
sed -i "s/(HOST.*)(/(HOST = $HOSTNAME)(/g" /u01/app/oracle/product/11.2.0/db_1/network/admin/listener.ora
|
||||
echo "Show tnsnames.ora..."
|
||||
cat /u01/app/oracle/product/11.2.0/db_1/network/admin/tnsnames.ora
|
||||
echo "Show listener.ora..."
|
||||
cat /u01/app/oracle/product/11.2.0/db_1/network/admin/listener.ora
|
||||
}
|
||||
# Start listener
|
||||
start_lsnr() {
|
||||
echo ""
|
||||
echo "Starting listener..."
|
||||
monitor $listener_log listener &
|
||||
lsnrctl start | while read line; do echo -e "lsnrctl: $line"; done
|
||||
MON_LSNR_PID=$!
|
||||
}
|
||||
# Start database
|
||||
start_db() {
|
||||
echo ""
|
||||
echo "Starting database..."
|
||||
trap_db
|
||||
monitor $alert_log alertlog &
|
||||
MON_ALERT_PID=$!
|
||||
sqlplus / as sysdba <<-EOF |
|
||||
pro Starting with pfile='$pfile' ...
|
||||
startup;
|
||||
alter system register;
|
||||
exit 0
|
||||
EOF
|
||||
while read line; do echo -e "sqlplus: $line"; done
|
||||
change_dpdump_dir
|
||||
change_profile_default_limit
|
||||
wait $MON_ALERT_PID
|
||||
}
|
||||
# Stop database
|
||||
stop_db() {
|
||||
trap '' SIGINT SIGTERM
|
||||
shut_immediate
|
||||
echo "Shutting down listener..."
|
||||
lsnrctl stop | while read line; do echo -e "lsnrctl: $line"; done
|
||||
kill $MON_ALERT_PID $MON_LSNR_PID
|
||||
exit 0
|
||||
}
|
||||
shut_immediate() {
|
||||
ps -ef | grep ora_pmon | grep -v grep > /dev/null && \
|
||||
echo "Shutting down the database..." && \
|
||||
sqlplus / as sysdba <<-EOF |
|
||||
set echo on
|
||||
shutdown immediate;
|
||||
exit 0
|
||||
EOF
|
||||
while read line; do echo -e "sqlplus: $line"; done
|
||||
}
|
||||
# change_dpdump_dir
|
||||
change_dpdump_dir () {
|
||||
echo ""
|
||||
echo "Changing dpdump dir to /u01/app/dumpdir"
|
||||
sqlplus / as sysdba <<-EOF |
|
||||
create or replace directory data_pump_dir as '/u01/app/dumpdir';
|
||||
commit;
|
||||
exit 0
|
||||
EOF
|
||||
while read line; do echo -e "sqlplus: $line"; done
|
||||
}
|
||||
# change profile default limit
|
||||
change_profile_default_limit() {
|
||||
echo ""
|
||||
echo "Changing profile default limit : password_life_time/failed_login_attempts"
|
||||
sqlplus / as sysdba <<-EOF |
|
||||
alter profile default limit password_life_time unlimited;
|
||||
alter profile default limit failed_login_attempts unlimited;
|
||||
commit;
|
||||
exit 0
|
||||
EOF
|
||||
while read line; do echo -e "sqlplus: $line"; done
|
||||
}
|
||||
# Check shared memory
|
||||
check_shm
|
||||
# Reconfig listener
|
||||
reconfig_lsnr
|
||||
# Start listener
|
||||
start_lsnr
|
||||
# Start database
|
||||
start_db
|
||||
```
|
||||
|
||||
entrypoint.sh :
|
||||
```bash
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
/etc/init.d/sshd start
|
||||
find /u01 ! -user oracle -o ! -group oinstall -exec chown oracle:oinstall {} +
|
||||
su - oracle -c "/usr/sbin/entrypoint_oracle.sh"
|
||||
```
|
||||
|
||||
Dockerfile-run
|
||||
```Dockerfile
|
||||
# Use Oracle Database 11.2.0.4 as the base image
|
||||
FROM oracle:11.2.0.4-db
|
||||
|
||||
# Set the timezone to Shanghai
|
||||
ENV TZ=Asia/Shanghai
|
||||
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
|
||||
# Set environment variables
|
||||
ENV LANG=en_US.utf8
|
||||
|
||||
# Copy entry point scripts
|
||||
ADD entrypoint.sh /usr/sbin/entrypoint.sh
|
||||
ADD entrypoint_oracle.sh /usr/sbin/entrypoint_oracle.sh
|
||||
|
||||
# Make scripts executable
|
||||
RUN chmod +x /usr/sbin/entrypoint.sh /usr/sbin/entrypoint_oracle.sh
|
||||
|
||||
# Modify SSH configuration (with security considerations)
|
||||
# It's recommended to create a non-root user and use SSH keys
|
||||
# RUN sed -i "s/#PermitRootLogin.*/PermitRootLogin yes/g" /etc/ssh/sshd_config
|
||||
|
||||
# Set the root password securely (not recommended to hardcode)
|
||||
# ARG ROOT_PASSWORD
|
||||
# RUN echo "root:${ROOT_PASSWORD}" | chpasswd
|
||||
|
||||
EXPOSE 1521
|
||||
|
||||
# Set the entry point
|
||||
ENTRYPOINT ["/usr/sbin/entrypoint.sh"]
|
||||
CMD [""]
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
debain can't run oraclelinux
|
||||
```
|
||||
I believe this is the vsyscall=emulate problem:
|
||||
|
||||
If `sudo grep vsyscall /proc/1/maps` prints nothing, then edit `/etc/default/grub` and append `vsyscall=emulate` to the variable `GRUB_CMDLINE_LINUX_DEFAULT`. Then run a `sudo update-grub` and reboot.
|
||||
|
||||
Additional references: [https://github.com/JiscSD/rdss-archivematica/issues/65](https://github.com/JiscSD/rdss-archivematica/issues/65) , [Enalean/docker-tuleap-aio#57](https://github.com/Enalean/docker-tuleap-aio/issues/57) , [moby/moby#28705](https://github.com/moby/moby/issues/28705)
|
||||
|
||||
👍8
|
||||
```
|
||||
Executable
+154
@@ -0,0 +1,154 @@
|
||||
--XBOS資料庫設定值取得SQL Script如下：
|
||||
-- 1. 收集資料庫版本資訊
|
||||
select banner from v$version
|
||||
union all
|
||||
select distinct banner from (select 'Oracle Client version '||client_version banner FROM v$session_connect_info WHERE sid = SYS_CONTEXT('USERENV', 'SID'))
|
||||
union all
|
||||
select 'Database CharacterSet: '||value from v$nls_parameters where parameter='NLS_CHARACTERSET'
|
||||
union all
|
||||
select 'Database archive mode: '||log_mode from v$database
|
||||
union all
|
||||
select 'Database Global Name: '||GLOBAL_NAME from GLOBAL_NAME
|
||||
union all
|
||||
select 'Database Server Name: '||host_name from v$instance
|
||||
union all
|
||||
select 'Database Startup Time: '||to_char(startup_time, 'YYYY/MM/DD HH:MI:SS') from v$instance
|
||||
union all
|
||||
select 'Database Client IP: '||sys_context('USERENV', 'IP_ADDRESS') from dual
|
||||
union all
|
||||
select 'Database Trace Log: '||value from v$diag_info where name='Diag Trace';
|
||||
-- 2. 收集資料庫參數設定資訊
|
||||
select name, value from v$parameter2 where name in (
|
||||
'audit_file_dest',
|
||||
'audit_trail',
|
||||
'cluster_database',
|
||||
'cluster_database_instances',
|
||||
'control_files',
|
||||
'control_management_pack_access',
|
||||
'cpu_count',
|
||||
'db_block_size',
|
||||
'db_files',
|
||||
'db_name',
|
||||
'instance_mode',
|
||||
'memory_max_target',
|
||||
'memory_target',
|
||||
'optimizer_features_enable',
|
||||
'pga_aggregate_target',
|
||||
'processes',
|
||||
'remote_login_passwordfile',
|
||||
'service_names',
|
||||
'sessions',
|
||||
'sga_max_size',
|
||||
'sga_target',
|
||||
'spfile',
|
||||
'statistics_level',
|
||||
'user_dump_dest',
|
||||
'utl_file_dir'
|
||||
)
|
||||
order by name;
|
||||
|
||||
-- 3. 收集Tablespace使用空間大小資訊
|
||||
SELECT df.tablespace_name "Tablespace",
|
||||
df.bytes / (1024 * 1024) "Size (MB)",
|
||||
SUM(fs.bytes) / (1024 * 1024) "Free (MB)",
|
||||
Nvl(Round(SUM(fs.bytes) * 100 / df.bytes),1) "% Free",
|
||||
Round((df.bytes - SUM(fs.bytes)) * 100 / df.bytes) "% Used"
|
||||
FROM dba_free_space fs,
|
||||
(SELECT tablespace_name,SUM(bytes) bytes FROM dba_data_files
|
||||
GROUP BY tablespace_name) df
|
||||
WHERE fs.tablespace_name (+) = df.tablespace_name
|
||||
GROUP BY df.tablespace_name,df.bytes
|
||||
UNION ALL
|
||||
SELECT df.tablespace_name tspace,
|
||||
fs.bytes / (1024 * 1024),
|
||||
SUM(df.bytes_free) / (1024 * 1024),
|
||||
Nvl(Round((SUM(fs.bytes) - df.bytes_used) * 100 / fs.bytes), 1),
|
||||
Round((SUM(fs.bytes) - df.bytes_free) * 100 / fs.bytes)
|
||||
FROM dba_temp_files fs,
|
||||
(SELECT tablespace_name,bytes_free,bytes_used FROM v$temp_space_header
|
||||
GROUP BY tablespace_name,bytes_free,bytes_used) df
|
||||
WHERE fs.tablespace_name (+) = df.tablespace_name
|
||||
GROUP BY df.tablespace_name,fs.bytes,df.bytes_free,df.bytes_used
|
||||
ORDER BY 1;
|
||||
|
||||
-- 4. 收集Data Files使用空間大小資訊
|
||||
select file_name,tablespace_name, bytes/1048576 "SizeMB", bytes/blocks "BLOCK", autoextensible from dba_data_files
|
||||
union all
|
||||
select file_name,tablespace_name, bytes/1048576 "SizeMB", bytes/blocks "BLOCK", autoextensible from dba_temp_files;
|
||||
|
||||
-- 5. 收集主機名稱資訊
|
||||
select instance_name,host_name,version,startup_time,status from v$instance;
|
||||
|
||||
-- 6. 收集資料庫名稱狀態
|
||||
select dbid, db_unique_name, name, log_mode, open_mode, database_role, guard_status, platform_name, flashback_on from v$database;
|
||||
|
||||
-- 7. 收集表格(tables)使用空間大小資訊
|
||||
select OWNER,TABLE_NAME,NUM_ROWS,BLOCKS,round(BLOCKS/128) as SizeMB,AVG_ROW_LEN,round(AVG_ROW_LEN*NUM_ROWS/1048576) as LenMB
|
||||
from all_tables where owner in ('FBOSPROD', 'XBOSWRNT', 'XBOSPROD') and blocks is not null order by 1, 5 desc;
|
||||
|
||||
-- 8. 收集索引(indexes)使用空間大小資訊
|
||||
select owner, segment_name, bytes/1024/1024 "SizeMB" from dba_segments
|
||||
where owner in ('FBOSPROD', 'XBOSWRNT', 'XBOSPROD') and segment_type = 'INDEX' order by 3 desc;
|
||||
|
||||
-- 9. 收集Partition Table設定資訊
|
||||
select table_name, partition_name, num_rows, round(blocks/128, 2) SizeMB, last_analyzed
|
||||
from dba_tab_statistics where owner in ('FBOSPROD', 'XBOSWRNT', 'XBOSPROD');
|
||||
|
||||
--10. 收集資料表空間使用額度
|
||||
select tablespace_name,username,max_bytes,max_blocks from dba_ts_quotas where username in ('FBOSPROD', 'XBOSWRNT', 'XBOSPROD');
|
||||
|
||||
--11. 收集資料庫SYS權限設定
|
||||
select * from dba_sys_privs where grantee in ('FBOSPROD', 'WRNTPROD', 'XBOSPROD')
|
||||
union all
|
||||
select * from dba_sys_privs where grantee in ('FBOSLOAD', 'WRNTLOAD', 'XBOSLOAD')
|
||||
union all
|
||||
select * from dba_sys_privs where grantee in ('FBOSLOAD_ROLE', 'WRNTLOAD_ROLE', 'XBOSLOAD_ROLE')
|
||||
order by 1, 2;
|
||||
|
||||
--12. 收集資料庫ROLE權限設定
|
||||
select * from dba_role_privs where grantee in ('FBOSPROD', 'WRNTPROD', 'XBOSPROD')
|
||||
union all
|
||||
select * from dba_role_privs where grantee in ('FBOSLOAD', 'WRNTLOAD', 'XBOSLOAD')
|
||||
union all
|
||||
select * from dba_role_privs where grantee in ('FBOSLOAD_ROLE', 'WRNTLOAD_ROLE', 'XBOSLOAD_ROLE')
|
||||
order by 1, 2;
|
||||
|
||||
--14. 收集資料庫User Objects Count
|
||||
select owner, object_type, count(*) from dba_objects
|
||||
where owner in ('FBOSPROD', 'WRNTPROD', 'XBOSPROD')
|
||||
group by owner, object_type, object_type order by 1, 2;
|
||||
select owner, object_type, count(*) from dba_objects
|
||||
where owner in ('FBOSLOAD', 'WRNTLOAD', 'XBOSLOAD')
|
||||
group by owner, object_type, object_type order by 1, 2;
|
||||
|
||||
--15. 收集物件授權Scripts語法
|
||||
select 'GRANT DELETE, INSERT, SELECT, UPDATE ON XBOSPROD.' || object_name || ' TO XBOSLOAD;' GRANT_TEXT
|
||||
from dba_objects where owner = 'XBOSPROD' and object_type = 'TABLE'
|
||||
union all
|
||||
select 'GRANT EXECUTE ON XBOSPROD.' || object_name || ' TO XBOSLOAD;' GRANT_TEXT
|
||||
from dba_objects where owner = 'XBOSPROD' and object_type in('FUNCTION','PACKAGE','PACKAGE BODY','PROCEDURE')
|
||||
union all
|
||||
select 'GRANT ALTER, SELECT ON XBOSPROD.' || object_name || ' TO XBOSLOAD;' GRANT_TEXT
|
||||
from dba_objects where owner = 'XBOSPROD' and object_type = 'SEQUENCE'
|
||||
union all
|
||||
select 'GRANT SELECT ON XBOSPROD.' || object_name || ' TO XBOSLOAD;' GRANT_TEXT
|
||||
from dba_objects where owner = 'XBOSPROD' and object_type = 'VIEW'
|
||||
order by GRANT_TEXT;
|
||||
|
||||
--16. 收集Create Synonym Scripts語法
|
||||
select 'create or replace synonym XBOSLOAD.' || object_name || ' for XBOSPROD.'||object_name||';'
|
||||
from dba_objects where owner = 'XBOSPROD';
|
||||
|
||||
--17. Schema OWNER & Table統計值收集Scripts語法
|
||||
select table_name, last_analyzed from user_tab_statistics where table_name = 'TRANSFER_SEND';
|
||||
exec dbms_stats.gather_table_stats(ownname => 'XBOSPROD' , tabname => 'TRANSFER_SEND',cascade => true);
|
||||
exec dbms_stats.gather_schema_stats(ownname => 'XBOSPROD', degree => 4, cascade => true);
|
||||
select table_name, last_analyzed from user_tab_statistics where table_name = 'TRANSFER_SEND';
|
||||
|
||||
--18. Tablespaces & datafiles list
|
||||
select * from v$tablespace; -- NAME, BIGFILE, FLASHBACK_ON
|
||||
select * from v$datafile; -- NAME, BYTES, BLOCKS, BLOCK_SIZE
|
||||
select * from v$tempfile; -- NAME, BYTES, BLOCKS, BLOCK_SIZE
|
||||
select * from dba_tablespaces; -- TABLESPACE_NAME, BIGFILE, BLOCK_SIZE
|
||||
select * from dba_data_files; -- FILE_NAME, TABLESPACE_NAME, BYTES, BLOCKS, AUTOEXTENSIBLE, MAXBYTES, MAXBLOCKS
|
||||
select * from dba_temp_files; -- FILE_NAME, TABLESPACE_NAME, BYTES, BLOCKS, AUTOEXTENSIBLE, MAXBYTES, MAXBLOCKS
|
||||
@@ -0,0 +1,623 @@
|
||||
|
||||
|
||||
|
||||
sunlogin
|
||||
id:orkj8471777m7nfe
|
||||
```password
|
||||
m2mg2Lh*T9w
|
||||
```
|
||||
|
||||
|
||||
|
||||
remote: 795906644
|
||||
```password
|
||||
840la5
|
||||
```
|
||||
|
||||
windows password:
|
||||
```
|
||||
gzzn@123
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
gzzn@123
|
||||
```
|
||||
|
||||
|
||||
|
||||
流水号 0026
|
||||
类型 PLN
|
||||
报文 ZCZC BTZ0026 060338 QU LLFZP8X . QU LLFZP8X .XIYOC9H 060338 PLN 07MAY 01 9H8313 B1163 XIY0455(07MAY) LLF 02 9H8313 B1163 LLF0755(07MAY) HAK 03 9H8314 B1163 HAK1050(07MAY) LLF 04 9H8314 B1163 LLF1405(07MAY) XIY = NNNN
|
||||
接收时间 2025-05-07 12:16:32
|
||||
|
||||
|
||||
```
|
||||
ZCZC
|
||||
BTZ0026 060338 QU LLFZP8X . QU LLFZP8X .XIYOC9H 060338
|
||||
PLN 07MAY
|
||||
01 9H8313 B1163 XIY0455(07MAY) LLF
|
||||
02 9H8313 B1163 LLF0755(07MAY) HAK
|
||||
03 9H8314 B1163 HAK1050(07MAY) LLF
|
||||
04 9H8314 B1163 LLF1405(07MAY) XIY
|
||||
=
|
||||
NNNN
|
||||
```
|
||||
|
||||
|
||||
```groovy
|
||||
// locations to search for config files that get merged into the main config;
|
||||
// config files can be ConfigSlurper scripts, Java properties files, or classes
|
||||
// in the classpath in ConfigSlurper format
|
||||
|
||||
// grails.config.locations = [ "classpath:${appName}-config.properties",
|
||||
// "classpath:${appName}-config.groovy",
|
||||
// "file:${userHome}/.grails/${appName}-config.properties",
|
||||
// "file:${userHome}/.grails/${appName}-config.groovy"]
|
||||
grails.config.locations = [ "file:Quartz-config.groovy"]
|
||||
// if (System.properties["${appName}.config.location"]) {
|
||||
// grails.config.locations << "file:" + System.properties["${appName}.config.location"]
|
||||
// }
|
||||
|
||||
grails.project.groupId = appName // change this to alter the default package name and Maven publishing destination
|
||||
grails.mime.file.extensions = true // enables the parsing of file extensions from URLs into the request format
|
||||
grails.mime.use.accept.header = false
|
||||
grails.mime.types = [
|
||||
all: '*/*',
|
||||
atom: 'application/atom+xml',
|
||||
css: 'text/css',
|
||||
csv: 'text/csv',
|
||||
form: 'application/x-www-form-urlencoded',
|
||||
html: ['text/html','application/xhtml+xml'],
|
||||
js: 'text/javascript',
|
||||
json: ['application/json', 'text/json'],
|
||||
multipartForm: 'multipart/form-data',
|
||||
rss: 'application/rss+xml',
|
||||
text: 'text/plain',
|
||||
xml: ['text/xml', 'application/xml']
|
||||
]
|
||||
|
||||
// URL Mapping Cache Max Size, defaults to 5000
|
||||
//grails.urlmapping.cache.maxsize = 1000
|
||||
|
||||
// What URL patterns should be processed by the resources plugin
|
||||
grails.resources.adhoc.patterns = ['/images/*', '/css/*', '/js/*', '/plugins/*']
|
||||
|
||||
// The default codec used to encode data with ${}
|
||||
grails.views.default.codec = "none" // none, html, base64
|
||||
grails.views.gsp.encoding = "UTF-8"
|
||||
grails.converters.encoding = "UTF-8"
|
||||
// enable Sitemesh preprocessing of GSP pages
|
||||
grails.views.gsp.sitemesh.preprocess = true
|
||||
// scaffolding templates configuration
|
||||
grails.scaffolding.templates.domainSuffix = 'Instance'
|
||||
|
||||
// Set to false to use the new Grails 1.2 JSONBuilder in the render method
|
||||
grails.json.legacy.builder = false
|
||||
// enabled native2ascii conversion of i18n properties files
|
||||
grails.enable.native2ascii = true
|
||||
// packages to include in Spring bean scanning
|
||||
grails.spring.bean.packages = []
|
||||
// whether to disable processing of multi part requests
|
||||
grails.web.disable.multipart=false
|
||||
|
||||
// request parameters to mask when logging exceptions
|
||||
grails.exceptionresolver.params.exclude = ['password']
|
||||
|
||||
// configure auto-caching of queries by default (if false you can cache individual queries with 'cache: true')
|
||||
grails.hibernate.cache.queries = false
|
||||
|
||||
|
||||
|
||||
environments {
|
||||
development {
|
||||
grails.logging.jul.usebridge = true
|
||||
}
|
||||
production {
|
||||
grails.logging.jul.usebridge = false
|
||||
// TODO: grails.serverURL = "http://www.changeme.com"
|
||||
}
|
||||
}
|
||||
|
||||
// log4j configuration
|
||||
log4j = {
|
||||
// Example of changing the log pattern for the default console appender:
|
||||
//
|
||||
appenders {
|
||||
// console name:'stdout', layout:pattern(conversionPattern: '%d [%-15.15t] %-5p %-30.30c{1} - %m%n')
|
||||
appender new org.apache.log4j.DailyRollingFileAppender(
|
||||
name:"file",
|
||||
fileName:"logs/telegram.log",
|
||||
append: true,
|
||||
datePattern: '\'_\'yyyy-MM-dd',
|
||||
layout:pattern(conversionPattern: '%d{yy-MM-dd HHmmss}\t%p %-15.15c{1} :: %m%n'))
|
||||
appender new org.apache.log4j.DailyRollingFileAppender(
|
||||
name: "telegram",
|
||||
fileName:"logs/orginal.txt",
|
||||
append: true,
|
||||
datePattern: '\'_\'yyyy-MM-dd',
|
||||
layout:pattern(conversionPattern: '::%d{yyyy-MM-dd HHmmss}:: %m%n'))
|
||||
console name:'stdout', layout:pattern(conversionPattern: ' %d{yy-MM-dd HH:mm:ss} %-5p> %-15.15c{1} :: %m%n')
|
||||
}
|
||||
|
||||
root {
|
||||
info 'stdout', 'file'
|
||||
// additivity = false
|
||||
}
|
||||
|
||||
|
||||
//trace 'org.hibernate.type'
|
||||
|
||||
// info 'grails.app.services',
|
||||
// 'grails.app.utils.tbia.telegram.parser',
|
||||
// info 'grails.app.jobs'
|
||||
// additivity = false
|
||||
|
||||
info 'org.grails.plugin'
|
||||
|
||||
//debug 'grails.app.utils.tbia.telegram.TcpReader'
|
||||
// 'grails.app.services'
|
||||
// 'org.grails.plugin'
|
||||
// 'grails.app.jobs'
|
||||
// additivity: false
|
||||
|
||||
// info 'org.codehaus.groovy.grails.orm.hibernate', // hibernate integration
|
||||
// info additivity: false,
|
||||
// telegram : ['grails.app.utils.tbia.telegram.TelegramTextLoggerUtils'],
|
||||
// info 'org.codehaus.groovy.grails.web.servlet', // controllers
|
||||
// 'org.hibernate',
|
||||
// 'org.springframework',
|
||||
// 'org.codehaus.groovy.grails.orm.hibernate' // hibernate integration
|
||||
|
||||
|
||||
|
||||
debug telegram: 'grails.app.utils.tbia.telegram.TelegramTextLoggerUtils'
|
||||
|
||||
|
||||
// error 'org.codehaus.groovy.grails.web.servlet', // controllers
|
||||
error 'org.codehaus.groovy.grails.web.pages', // GSP
|
||||
'org.codehaus.groovy.grails.web.sitemesh', // layouts
|
||||
'org.codehaus.groovy.grails.web.mapping.filter', // URL mapping
|
||||
'org.codehaus.groovy.grails.web.mapping', // URL mapping
|
||||
'org.codehaus.groovy.grails.commons', // core / classloading
|
||||
'org.codehaus.groovy.grails.plugins', // plugins
|
||||
'org.codehaus.groovy.grails.orm.hibernate', // hibernate integration
|
||||
// 'org.springframework',
|
||||
'org.hibernate',
|
||||
'net.sf.ehcache.hibernate',
|
||||
'grails.app.service.org.grails.plugin'
|
||||
// additivity: false
|
||||
|
||||
|
||||
}
|
||||
|
||||
CIIMS = [
|
||||
url:'http://192.168.50.39:8082/services/ExchangeService',
|
||||
user:'ATC',
|
||||
password:'ATCPASS'
|
||||
]
|
||||
|
||||
localICAO = 'ZGLG'
|
||||
|
||||
TBIARoutes = [
|
||||
estt:'FLOP-ESTT-ATC-ALL',
|
||||
dely:'FLOP-DELY-ATC-ALL',
|
||||
pdda:'FLOP-PDDA-ATC-ALL',
|
||||
actt:'FLOP-ACTT-ATC-ALL',
|
||||
reno:'FLOP-RENO-ATC-ALL',
|
||||
schd:'SCHD-NONE-ATC-ALL'
|
||||
]
|
||||
|
||||
SQL {
|
||||
MAPPING = "SELECT MAPPING_FLIGHT_NUMBER FROM TEL_FLIGHT_MAPPING WHERE OLD_FLIGHT_NUMBER=?"
|
||||
|
||||
//GET_FLIGHT_YESTERDAY = "SELECT scheduled_datetime, route_type FROM TEL_FLIGHTSCHD_NEXTDAY_HISTORY WHERE flight_number = ? and arri_or_dept = ? and flight_date >= to_date(?, 'yyyy-mm-dd') order by flight_date desc"
|
||||
//直接查运营表
|
||||
GET_FLIGHT_YESTERDAY_OPER = """
|
||||
SELECT
|
||||
to_char(scheduled_datetime, 'yyyy-MM-dd HH24MI') as scheduled_datetime,
|
||||
route_type, start_airport, end_airport,
|
||||
aircraft_number
|
||||
FROM
|
||||
FIMS_FLIGHTSCHD_OPERATION
|
||||
WHERE
|
||||
REGEXP_LIKE(FLIGHT_NUMBER, ?)
|
||||
and arri_or_dept = ?
|
||||
and flight_date >= to_date(?, 'yyyy-mm-dd')
|
||||
order by
|
||||
flight_date asc
|
||||
"""
|
||||
GET_FLIGHT_YESTERDAY_HIS = """
|
||||
SELECT
|
||||
to_char(scheduled_datetime, 'yyyy-MM-dd HH24MI') as scheduled_datetime,
|
||||
route_type, start_airport, end_airport,
|
||||
aircraft_number
|
||||
FROM
|
||||
FIMS_FLIGHTSCHD_HST
|
||||
WHERE
|
||||
REGEXP_LIKE(FLIGHT_NUMBER, ?)
|
||||
and arri_or_dept = ?
|
||||
and flight_date >= to_date(?, 'yyyy-mm-dd')
|
||||
order by
|
||||
flight_date asc
|
||||
"""
|
||||
// GET_FLIGHT = "SELECT scheduled_datetime, route_type FROM TEL_FLIGHTSCHD_NEXTDAY_HISTORY WHERE flight_number = ? and arri_or_dept = ? and flight_date = to_date(?, 'yyyy-mm-dd') order by flight_date desc"
|
||||
// 直接查询运营表
|
||||
GET_FLIGHT = """
|
||||
SELECT
|
||||
to_char(scheduled_datetime, 'yyyy-MM-dd HH24MI') as scheduled_datetime,
|
||||
route_type, start_airport, end_airport,
|
||||
aircraft_number
|
||||
FROM
|
||||
FIMS_FLIGHTSCHD_OPERATION
|
||||
WHERE
|
||||
REGEXP_LIKE(FLIGHT_NUMBER, ?)
|
||||
and arri_or_dept = ?
|
||||
and flight_date = to_date(?, 'yyyy-mm-dd')
|
||||
order by
|
||||
flight_date asc
|
||||
"""
|
||||
|
||||
ICAO = "SELECT airline_code_iata FROM sys_airline WHERE airline_code_icao=?"
|
||||
|
||||
COUNT_HIS_ARR_FLT = "SELECT count(*) FROM FIMS_FLIGHTSCHD_HST WHERE flight_number=? and pre_dept_datetime_actual is not null and actual_datetime is not null and arri_or_dept='A' "
|
||||
|
||||
GET_HIS_ARR_FLT = """
|
||||
select * from (
|
||||
select rownum rn, t.* from (
|
||||
SELECT
|
||||
flight_id id,
|
||||
to_char(pre_dept_datetime_actual, 'yyyy-MM-dd HH24MI') pdda,
|
||||
to_char(actual_datetime, 'yyyy-MM-dd HH24MI') actt,
|
||||
flight_date fd
|
||||
FROM
|
||||
FIMS_FLIGHTSCHD_HST
|
||||
WHERE
|
||||
flight_number = ?
|
||||
and pre_dept_datetime_actual is not null
|
||||
and actual_datetime is not null
|
||||
and arri_or_dept='A'
|
||||
order by
|
||||
actt desc
|
||||
) t
|
||||
)
|
||||
where rn <= ?
|
||||
"""
|
||||
|
||||
GET_SEASON_SCHEDULE_FLIGHTS = """
|
||||
SELECT
|
||||
FLIGHT_NUMBER,
|
||||
START_AIRPORT,
|
||||
END_AIRPORT,
|
||||
ARRI_OR_DEPT,
|
||||
to_char(ARRIVAL_TIME, 'HH24MI') as ARRIVAL_TIME,
|
||||
to_char(DEPARTURE_TIME, 'HH24MI') as DEPARTURE_TIME,
|
||||
FLYING_TIME,
|
||||
ROUTE_TYPE,
|
||||
FLIGHT_TASK,
|
||||
OPERATION_DAYS
|
||||
FROM
|
||||
FIMS_FLIGHTSCHD_SEASON, FIMS_FLIGHTSEASON
|
||||
WHERE
|
||||
FIMS_FLIGHTSCHD_SEASON.SEASON_REC_ID = FIMS_FLIGHTSEASON.SEASON_REC_ID
|
||||
and ACTIVESEASON_FLAG = 1
|
||||
ORDER by
|
||||
ARRIVAL_TIME desc, DEPARTURE_TIME desc
|
||||
"""
|
||||
|
||||
GET_AIRCRAFT = """
|
||||
select AIRCRAFT_TYPE_CODE, AIRCRAFT_NUMBER
|
||||
from SYS_AIRCRAFT
|
||||
"""
|
||||
|
||||
GET_AIRPORT = """
|
||||
select
|
||||
AIRPORT_CODE_IATA as THREE,
|
||||
AIRPORT_CODE_ICAO as FOUR,
|
||||
AIRPORT_NAME_CHN as CHN,
|
||||
SYS_COUNTRY.COUNTRY_ID as COUNTRY
|
||||
from
|
||||
SYS_AIRPORT,
|
||||
SYS_CITY,
|
||||
SYS_COUNTRY
|
||||
WHERE
|
||||
SYS_AIRPORT.CITY_ID = SYS_CITY.CITY_ID
|
||||
and SYS_CITY.COUNTRY_ID = SYS_COUNTRY.COUNTRY_ID
|
||||
"""
|
||||
|
||||
}
|
||||
|
||||
pattern =[
|
||||
/**
|
||||
* 上航（FM）解析
|
||||
* 解析参考
|
||||
*W/Z FM9134 B2688 1/1ILS (00) TSN0100 SHA
|
||||
*W/Z FM9133 B2688 1/1ILS (00) SHA0340 TSN
|
||||
*/
|
||||
FM:[
|
||||
fields:[0:'task',1:'flightNumber',2:'registerNumber'],
|
||||
min:7,
|
||||
airway:5,
|
||||
company:"FM"
|
||||
],
|
||||
/**
|
||||
* 解析厦航(MF)计划
|
||||
*01) MF8193 B5595 ILS(8) HGH1100 1305TSN
|
||||
*02) MF8194 B5595 ILS(8) TSN1355 1550HGH
|
||||
*/
|
||||
MF:[
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:6,
|
||||
airway:4,
|
||||
company:"MF"
|
||||
],
|
||||
/**
|
||||
* 解析奥凯(8X)计划
|
||||
* 计划参考：
|
||||
*L1: 29OCT BK2735 B2863 ILS IS (3/6) TSN2350(28OCT) HAK
|
||||
*L2: 29OCT BK2735 B2863 ILS IS (3/6) HAK0435 NKG
|
||||
*/
|
||||
"8X":[
|
||||
fields:[1:'flightDate',2:'flightNumber',3:'registerNumber'],
|
||||
min: 9,
|
||||
airway : 7,
|
||||
company : "8X(BK)"
|
||||
],
|
||||
/**
|
||||
* 解析海航(HU)计划
|
||||
* 计划参考
|
||||
*L04 W/Z HU7204 B5637 (9) SZX/0500 TSN
|
||||
*L05 W/Z HU7205 B5406 (9) TSN/2355(30OCT) PVG
|
||||
* 1) JD5195 B6727 ILS I(9) SYX/0800 1135/TSN
|
||||
*
|
||||
*L07 W/Z GS6571 B3155 (7) XIY/0025 TSN/0245 CGQ
|
||||
*/
|
||||
HU:[
|
||||
fields:[1:'task',2:'flightNumber',3:'registerNumber'],
|
||||
min: 5,
|
||||
airway : 5,
|
||||
company : "HU"
|
||||
],
|
||||
/**
|
||||
* 1) JD5195 B6727 ILS I(9) SYX/0800 1135/TSN
|
||||
*/
|
||||
JD: [
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:7,
|
||||
airway : 5,
|
||||
company:"JD"
|
||||
],
|
||||
/**
|
||||
* 解析天津航空(GS)公司计划
|
||||
* 解析参考
|
||||
*
|
||||
*L01 W/Z GS6503 B3122 (7) TSN/0730 DLC
|
||||
*L04 W/Z GS6516 B3192 (8) URC/0555 DSN/0920 TSN
|
||||
*L03 W/Z GS6515 B3183 (8) TSN/2320(30OCT) DSN/0145 URC
|
||||
*L55 CNL GS6601 TSN TYN
|
||||
*L44 W/Z GS7533 B3156 (7) XIY/0415 TSN/0645 CGQ
|
||||
*L45 W/Z GS7534 B3156 (7) CGQ/0905 TSN/1145 XIY
|
||||
*
|
||||
* changde
|
||||
* 01 GS7635 B3193 XIY0020(16APR) CGD
|
||||
*/
|
||||
GS: [
|
||||
//fields:[1:'task',2:'flightNumber', 3:'registerNumber'],
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:4,
|
||||
airway : 3,
|
||||
company:"GS"
|
||||
],
|
||||
/**
|
||||
* 杨子快运(Y8)
|
||||
*01 Y87969 B2119 XMN 1540 HGH
|
||||
*13 Y87444 B2578 ICN 0235 TSN
|
||||
*/
|
||||
Y8: [
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:6,
|
||||
airway : 3,
|
||||
company:"Y8"
|
||||
],
|
||||
/**
|
||||
* 四川航空 (3U)
|
||||
* 01) 31OCT 3U8863 B6598 CAT1 (10) CKG0010 0235TSN
|
||||
*/
|
||||
"3U":[
|
||||
fields:[1:'flightDate',2:'flightNumber', 3:'registerNumber'],
|
||||
min:8,
|
||||
airway : 6,
|
||||
company:"3U"
|
||||
],
|
||||
/**
|
||||
* 中国货运 (CK)
|
||||
*01)H/Z CK261 B2076 PVG1535(30OCT) 1705TPE
|
||||
*/
|
||||
CK:[
|
||||
fields:[0:'task',1:'flightNumber', 2:'registerNumber'],
|
||||
min:4,
|
||||
airway : 3,
|
||||
company:"CK"
|
||||
],
|
||||
/**
|
||||
* 华夏航空 (G5)
|
||||
*L01 W/Z G52665 B7762 (6) CKG/0725 CIH/0940 TSN
|
||||
* 01 G52653 B7762 (6) CKG0015(03FEB) LLF
|
||||
*/
|
||||
G5:[
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:4,
|
||||
airway : 3,
|
||||
company:"G5"
|
||||
],
|
||||
/**
|
||||
* 春秋航空 (9C)
|
||||
*31OCT W/Z 9C8884 B6573 ILS1/1 (06) TSN0650 SYX
|
||||
*/
|
||||
"9C":[
|
||||
fields:[0:'flightDate', 1:'task',2:'flightNumber', 3:'registerNumber'],
|
||||
min:8,
|
||||
airway : 6,
|
||||
company:"9C"
|
||||
],
|
||||
/**
|
||||
* 深圳航空 (ZH)
|
||||
*204) W/Z 31OCT ZH9783 B5670 CAT1 (10) SZX0045 0355TSN
|
||||
*/
|
||||
ZH:[
|
||||
fields:[2:'flightDate', 1:'task',3:'flightNumber', 4:'registerNumber'],
|
||||
min:9,
|
||||
airway : 7,
|
||||
company:"ZH"
|
||||
],
|
||||
/**
|
||||
* 翔鹏航空 (8L)
|
||||
*L59 W/Z 8L9976 B6959 TSN/0510 CTU/0855 KMG
|
||||
*/
|
||||
"8L":[
|
||||
fields:[1:'task',2:'flightNumber', 3:'registerNumber'],
|
||||
min:6,
|
||||
airway : 4,
|
||||
company:"8L"
|
||||
],
|
||||
/**
|
||||
* 山东航空 (SC)
|
||||
*(1) SC4717 B3080 CRJ7 ILS I (6) TAO/2350 TSN
|
||||
*/
|
||||
SC:[
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:9,
|
||||
airway : 7,
|
||||
company:"SC"
|
||||
],
|
||||
/**
|
||||
* 西部航空 (PN)
|
||||
*21) PN6237 B6763 ILS I(9) CKG/0000 0220/TSN
|
||||
*23) PN6235 B6763 ILS I(9) CKG/0905 1025/WUH/1100 1225/WNZ
|
||||
*/
|
||||
PN:[
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:7,
|
||||
airway : 5,
|
||||
company:"PN"
|
||||
],
|
||||
/**
|
||||
* 南方航空 (CZ)
|
||||
*
|
||||
*83. CZ3301/2 B2823 B752 CAN0135 TSN0535 CAN
|
||||
*02. CZ6973/4 B5239 B737 YIN0235 URC0425 PVG0940 URC1545 YIN
|
||||
*/
|
||||
CZ: [
|
||||
fields:[1:'flightNumber', 2:'registerNumber', 3:'aircraftType'],
|
||||
min:6,
|
||||
airway : 4,
|
||||
company:"CZ"
|
||||
],
|
||||
//124) 14NOV W/Z HO1245 B6966 ILS(8) SHA0005 0255CKG
|
||||
//LLF new:
|
||||
//174 Ho1019 B6984 PVG0635(03FEB) LLF
|
||||
HO: [
|
||||
//fields:[1:'flightDate', 2:'task', 3:'flightNumber', 4:'registerNumber'],
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
//min:7,
|
||||
min:4,
|
||||
airway: 3,
|
||||
company: "HO"
|
||||
],
|
||||
//05) 14NOV N/M NS3230 B3188 ILS(2) TSN2200 2240SJW
|
||||
NS: [
|
||||
fields:[1:'flightDate', 2:'task', 3:'flightNumber', 4:'registerNumber'],
|
||||
min:7,
|
||||
airway: 6,
|
||||
company: "NS"
|
||||
],
|
||||
//38)W/Z 27NOV EU2748 B6900 CAT1 (8) TSN0800 1055CTU
|
||||
EU: [
|
||||
fields:[0:'task', 1:'flightDate', 2:'flightNumber', 3:'registerNumber'],
|
||||
min:7,
|
||||
airway: 6,
|
||||
company: "EU"
|
||||
],
|
||||
//01 9H8313 B1163 XIY0455(07MAY) LLF
|
||||
"9H": [
|
||||
fields:[1:'flightNumber', 2:'registerNumber'],
|
||||
min:4,
|
||||
airway: 3,
|
||||
company: "9H"
|
||||
],
|
||||
|
||||
]
|
||||
|
||||
flightType = [
|
||||
H:["H/G", "H/Y"], //货机
|
||||
O:["U/H"], //公务
|
||||
B:["J/B"] //专机
|
||||
]
|
||||
|
||||
|
||||
|
||||
// 17点定时发送计划
|
||||
Plan17Cron = "0 50 16 * * ?"
|
||||
|
||||
// 18点定时发送计划
|
||||
Plan18Cron = "0 50 17 * * ?"
|
||||
|
||||
//对于三字码相同的航空公司，使一部分不实用的机场失效
|
||||
//如果机场真有相同三字码的航空公司，需要修改查询接口，支持多个航空公司
|
||||
disabledAirport = [
|
||||
// 曼谷航空
|
||||
OKA:'PG'
|
||||
]
|
||||
|
||||
// 针对航空公司二字码相同，三字码不同的情况，追加电报本地映射
|
||||
MyAirports = [
|
||||
//内蒙古航空，二字码对应国航的CA
|
||||
CNM:"CA"
|
||||
]
|
||||
|
||||
//针对航班补班的情况，允许在航班号后面加1，2个字母
|
||||
flightNumberPattern = '[A-Z]{0,2}'
|
||||
//yyyy-MM-dd 制定具体日期（系统测试）
|
||||
//now 取系统当前时间
|
||||
// operDate="2012-10-30"
|
||||
operDate="now"
|
||||
|
||||
// 检查过夜航班配置， 值是4表示在4点之前，如果电报中不包含DOF，则检查今天和昨天航班
|
||||
checkHour = 4
|
||||
|
||||
// 计算飞行时长的历史航班数，30表示最近的30次历史飞行的平均值
|
||||
hisFlyTime = 30
|
||||
|
||||
localThree="LLF"
|
||||
//中国ID，用于判断是否是国内航班
|
||||
countryChinaID = 142
|
||||
|
||||
//socket = [server:"172.28.0.3", port:5555]
|
||||
socket = [server:"127.0.0.1", port:7000]
|
||||
|
||||
socketCheckStatus = true
|
||||
|
||||
serial = [baudRate:1200, dataBits:8, stopBits:1, parity:0]
|
||||
|
||||
// windows 默认端口: COM1
|
||||
serialPort = "/Users/windy/Dev/tmp/ttys0"
|
||||
|
||||
//工作模式：
|
||||
//串口：serial, TCP: tcp
|
||||
serviceMode = "tcp"
|
||||
|
||||
//测试模式，当为true的时候，查运营航班数据的时候可以查询历史表（优先查历史表）
|
||||
testMode = false
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
ParsePLN.groovy
|
||||
```groovy
|
||||
static def NORMAL = [
|
||||
'9H' //长安航空
|
||||
]
|
||||
|
||||
```
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
账号：
|
||||
18813973711@1826109533440870.onaliyun.com
|
||||
密码：
|
||||
Jinke@202403
|
||||
|
||||
|
||||
服务器：
|
||||
root
|
||||
Passw0rd
|
||||
|
||||
|
||||
nginx:
|
||||
|
||||
```nginx
|
||||
location /jsc/ {
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_pass http://172.16.0.13:8082/;
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,193 @@
|
||||
|
||||
|
||||
130.120.3.75:
|
||||
|
||||
```bash
|
||||
cat /etc/redhat-release
|
||||
CentOS Linux release 7.5.1804 (Core)
|
||||
```
|
||||
|
||||
|
||||
download :
|
||||
```url
|
||||
https://download.dameng.com/eco/adapter/DM8/202405/dm8_20240408_x86_rh7_64_ent_8.1.3.140.zip
|
||||
```
|
||||
|
||||
|
||||
create user:
|
||||
```bash
|
||||
sudo groupadd dinstall
|
||||
sudo useradd -g dinstall -m -d /home/dmdba -s /bin/bash dmdba
|
||||
```
|
||||
|
||||
|
||||
disable selinux
|
||||
```bash
|
||||
sudo vim /etc/selinux/config
|
||||
```
|
||||
|
||||
limit
|
||||
```
|
||||
sudo vim /etc/security/limits.d/dmdba.conf
|
||||
dmdba soft nofile 65536
|
||||
dmdba hard nofile 65536
|
||||
dmdba soft nproc 4096
|
||||
dmdba hard nproc 63653
|
||||
dmdba soft core unlimited
|
||||
dmdba hard core unlimited
|
||||
|
||||
|
||||
```
|
||||
|
||||
install
|
||||
```bash
|
||||
|
||||
sudo mkdir -p /opt/db/dm
|
||||
|
||||
sudo chown -R dmdba:dinstall /opt/db/dm
|
||||
|
||||
sudo chmod -R 775 /opt/db/dm
|
||||
|
||||
su - dmdba
|
||||
|
||||
cd /opt/db/dm
|
||||
unzip dm8_20240408_x86_rh7_64_ent_8.1.3.140.zip
|
||||
Archive: dm8_20240408_x86_rh7_64_ent_8.1.3.140.zip
|
||||
inflating: dm8_20240408_x86_rh7_64.iso
|
||||
inflating: dm8_20240408_x86_rh7_64.iso_SHA256.txt
|
||||
|
||||
sudo mkdir /mnt/iso
|
||||
sudo mount -o loop /opt/db/dm/dm8_20240408_x86_rh7_64.iso /mnt/iso
|
||||
su - dmdba
|
||||
./DMInstall.bin -i
|
||||
Installer Language:
|
||||
[1]: 简体中文
|
||||
[2]: English
|
||||
Please select the installer's language [2]:
|
||||
Extract install files.........
|
||||
Welcome to DM DBMS Installer
|
||||
|
||||
Whether to input the path of Key File? (Y/y:Yes N/n:No) [Y/y]:n
|
||||
|
||||
Whether to Set The TimeZone? (Y/y:Yes N/n:No) [Y/y]:y
|
||||
TimeZone:
|
||||
[ 1]: (GTM-12:00) West Date Line
|
||||
[ 2]: (GTM-11:00) Samoa
|
||||
[ 3]: (GTM-10:00) Hawaii
|
||||
[ 4]: (GTM-09:00) Alaska
|
||||
[ 5]: (GTM-08:00) Pacific(America and Canada)
|
||||
[ 6]: (GTM-07:00) Arizona
|
||||
[ 7]: (GTM-06:00) Central(America and Canada)
|
||||
[ 8]: (GTM-05:00) East(America and Canada)
|
||||
[ 9]: (GTM-04:00) Atlantic(America and Canada)
|
||||
[10]: (GTM-03:00) Brasilia
|
||||
[11]: (GTM-02:00) Middle Atlantic
|
||||
[12]: (GTM-01:00) Azores
|
||||
[13]: (GTM) Greenwich Mean Time
|
||||
[14]: (GTM+01:00) Sarajevo
|
||||
[15]: (GTM+02:00) Cairo
|
||||
[16]: (GTM+03:00) Moscow
|
||||
[17]: (GTM+04:00) AbuDhabi
|
||||
[18]: (GTM+05:00) Islamabad
|
||||
[19]: (GTM+06:00) Dakar
|
||||
[20]: (GTM+07:00) BangKok,Hanoi
|
||||
[21]: (GTM+08:00) China
|
||||
[22]: (GTM+09:00) Seoul
|
||||
[23]: (GTM+10:00) Guam
|
||||
[24]: (GTM+11:00) Solomon
|
||||
[25]: (GTM+12:00) Fiji
|
||||
[26]: (GTM+13:00) Nukualofa
|
||||
[27]: (GTM+14:00) Kiribati
|
||||
Please Select the TimeZone [9]:21
|
||||
|
||||
Installation Type:
|
||||
1 Typical
|
||||
2 Server
|
||||
3 Client
|
||||
4 Custom
|
||||
Please Input the number of the Installation Type [1 Typical]:1
|
||||
Require Space: 2310M
|
||||
|
||||
Please Input the install path [/home/dmdba/dmdbms]:/opt/db/dm/dmdbms
|
||||
Available Space:32G
|
||||
Please Confirm the install path(/opt/db/dm/dmdbms)? (Y/y:Yes N/n:No) [Y/y]:y
|
||||
|
||||
Pre-Installation Summary
|
||||
Installation Location: /opt/db/dm/dmdbms
|
||||
Require Space: 2310M
|
||||
Available Space: 32G
|
||||
Version Information:
|
||||
Expire Date:
|
||||
Installation Type: Typical
|
||||
Confirm to Install? (Y/y:Yes N/n:No):y
|
||||
2024-06-28 04:55:28
|
||||
[INFO] Installing DM DBMS...
|
||||
2024-06-28 04:55:28
|
||||
[INFO] Installing BASE Module...
|
||||
2024-06-28 04:55:38
|
||||
[INFO] Installing SERVER Module...
|
||||
2024-06-28 04:55:41
|
||||
[INFO] Installing CLIENT Module...
|
||||
2024-06-28 04:55:46
|
||||
[INFO] Installing DRIVERS Module...
|
||||
2024-06-28 04:55:50
|
||||
[INFO] Installing MANUAL Module...
|
||||
2024-06-28 04:55:51
|
||||
[INFO] Installing SERVICE Module...
|
||||
2024-06-28 04:55:51
|
||||
[INFO] Move log file to log directory.
|
||||
2024-06-28 04:55:52
|
||||
[INFO] Installed DM DBMS completely.
|
||||
|
||||
Please execute the commands by root:
|
||||
/opt/db/dm/dmdbms/script/root/root_installer.sh
|
||||
|
||||
End
|
||||
|
||||
[dmdba@localhost iso]$ su -
|
||||
/opt/db/dm/dmdbms/script/root/root_installer.sh
|
||||
Move /opt/db/dm/dmdbms/bin/dm_svc.conf to /etc
|
||||
Create the DmAPService service
|
||||
Created symlink from /etc/systemd/system/multi-user.target.wants/DmAPService.service to /usr/lib/systemd/system/DmAPService.service.
|
||||
Finished to create the service (DmAPService)
|
||||
Start the DmAPService service
|
||||
|
||||
```
|
||||
|
||||
init db
|
||||
```bash
|
||||
cd /opt/db/dm/dmdbms/bin
|
||||
|
||||
./dminit PATH=/opt/db/dm/dmdbms/data DB_NAME=DMDB INSTANCE_NAME=DMDW PORT_NUM=5236
|
||||
initdb V8
|
||||
db version: 0x7000c
|
||||
file dm.key not found, use default license!
|
||||
License will expire on 2025-03-21
|
||||
Normal of FAST
|
||||
Normal of DEFAULT
|
||||
Normal of RECYCLE
|
||||
Normal of KEEP
|
||||
Normal of ROLL
|
||||
|
||||
log file path: /opt/db/dm/dmdbms/data/DMDB/DMDB01.log
|
||||
|
||||
|
||||
log file path: /opt/db/dm/dmdbms/data/DMDB/DMDB02.log
|
||||
|
||||
write to dir [/opt/db/dm/dmdbms/data/DMDB].
|
||||
create dm database success. 2024-06-28 05:18:08
|
||||
|
||||
cd /opt/db/dm/dmdbms/script/root
|
||||
su
|
||||
Password:
|
||||
[root@localhost root]# ls
|
||||
dm_service_installer.sh dm_service_uninstaller.sh root_installer.sh
|
||||
[root@localhost root]# pwd
|
||||
/opt/db/dm/dmdbms/script/root
|
||||
[root@localhost root]# ./dm_service_installer.sh -t dmserver -dm_ini /opt/db/dm/dmdbms/data/DMDB/dm.ini -p DMDW
|
||||
Created symlink from /etc/systemd/system/multi-user.target.wants/DmServiceDMDW.service to /usr/lib/systemd/system/DmServiceDMDW.service.
|
||||
Finished to create the service (DmServiceDMDW)
|
||||
|
||||
|
||||
```
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
token:
|
||||
g1mYHokq7pEGgP_z4_VU
|
||||
|
||||
http --pretty format "https://gitlab.int.it2000.com.cn/api/v4/projects/?simple=yes&per_page=1000&page=1" > project.json
|
||||
|
||||
curl --header "PRIVATE-TOKEN:g1mYHokq7pEGgP_z4_VU" "https://gitlab.int.it2000.com.cn/api/v4/projects/?simple=yes&private=true&per_page=1000&page=1" | jq > project.json
|
||||
|
||||
https://tableconvert.com/json-to-excel
|
||||
|
||||
|
||||
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
|
||||
|
||||
https://121.8.227.182:8988/
|
||||
|
||||
|
||||
admin
|
||||
|
||||
u3fPP*-N?pYGYLZT
|
||||
@@ -0,0 +1,7 @@
|
||||
https://nvd.nist.gov/developers/confirm-api-key?uuid=40BC52EA-8655-F011-835C-129478FCB64D
|
||||
|
||||
|
||||
API Key:
|
||||
```
|
||||
5933b86c-fe7c-4836-8959-345214c5a003
|
||||
```
|
||||
@@ -0,0 +1,508 @@
|
||||
|
||||
Certainly! I can guide you through the process of using **cfssl** (Cloudflare's PKI toolkit) to generate a self-signed Certificate Authority (CA) and server certificate for your Nacos server. Then, I'll show you how to import the CA certificate into your Spring Boot application's Docker container so that it trusts the Nacos server's certificate.
|
||||
|
||||
This approach provides a robust and manageable way to handle certificates, especially when dealing with multiple services and environments.
|
||||
|
||||
---
|
||||
|
||||
## **Overview**
|
||||
|
||||
1. **Install cfssl and cfssljson**: Set up the cfssl toolkit.
|
||||
2. **Generate a Self-Signed CA Certificate**: Create a root CA using cfssl.
|
||||
3. **Generate a Server Certificate for Nacos Signed by the CA**: Create a certificate for your Nacos server.
|
||||
4. **Configure the Nacos Server to Use the Server Certificate**: Set up Nacos to use the generated certificate.
|
||||
5. **Import the CA Certificate into Your Spring Boot Application's Docker Container**: Ensure your application trusts the Nacos server's certificate.
|
||||
6. **Configure Your Spring Boot Application**: Update settings to communicate with the Nacos server over HTTPS.
|
||||
7. **Test the Setup**: Verify that everything works as expected.
|
||||
|
||||
---
|
||||
|
||||
## **Prerequisites**
|
||||
|
||||
- **cfssl and cfssljson** installed on your system.
|
||||
- **Nacos server** installed and running.
|
||||
- **Docker** installed and configured.
|
||||
- **Spring Boot application** ready to be containerized.
|
||||
|
||||
---
|
||||
|
||||
## **Step 1: Install cfssl and cfssljson**
|
||||
|
||||
First, you need to install **cfssl** and **cfssljson**. These are command-line tools provided by Cloudflare for managing PKI.
|
||||
|
||||
### **1.1. Download the Binaries**
|
||||
|
||||
#### **For Linux:**
|
||||
|
||||
```bash
|
||||
# Download cfssl
|
||||
curl -L -o cfssl https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssl_linux-amd64
|
||||
|
||||
# Download cfssljson
|
||||
curl -L -o cfssljson https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssljson_linux-amd64
|
||||
```
|
||||
|
||||
#### **For macOS:**
|
||||
|
||||
```bash
|
||||
# Download cfssl
|
||||
curl -L -o cfssl https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssl_darwin-amd64
|
||||
|
||||
# Download cfssljson
|
||||
curl -L -o cfssljson https://github.com/cloudflare/cfssl/releases/download/v1.6.3/cfssljson_darwin-amd64
|
||||
```
|
||||
|
||||
### **1.2. Make the Binaries Executable**
|
||||
|
||||
```bash
|
||||
chmod +x cfssl cfssljson
|
||||
```
|
||||
|
||||
### **1.3. Move the Binaries to Your PATH**
|
||||
|
||||
```bash
|
||||
sudo mv cfssl cfssljson /usr/local/bin/
|
||||
```
|
||||
|
||||
Alternatively, you can add the directory containing `cfssl` and `cfssljson` to your `PATH`.
|
||||
|
||||
### **1.4. Verify Installation**
|
||||
|
||||
```bash
|
||||
cfssl version
|
||||
cfssljson -version
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Step 2: Generate a Self-Signed CA Certificate**
|
||||
|
||||
We'll create a self-signed CA certificate using cfssl.
|
||||
|
||||
### **2.1. Create a CA Configuration File (`ca-config.json`)**
|
||||
|
||||
Create a file named `ca-config.json` with the following content:
|
||||
|
||||
```json
|
||||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "8760h"
|
||||
},
|
||||
"profiles": {
|
||||
"nacos": {
|
||||
"expiry": "87600h",
|
||||
"usages": ["signing", "key encipherment", "server auth", "client auth"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### **2.2. Create a CA Certificate Signing Request (`ca-csr.json`)**
|
||||
|
||||
Create a file named `ca-csr.json` with the following content:
|
||||
|
||||
```json
|
||||
{
|
||||
"CN": "My Root CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 4096
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"ST": "State",
|
||||
"L": "City",
|
||||
"O": "YourOrganization",
|
||||
"OU": "YourUnit"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### **2.3. Generate the CA Certificate and Key**
|
||||
|
||||
Run the following command:
|
||||
|
||||
```bash
|
||||
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
|
||||
```
|
||||
|
||||
This command generates:
|
||||
|
||||
- `ca.pem`: The CA certificate.
|
||||
- `ca-key.pem`: The CA private key.
|
||||
- `ca.csr`: The CA certificate signing request (not needed further).
|
||||
|
||||
**Note:** Keep `ca-key.pem` secure and do not share it.
|
||||
|
||||
---
|
||||
|
||||
## **Step 3: Generate a Server Certificate for Nacos Signed by the CA**
|
||||
|
||||
### **3.1. Create a Server Certificate Signing Request (`nacos-csr.json`)**
|
||||
|
||||
Create a file named `nacos-csr.json` with the following content:
|
||||
|
||||
```json
|
||||
{
|
||||
"CN": "nacos.example.com",
|
||||
"hosts": [
|
||||
"nacos.example.com",
|
||||
"127.0.0.1",
|
||||
"192.168.1.100"
|
||||
],
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"ST": "State",
|
||||
"L": "City",
|
||||
"O": "YourOrganization",
|
||||
"OU": "YourUnit"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
- **`CN`**: Common Name. Should match the domain name used to access Nacos.
|
||||
- **`hosts`**: Include all DNS names and IP addresses that will be used to access the Nacos server.
|
||||
- Replace `"nacos.example.com"` and `"192.168.1.100"` with your server's actual domain and IP address.
|
||||
|
||||
### **3.2. Generate the Server Certificate and Key**
|
||||
|
||||
Run the following command:
|
||||
|
||||
```bash
|
||||
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=nacos nacos-csr.json | cfssljson -bare nacos
|
||||
```
|
||||
|
||||
This command generates:
|
||||
|
||||
- `nacos.pem`: The Nacos server certificate.
|
||||
- `nacos-key.pem`: The Nacos server private key.
|
||||
- `nacos.csr`: The Nacos server CSR (not needed further).
|
||||
|
||||
### **3.3. Verify the Certificates**
|
||||
|
||||
You can inspect the server certificate:
|
||||
|
||||
```bash
|
||||
openssl x509 -in nacos.pem -text -noout
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Step 4: Configure the Nacos Server to Use the Server Certificate**
|
||||
|
||||
Now, configure your Nacos server to use the generated `nacos.pem` and `nacos-key.pem` files.
|
||||
|
||||
### **4.1. Convert the Certificates to PKCS#12 Format (If Necessary)**
|
||||
|
||||
Some servers require certificates in PKCS#12 format.
|
||||
|
||||
```bash
|
||||
openssl pkcs12 -export -in nacos.pem -inkey nacos-key.pem -out nacos.p12 -name nacos -CAfile ca.pem -caname root -password pass:yourpassword
|
||||
```
|
||||
|
||||
- **`nacos.p12`**: The PKCS#12 keystore file.
|
||||
- **`yourpassword`**: Replace with a secure password.
|
||||
|
||||
### **4.2. Configure Nacos to Use SSL**
|
||||
|
||||
#### **Option A: Standalone Nacos (Embedded Tomcat)**
|
||||
|
||||
If you're running Nacos in standalone mode using embedded Tomcat, you can configure SSL in `application.properties` or `application.yml`.
|
||||
|
||||
**In `application.properties`:**
|
||||
|
||||
```properties
|
||||
server.port=8848
|
||||
server.ssl.enabled=true
|
||||
server.ssl.key-store=classpath:nacos.p12
|
||||
server.ssl.key-store-password=yourpassword
|
||||
server.ssl.key-store-type=PKCS12
|
||||
```
|
||||
|
||||
- **Note**: Place `nacos.p12` in the `classpath` (e.g., in the `resources` directory).
|
||||
|
||||
#### **Option B: Nacos with External Tomcat or Nginx**
|
||||
|
||||
If you're using an external server (like Tomcat or Nginx), configure it to use `nacos.pem` and `nacos-key.pem`.
|
||||
|
||||
**Example with Nginx:**
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name nacos.example.com;
|
||||
|
||||
ssl_certificate /path/to/nacos.pem;
|
||||
ssl_certificate_key /path/to/nacos-key.pem;
|
||||
ssl_client_certificate /path/to/ca.pem;
|
||||
ssl_verify_client off; # Change to 'on' if you want to verify client certificates
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:8848;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### **4.3. Restart the Nacos Server**
|
||||
|
||||
After configuring SSL, restart your Nacos server to apply the changes.
|
||||
|
||||
---
|
||||
|
||||
## **Step 5: Import the CA Certificate into Your Spring Boot Application's Docker Container**
|
||||
|
||||
Your Spring Boot application needs to trust the CA that signed the Nacos server's certificate. We'll import `ca.pem` into the Java trust store inside your Docker container.
|
||||
|
||||
### **5.1. Convert the CA Certificate to DER Format**
|
||||
|
||||
Java `keytool` requires certificates in DER format.
|
||||
|
||||
```bash
|
||||
openssl x509 -outform der -in ca.pem -out ca.der
|
||||
```
|
||||
|
||||
### **5.2. Update Your Dockerfile**
|
||||
|
||||
Modify your `Dockerfile` to include the CA certificate and import it into the Java trust store.
|
||||
|
||||
#### **Example Dockerfile:**
|
||||
|
||||
```dockerfile
|
||||
# Use an official OpenJDK runtime as a parent image
|
||||
FROM openjdk:17-jdk-slim
|
||||
|
||||
# Set the working directory
|
||||
WORKDIR /app
|
||||
|
||||
# Copy the application's JAR file into the container
|
||||
COPY target/your-application.jar /app/your-application.jar
|
||||
|
||||
# Copy the CA certificate into the container
|
||||
COPY ca.der /tmp/ca.der
|
||||
|
||||
# Import the CA certificate into Java's trust store
|
||||
RUN keytool -importcert \
|
||||
-alias myca \
|
||||
-keystore $JAVA_HOME/lib/security/cacerts \
|
||||
-file /tmp/ca.der \
|
||||
-storepass changeit \
|
||||
-noprompt
|
||||
|
||||
# Clean up the temporary certificate file
|
||||
RUN rm /tmp/ca.der
|
||||
|
||||
# Expose the application port
|
||||
EXPOSE 8080
|
||||
|
||||
# Run the application
|
||||
ENTRYPOINT ["java", "-jar", "/app/your-application.jar"]
|
||||
```
|
||||
|
||||
**Notes:**
|
||||
|
||||
- **`COPY ca.der /tmp/ca.der`**: Ensure `ca.der` is in the same directory as your `Dockerfile`.
|
||||
- **`$JAVA_HOME/lib/security/cacerts`**: Default Java trust store.
|
||||
- **`-storepass changeit`**: Default password for `cacerts`. Use the correct password if it's different.
|
||||
|
||||
### **5.3. Build the Docker Image**
|
||||
|
||||
```bash
|
||||
docker build -t your-application-image .
|
||||
```
|
||||
|
||||
### **5.4. Run the Docker Container**
|
||||
|
||||
```bash
|
||||
docker run -p 8080:8080 your-application-image
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Step 6: Configure Your Spring Boot Application**
|
||||
|
||||
Ensure your application is configured to communicate with the Nacos server over HTTPS.
|
||||
|
||||
### **6.1. Update Application Properties**
|
||||
|
||||
In your `application.properties` or `application.yml`, update the Nacos server address to use `https` and the correct port.
|
||||
|
||||
**Example (`application.properties`):**
|
||||
|
||||
```properties
|
||||
spring.cloud.nacos.server-addr=https://nacos.example.com:8848
|
||||
spring.cloud.nacos.username=your-username
|
||||
spring.cloud.nacos.password=your-password
|
||||
```
|
||||
|
||||
### **6.2. Disable Hostname Verification (If Necessary)**
|
||||
|
||||
If the hostname verification fails, you may need to disable it (not recommended for production).
|
||||
|
||||
Add the following JVM option:
|
||||
|
||||
```bash
|
||||
-Dcom.sun.net.ssl.checkRevocation=false -Djavax.net.ssl.trustStore=$JAVA_HOME/lib/security/cacerts
|
||||
```
|
||||
|
||||
Alternatively, set up a custom `HostnameVerifier` in your code.
|
||||
|
||||
---
|
||||
|
||||
## **Step 7: Test the Setup**
|
||||
|
||||
After starting your Docker container, test your application to ensure it communicates securely with the Nacos server.
|
||||
|
||||
- **Check Logs**: Look for any SSL-related errors.
|
||||
- **Verify Communication**: Ensure your application can register with Nacos or retrieve configurations.
|
||||
|
||||
---
|
||||
|
||||
## **Additional Considerations**
|
||||
|
||||
### **Using a Custom Trust Store**
|
||||
|
||||
Instead of modifying the default Java trust store (`cacerts`), you can create and use a custom trust store.
|
||||
|
||||
#### **5.2.1. Create a Custom Trust Store**
|
||||
|
||||
```dockerfile
|
||||
# Create a custom trust store and import the CA certificate
|
||||
RUN keytool -importcert \
|
||||
-alias myca \
|
||||
-keystore /app/truststore.jks \
|
||||
-file /tmp/ca.der \
|
||||
-storepass yourtruststorepassword \
|
||||
-noprompt
|
||||
```
|
||||
|
||||
#### **5.2.2. Set JVM Options to Use the Custom Trust Store**
|
||||
|
||||
```dockerfile
|
||||
# Set environment variable for JVM options
|
||||
ENV JAVA_OPTS="-Djavax.net.ssl.trustStore=/app/truststore.jks -Djavax.net.ssl.trustStorePassword=yourtruststorepassword"
|
||||
```
|
||||
|
||||
#### **5.2.3. Update the ENTRYPOINT**
|
||||
|
||||
```dockerfile
|
||||
ENTRYPOINT ["java", "$JAVA_OPTS", "-jar", "/app/your-application.jar"]
|
||||
```
|
||||
|
||||
### **Handling Sensitive Information**
|
||||
|
||||
Avoid hardcoding passwords in your `Dockerfile`. Use build arguments or environment variables.
|
||||
|
||||
#### **Using Build Arguments**
|
||||
|
||||
```dockerfile
|
||||
# Build argument for trust store password
|
||||
ARG TRUSTSTORE_PASS=yourtruststorepassword
|
||||
|
||||
# Use the build argument in the RUN command
|
||||
RUN keytool -importcert \
|
||||
-alias myca \
|
||||
-keystore /app/truststore.jks \
|
||||
-file /tmp/ca.der \
|
||||
-storepass $TRUSTSTORE_PASS \
|
||||
-noprompt
|
||||
|
||||
# Set JVM options
|
||||
ENV JAVA_OPTS="-Djavax.net.ssl.trustStore=/app/truststore.jks -Djavax.net.ssl.trustStorePassword=$TRUSTSTORE_PASS"
|
||||
```
|
||||
|
||||
Build the Docker image with:
|
||||
|
||||
```bash
|
||||
docker build --build-arg TRUSTSTORE_PASS=yourtruststorepassword -t your-application-image .
|
||||
```
|
||||
|
||||
### **Securing Private Keys**
|
||||
|
||||
- **Do Not Include Private Keys in Docker Images**: Ensure that `ca-key.pem` and `nacos-key.pem` are not copied into the Docker image.
|
||||
- **Secure Storage**: Store private keys securely and avoid committing them to version control.
|
||||
|
||||
---
|
||||
|
||||
## **Troubleshooting**
|
||||
|
||||
### **Common Issues and Solutions**
|
||||
|
||||
#### **SSLHandshakeException**
|
||||
|
||||
- **Cause**: The application doesn't trust the Nacos server's certificate.
|
||||
- **Solution**: Ensure the CA certificate is correctly imported into the trust store.
|
||||
|
||||
#### **Hostname Verification Failure**
|
||||
|
||||
- **Cause**: The hostname used to access the Nacos server doesn't match the `CN` or `hosts` in the certificate.
|
||||
- **Solution**:
|
||||
- Ensure the Nacos server's domain matches the `CN` or is included in the `hosts` field.
|
||||
- Use the correct domain or IP address when accessing the server.
|
||||
- As a temporary measure, disable hostname verification (not recommended for production).
|
||||
|
||||
#### **Keytool Not Found**
|
||||
|
||||
- **Cause**: `keytool` is not available in the base Docker image.
|
||||
- **Solution**: Use a JDK-based Docker image (e.g., `openjdk:17-jdk-slim`) instead of a JRE image.
|
||||
|
||||
#### **Incorrect Keystore Password**
|
||||
|
||||
- **Cause**: Wrong `storepass` used when importing the certificate.
|
||||
- **Solution**: Verify the trust store password.
|
||||
|
||||
#### **Certificate Not Found**
|
||||
|
||||
- **Cause**: The certificate file is not correctly copied or the path is incorrect.
|
||||
- **Solution**: Verify the `COPY` command and file paths in the `Dockerfile`.
|
||||
|
||||
### **Testing the Trust Store**
|
||||
|
||||
List the certificates in the trust store to confirm the import:
|
||||
|
||||
```dockerfile
|
||||
RUN keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **Summary**
|
||||
|
||||
By using **cfssl**, you've:
|
||||
|
||||
- Created a self-signed CA certificate.
|
||||
- Generated a server certificate for your Nacos server signed by the CA.
|
||||
- Configured your Nacos server to use the new SSL certificate.
|
||||
- Imported the CA certificate into your Spring Boot application's Docker container, ensuring trust.
|
||||
- Configured your application to communicate with the Nacos server over HTTPS.
|
||||
|
||||
This setup enhances security by establishing a trusted SSL connection between your application and the Nacos server.
|
||||
|
||||
---
|
||||
|
||||
## **Next Steps**
|
||||
|
||||
- **Automate Certificate Management**: Consider automating certificate renewal and distribution.
|
||||
- **Use a Trusted CA in Production**: For production environments, obtain certificates from a trusted Certificate Authority.
|
||||
- **Monitor SSL Connections**: Implement monitoring to detect and resolve SSL issues promptly.
|
||||
|
||||
---
|
||||
|
||||
## **References**
|
||||
|
||||
- [cfssl GitHub Repository](https://github.com/cloudflare/cfssl)
|
||||
- [Nacos Documentation](https://nacos.io/en-us/docs/what-is-nacos.html)
|
||||
- [Spring Boot SSL Configuration](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto-configure-ssl)
|
||||
|
||||
---
|
||||
|
||||
Feel free to ask if you have any questions or need further assistance with any of the steps!
|
||||
@@ -0,0 +1,63 @@
|
||||
BEGIN
|
||||
DBMS_WORKLOAD_REPOSITORY.modify_snapshot_settings(
|
||||
retention => 7 * 24 * 60, -- Retain snapshots for 7 days
|
||||
interval => 60 -- Collect snapshot every 60 minutes
|
||||
);
|
||||
END;
|
||||
/
|
||||
|
||||
|
||||
BEGIN
|
||||
DBMS_WORKLOAD_REPOSITORY.modify_snapshot_settings(
|
||||
retention => 7 * 24 * 60,
|
||||
interval => 60
|
||||
);
|
||||
END;
|
||||
/
|
||||
|
||||
|
||||
EXEC DBMS_STATS.alter_stats_history_retention(RETENTION => 7);
|
||||
|
||||
4gu1ln
|
||||
|
||||
|
||||
SELECT table_name,
|
||||
bytes / 1024 / 1024 AS size_mb,
|
||||
blocks,
|
||||
extents
|
||||
FROM dba_segments
|
||||
WHERE segment_type = 'TABLE'
|
||||
AND tablespace_name = 'USERS'
|
||||
ORDER BY bytes DESC;
|
||||
|
||||
SELECT segment_name AS table_name,
|
||||
bytes / 1024 / 1024 AS size_mb,
|
||||
blocks,
|
||||
extents
|
||||
FROM dba_segments
|
||||
WHERE segment_type = 'TABLE'
|
||||
AND tablespace_name = 'USERS'
|
||||
ORDER BY bytes DESC;
|
||||
|
||||
|
||||
ALTER TABLE enforce_center.SHR_DATA_SWITCH_LOGS ENABLE ROW MOVEMENT;
|
||||
ALTER TABLE enforce_center.SHR_DATA_SWITCH_LOGS SHRINK SPACE;
|
||||
|
||||
|
||||
|
||||
SELECT segment_name AS index_name,
|
||||
owner,
|
||||
bytes / 1024 / 1024 AS size_mb,
|
||||
blocks,
|
||||
extents
|
||||
FROM dba_segments
|
||||
WHERE segment_type = 'INDEX'
|
||||
AND tablespace_name = 'ENFORCE_CENTER'
|
||||
ORDER BY size_mb DESC;
|
||||
|
||||
|
||||
ALTER INDEX ENFORCE_CENTER.PERSON_INDEX REBUILD;
|
||||
|
||||
|
||||
|
||||
DROP TABLE ENFORCE_CENTER.PATROL_DOC_copy1 PURGE;
|
||||
@@ -0,0 +1,9 @@
|
||||
|
||||
```sql
|
||||
ALTER SESSION SET CURRENT_SCHEMA=enforce_center;
|
||||
|
||||
ALTER SESSION SET sql_trace = TRUE;
|
||||
|
||||
|
||||
```
|
||||
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
|
||||
|
||||
# Rustdesk
|
||||
## GZZN OFFICE
|
||||
|
||||
### win 10 desktop
|
||||
1259681763
|
||||
```
|
||||
w42YyME_y3jVb!qa4X.c
|
||||
```
|
||||
|
||||
### opensuse desktop
|
||||
11 439 584:
|
||||
```
|
||||
uW!g6CU6kteozaHUaJX*
|
||||
```
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
|
||||
|
||||
```bash
|
||||
$ cosign generate-key-pair
|
||||
Enter password for private key:
|
||||
Enter password for private key again:
|
||||
Private key written to cosign.key
|
||||
Public key written to cosign.pub
|
||||
|
||||
```
|
||||
password: windyboy
|
||||
@@ -0,0 +1,32 @@
|
||||
|
||||
|
||||
自制精简优化Windows 10 LTSC2021简体中文版
|
||||
—————————————————————————————————————————
|
||||
文件名称: WIN10_LTSC2021_X64_ZH-CN_19044.1387.iso
|
||||
文件大小: 3.34 GB (3,592,355,840 字节)
|
||||
修改时间: 2021年11月30日
|
||||
MD5: 9BFFE3984F14CC8F4ACA1F465636F2D3
|
||||
SHA256: B9451EE3383DAAF3C7AC21DF18DA700F9BC9BAEF310A158B4151F668B980C9CF
|
||||
CRC32: C27756CF
|
||||
—————————————————————————————————————————
|
||||
|
||||
KMS激活命令：以管理员身份运行CMD（命令提示符）
|
||||
—————————————————————————————————————————
|
||||
slmgr /skms kms.03k.org
|
||||
slmgr /ato
|
||||
—————————————————————————————————————————
|
||||
|
||||
下载链接
|
||||
—————————————————————————————————————————
|
||||
阿里云盘：https://www.aliyundrive.com/s/rVRSBYc85Xe （下载文件后去掉后缀.PDF）
|
||||
百度云盘：https://pan.baidu.com/s/1Nlh_3A-yvqZW2l6dq0hE2g（提取码: ifbs）
|
||||
|
||||
|
||||
|
||||
|
||||
```
|
||||
|
||||
sudo mkdir -p /var/lib/libvirt/qemu/smb
|
||||
sudo mount --bind /home/fengzhiqiang/shared /var/lib/libvirt/qemu/smb
|
||||
|
||||
```
|
||||
@@ -0,0 +1,131 @@
|
||||
|
||||
|
||||
To integrate Forgejo running in a Docker container with the host's SSH server, follow these steps:
|
||||
|
||||
### Step 1: Disable Forgejo's Internal SSH Server
|
||||
In your `docker-compose.yml` file, add the environment variable to disable Forgejo's internal SSH server:
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- FORGEJO__server__START_SSH_SERVER=false
|
||||
```
|
||||
|
||||
### Step 2: Configure the Host SSH Server
|
||||
Add a dedicated user for Forgejo (e.g., `git`) on your host:
|
||||
|
||||
```bash
|
||||
sudo adduser --disabled-password --gecos 'Forgejo' git
|
||||
```
|
||||
|
||||
Update the SSH configuration in `/etc/ssh/sshd_config`:
|
||||
|
||||
```bash
|
||||
Match User git
|
||||
AllowTcpForwarding yes
|
||||
X11Forwarding no
|
||||
PermitTunnel no
|
||||
AllowAgentForwarding no
|
||||
ForceCommand docker exec -i forgejo /app/gitea/gitea serv key-$SSH_ORIGINAL_COMMAND
|
||||
```
|
||||
|
||||
Restart the SSH server:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart sshd
|
||||
```
|
||||
|
||||
### Step 3: Update Forgejo Configuration
|
||||
Ensure that Forgejo's SSH domain and port in the configuration match your host's SSH settings. You can do this in the Forgejo web interface or by modifying the `app.ini` file within the container.
|
||||
|
||||
This setup allows Forgejo to use the host's SSH server for Git operations while running in a Docker container.
|
||||
|
||||
|
||||
|
||||
create user
|
||||
```bash
|
||||
docker exec forgejo forgejo admin user create --username fengzhiqiang --password admingzzn --email fengzhq@it2000.com.cn --admin
|
||||
```
|
||||
|
||||
|
||||
email
|
||||
```
|
||||
HOST = smtp.exmail.qq.com:465
|
||||
FROM = server@it2000.com.cn
|
||||
USER = server@it2000.com.cn
|
||||
PASSWD = Gzzn1234
|
||||
|
||||
```
|
||||
|
||||
|
||||
freeipa:
|
||||
add user forgejo/forgejopass for bind
|
||||
|
||||
|
||||
To add FreeIPA LDAP as an authentication source in Forgejo, follow these steps:
|
||||
|
||||
## Prerequisites
|
||||
|
||||
1. **FreeIPA Server**: Ensure you have a FreeIPA server set up and running.
|
||||
2. **Forgejo Installation**: Have Forgejo installed and accessible.
|
||||
|
||||
## Configuration Steps
|
||||
|
||||
### 1. Create a Bind Account in FreeIPA
|
||||
|
||||
- **Create a gitea.ldif file** on the FreeIPA server, replacing `dc=example,dc=com` with your DN, and provide an appropriately secure password:
|
||||
|
||||
```ldif
|
||||
dn: uid=gitea,cn=sysaccounts,cn=etc,dc=example,dc=com
|
||||
changetype: add
|
||||
objectclass: account
|
||||
objectclass: simplesecurityobject
|
||||
uid: gitea
|
||||
userPassword: secure password
|
||||
passwordExpirationTime: 20380119031407Z
|
||||
nsIdleTimeout: 0
|
||||
```
|
||||
|
||||
- **Import the LDIF** (change localhost to an IPA server if needed). Provide the Directory Manager password when prompted:
|
||||
|
||||
```bash
|
||||
ldapmodify -h localhost -p 389 -x -D "cn=Directory Manager" -W -f gitea.ldif
|
||||
```
|
||||
|
||||
- **Add an IPA group for gitea_users**:
|
||||
|
||||
```bash
|
||||
ipa group-add --desc="Gitea Users" gitea_users
|
||||
```
|
||||
|
||||
### 2. Configure Forgejo
|
||||
|
||||
- **Log in to Forgejo as an Administrator** and navigate to Admin Panel > Authentication.
|
||||
- **Click on "Add New Source"** and select "LDAP (via BindDN)".
|
||||
- **Fill in the following fields**, changing all where appropriate:
|
||||
|
||||
- **Authorization Name**: FreeIPA
|
||||
- **Host**: `ldap://<your-freeipa-server>`
|
||||
- **Port**: 389
|
||||
- **Bind DN**: `uid=gitea,cn=sysaccounts,cn=etc,dc=example,dc=com`
|
||||
- **Bind Password**: secure password
|
||||
- **User Search Base**: `ou=Users,dc=example,dc=com`
|
||||
- **User Filter**: `(&(objectClass=posixAccount)(uid=%s))`
|
||||
- **Admin Filter**: `(memberOf=cn=gitea_users,cn=groups,cn=accounts,dc=example,dc=com)`
|
||||
- **Username Attribute**: uid
|
||||
- **First Name Attribute**: givenName
|
||||
- **Surname Attribute**: sn
|
||||
- **Email Attribute**: mail
|
||||
|
||||
- **Save the changes** and test the authentication by logging out and trying to log in with a FreeIPA user account.
|
||||
|
||||
By following these steps, you can successfully integrate FreeIPA LDAP as an authentication source in Forgejo, allowing users to log in with their FreeIPA credentials.
|
||||
|
||||
Citations:
|
||||
[1] https://www.reddit.com/r/FreeIPA/comments/1ax8te1/can_i_use_an_existing_ldap_server_as_a_source_of/
|
||||
[2] https://github.com/freeipa/freeipa
|
||||
[3] https://freeipa.readthedocs.io/en/latest/designs/external-idp/external-idp.html
|
||||
[4] https://fossies.org/linux/forgejo/docs/content/usage/authentication.en-us.md
|
||||
[5] https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
||||
[6] https://huijzer.xyz/posts/forgejo-setup/
|
||||
[7] https://forum.yunohost.org/t/how-to-authenticate-to-foregjo-over-https/25444
|
||||
[8] https://forgejo.org/docs/latest/admin/email-setup/
|
||||
@@ -0,0 +1,31 @@
|
||||
|
||||
|
||||
install:
|
||||
|
||||
```bash
|
||||
|
||||
sudo ipa-server-install --domain=int.it2000.com.cn \
|
||||
--ds-password=admingzzn \
|
||||
--admin-password=admingzzn \
|
||||
--hostname=ipa.int.it2000.com.cn \
|
||||
--ip-address=10.100.100.2 \
|
||||
--setup-dns
|
||||
```
|
||||
|
||||
|
||||
coolpit ssl:
|
||||
|
||||
```bash
|
||||
ipa-getcert request -f /etc/cockpit/ws-certs.d/$(hostname -f).cert -k /etc/cockpit/ws-certs.d/$(hostname -f).key -D $(hostname -f) -K host/$(hostname -f) -m 0640 -o root:cockpit-ws -O root:root -M 0644
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
ipa-getcert list
|
||||
```
|
||||
|
||||
|
||||
change user password:
|
||||
```bash
|
||||
ipa user-mod (user) --password
|
||||
```
|
||||
@@ -0,0 +1,4 @@
|
||||
|
||||
```
|
||||
sudo nmcli con add type ethernet slave-type bridge con-name br0-port-eno1 ifname eno1 master br0
|
||||
```
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
|
||||
[[什麼是SBOM (軟體物料清單)？ - 網路安全解決方案 - 艾索科技]]
|
||||
|
||||
[[如何使用微软的开源工具生成 SBOM - 知乎]]
|
||||
Executable
+125
@@ -0,0 +1,125 @@
|
||||
|
||||
|
||||
# install
|
||||
## prepare
|
||||
|
||||
### user and group
|
||||
```bash
|
||||
groupadd dinstall -g 2001
|
||||
useradd -G dinstall -m -d /home/dmdba -s /bin/bash -u 2001 dmdba
|
||||
passwd dmdba
|
||||
```
|
||||
|
||||
### limit
|
||||
|
||||
```bash
|
||||
vi /etc/security/limits.conf
|
||||
```
|
||||
|
||||
```limits.conf
|
||||
dmdba soft nice 0
|
||||
dmdba hard nice 0
|
||||
dmdba soft as unlimited
|
||||
dmdba hard as unlimited
|
||||
dmdba soft fsize unlimited
|
||||
dmdba hard fsize unlimited
|
||||
dmdba soft nproc 65536
|
||||
dmdba hard nproc 65536
|
||||
dmdba soft nofile 65536
|
||||
dmdba hard nofile 65536
|
||||
dmdba soft core unlimited
|
||||
dmdba hard core unlimited
|
||||
dmdba soft data unlimited
|
||||
dmdba hard data unlimited
|
||||
```
|
||||
|
||||
restart
|
||||
|
||||
```bash
|
||||
restart
|
||||
```
|
||||
|
||||
check
|
||||
```bash
|
||||
su - dmdba
|
||||
ulimit -a
|
||||
```
|
||||
|
||||
### database directories
|
||||
|
||||
```bash
|
||||
mkdir /opt/dmdata
|
||||
chown dmdba:dinstall /opt/dmdata
|
||||
mkdir data arch backup
|
||||
chown dmdba:dinstall data
|
||||
chown dmdba:dinstall arch
|
||||
chown dmdba:dinstall backup
|
||||
chmod 755 data
|
||||
chmod 755 arch
|
||||
chmod 755 backup
|
||||
```
|
||||
|
||||
## mount iso
|
||||
|
||||
```bash
|
||||
cd /opt
|
||||
mkdir iso
|
||||
mount -o loop dm8_20240712_HWarm920_kylin10_64.iso /opt/iso
|
||||
```
|
||||
|
||||
## command line install
|
||||
|
||||
```bash
|
||||
cd /opt/iso
|
||||
./DMInstall.bin -i
|
||||
```
|
||||
|
||||
按需求选择安装语言，
|
||||
没有 key 文件选择 "n"，
|
||||
时区按需求选择一般选择 “21”，
|
||||
安装类型选择“1”，
|
||||
安装目录按实际情况配置，这里示例使用默认安装位置 /home/dmdba/dmdbms
|
||||
|
||||
### execute as root
|
||||
```bash
|
||||
/home/dmdba/dmdbms/script/root/root_installer.sh
|
||||
```
|
||||
|
||||
|
||||
## dmdba env
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba
|
||||
vim .bash_profile
|
||||
```
|
||||
|
||||
```.bash_profile
|
||||
export DM_HOME=/home/dmdba/dmdbms
|
||||
export LD_LIBRARY_PATH=$LD_LIBRARY_PD:$DM_HOME/bin
|
||||
export PATH=$PATH:$DM_HOME/bin:$DM_HOME/tool
|
||||
```
|
||||
|
||||
|
||||
## create instance
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
source ~/.bash_profile
|
||||
dminit path=/optdmdata/data PAGE_SIZE=32 EXTENT_SIZE=32 CASE_SENSITIVE=y CHARSET=1 DB_NAME=DM8 INSTANCE_NAME=DBSERVER PORT_NUM=5236
|
||||
```
|
||||
|
||||
## install service
|
||||
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/script/root
|
||||
./dm_service_uninstaller.sh -t dmserver -dm_ini /opt/dmdata/data/DMDB/dm.ini -p 8
|
||||
```
|
||||
|
||||
uninstall
|
||||
```bash
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/script/root
|
||||
./dm_service_uninstaller.sh -t dmserver -dm_ini /opt/dmdata/data/DMDB/dm.ini -p 8
|
||||
```
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
|
||||
|
||||
https://14.23.127.26
|
||||
兼容模式
|
||||
|
||||
用户名：gdyt_lm
|
||||
密码：GDyt@lm
|
||||
|
||||
gdyt_lzy
|
||||
GDyt@lzy
|
||||
|
||||
|
||||
堡垒机访问地址：https://10.201.201.201
|
||||
账号：gzschyjglj
|
||||
初始密码：Pass@XC#202304
|
||||
Executable
+405
@@ -0,0 +1,405 @@
|
||||
|
||||
|
||||
|
||||
---
|
||||
|
||||
# 🧭 GCC 13.3.0 从源码构建指南（适用于 Kylin Linux Advanced Server V10 / RHEL 系）
|
||||
|
||||
目标：在 `/opt/gcc-13` 构建一套完全独立的新 GCC，不覆盖系统自带版本。
|
||||
附带可选 `/opt/binutils-2.40`，用于提升链接器兼容性。
|
||||
|
||||
---
|
||||
|
||||
## 一、系统准备
|
||||
|
||||
### 1️⃣ 更新系统并安装构建依赖
|
||||
|
||||
```bash
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y \
|
||||
gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel \
|
||||
gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
```
|
||||
|
||||
> 若系统仓库的 `gmp/mpfr/mpc/isl` 太旧，也没关系，下面会采用 **内联构建**。
|
||||
|
||||
---
|
||||
|
||||
## 二、可选但推荐：升级 binutils (2.40)
|
||||
|
||||
### 2️⃣ 构建并安装
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/binutils/binutils-2.40.tar.gz
|
||||
tar -xzf binutils-2.40.tar.gz
|
||||
mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
|
||||
../binutils-2.40/configure \
|
||||
--prefix=/usr/local/binutils-2.40 \
|
||||
--disable-multilib \
|
||||
--enable-gold \
|
||||
--enable-ld=default \
|
||||
--enable-plugins
|
||||
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
### 3️⃣ 激活新版 binutils
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/binutils-2.40/bin:$PATH
|
||||
```
|
||||
|
||||
验证：
|
||||
|
||||
```bash
|
||||
ld --version | head -1
|
||||
as --version | head -1
|
||||
```
|
||||
|
||||
输出应含 “2.40”。
|
||||
|
||||
> ✅ 若系统已有较新 binutils，可跳过本节。
|
||||
|
||||
---
|
||||
|
||||
## 三、下载并准备 GCC 13.3.0 源码
|
||||
|
||||
### 4️⃣ 获取源码
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
wget https://mirrors.aliyun.com/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0
|
||||
```
|
||||
|
||||
### 5️⃣ 下载依赖库（推荐）
|
||||
|
||||
```bash
|
||||
./contrib/download_prerequisites
|
||||
```
|
||||
|
||||
该脚本会自动下载合适的：
|
||||
|
||||
- GMP
|
||||
|
||||
- MPFR
|
||||
|
||||
- MPC
|
||||
|
||||
- ISL
|
||||
|
||||
|
||||
> 若离线环境，可在其他机器下载后放到以下目录：
|
||||
>
|
||||
> ```
|
||||
> gcc-13.3.0/gmp/
|
||||
> gcc-13.3.0/mpfr/
|
||||
> gcc-13.3.0/mpc/
|
||||
> gcc-13.3.0/isl/
|
||||
> ```
|
||||
|
||||
---
|
||||
|
||||
```
|
||||
cat > contrib/download_prerequisites <<'EOF'
|
||||
#!/bin/sh
|
||||
# Modified for Aliyun GNU mirror + official ISL source (SourceForge)
|
||||
# Author: windyboy setup helper
|
||||
|
||||
set -e
|
||||
|
||||
gmp='gmp-6.2.1.tar.bz2'
|
||||
mpfr='mpfr-4.1.0.tar.bz2'
|
||||
mpc='mpc-1.2.1.tar.gz'
|
||||
isl='isl-0.24.tar.bz2'
|
||||
|
||||
fetch='wget -c --no-check-certificate'
|
||||
|
||||
# 阿里云 GNU 镜像基础路径
|
||||
base="https://mirrors.aliyun.com/gnu"
|
||||
|
||||
download() {
|
||||
pkg=$1
|
||||
url=$2
|
||||
echo "==> Downloading $pkg"
|
||||
${fetch} "$url" -O "$pkg" || {
|
||||
echo "❌ Failed: $pkg"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
download "$gmp" "$base/gmp/$gmp"
|
||||
download "$mpfr" "$base/mpfr/$mpfr"
|
||||
download "$mpc" "$base/mpc/$mpc"
|
||||
download "$isl" "https://libisl.sourceforge.io/$isl"
|
||||
|
||||
echo "==> Extracting..."
|
||||
for ar in $gmp $mpfr $mpc $isl; do
|
||||
tar -xf "$ar"
|
||||
ln -sf "${ar%.tar*}" "${ar%-*}"
|
||||
done
|
||||
|
||||
echo "✅ All prerequisites downloaded and extracted successfully (Aliyun + SourceForge)."
|
||||
EOF
|
||||
|
||||
chmod +x contrib/download_prerequisites
|
||||
```
|
||||
|
||||
|
||||
## 四、构建并安装 GCC 13.3.0
|
||||
|
||||
### 6️⃣ 创建构建目录（out-of-tree）
|
||||
|
||||
```bash
|
||||
cd soft
|
||||
mkdir build-gcc-13 && cd build-gcc-13
|
||||
```
|
||||
|
||||
### 7️⃣ 配置参数
|
||||
|
||||
```bash
|
||||
../gcc-13.3.0/configure \
|
||||
--prefix=/usr/local/gcc-13 \
|
||||
--enable-languages=c,c++ \
|
||||
--disable-multilib \
|
||||
--enable-checking=release \
|
||||
--enable-lto \
|
||||
--enable-threads=posix \
|
||||
--with-system-zlib
|
||||
```
|
||||
|
||||
|
||||
说明：
|
||||
|
||||
- `--disable-multilib`：仅构建 64 位版，节省空间、避免冲突
|
||||
|
||||
- `--enable-lto`：启用 Link Time Optimization
|
||||
|
||||
- `--enable-threads=posix`：标准线程支持
|
||||
|
||||
- `--with-system-zlib`：若安装了 zlib-devel
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 8️⃣ 编译与安装
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
make install
|
||||
```
|
||||
|
||||
💡 **提示：**
|
||||
|
||||
- 首次编译耗时较久（15–60 分钟）。
|
||||
|
||||
- 若出现 OOM，可降并行度：
|
||||
|
||||
```bash
|
||||
sudo make -j4
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 五、启用与测试新 GCC
|
||||
|
||||
### 9️⃣ 临时启用
|
||||
|
||||
```bash
|
||||
export PATH=/usr/local/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/usr/local/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
### 🔟 验证版本
|
||||
|
||||
```bash
|
||||
gcc -v
|
||||
g++ -v
|
||||
```
|
||||
|
||||
应显示：
|
||||
|
||||
```
|
||||
gcc version 13.3.0 (GCC)
|
||||
```
|
||||
|
||||
测试代码：
|
||||
|
||||
```bash
|
||||
cat > hello.cpp <<'EOF'
|
||||
#include <iostream>
|
||||
int main() { std::cout << "Hello GCC " << __VERSION__ << std::endl; }
|
||||
EOF
|
||||
g++ -std=c++20 hello.cpp -O2 -o hello
|
||||
./hello
|
||||
```
|
||||
|
||||
输出应为：
|
||||
|
||||
```
|
||||
Hello GCC 13.3.0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 六、长期使用与并存管理
|
||||
|
||||
### 11️⃣ 持久化环境变量
|
||||
|
||||
**用户级：**
|
||||
|
||||
```bash
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' >> ~/.bashrc
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
**系统级（所有用户生效）：**
|
||||
|
||||
```bash
|
||||
sudo tee /etc/profile.d/gcc13.sh <<'EOF'
|
||||
export PATH=/opt/gcc-13/bin:$PATH
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
EOF
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 12️⃣ 运行时库兼容性（关键）
|
||||
|
||||
若运行你的程序时报：
|
||||
|
||||
```
|
||||
GLIBCXX_3.x.y not found
|
||||
```
|
||||
|
||||
说明运行期加载了系统旧版 libstdc++。
|
||||
解决办法：
|
||||
|
||||
1. 临时解决：
|
||||
|
||||
```bash
|
||||
export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH
|
||||
```
|
||||
|
||||
2. 编译期内嵌 rpath：
|
||||
|
||||
```bash
|
||||
g++ main.cpp -Wl,-rpath=/opt/gcc-13/lib64 -O2 -o app
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 七、常见问题与修复要点
|
||||
|
||||
|问题|原因|解决方案|
|
||||
|---|---|---|
|
||||
|`configure: error: GMP/MPFR/MPC not found`|系统库过旧或缺失|使用 `contrib/download_prerequisites`|
|
||||
|`collect2: error: ld returned 1 exit status`|binutils 太旧|启用 `/opt/binutils-2.40` 并确认 PATH|
|
||||
|`checking for sufficient default stack space... no`|栈空间不足|执行 `ulimit -s unlimited`|
|
||||
|`cc1plus: out of memory`|并行过高或 swap 不足|降低并行度、添加 swap|
|
||||
|
||||
---
|
||||
|
||||
## 八、验证构建质量（可选）
|
||||
|
||||
自检：
|
||||
|
||||
```bash
|
||||
cd /usr/local/src/build-gcc-13
|
||||
sudo make -k check > test.log 2>&1
|
||||
grep -A2 "Summary" test.log
|
||||
```
|
||||
|
||||
成功率通常 > 99%，剩余测试多为非致命的浮点容差差异。
|
||||
|
||||
---
|
||||
|
||||
## ✅ 总结：完整流程一览
|
||||
|
||||
```bash
|
||||
# 一次性复现构建流程 (示例版)
|
||||
sudo dnf groupinstall "Development Tools" -y
|
||||
sudo dnf install -y gcc gcc-c++ make bison flex texinfo git wget curl xz gawk perl python3 \
|
||||
glibc-devel glibc-headers libstdc++-devel zlib-devel gmp-devel mpfr-devel libmpc-devel isl-devel
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/binutils/binutils-2.40.tar.xz
|
||||
sudo tar -xf binutils-2.40.tar.xz
|
||||
sudo mkdir build-binutils-2.40 && cd build-binutils-2.40
|
||||
sudo ../binutils-2.40/configure --prefix=/opt/binutils-2.40 --disable-multilib --enable-gold --enable-ld=default --enable-plugins
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
export PATH=/opt/binutils-2.40/bin:$PATH
|
||||
|
||||
cd /usr/local/src
|
||||
sudo wget https://ftp.gnu.org/gnu/gcc/gcc-13.3.0/gcc-13.3.0.tar.xz
|
||||
sudo tar -xf gcc-13.3.0.tar.xz
|
||||
cd gcc-13.3.0 && ./contrib/download_prerequisites
|
||||
|
||||
cd /usr/local/src && sudo mkdir build-gcc-13 && cd build-gcc-13
|
||||
sudo ../gcc-13.3.0/configure --prefix=/opt/gcc-13 --enable-languages=c,c++ --disable-multilib \
|
||||
--enable-checking=release --enable-lto --enable-threads=posix --with-system-zlib
|
||||
sudo make -j"$(nproc)" && sudo make install
|
||||
|
||||
echo 'export PATH=/opt/gcc-13/bin:$PATH' | sudo tee /etc/profile.d/gcc13.sh
|
||||
echo 'export LD_LIBRARY_PATH=/opt/gcc-13/lib64:$LD_LIBRARY_PATH' | sudo tee -a /etc/profile.d/gcc13.sh
|
||||
sudo chmod +x /etc/profile.d/gcc13.sh
|
||||
source /etc/profile.d/gcc13.sh
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
是否希望我把上述完整命令整理成 **一键可执行的 build-gcc13.sh 脚本**（带错误检查、日志输出、并自动检测是否已安装 binutils）？
|
||||
这样你只需运行一行命令即可完成全部流程。
|
||||
|
||||
|
||||
openssl
|
||||
|
||||
```
|
||||
./Configure --prefix=/usr/local/openssl-3 \
|
||||
--openssldir=/usr/local/openssl-3/ssl \
|
||||
shared zlib \
|
||||
enable-ec_nistp_64_gcc_128 \
|
||||
enable-tls1_3
|
||||
```
|
||||
|
||||
```
|
||||
make -j$(nproc)
|
||||
make install
|
||||
```
|
||||
|
||||
```
|
||||
export CC=/usr/local/gcc-13/bin/gcc
|
||||
export CXX=/usr/local/gcc-13/bin/g++
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib64"
|
||||
```
|
||||
|
||||
```
|
||||
echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl-3.conf
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
export CPPFLAGS="-I/usr/local/openssl-3/include"
|
||||
export LDFLAGS="-L/usr/local/openssl-3/lib -Wl,-rpath=/usr/local/openssl-3/lib"
|
||||
export PKG_CONFIG_PATH="/usr/local/openssl-3/lib/pkgconfig"
|
||||
export LD_LIBRARY_PATH="/usr/local/openssl-3/lib:$LD_LIBRARY_PATH"
|
||||
export PATH="/usr/local/openssl-3/bin:$PATH"
|
||||
|
||||
./configure \
|
||||
--prefix=/usr/local/openssh-10 \
|
||||
--sysconfdir=/usr/local/openssh-10/etc \
|
||||
--with-ssl-dir=/usr/local/openssl-3 \
|
||||
--with-pam \
|
||||
--with-md5-passwords
|
||||
|
||||
```
|
||||
Executable
+75
@@ -0,0 +1,75 @@
|
||||
easyconnect
|
||||
https://218.20.201.210
|
||||
|
||||
gwjhgzzn
|
||||
Pygwjh@202409
|
||||
|
||||
|
||||
|
||||
10.160.20.112
|
||||
root：
|
||||
```
|
||||
gZ112gw$jH0510M
|
||||
```
|
||||
|
||||
|
||||
10.160.20.113
|
||||
root:
|
||||
```
|
||||
gZgw$jH0510M113
|
||||
```
|
||||
|
||||
10.160.20.114
|
||||
root:
|
||||
```
|
||||
114gZgw$jH0510M
|
||||
```
|
||||
|
||||
10.160.20.115
|
||||
root:
|
||||
```
|
||||
gZg115w$jH0510M
|
||||
```
|
||||
|
||||
10.160.20.116
|
||||
root:
|
||||
```
|
||||
gZgw116$jH0510M
|
||||
```
|
||||
|
||||
10.160.20.117
|
||||
root:
|
||||
```
|
||||
gZgw$jH1170510M
|
||||
```
|
||||
|
||||
10.160.20.118
|
||||
root:
|
||||
```
|
||||
gZgw$jH0510M118
|
||||
```
|
||||
|
||||
10.160.20.119
|
||||
root:
|
||||
```
|
||||
gZgw119$jH0510M
|
||||
```
|
||||
|
||||
10.160.20.107
|
||||
root:
|
||||
```
|
||||
zwdC1PhH63Zh
|
||||
```
|
||||
|
||||
10.160.20.176
|
||||
root:
|
||||
```
|
||||
g@W2024.Jh
|
||||
```
|
||||
|
||||
|
||||
10.160.20.177
|
||||
root:
|
||||
```
|
||||
Gw@Jh2023.K
|
||||
```
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
|
||||
|
||||
服务器IP 应用服务
|
||||
10.160.20.112 zookeeper
|
||||
10.160.20.113 Prometheus grafana
|
||||
10.160.20.114 minio
|
||||
10.160.20.115 minio
|
||||
10.160.20.116 minio
|
||||
10.160.20.117 docker swarm
|
||||
10.160.20.118 docker swarm
|
||||
10.160.20.119 docker swarm
|
||||
10.160.20.102 达梦数据库
|
||||
10.160.20.107 达梦数据库
|
||||
10.160.20.176（VIP：10.160.20.110） nginx、keepalived
|
||||
10.160.20.177（VIP：10.160.20.110） nginx、keepalived
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
|
||||
问题 5：
|
||||
```
|
||||
（1）缺乏对通信设备可信验证方面的安全设计要求；
|
||||
（2）现有的通信设备存在未能实现操作系统到上层应用的信任链的情况，系统运行过程中的可信检验不全面；
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程
|
||||
（3）未采用第三方工具实现相关系统的可信验证。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）建议在管理规范文档内对通信设备可信验证方面的安全设计提出要求；
|
||||
（2）建议系统实现对所有可执行环节进行可信验证，包括：
|
||||
运行过程中的可信检验：
|
||||
■系统引导
|
||||
■重要系统程序或文件
|
||||
■重要配置参数
|
||||
■通信应用连接过程；
|
||||
（3）本身设备不支持的情况下，可采用第三方工具实现可信的验证功能；
|
||||
（4）对整体的可信验证措施做到：
|
||||
■对可信性破坏报警
|
||||
■将可信性验证结果形成审计记录
|
||||
■对可信性审计的动态关联感知。
|
||||
```
|
||||
|
||||
|
||||
|
||||
(31 条)问题 7,12,16,28,34,45,51：
|
||||
```
|
||||
（1）系统未采取完整性保护措施保证重要业务数据在存储过程中的完整性。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统配置使用加密算法对重要数据在存储过程中采取完整性保护措施。
|
||||
```
|
||||
|
||||
|
||||
|
||||
问题 9,13,17:
|
||||
```
|
||||
（1）系统未采取加密措施对重要业务数据的存储实现加密保障。
|
||||
```
|
||||
建议：
|
||||
```
|
||||
（1）系统使用加密算法对重要数据在存储过程中采取保密性保护措施；
|
||||
（2）在存储过程中需要加密保护的数据类型包括（不限于）鉴别数据、配置数据、重要业务数据、重要个人信息数据。
|
||||
```
|
||||
|
||||
|
||||
(32条)问题 25,33,42,50,59,71,79,88,97,102,107,112,118,125,133...:
|
||||
```
|
||||
（1）未采取措施对所有主体和客体设置敏感标记。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）建议对数据库系统应对重要信息资源设置敏感标记，数据库不支持敏感标记的，应在系统级生成敏感标记，使系统整体支持强制访问控制机制；
|
||||
（2）依据安全策略严格控制用户对有敏感标记重要信息资源的操作。
|
||||
```
|
||||
|
||||
|
||||
问题 26:
|
||||
```
|
||||
（1）数据库系统未设定有效的终端接入方式及范围限制措施；
|
||||
■数据库系统未对账号进行IP限制，host = %
|
||||
（2）数据库系统未对登录用户数量进行限制。
|
||||
```
|
||||
建议:
|
||||
```
|
||||
（1）数据库系统针设定有效的终端接入策略，对通过网络进行管理的终端进行限制。 ■数据库系统对账号进行IP限制，host ≠ %，限制固定IP段登录
|
||||
数据库系统对登录用户数量进行限制，如配置max_connections为50（具体数值需根据实际业务需求调整）。
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,636 @@
|
||||
|
||||
|
||||
login jump server: 10.160.20.112
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
ssh -V
|
||||
OpenSSH_8.2p1, OpenSSL 1.1.1f 31 Mar 2020
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
uname -a
|
||||
Linux v10-200g-clone-10 4.19.90-20.1stable.ky10.aarch64 #1 SMP Sun Aug 23 11:31:17 CST 2020 aarch64 aarch64 aarch64 GNU/Linux
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
uname -m
|
||||
aarch64
|
||||
getenforce
|
||||
Disabled
|
||||
```
|
||||
|
||||
|
||||
|
||||
备份配置
|
||||
|
||||
```bash
|
||||
cp -a /etc/ssh /etc/ssh.bak-$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
依赖安装
|
||||
|
||||
```bash
|
||||
dnf groupinstall "Development Tools" -y
|
||||
```
|
||||
```bash
|
||||
dnf install -y openssl-devel zlib-devel pam-devel libedit-devel krb5-devel audit-libs-devel libselinux-devel libcap-ng-devel systemd-devel
|
||||
```
|
||||
|
||||
|
||||
编译
|
||||
|
||||
```bash
|
||||
wget https://codeload.github.com/openssh/openssh-portable/zip/refs/heads/V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
unzip openssh-portable-V_10_2.zip
|
||||
cd openssh-portable-V_10_2
|
||||
```
|
||||
|
||||
```bash
|
||||
./configure --prefix=/usr --sysconfdir=/etc/ssh --sbindir=/usr/sbin --with-pam --with-privsep-path=/var/lib/sshd
|
||||
```
|
||||
|
||||
```bash
|
||||
make -j"$(nproc)"
|
||||
```
|
||||
|
||||
```bash
|
||||
make install
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
- 找到对应行，前面加 #，或直接删除。例如：
|
||||
```bash
|
||||
vi /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
- # GSSAPIAuthentication no
|
||||
|
||||
- # GSSAPICleanupCredentials yes
|
||||
|
||||
- # RSAAuthentication no
|
||||
|
||||
- # RhostsRSAAuthentication no
|
||||
|
||||
```bash
|
||||
/usr/sbin/sshd -t -f /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
systemctl enable --now sshd
|
||||
```
|
||||
|
||||
```
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
```
|
||||
journalctl -u sshd -b
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
vi /etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
```
|
||||
dnf install -y rpm-build rpmlint
|
||||
```
|
||||
|
||||
制作安装包
|
||||
|
||||
```
|
||||
dnf install -y ruby ruby-devel gcc make rpm-build
|
||||
```
|
||||
|
||||
```
|
||||
mkdir -p ~/buildroot
|
||||
```
|
||||
|
||||
```
|
||||
install -D /usr/sbin/sshd ~/buildroot/usr/sbin/sshd
|
||||
install -D /usr/bin/ssh ~/buildroot/usr/bin/ssh
|
||||
install -D /usr/bin/scp ~/buildroot/usr/bin/scp
|
||||
install -D /usr/bin/sftp ~/buildroot/usr/bin/sftp
|
||||
install -D /usr/bin/ssh-keygen ~/buildroot/usr/bin/ssh-keygen
|
||||
install -D /usr/bin/ssh-agent ~/buildroot/usr/bin/ssh-agent
|
||||
install -D /usr/bin/ssh-add ~/buildroot/usr/bin/ssh-add
|
||||
install -D /usr/bin/ssh-keyscan ~/buildroot/usr/bin/ssh-keyscan
|
||||
rsync -aR /usr/libexec/ssh/ ~/buildroot/ 2>/dev/null || true rsync -aR /usr/lib/ssh/ ~/buildroot/ 2>/dev/null || true
|
||||
install -D /etc/ssh/sshd_config ~/buildroot/etc/ssh/sshd_config
|
||||
install -D /etc/ssh/ssh_config ~/buildroot/etc/ssh/ssh_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
test -f /usr/lib/systemd/system/sshd.service && install -D /usr/lib/systemd/system/sshd.service ~/buildroot/usr/lib/systemd/system/sshd.service || true
|
||||
```
|
||||
|
||||
~/rpmbuild/SPECS/openssh-custom.spec
|
||||
|
||||
```
|
||||
Name: openssh
|
||||
Version: 10.2
|
||||
Release: 1%{?dist}
|
||||
Summary: An open source implementation of SSH protocol version 2
|
||||
|
||||
License: BSD
|
||||
URL: https://www.openssh.com/
|
||||
Source0: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: make
|
||||
BuildRequires: openssl-devel >= 1.1.1
|
||||
BuildRequires: zlib-devel
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: systemd
|
||||
BuildRequires: libselinux-devel
|
||||
|
||||
%description
|
||||
SSH (Secure SHell) is a program for logging into and executing
|
||||
commands on a remote machine. SSH is intended to replace rlogin and
|
||||
rsh, and to provide secure encrypted communications between two
|
||||
untrusted hosts over an insecure network. This package includes the
|
||||
core files necessary for both the OpenSSH client and server.
|
||||
|
||||
%package clients
|
||||
Summary: SSH client applications
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description clients
|
||||
OpenSSH clients, including ssh, scp, and sftp.
|
||||
|
||||
%package server
|
||||
Summary: SSH server daemon
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires(post): systemd
|
||||
Requires(preun): systemd
|
||||
Requires(postun): systemd
|
||||
|
||||
%description server
|
||||
OpenSSH server daemon (sshd) with support for the new sshd-session
|
||||
and sshd-auth architecture introduced in OpenSSH 9.8+.
|
||||
|
||||
%prep
|
||||
%setup -q -n openssh-portable-V_10_2
|
||||
|
||||
%build
|
||||
%configure \
|
||||
--sysconfdir=%{_sysconfdir}/ssh \
|
||||
--libexecdir=%{_libexecdir}/openssh \
|
||||
--datadir=%{_datadir}/openssh \
|
||||
--with-pam \
|
||||
--with-selinux \
|
||||
--with-privsep-path=/var/empty/sshd \
|
||||
--with-pid-dir=/run \
|
||||
--with-ssl-engine \
|
||||
--disable-strip
|
||||
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
rm -rf %{buildroot}
|
||||
make install DESTDIR=%{buildroot}
|
||||
|
||||
# Install systemd unit files
|
||||
install -d %{buildroot}%{_unitdir}
|
||||
|
||||
# Create sshd.service file
|
||||
cat > %{buildroot}%{_unitdir}/sshd.service << 'SVCEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH server daemon
|
||||
Documentation=man:sshd(8) man:sshd_config(5)
|
||||
After=network.target sshd-keygen.target
|
||||
Wants=sshd-keygen.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
EnvironmentFile=-/etc/sysconfig/sshd
|
||||
ExecStart=/usr/sbin/sshd -D $OPTIONS
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
RestartSec=42s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
SVCEOF
|
||||
|
||||
# Create sshd-keygen service
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen@.service << 'KEYGENEOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/ssh-keygen -A
|
||||
RemainAfterExit=yes
|
||||
KEYGENEOF
|
||||
|
||||
# Create sshd-keygen target
|
||||
cat > %{buildroot}%{_unitdir}/sshd-keygen.target << 'KEYTAREOF'
|
||||
[Unit]
|
||||
Description=OpenSSH Server Key Generation
|
||||
Documentation=man:sshd(8) man:ssh-keygen(1)
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
|
||||
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
|
||||
KEYTAREOF
|
||||
|
||||
# Create empty sshd privsep directory
|
||||
install -d -m 0711 %{buildroot}/var/empty/sshd
|
||||
|
||||
# Install PAM configuration
|
||||
install -d %{buildroot}%{_sysconfdir}/pam.d
|
||||
cat > %{buildroot}%{_sysconfdir}/pam.d/sshd << 'PAMEOF'
|
||||
#%PAM-1.0
|
||||
auth substack password-auth
|
||||
auth include postlogin
|
||||
account required pam_sepermit.so
|
||||
account required pam_nologin.so
|
||||
account include password-auth
|
||||
password include password-auth
|
||||
session required pam_selinux.so close
|
||||
session required pam_loginuid.so
|
||||
session required pam_selinux.so open env_params
|
||||
session required pam_namespace.so
|
||||
session optional pam_keyinit.so force revoke
|
||||
session optional pam_motd.so
|
||||
session include password-auth
|
||||
session include postlogin
|
||||
PAMEOF
|
||||
|
||||
# Modify sshd_config to enable root login
|
||||
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
|
||||
%{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
|
||||
# Ensure PermitRootLogin is set
|
||||
if ! grep -q "^PermitRootLogin" %{buildroot}%{_sysconfdir}/ssh/sshd_config; then
|
||||
echo "PermitRootLogin yes" >> %{buildroot}%{_sysconfdir}/ssh/sshd_config
|
||||
fi
|
||||
|
||||
# Create sysconfig directory
|
||||
install -d %{buildroot}%{_sysconfdir}/sysconfig
|
||||
cat > %{buildroot}%{_sysconfdir}/sysconfig/sshd << 'SYSCONFIGEOF'
|
||||
# Configuration file for the sshd service.
|
||||
|
||||
# Options for sshd
|
||||
OPTIONS=""
|
||||
SYSCONFIGEOF
|
||||
|
||||
%files
|
||||
%license LICENCE
|
||||
%doc ChangeLog CREDITS OVERVIEW PROTOCOL* README*
|
||||
%dir %{_sysconfdir}/ssh
|
||||
%config(noreplace) %{_sysconfdir}/ssh/moduli
|
||||
%config(noreplace) %{_sysconfdir}/ssh/ssh_config
|
||||
%{_mandir}/man5/moduli.5*
|
||||
%{_mandir}/man5/ssh_config.5*
|
||||
%{_mandir}/man5/sshd_config.5*
|
||||
|
||||
%files clients
|
||||
%{_bindir}/ssh
|
||||
%{_bindir}/scp
|
||||
%{_bindir}/sftp
|
||||
%{_bindir}/ssh-add
|
||||
%{_bindir}/ssh-agent
|
||||
%{_bindir}/ssh-keygen
|
||||
%{_bindir}/ssh-keyscan
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/ssh-keysign
|
||||
%{_libexecdir}/openssh/ssh-pkcs11-helper
|
||||
%{_libexecdir}/openssh/ssh-sk-helper
|
||||
%{_mandir}/man1/scp.1*
|
||||
%{_mandir}/man1/sftp.1*
|
||||
%{_mandir}/man1/ssh.1*
|
||||
%{_mandir}/man1/ssh-add.1*
|
||||
%{_mandir}/man1/ssh-agent.1*
|
||||
%{_mandir}/man1/ssh-keygen.1*
|
||||
%{_mandir}/man1/ssh-keyscan.1*
|
||||
%{_mandir}/man8/ssh-keysign.8*
|
||||
%{_mandir}/man8/ssh-pkcs11-helper.8*
|
||||
%{_mandir}/man8/ssh-sk-helper.8*
|
||||
|
||||
%files server
|
||||
%{_sbindir}/sshd
|
||||
%dir %{_libexecdir}/openssh
|
||||
%{_libexecdir}/openssh/sftp-server
|
||||
%{_libexecdir}/openssh/sshd-session
|
||||
%{_libexecdir}/openssh/sshd-auth
|
||||
%{_unitdir}/sshd.service
|
||||
%{_unitdir}/sshd-keygen@.service
|
||||
%{_unitdir}/sshd-keygen.target
|
||||
%dir %attr(0711,root,root) /var/empty/sshd
|
||||
%config(noreplace) %{_sysconfdir}/ssh/sshd_config
|
||||
%config(noreplace) %{_sysconfdir}/pam.d/sshd
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/sshd
|
||||
%{_mandir}/man8/sshd.8*
|
||||
%{_mandir}/man8/sftp-server.8*
|
||||
|
||||
%pre server
|
||||
# Create sshd user if it doesn't exist
|
||||
getent group sshd >/dev/null || groupadd -r sshd
|
||||
getent passwd sshd >/dev/null || \
|
||||
useradd -r -g sshd -d /var/empty/sshd -s /sbin/nologin \
|
||||
-c "Privilege-separated SSH" sshd
|
||||
exit 0
|
||||
|
||||
%post server
|
||||
%systemd_post sshd.service
|
||||
# Generate host keys if they don't exist
|
||||
/usr/bin/ssh-keygen -A >/dev/null 2>&1 || :
|
||||
|
||||
%preun server
|
||||
%systemd_preun sshd.service
|
||||
|
||||
%postun server
|
||||
%systemd_postun_with_restart sshd.service
|
||||
|
||||
%changelog
|
||||
* Wed Oct 22 2025 System Administrator <admin@example.com> - 10.2-1
|
||||
- Update to OpenSSH 10.2
|
||||
- Enable PermitRootLogin by default
|
||||
- Add support for sshd-session and sshd-auth
|
||||
- Include systemd service files
|
||||
- Add PAM configuration
|
||||
- Create privilege separation user and directory
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
find ~/rpmbuild/BUILD/openssh-10.2-1.ky10.*/usr/libexec/openssh/ -type f
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
处理完：
|
||||
117
|
||||
177
|
||||
|
||||
不能ssh
|
||||
102
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
处理102:
|
||||
|
||||
1. 下载新编译的openssh
|
||||
```
|
||||
-rw-r--r-- 1 root root 209096 Oct 22 14:45 openssh-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 872348 Oct 22 14:45 openssh-clients-10.2-1.ky10.ky10.aarch64.rpm
|
||||
-rw-r--r-- 1 root root 576228 Oct 22 14:45 openssh-server-10.2-1.ky10.ky10.aarch64.rpm
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
2. 修改 /etc/ssh/sshd_config
|
||||
注释选项
|
||||
|
||||
```
|
||||
GSSAPIAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
GSSAPICleanupCredentials
|
||||
```
|
||||
|
||||
```
|
||||
RSAAuthentication
|
||||
```
|
||||
|
||||
```
|
||||
RhostsRSAAuthentication
|
||||
```
|
||||
|
||||
注释
|
||||
|
||||
```
|
||||
/etc/crypto-policies/back-ends/opensshserver.config
|
||||
```
|
||||
|
||||
|
||||
3. 修改
|
||||
```
|
||||
chmod 600 /etc/ssh/ssh_*
|
||||
```
|
||||
|
||||
|
||||
|
||||
3. 安装
|
||||
```
|
||||
dnf install ./openssh-*
|
||||
```
|
||||
|
||||
4. 测试
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -t
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
/usr/sbin/sshd -D -d
|
||||
```
|
||||
|
||||
```
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now sshd
|
||||
systemctl start sshd
|
||||
systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
112:
|
||||
安装 openssh 10 with openssl 3
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
10.160.20.112, 10.160.20.113,10.160.20.114,10.160.20.115,10.160.20.116,10.160.20.118,10.160.20.119,10.160.20.107
|
||||
|
||||
|
||||
|
||||
```
|
||||
export LD_LIBRARY_PATH=/usr/local/openssl-3/lib:/usr/local/openssl-3/lib64
|
||||
```
|
||||
|
||||
```
|
||||
/usr/local/openssl-3/bin/openssl version -a
|
||||
/usr/local/openssh-10/bin/ssh -V
|
||||
```
|
||||
|
||||
|
||||
|
||||
生成key
|
||||
```
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-10/etc/ssh_host_rsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-10/etc/ssh_host_ecdsa_key -N "" -q
|
||||
/usr/local/openssh-10/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-10/etc/ssh_host_ed25519_key -N "" -q
|
||||
```
|
||||
|
||||
测试语法
|
||||
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -t -f /usr/local/openssh-10/etc/sshd_config
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
mkdir -p /var/empty
|
||||
chown root:root /var/empty
|
||||
chmod 755 /var/empty
|
||||
```
|
||||
|
||||
|
||||
测试启动
|
||||
```
|
||||
/usr/local/openssh-10/sbin/sshd -p 2222 -f /usr/local/openssh-10/etc/sshd_config -D
|
||||
```
|
||||
|
||||
|
||||
备份
|
||||
```
|
||||
mkdir -p /usr/local/openssh-backup
|
||||
cp /usr/sbin/sshd /usr/local/openssh-backup/
|
||||
cp /usr/bin/ssh* /usr/local/openssh-backup/
|
||||
cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)
|
||||
```
|
||||
|
||||
|
||||
替换
|
||||
```
|
||||
ln -sf /usr/local/openssh-10/sbin/sshd /usr/sbin/sshd
|
||||
ln -sf /usr/local/openssh-10/bin/ssh /usr/bin/ssh
|
||||
ln -sf /usr/local/openssh-10/bin/scp /usr/bin/scp
|
||||
ln -sf /usr/local/openssh-10/bin/sftp /usr/bin/sftp
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keygen /usr/bin/ssh-keygen
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-keyscan /usr/bin/ssh-keyscan
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-agent /usr/bin/ssh-agent
|
||||
ln -sf /usr/local/openssh-10/bin/ssh-add /usr/bin/ssh-add
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
cp /usr/lib/systemd/system/sshd.service /etc/systemd/system/sshd.service
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
sed -i 's|ExecStart=.*|ExecStart=/usr/local/openssh-10/sbin/sshd -D -f /usr/local/openssh-10/etc/sshd_config|' /etc/systemd/system/sshd.service
|
||||
|
||||
sed -i '/^\[Service\]/a Environment="LD_LIBRARY_PATH=/usr/local/openssl-3/lib"' /etc/systemd/system/sshd.service
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl daemon-reexec
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
```
|
||||
sudo systemctl restart sshd
|
||||
sudo systemctl status sshd
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
# 商务局堡垒机和服务器账号密码
|
||||
|
||||
远程机：
|
||||
|
||||
使用raylink软件远程登录
|
||||
|
||||
远程码：162 644 044
|
||||
|
||||
密码：swj888gg
|
||||
|
||||
|
||||
|
||||
堡垒机地址：
|
||||
|
||||
https://10.208.209.226/login
|
||||
|
||||
账号：znkj
|
||||
|
||||
密码：Swjbd@202410
|
||||
|
||||
```
|
||||
Swjbd@202410
|
||||
```
|
||||
|
||||
|
||||
|
||||
10:
|
||||
suops
|
||||
```
|
||||
uyv@#ADSnbv65
|
||||
```
|
||||
|
||||
|
||||
14:
|
||||
suops
|
||||
```
|
||||
Ghg23476%65Gnh23
|
||||
```
|
||||
|
||||
|
||||
| 服务器类型 | 服务器IP | 外网映射IP | 访问端口 | 系统类型 | 访问方式 | 服务器账户 | 服务器密码 | 挂载存储 | 部署内容 |
|
||||
| ------- | ------------ | ------------- | ---------- | ------- | ------------ | ---------------------------------- | --------------------------------------------------------------------------- | ----- | ----------- |
|
||||
| 中型鲲鹏云主机 | 10.201.31.1 | 59.41.8.111 | 80 443 | 银河麒麟V10 | SSH SFTP | root suops | Gzswj@Rapid2024.Lm.31.1 Mjk@2023.L!FGBn | 100G | 商贸直通车应用服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.8 | | | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2024.Lm,31.8 Gj@2024Gx. | 100G | 数据交换服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.9 | | | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2024.zN,31.9 oPd9&88,.F541xc | 100G | 文件存储服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.10 | | | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2024.zN,31.10 uyv@#ADSnbv65 | 100G | 代理服务器、应用服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.11 | 112.94.64.121 | 80 | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2024.zN,31.11 uyv@#ADSnbv65 | 100G | 可视化应用服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.12 | | | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2023.Lm,31.12 .Lojd7%^F15DxG | 100G | 数据治理服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.13 | | | 银河麒麟V10 | SSH SFTP | root suops | 88FUSdbng@25G8c% uvdfh&741445FDGDf | 100G | 总线服务器1 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.14 | | | 银河麒麟V10 | SSH SFTP | root suops | gZSswj@2023.Lm,31.14 Ghg23476%65Gnh23 | 100G | 总线服务器2 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.15 | | | 银河麒麟V10 | SSH SFTP | root suops | root密码不对 gZSswj@2023.Lm,31.15 H2gF34^&nG5 | 100G | 总线服务器3 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.21 | | | 银河麒麟V10 | SSH SFTP | root suops xcyun | root密码不对 gZSswj@2023.Lm,31.21 9L@1015.2024Syj. 8Gssdjkh@2024,G | 100G | 应用服务器 |
|
||||
| 大型鲲鹏云主机 | 10.201.31.24 | | | 银河麒麟V10 | SSH SFTP | root suops xcyun dmdba | gZSswj@2023.Lm,31.24 9,Mjd6Fuhd457V 7Psdjkh@2024,G Gx58YH23#gdG | 200GB | 数据库服务器 |
|
||||
| 物理机 | 10.201.31.3 | | | 银河麒麟V10 | SSH SFTP | root suops | Gzswj@Rapid2024.Lm.31.3 P.Jmdb798*22 | 600GB | 达梦数据库 - 备 |
|
||||
| 物理机 | 10.201.31.4 | | | 银河麒麟V10 | SSH SFTP | root suops | Gzswj@Rapid2024.Lm.31.4 X.Jm87mB76@*22 | 600GB | 达梦数据库 - 主 |
|
||||
@@ -0,0 +1,81 @@
|
||||
|
||||
|
||||
### 13
|
||||
10.201.31.13
|
||||
|
||||
```
|
||||
Apache Flink 远程代码执行漏洞【原理扫描】
|
||||
```
|
||||
|
||||
可能有客户端，无服务端
|
||||
|
||||
|
||||
### 14
|
||||
10.201.31.13
|
||||
```
|
||||
Apache Flink 任意文件写入(CVE-2020-17518)【原理扫描】
|
||||
```
|
||||
|
||||
```
|
||||
CVE-2020-17518
|
||||
While all versions before `1.11.3` are affected the related vulnerability, Apache Flink has been fixed vulnerability for versions `1.11.3` and above.
|
||||
```
|
||||
|
||||
|
||||
### 38
|
||||
10.201.31.10
|
||||
```
|
||||
Nacos Namespace 未授权访问漏洞【原理扫描】
|
||||
```
|
||||
误报
|
||||
|
||||
|
||||
### 39
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2018-1060）
|
||||
```
|
||||
|
||||
|
||||
### 40
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2018-20406）
|
||||
```
|
||||
|
||||
|
||||
### 41
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2019-9674）
|
||||
```
|
||||
|
||||
### 42
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2021-28861）
|
||||
```
|
||||
|
||||
### 44
|
||||
10.201.31.10
|
||||
```
|
||||
Python 资源管理错误漏洞（CVE-2022-45061）
|
||||
```
|
||||
|
||||
|
||||
### 45
|
||||
10.201.31.10
|
||||
```
|
||||
Python 输入验证错误漏洞（CVE-2023-24329）
|
||||
```
|
||||
|
||||
### 46
|
||||
10.201.31.10
|
||||
```
|
||||
Python 安全漏洞（CVE-2023-36632）
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
升级 arm64v8/mofcom_spider_api:v2 的python > 3.11.4
|
||||
```
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
|
||||
## 主机漏洞：
|
||||
### 13，14，21，23，30，31：
|
||||
都是flink问题：
|
||||
如果是软件是在本地启动服务，则需要升级软件中flink的版本
|
||||
如果只是客户端，则是误报
|
||||
|
||||
### 39，40，41，42，44，45，46，56，58，60，61，62，64，65，66，67
|
||||
都是python版本升级：
|
||||
需要获得运行容器的源码，把python 3.6升级到python 3.11以上
|
||||
|
||||
|
||||
### 22，38
|
||||
nacos 漏洞：
|
||||
目前厂商没有发布解决问题的新版本
|
||||
|
||||
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
vpn: https://vpn.zengcheng.gov.cn:3300
|
||||
|
||||
VPN账号密码：xiean Nxmgl2024#szzf
|
||||
|
||||
堡垒机：https://172.27.11.249（政务网登陆或通过vpn接入政务网）
|
||||
账号：xiean
|
||||
初始密码：QNq66L$~2023IKP
|
||||
|
||||
|
||||
|
||||
172.27.11.175:1521/oproject
|
||||
idbc.username: zct_base
|
||||
jdbc.password: 33g+sm!KEqis
|
||||
|
||||
exp userid=zct_base/33g+sm!KEqis@172.27.11.175:1521/oproject file=oproject.dmp log=exp.log OWNER=zct_base
|
||||
|
||||
GRANT EXP_FULL_DATABASE TO zct_base;
|
||||
Executable
+385
@@ -0,0 +1,385 @@
|
||||
```sql
|
||||
|
||||
SELECT
|
||||
column_name,
|
||||
comments
|
||||
FROM
|
||||
all_col_comments
|
||||
WHERE
|
||||
owner = 'ZC'
|
||||
AND table_name = 'BASE_USER';
|
||||
```
|
||||
|
||||
|
||||
|
||||
To close all sessions associated with the user `'zc'` in an Oracle database, you need to identify those sessions and then terminate them. This process requires administrative privileges. Below are the steps to accomplish this:
|
||||
|
||||
1. **Connect to the Database as an Administrator**
|
||||
|
||||
Open SQL*Plus or your preferred SQL client and connect as a user with administrative privileges (such as `SYSDBA`):
|
||||
|
||||
```sql
|
||||
sqlplus / as sysdba
|
||||
```
|
||||
|
||||
2. **Identify the Sessions Belonging to User 'zc'**
|
||||
|
||||
Execute the following query to retrieve the `SID` and `SERIAL#` of all sessions for user `'zc'`:
|
||||
|
||||
```sql
|
||||
SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC';
|
||||
```
|
||||
|
||||
*Note*: Oracle usernames are usually stored in uppercase unless created with double quotes.
|
||||
|
||||
3. **Terminate the Sessions**
|
||||
|
||||
You can terminate each session individually using the `ALTER SYSTEM KILL SESSION` command:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM KILL SESSION 'SID,SERIAL#';
|
||||
```
|
||||
|
||||
Replace `SID` and `SERIAL#` with the values obtained from the previous query.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the query returns `SID` = 123 and `SERIAL#` = 4567, execute:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM KILL SESSION '123,4567';
|
||||
```
|
||||
|
||||
4. **Automate the Termination of All Sessions**
|
||||
|
||||
To kill all sessions for user `'zc'` in one step, you can use a PL/SQL block:
|
||||
|
||||
```sql
|
||||
BEGIN
|
||||
FOR rec IN (SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC') LOOP
|
||||
EXECUTE IMMEDIATE 'ALTER SYSTEM KILL SESSION ''' || rec.SID || ',' || rec.SERIAL# || ''' IMMEDIATE';
|
||||
END LOOP;
|
||||
END;
|
||||
/
|
||||
```
|
||||
|
||||
This script loops through each session and issues the kill command.
|
||||
|
||||
5. **Verify the Sessions Are Closed**
|
||||
|
||||
Run the initial query again to ensure all sessions have been terminated:
|
||||
|
||||
```sql
|
||||
SELECT SID, SERIAL# FROM V$SESSION WHERE USERNAME = 'ZC';
|
||||
```
|
||||
|
||||
If no rows are returned, all sessions have been successfully closed.
|
||||
|
||||
**Important Considerations**:
|
||||
|
||||
- **Transactions**: Killing a session that is in the middle of a transaction can cause that transaction to be rolled back. Ensure that terminating these sessions won't negatively impact your database integrity.
|
||||
- **Privileges**: You must have the necessary privileges (`ALTER SYSTEM` privilege) to kill sessions.
|
||||
- **Immediate Termination**: Adding the `IMMEDIATE` clause forces the session to terminate without waiting for ongoing transactions to complete.
|
||||
- **Oracle Versions**: In Oracle 12c and newer, you can use `ALTER SYSTEM DISCONNECT SESSION` for immediate termination:
|
||||
|
||||
```sql
|
||||
ALTER SYSTEM DISCONNECT SESSION 'SID,SERIAL#' IMMEDIATE;
|
||||
```
|
||||
|
||||
By following these steps, you can close all sessions associated with the user `'zc'` in your Oracle database.
|
||||
|
||||
|
||||
|
||||
|
||||
When the source and target databases have different character sets (NLS settings), exporting and importing data in Oracle requires careful handling to ensure data integrity. Incorrect handling can lead to character corruption, loss of data, or import errors. Below, I'll guide you through the steps to perform `exp` (export) and `imp` (import) when the source and target `NLS_LANG` settings are not the same.
|
||||
|
||||
---
|
||||
|
||||
### **Understanding NLS_LANG and Character Sets**
|
||||
|
||||
- **`NLS_LANG` Environment Variable**: Determines the language, territory, and character set settings for Oracle client applications.
|
||||
- **Character Set Conversion**: Oracle performs character set conversion between the client (as specified by `NLS_LANG`) and the database character set.
|
||||
|
||||
**Key Principle**: To prevent unwanted character set conversion and potential data corruption, set `NLS_LANG` to match the **database character set** when using `exp` and `imp` utilities.
|
||||
|
||||
---
|
||||
|
||||
### **Steps for Exporting and Importing Between Different NLS_LANG Settings**
|
||||
|
||||
#### **1. Determine the Character Sets**
|
||||
|
||||
**Source Database**:
|
||||
|
||||
```sql
|
||||
SELECT value FROM nls_database_parameters WHERE parameter = 'NLS_CHARACTERSET';
|
||||
```
|
||||
|
||||
**Target Database**:
|
||||
|
||||
```sql
|
||||
SELECT value FROM nls_database_parameters WHERE parameter = 'NLS_CHARACTERSET';
|
||||
```
|
||||
|
||||
#### **2. Set NLS_LANG for Export**
|
||||
|
||||
- **Objective**: Prevent character set conversion during export.
|
||||
- **Action**: Set `NLS_LANG` to match the **source database character set**.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the source database character set is `WE8MSWIN1252`:
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
```
|
||||
|
||||
#### **3. Perform the Export (`exp`)**
|
||||
|
||||
Run the `exp` command after setting `NLS_LANG`:
|
||||
|
||||
```cmd
|
||||
exp userid=username/password@source_db file=export.dmp log=export.log [other options]
|
||||
```
|
||||
|
||||
- **No Character Set Conversion**: Since `NLS_LANG` matches the database character set, Oracle doesn't perform character set conversion during export.
|
||||
|
||||
#### **4. Transfer the Dump File**
|
||||
|
||||
Copy `export.dmp` to the target machine if necessary.
|
||||
|
||||
#### **5. Set NLS_LANG for Import**
|
||||
|
||||
- **Objective**: Ensure correct character set conversion during import.
|
||||
- **Action**: Set `NLS_LANG` to match the **target database character set**.
|
||||
|
||||
**Example**:
|
||||
|
||||
If the target database character set is `AL32UTF8`:
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
#### **6. Perform the Import (`imp`)**
|
||||
|
||||
Run the `imp` command:
|
||||
|
||||
```cmd
|
||||
imp userid=username/password@target_db file=export.dmp log=import.log [other options]
|
||||
```
|
||||
|
||||
- **Character Set Conversion**: Oracle converts character data from the dump file's character set (source database character set) to the target database character set.
|
||||
|
||||
#### **7. Verify the Imported Data**
|
||||
|
||||
After import, check the data integrity, especially for special characters or multilingual data.
|
||||
|
||||
---
|
||||
|
||||
### **Detailed Explanation**
|
||||
|
||||
#### **Why Set NLS_LANG to the Database Character Set?**
|
||||
|
||||
- **During Export**:
|
||||
- Setting `NLS_LANG` to match the source database character set ensures that no character set conversion occurs between the database and the export utility.
|
||||
- Data is exported exactly as it is stored in the database.
|
||||
|
||||
- **During Import**:
|
||||
- Setting `NLS_LANG` to match the target database character set allows Oracle to correctly interpret the character data from the dump file and convert it to the target database's character set if necessary.
|
||||
- This prevents character corruption due to incorrect character set conversion.
|
||||
|
||||
#### **Understanding Character Set Conversion**
|
||||
|
||||
- **Export Process**:
|
||||
- **Database → Client (`exp` utility)**: If `NLS_LANG` matches the database character set, no conversion occurs.
|
||||
|
||||
- **Import Process**:
|
||||
- **Dump File → Client (`imp` utility)**: The `imp` utility reads data in the dump file's character set.
|
||||
- **Client (`imp` utility) → Target Database**: Oracle converts character data from the client character set (specified by `NLS_LANG`) to the target database character set.
|
||||
|
||||
---
|
||||
|
||||
### **Example Scenario**
|
||||
|
||||
**Source Database**:
|
||||
|
||||
- **Character Set**: `WE8ISO8859P1`
|
||||
- **NLS_LANG**: `AMERICAN_AMERICA.WE8ISO8859P1`
|
||||
|
||||
**Target Database**:
|
||||
|
||||
- **Character Set**: `AL32UTF8`
|
||||
- **NLS_LANG**: `AMERICAN_AMERICA.AL32UTF8`
|
||||
|
||||
#### **Export Steps**
|
||||
|
||||
1. **Set NLS_LANG**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8ISO8859P1
|
||||
```
|
||||
|
||||
2. **Run Export**:
|
||||
|
||||
```cmd
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
#### **Import Steps**
|
||||
|
||||
1. **Set NLS_LANG**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
```
|
||||
|
||||
2. **Run Import**:
|
||||
|
||||
```cmd
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **Additional Considerations**
|
||||
|
||||
#### **Character Set Compatibility**
|
||||
|
||||
- Ensure the target character set can represent all characters from the source character set.
|
||||
- **Superset Character Sets**: If the target character set is a superset of the source, conversion should be lossless (e.g., importing from `WE8ISO8859P1` to `AL32UTF8`).
|
||||
|
||||
#### **Testing**
|
||||
|
||||
- **Test Import**: Before full-scale import, test with a small dataset to verify character data integrity.
|
||||
|
||||
#### **Data Pump Utilities**
|
||||
|
||||
- **`expdp` and `impdp`**: For Oracle 10g and later, consider using Data Pump utilities which handle character set conversions more efficiently.
|
||||
- **Note**: Data Pump utilities run on the server side and generally require less attention to `NLS_LANG`, but it's still good practice to set it appropriately if your parameters include non-ASCII characters.
|
||||
|
||||
#### **Locale-Specific Data**
|
||||
|
||||
- **Date Formats, Numeric Formats**: Other NLS parameters (like `NLS_DATE_FORMAT`, `NLS_NUMERIC_CHARACTERS`) may need to be set if your data depends on locale-specific formats.
|
||||
|
||||
---
|
||||
|
||||
### **Common Mistakes to Avoid**
|
||||
|
||||
#### **Setting NLS_LANG to the Wrong Character Set**
|
||||
|
||||
- **Do Not**: Set `NLS_LANG` to the operating system character set unless it matches the database character set.
|
||||
- **Result**: Misalignment can cause Oracle to perform unwanted character set conversions, leading to data corruption.
|
||||
|
||||
#### **Ignoring NCHAR and NVARCHAR Data**
|
||||
|
||||
- **Note**: `NLS_NCHAR_CHARACTERSET` may also need to be considered if your databases use NCHAR, NVARCHAR2, or NCLOB data types.
|
||||
|
||||
---
|
||||
|
||||
### **Frequently Asked Questions**
|
||||
|
||||
**Q1: Can I set `NLS_LANG` to the same value during both export and import?**
|
||||
|
||||
- **A**: While possible, it's not recommended unless the source and target databases have the same character set. Setting `NLS_LANG` to match the respective database character sets at each stage ensures proper handling.
|
||||
|
||||
**Q2: What if I can't match `NLS_LANG` to the database character set?**
|
||||
|
||||
- **A**: If you cannot set `NLS_LANG` to match the database character set, you risk character data corruption. It's crucial to find out the correct character set and set `NLS_LANG` accordingly.
|
||||
|
||||
**Q3: How do I handle data that includes special or non-English characters?**
|
||||
|
||||
- **A**: Use Unicode character sets (e.g., `AL32UTF8`) for the target database if possible, and ensure `NLS_LANG` is correctly set to handle these characters.
|
||||
|
||||
---
|
||||
|
||||
### **Summary of Steps**
|
||||
|
||||
1. **Determine Character Sets**:
|
||||
|
||||
- Source and target database character sets.
|
||||
|
||||
2. **Set NLS_LANG for Export**:
|
||||
|
||||
- Match to source database character set.
|
||||
|
||||
3. **Export Data**:
|
||||
|
||||
- Use `exp` utility.
|
||||
|
||||
4. **Set NLS_LANG for Import**:
|
||||
|
||||
- Match to target database character set.
|
||||
|
||||
5. **Import Data**:
|
||||
|
||||
- Use `imp` utility.
|
||||
|
||||
6. **Verify Data Integrity**:
|
||||
|
||||
- Check for character corruption or data loss.
|
||||
|
||||
---
|
||||
|
||||
### **Example Commands**
|
||||
|
||||
#### **Export Command**
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.WE8MSWIN1252
|
||||
exp userid=source_user/password@source_db file=export.dmp log=export.log
|
||||
```
|
||||
|
||||
#### **Import Command**
|
||||
|
||||
- **Windows**:
|
||||
|
||||
```cmd
|
||||
SET NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
- **Unix/Linux**:
|
||||
|
||||
```bash
|
||||
export NLS_LANG=AMERICAN_AMERICA.AL32UTF8
|
||||
imp userid=target_user/password@target_db file=export.dmp log=import.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **Final Tips**
|
||||
|
||||
- **Backup**: Always backup your databases before performing import/export operations.
|
||||
- **Documentation**: Keep records of your `NLS_LANG` settings and character sets for future reference.
|
||||
- **Consult Oracle Documentation**: For complex scenarios, refer to Oracle's Globalization Support Guide.
|
||||
|
||||
---
|
||||
|
||||
By carefully setting the `NLS_LANG` environment variable to match the database character sets during export and import, you can safely transfer data between databases with different NLS_LANG settings. This approach ensures proper character set conversion and maintains data integrity across different environments.
|
||||
|
||||
If you have further questions or encounter specific issues during the process, feel free to ask for more assistance!
|
||||
Executable
+1190
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,130 @@
|
||||
## win desktop
|
||||
|
||||
ToDesk设备代码:299 885 389
|
||||
pass: Admingzzn@1
|
||||
|
||||
rust desktop
|
||||
11 439 584
|
||||
|
||||
|
||||
|
||||
## 堡垒机
|
||||
|
||||
https://10.208.105.34
|
||||
|
||||
user: lizx
|
||||
|
||||
pass: gzzn#Gxj,08.202324
|
||||
|
||||
```
|
||||
gzzn#Gxj,08.202324
|
||||
```
|
||||
|
||||
|
||||
new pass:
|
||||
```
|
||||
gzzn#Gxj,08.202411
|
||||
```
|
||||
|
||||
```
|
||||
gzzn#Gxj,08.202502
|
||||
```
|
||||
|
||||
```
|
||||
`JU,@UOjy`J3Yf0
|
||||
```
|
||||
|
||||
```
|
||||
gzzn#Gxj,08.202512
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
freeotp 验证
|
||||
|
||||
|
||||
|
||||
|
||||
## 零信任VPN:
|
||||
|
||||
ip: 112.94.64.30
|
||||
|
||||
user: Lixiaobing3905
|
||||
|
||||
password: Gxjrapid@2024
|
||||
new:
|
||||
```
|
||||
Gxjrapid@2501
|
||||
```
|
||||
|
||||
```
|
||||
Gxjrapid@2507
|
||||
```
|
||||
|
||||
|
||||
|
||||
管理员密码： Asiainfo@0427
|
||||
|
||||
|
||||
todesk:
|
||||
226 868 837
|
||||
Admingzzn@1
|
||||
windows password: admingzzn
|
||||
|
||||
|
||||
rustdusk :
|
||||
1259681763
|
||||
```
|
||||
w42YyME_y3jVb!qa4X.c
|
||||
```
|
||||
|
||||
11 439 584:
|
||||
```
|
||||
uW!g6CU6kteozaHUaJX*
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
![[Pasted image 20240909145917.png]]
|
||||
|
||||
```
|
||||
|
||||
10.194.64.102 root pW}3[H/TgGj
|
||||
10.194.64.103 root dF%7Sx?rKpU
|
||||
10.194.64.104 root jM#5&4vW^m<
|
||||
|
||||
```
|
||||
|
||||
|
||||
10.194.64.102， root
|
||||
```
|
||||
pW}3[H/TgGj
|
||||
```
|
||||
|
||||
10.194.64.103，root
|
||||
```
|
||||
dF%7Sx?rKpU
|
||||
```
|
||||
|
||||
104, root
|
||||
```
|
||||
jM#5&4vW^m<
|
||||
```
|
||||
|
||||
16,root
|
||||
```
|
||||
u>p!B{D,k6(
|
||||
```
|
||||
|
||||
|
||||
|
||||
new ip 17:
|
||||
root:
|
||||
```password
|
||||
jM#5&4vW^m<
|
||||
```
|
||||
|
||||
+199
@@ -0,0 +1,199 @@
|
||||
|
||||
# XtraDB Cluster install
|
||||
|
||||
## requirement
|
||||
### docker
|
||||
|
||||
### host
|
||||
|
||||
```hosts
|
||||
10.194.64.102 gzii-db-3
|
||||
10.194.64.103 gzii-db-4
|
||||
10.194.64.104 gzii-app-2
|
||||
```
|
||||
|
||||
### sysctl
|
||||
```bash
|
||||
modprobe br_netfilter
|
||||
lsmod | grep br_netfilter
|
||||
echo "br_netfilter" | sudo tee -a /etc/modules-load.d/br_netfilter.conf
|
||||
sysctl -w net.bridge.bridge-nf-call-iptables=1
|
||||
sysctl -w net.bridge.bridge-nf-call-ip6tables=1
|
||||
```
|
||||
|
||||
### iptables
|
||||
```bash
|
||||
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 33060 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 4567 -j ACCEPT
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
systemctl restart iptables
|
||||
```
|
||||
|
||||
### firewalld
|
||||
|
||||
```bash
|
||||
firewall-cmd --get-active-zones
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
firewall-cmd --zone=public --add-port=3306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4567/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=33060/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=2379/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4568/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=4444/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=13306/tcp --permanent
|
||||
firewall-cmd --zone=public --add-port=6032/tcp --permanent
|
||||
firewall-cmd --reload
|
||||
|
||||
```
|
||||
|
||||
## cluster
|
||||
## node 1
|
||||
|
||||
### image
|
||||
```bash
|
||||
gunzip -c percorna.tgz | docker load
|
||||
```
|
||||
### ssl
|
||||
```bash
|
||||
mkdir /opt/percorna/config
|
||||
```
|
||||
|
||||
|
||||
```my.cnf
|
||||
[client]
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/client-cert.pem
|
||||
ssl-key = /cert/client-key.pem
|
||||
|
||||
[sst]
|
||||
encrypt = 4
|
||||
ssl-ca = /cert/ca.pem
|
||||
ssl-cert = /cert/server-cert.pem
|
||||
ssl-key = /cert/server-key.pem
|
||||
|
||||
[mysqld]
|
||||
ssl-ca=/cert/ca.pem
|
||||
ssl-cert=/cert/server-cert.pem
|
||||
ssl-key=/cert/server-key.pem
|
||||
skip_name_resolve
|
||||
log-error = /var/lib/mysql/error.log
|
||||
wsrep_provider_options="socket.ssl_cert=/cert/server-cert.pem;socket.ssl_key=/cert/server-key.pem;socket.ssl_ca=/cert/ca.pem"
|
||||
```
|
||||
|
||||
|
||||
|
||||
### etcd
|
||||
```bash
|
||||
ETCD_HOST=10.192.64.102
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-p 4001:4001 -p 2380:2380 -p 2379:2379 \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--name etcd0 \
|
||||
--advertise-client-urls=http://${ETCD_HOST}:2379,http://${ETCD_HOST}:4001 \
|
||||
--listen-client-urls=http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--initial-advertise-peer-urls=http://${ETCD_HOST}:2380 \
|
||||
--listen-peer-urls=http://0.0.0.0:2380 \
|
||||
--initial-cluster-token=etcd-cluster-1 \
|
||||
--initial-cluster=etcd0=http://${ETCD_HOST}:2380 \
|
||||
--initial-cluster-state=new
|
||||
```
|
||||
|
||||
|
||||
|
||||
### bootstrap
|
||||
|
||||
|
||||
```bash
|
||||
mkpasswd -l 16
|
||||
```
|
||||
|
||||
root password:
|
||||
```
|
||||
wc97fjvDg:Ywgyad
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
gzii-db-3:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
--name=gzii-db-3 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
gzii-db-4:
|
||||
```bash
|
||||
docker run -d \
|
||||
-e MYSQL_ROOT_PASSWORD=wc97fjvDg:Ywgyad \
|
||||
-e CLUSTER_NAME=pxc-cluster1 \
|
||||
-e CLUSTER_JOIN=gzii-db-3 \
|
||||
--name=gzii-db-4 \
|
||||
--net=host \
|
||||
-v ./cert:/cert \
|
||||
-v ./config:/etc/percona-xtradb-cluster.conf.d \
|
||||
-v ./data:/var/lib/mysql:rw \
|
||||
percona/percona-xtradb-cluster:8.4.0
|
||||
```
|
||||
|
||||
|
||||
monitor pass:
|
||||
```
|
||||
0nz&lzDAxcxet5ta
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
ALTER USER 'monitor'@'%' IDENTIFIED BY 'monitor';
|
||||
GRANT SELECT, PROCESS, REPLICATION CLIENT ON *.* TO 'monitor'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
CREATE USER 'operator'@'%' IDENTIFIED BY 'operator';
|
||||
GRANT SELECT, REPLICATION CLIENT ON *.* TO 'operator'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup, active)
|
||||
VALUES ('monitoring', '0nz&lzDAxcxet5ta', 0, 1);
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_users (username, password, default_hostgroup) VALUES ('monitor', '0nz&lzDAxcxet5ta', 0);
|
||||
LOAD MYSQL USERS TO RUNTIME;
|
||||
SAVE MYSQL USERS TO DISK;
|
||||
|
||||
```
|
||||
|
||||
|
||||
```bash
|
||||
proxysql-admin --config-file=/var/lib/proxysql/proxysql-admin.cnf --enable
|
||||
```
|
||||
@@ -0,0 +1,103 @@
|
||||
|
||||
Great! Since you're using `root`, there's no need to prepend commands with `sudo`. Here's how to configure `iptables` to allow all traffic on `10.194.64.0/24` without `sudo`:
|
||||
|
||||
---
|
||||
|
||||
### **1. Check Current iptables Rules**
|
||||
|
||||
To inspect the current rules:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Add Rules to Allow All Traffic on the Subnet**
|
||||
|
||||
#### **2.1. Allow Incoming Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A INPUT -s 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.2. Allow Outgoing Traffic**
|
||||
|
||||
```bash
|
||||
iptables -A OUTPUT -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
#### **2.3. Allow Forwarded Traffic (if needed)**
|
||||
|
||||
If this system acts as a router or forwards traffic:
|
||||
|
||||
```bash
|
||||
iptables -A FORWARD -s 10.194.64.0/24 -j ACCEPT
|
||||
iptables -A FORWARD -d 10.194.64.0/24 -j ACCEPT
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **3. Save the iptables Configuration**
|
||||
|
||||
To persist these rules across reboots:
|
||||
|
||||
#### **3.1. Save Rules (Legacy Method)**
|
||||
|
||||
Use `iptables-save` to save the rules into a configuration file:
|
||||
|
||||
```bash
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
```
|
||||
|
||||
#### **3.2. For Systems Using `netfilter-persistent`**
|
||||
|
||||
If `netfilter-persistent` is installed:
|
||||
|
||||
```bash
|
||||
netfilter-persistent save
|
||||
```
|
||||
|
||||
#### **3.3. For RHEL-Based Systems**
|
||||
|
||||
If you're on a RHEL-based system:
|
||||
|
||||
```bash
|
||||
service iptables save
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify Rules**
|
||||
|
||||
To confirm the rules are applied:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **5. Optional: Test Connectivity**
|
||||
|
||||
Test traffic to and from the `10.194.64.0/24` subnet:
|
||||
|
||||
```bash
|
||||
ping 10.194.64.1
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **6. Debugging (if needed)**
|
||||
|
||||
If traffic is still blocked:
|
||||
|
||||
- Look for conflicting `DROP` rules in the `INPUT`, `OUTPUT`, or `FORWARD` chains:
|
||||
|
||||
```bash
|
||||
iptables -L -v -n
|
||||
```
|
||||
|
||||
- Ensure the system's network interface is properly configured.
|
||||
|
||||
Let me know if you need help troubleshooting further or additional features like logging specific traffic!
|
||||
@@ -0,0 +1,559 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
要修改 ProxySQL 的**全局**默认查询超时（`mysql-default_query_timeout`），你可以通过 Admin 接口在线调整，也可以修改配置文件后重启或重加载。下面分别介绍这两种方法。
|
||||
|
||||
---
|
||||
|
||||
## 一、通过 Admin 接口在线修改
|
||||
|
||||
1. **登录到 ProxySQL Admin 界面**
|
||||
|
||||
```bash
|
||||
mysql -u admin -padmin -h 127.0.0.1 -P 6032
|
||||
```
|
||||
|
||||
将 `admin`/`admin` 替换成你的管理员用户名和密码。
|
||||
|
||||
2. **设置新的默认查询超时**（单位：毫秒）
|
||||
比如将超时改为 **60 000 ms（60 秒）**：
|
||||
|
||||
```sql
|
||||
SET mysql-default_query_timeout = 60000;
|
||||
```
|
||||
|
||||
3. **将变量加载到运行时配置**
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
```
|
||||
|
||||
4. **将当前运行时配置保存到磁盘**
|
||||
|
||||
```sql
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
> 默认情况下，`mysql-default_query_timeout` 的值是 `86400000`（24 小时）([proxysql.com](https://proxysql.com/documentation/global-variables/mysql-variables/?utm_source=chatgpt.com "MySQL Variables - ProxySQL"))。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 二、修改配置文件
|
||||
|
||||
1. 打开你的 ProxySQL 配置文件（常见路径 `/etc/proxysql.cnf` 或者 `/etc/proxysql/proxysql.cnf`）
|
||||
|
||||
2. 找到 `mysql_variables` 段落，添加或修改 `default_query_timeout`，例如：
|
||||
|
||||
```ini
|
||||
mysql_variables = {
|
||||
# … 其他变量 …
|
||||
default_query_timeout = 60000
|
||||
}
|
||||
```
|
||||
|
||||
3. 重启 ProxySQL 服务以使配置生效：
|
||||
|
||||
```bash
|
||||
systemctl restart proxysql
|
||||
```
|
||||
|
||||
或者如果你希望不中断服务，可以先启动 ProxySQL，然后执行：
|
||||
|
||||
```sql
|
||||
LOAD MYSQL VARIABLES TO RUNTIME;
|
||||
SAVE MYSQL VARIABLES TO DISK;
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 三、针对单条规则定制超时
|
||||
|
||||
如果你只想对特定的查询模式设定更严格或更宽松的超时，可以在 **查询规则** 中使用 `timeout` 字段（单位同样为毫秒）：
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (
|
||||
rule_id, active, match_pattern, destination_hostgroup, timeout
|
||||
) VALUES (
|
||||
100, 1, '^SELECT .* FOR UPDATE$', 10, 30000
|
||||
);
|
||||
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
> 如果某条规则未指定 `timeout`，就会回退使用全局 `mysql-default_query_timeout`。([proxysql.com](https://proxysql.com/documentation/main-runtime/?utm_source=chatgpt.com "Main (runtime tables definition) - ProxySQL"))
|
||||
|
||||
---
|
||||
|
||||
以上就是修改 ProxySQL 默认查询超时的方式。根据你的场景选择「全局修改」或「单条规则覆盖」，并记得 `LOAD … TO RUNTIME` + `SAVE … TO DISK` 才能保证即时生效且持久保存。
|
||||
|
||||
|
||||
探针
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
内存：
|
||||
```
|
||||
free | awk '/^Mem:/ { printf("Memory Usage: %.2f%%\n", $3/$2 * 100) }'
|
||||
```
|
||||
|
||||
|
||||
nginx 加代理
|
||||
/dcwj to https://10.205.29.3:8081
|
||||
|
||||
```
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
#keepalive_timeout 65;
|
||||
|
||||
upstream form_api_backend {
|
||||
server 10.194.64.17:8180 max_fails=3 fail_timeout=30s;
|
||||
}
|
||||
|
||||
upstream dcwj_backend {
|
||||
server 10.205.29.3:8081;
|
||||
}
|
||||
|
||||
# 重定向HTTP请求到HTTPS
|
||||
server {
|
||||
listen 80;
|
||||
server_name data.gxj.gz.gov.cn;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# HTTPS服务器配置
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name data.gxj.gz.gov.cn 10.194.64.17 _;
|
||||
|
||||
# SSL证书配置
|
||||
ssl_certificate /etc/nginx/ssl/nginx.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/nginx.key;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:\
|
||||
ECDHE-RSA-AES128-GCM-SHA256:\
|
||||
ECDHE-ECDSA-AES256-GCM-SHA384:\
|
||||
ECDHE-RSA-AES256-GCM-SHA384:\
|
||||
ECDHE-ECDSA-CHACHA20-POLY1305:\
|
||||
ECDHE-RSA-CHACHA20-POLY1305:\
|
||||
DHE-RSA-AES128-GCM-SHA256:\
|
||||
DHE-RSA-AES256-GCM-SHA384:\
|
||||
DHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
client_max_body_size 30m;
|
||||
|
||||
# 默认根路径代理
|
||||
location / {
|
||||
proxy_pass http://form_api_backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# /dcwj 上的反向代理到 HTTPS 后端
|
||||
location /dcwj/ {
|
||||
access_log /var/log/nginx/dcwj_access.log main;
|
||||
proxy_pass https://dcwj_backend$request_uri;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
}
|
||||
|
||||
# 可选：健康检查
|
||||
location /healthcheck {
|
||||
return 200 "OK";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
curl -I -k -v https://10.205.29.3:8081
|
||||
```
|
||||
|
||||
|
||||
nginx logrotate
|
||||
|
||||
/etc/logrotate.d/nginx-docker
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0640 root root
|
||||
sharedscripts
|
||||
postrotate
|
||||
# signal the nginx in the container to reopen logs
|
||||
docker kill --signal=USR1 nginx_container_name
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
|
||||
new config with gz compress
|
||||
```
|
||||
/opt/app/nginx/log/*.log {
|
||||
daily
|
||||
missingok
|
||||
rotate 14
|
||||
|
||||
# enable gzip compression of rotated logs
|
||||
compress
|
||||
compresscmd /bin/gzip
|
||||
uncompresscmd /bin/gunzip
|
||||
compressoptions -9
|
||||
extension .gz
|
||||
delaycompress
|
||||
|
||||
notifempty
|
||||
create 0640 root root
|
||||
|
||||
sharedscripts
|
||||
postrotate
|
||||
# tell the nginx master in the “nginx” container to reopen its logs
|
||||
docker kill --signal=USR1 nginx
|
||||
endscript
|
||||
}
|
||||
|
||||
```
|
||||
Executable
+342
@@ -0,0 +1,342 @@
|
||||
|
||||
lsblk
|
||||
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
||||
loop0 7:0 0 3.6G 0 loop /mnt/dvd
|
||||
sr0 11:0 1 30.6M 0 rom
|
||||
sr1 11:1 1 1024M 0 rom
|
||||
vda 252:0 0 30G 0 disk
|
||||
├─vda1 252:1 0 200M 0 part /boot
|
||||
├─vda2 252:2 0 8G 0 part [SWAP]
|
||||
└─vda3 252:3 0 21.8G 0 part /
|
||||
vdb 252:16 0 70G 0 disk
|
||||
└─vdb1 252:17 0 70G 0 part /opt
|
||||
vdc 252:32 0 250G 0 disk
|
||||
|
||||
|
||||
|
||||
tomcat :
|
||||
x-forward-for:
|
||||
```xml
|
||||
<!-- Remote IP Valve -->
|
||||
<Valve className="org.apache.catalina.valves.RemoteIpValve" />
|
||||
|
||||
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
|
||||
prefix="localhost_access_log." suffix=".txt"
|
||||
pattern="combined" resolveHosts="false"/>
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
## docker ce install
|
||||
|
||||
download docker binary
|
||||
```
|
||||
http://mirrors.aliyun.com/docker-ce/linux/static/stable
|
||||
```
|
||||
|
||||
```bash
|
||||
tar xzvf docker-27.3.1.tgz
|
||||
cp docker/* /usr/loca/sbin/
|
||||
```
|
||||
|
||||
```bash
|
||||
vim /usr/lib/systemd/system/docker.service
|
||||
|
||||
```
|
||||
|
||||
```docker.service
|
||||
[Unit]
|
||||
Description=Docker Application Container Engine
|
||||
Documentation=https://docs.docker.com
|
||||
After=network-online.target firewalld.service
|
||||
Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
ExecStart=/usr/local/sbin/dockerd
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
LimitNOFILE=infinity
|
||||
LimitNPROC=infinity
|
||||
TimeoutStartSec=0
|
||||
Delegate=yes
|
||||
KillMode=process
|
||||
Restart=on-failure
|
||||
StartLimitBurst=3
|
||||
StartLimitInterval=60s
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker save
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name haproxy \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-p 3306:3306 \
|
||||
-v ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro \
|
||||
haproxy:3.0.6
|
||||
|
||||
```
|
||||
|
||||
|
||||
gzii-db-2:
|
||||
lookbusy:
|
||||
```
|
||||
#!/bin/bash
|
||||
/usr/local/bin/lookbusy -c 10-30 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu &
|
||||
```
|
||||
|
||||
disk:
|
||||
```
|
||||
fallocate -l 240G /opt/tmp/data.zip
|
||||
```
|
||||
|
||||
|
||||
sql timeout
|
||||
|
||||
|
||||
### Steps:
|
||||
|
||||
1. **Create a new rule for `jmwrapid`**:
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, replace_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 'SET SESSION max_execution_time=30000;', 0, 0, 10);
|
||||
```
|
||||
|
||||
This rule sets a maximum execution time of 30 seconds (30000 milliseconds) for all queries executed by the `jmwrapid` user.
|
||||
|
||||
2. **Load the rule into runtime and save it**:
|
||||
|
||||
```sql
|
||||
LOAD MYSQL QUERY RULES TO RUNTIME;
|
||||
SAVE MYSQL QUERY RULES TO DISK;
|
||||
```
|
||||
|
||||
3. **Verify the rule**:
|
||||
|
||||
```sql
|
||||
SELECT * FROM mysql_query_rules WHERE username = 'jmwrapid';
|
||||
```
|
||||
|
||||
|
||||
This will apply the SQL timeout specifically for `jmwrapid`. Let me know if you need more adjustments!
|
||||
|
||||
```sql
|
||||
UPDATE mysql_query_rules
|
||||
SET timeout = 60
|
||||
WHERE username = 'jmwrapid' AND match_pattern = '.*';
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
```sql
|
||||
INSERT INTO mysql_query_rules (active, username, match_pattern, timeout, flagIN, destination_hostgroup)
|
||||
VALUES (1, 'jmwrapid', '.*', 60, 0, 10);
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
To update a Docker container's timezone, you can follow these steps:
|
||||
|
||||
---
|
||||
|
||||
### **1. Update Timezone in a Running Container**
|
||||
If the container is already running, you can change the timezone by:
|
||||
|
||||
#### **a. Using `exec` to set the timezone**
|
||||
Run the following command to set the timezone in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/<Region>/<City> /etc/localtime
|
||||
```
|
||||
For example, to set the timezone to `America/New_York`:
|
||||
```bash
|
||||
docker exec -it <container_name> ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
|
||||
```
|
||||
|
||||
#### **b. Set the timezone environment variable**
|
||||
You can also set the `TZ` environment variable in the container:
|
||||
```bash
|
||||
docker exec -it <container_name> sh -c "echo 'America/New_York' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. Set Timezone at Container Creation**
|
||||
To ensure the correct timezone is set when you start a container, you can configure the timezone during container creation.
|
||||
|
||||
#### **a. Add a `TZ` environment variable**
|
||||
Use the `-e` flag to set the `TZ` environment variable:
|
||||
```bash
|
||||
docker run -e TZ=America/New_York -d <image_name>
|
||||
```
|
||||
|
||||
#### **b. Mount the `/etc/localtime` file**
|
||||
You can mount the host system's timezone file into the container:
|
||||
```bash
|
||||
docker run -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro -d <image_name>
|
||||
```
|
||||
|
||||
This ensures the container uses the same timezone as the host system.
|
||||
|
||||
---
|
||||
|
||||
### **3. Update Dockerfile for Persistent Changes**
|
||||
If you want all containers created from a specific image to have a pre-configured timezone, you can modify the `Dockerfile`:
|
||||
|
||||
```dockerfile
|
||||
FROM <base_image>
|
||||
ENV TZ=America/New_York
|
||||
RUN ln -sf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
|
||||
```
|
||||
|
||||
Then rebuild the image:
|
||||
```bash
|
||||
docker build -t <new_image_name> .
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. Verify the Timezone**
|
||||
You can verify the timezone in the container by checking the current date and time:
|
||||
```bash
|
||||
docker exec -it <container_name> date
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Summary:
|
||||
- Use `docker exec` to update the timezone in a running container.
|
||||
- Configure the timezone at container creation using `-e TZ` or mounting `/etc/localtime`.
|
||||
- Modify the `Dockerfile` for persistent timezone settings.
|
||||
|
||||
Let me know if you need further clarification!
|
||||
|
||||
|
||||
```
|
||||
docker exec --user root -it proxysql ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
|
||||
```
|
||||
|
||||
```
|
||||
docker exec -it proxysql mysql -h 127.0.0.1 -u admin -padmin -P6032 -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
|
||||
```
|
||||
```
|
||||
docker exec -it gzii-db-3 mysql -u root -h 127.0.0.1 -pwc97fjvDg:Ywgyad mysql -e "SET GLOBAL time_zone = 'Asia/Shanghai';"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-3:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-3 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-3 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
```
|
||||
docker cp /usr/share/zoneinfo/Asia/Shanghai gzii-db-4:/usr/share/zoneinfo/Asia/Shanghai
|
||||
docker exec -it -u root gzii-db-4 sh -c "echo 'Asia/Shanghai' > /etc/timezone"
|
||||
docker exec -u root gzii-db-4 ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
|
||||
```
|
||||
|
||||
|
||||
|
||||
17:
|
||||
|
||||
cpu 内存:
|
||||
|
||||
```
|
||||
/usr/local/bin/lookbusy -c 10-70 --cpu-mode curve --cpu-curve-period 60m --cpu-curve-peak 30m cpu -m 19GB -M 3000 &
|
||||
```
|
||||
|
||||
|
||||
auth 失败处理
|
||||
|
||||
```
|
||||
docker run -d \
|
||||
--name etcd \
|
||||
--net host \
|
||||
-v /usr/share/ca-certificates/:/etc/ssl/certs \
|
||||
-v /opt/etcd/data:/etcd-data \
|
||||
quay.io/coreos/etcd:v3.4.35 \
|
||||
/usr/local/bin/etcd \
|
||||
--enable-v2=true \
|
||||
--name etcd0 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379,http://0.0.0.0:4001 \
|
||||
--advertise-client-urls http://10.194.64.102:2379,http://10.194.64.102:4001 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://10.194.64.102:2380 \
|
||||
--initial-cluster-token etcd-cluster-1 \
|
||||
--initial-cluster etcd0=http://10.194.64.102:2380 \
|
||||
--initial-cluster-state new
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --endpoints=http://127.0.0.1:2379 endpoint health
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl user add root --new-user-password="IeGheikae.Woo5ph"
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role add root
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 role grant-permission root --prefix=true readwrite /
|
||||
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 user grant-role root root
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec etcd etcdctl --endpoints=http://gzii-db-3:2379 auth enable
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
docker exec -e ETCDCTL_API=3 etcd etcdctl --user=root:IeGheikae.Woo5ph member list
|
||||
```
|
||||
|
||||
|
||||
安装探测器：
|
||||
|
||||
```
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
traceroute -T -p 9000 10.207.33.1
|
||||
```
|
||||
|
||||
backup etcd
|
||||
```
|
||||
docker exec etcd etcdctl \
|
||||
--endpoints=http://10.194.64.102:2379 \
|
||||
--user=root:IeGheikae.Woo5ph \
|
||||
snapshot save /etcd-data/backup-$(date +%Y%m%d-%H%M%S).db
|
||||
|
||||
```
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Executable
+245
@@ -0,0 +1,245 @@
|
||||
# 发改委登录信息
|
||||
|
||||
## VPN
|
||||
|
||||
服务器:
|
||||
|
||||
零信任账号：chenzhq1453
|
||||
|
||||
密码：Bianhua@88
|
||||
|
||||
|
||||
|
||||
new:
|
||||
|
||||
```user
|
||||
Lixiaobing3905
|
||||
```
|
||||
|
||||
|
||||
```pass
|
||||
Gxjrapid@2410
|
||||
```
|
||||
|
||||
|
||||
new password: 20250407
|
||||
```password
|
||||
Gxjrapid@2504
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
Gxjrapid@2507
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
Gxjrapid@2509
|
||||
```
|
||||
|
||||
|
||||
## 二期服务器
|
||||
|
||||
### 二期堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.36.152/ |
|
||||
| 账号 | gzsfgw04 |
|
||||
| 密码 | GzsFgw@0805 |
|
||||
|
||||
```sh
|
||||
# mimagengx
|
||||
GzsFgw@0905
|
||||
```
|
||||
|
||||
```pass
|
||||
GzsFgw@1029
|
||||
```
|
||||
|
||||
```
|
||||
GzsFgw@250320
|
||||
```
|
||||
|
||||
```
|
||||
GzsFgw@250612
|
||||
```
|
||||
|
||||
|
||||
|
||||
### 二期服务器
|
||||
|
||||
[GateShell]
|
||||
001: 10.194.62.21-linux
|
||||
002: 10.194.62.22-linux
|
||||
003: 10.194.62.23-linux
|
||||
004: 10.194.62.24-linux
|
||||
005: 10.194.62.25-linux
|
||||
006: 10.194.62.26-linux
|
||||
007: 10.194.62.27-linux
|
||||
008: 10.194.62.28-linux
|
||||
009: 10.194.62.29-linux
|
||||
010: 10.194.62.30-linux
|
||||
|
||||
Gzzwy@%2020$
|
||||
|
||||
```sh
|
||||
Gzzwy@%2020$
|
||||
```
|
||||
|
||||
```
|
||||
Gzzwy@%2020$
|
||||
```
|
||||
|
||||
|
||||
### 二期数据库
|
||||
|
||||
fgw
|
||||
|
||||
fgw_1QAZ2wsx
|
||||
|
||||
```sh
|
||||
fgw
|
||||
|
||||
fgw_1QAZ2wsx
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三期测试服务器
|
||||
|
||||
### 三期测试堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.201.201.201 |
|
||||
| 账号 | fgwsp_czq |
|
||||
| 密码 | Bianhua@88 |
|
||||
|
||||
```sh
|
||||
# 密码更新
|
||||
Bianhua@99
|
||||
```
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.209.224 |
|
||||
| 账号 | fgwsp_czq |
|
||||
| 密码 | Bianhua@88 |
|
||||
|
||||
### 三期测试服务器
|
||||
|
||||
| IP | 账号 | 旧密码 | 新密码 |
|
||||
| -------------- | ---- | ------------ | ------------ |
|
||||
| 10.209.246.116 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.117 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.118 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.119 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
|
||||
```sh
|
||||
LNTwxy8%%7tE
|
||||
```
|
||||
|
||||
nacos:
|
||||
user: nacos
|
||||
```password
|
||||
BneT!tsdrq&f
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三期正式服务器
|
||||
|
||||
### 三期正式堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.209.224 |
|
||||
| 账号 | gzsfgw23 |
|
||||
| 密码 | sQ3q7NkhTfuAr@^!t2 |
|
||||
ssh: 10.208.209.224 60022
|
||||
|
||||
新密码
|
||||
```
|
||||
FgwV3@Pszx202412
|
||||
```
|
||||
|
||||
```
|
||||
sQ3q7NkhTfuAr@^!t2
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
FgwV3@Pszx202503
|
||||
```
|
||||
|
||||
```
|
||||
FgwV3@Pszx202507
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
FgwV3@Pszx202510
|
||||
```
|
||||
|
||||
|
||||
|
||||
### 三期正式服务器
|
||||
|
||||
| IP | 账号 | 旧密码 | 新密码 |
|
||||
| ------------- | ---- | -------------- | ------------------ |
|
||||
| 10.209.42.11 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.12 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.13 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.14 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.15 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.16 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.17 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.18 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.19 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.20 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.21 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.22 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.201.23.102 | root | 123!@#Qwe | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.201.23.103 | root | 123!@#Qwe | 8VLtg#ZYA@AJSFJcPM |
|
||||
|
||||
|
||||
```password
|
||||
8VLtg#ZYA@AJSFJcPM
|
||||
```
|
||||
|
||||
```sh
|
||||
# es导入json文件
|
||||
curl -H "Content-Type: application/json" -XPOST http://elastic:FgwV3202403@10.209.246.118:9200/fgw_law_file_index --data-binary "@/opt/fgw_law_file_index_data.json"
|
||||
|
||||
# es备份
|
||||
elasticdump --input=/opt/fgw_law_file_index_data.json --output=http://elastic:FgwV3202403@10.209.246.118:9200/fgw_law_file_index --all=true --type=data
|
||||
```
|
||||
|
||||
```sh
|
||||
# es服务器用户账密
|
||||
elastic
|
||||
kL7@fJ5-wN3+
|
||||
```
|
||||
|
||||
```sh
|
||||
# harbor账号密码
|
||||
admin
|
||||
CP0!y3frC@
|
||||
```
|
||||
|
||||
```sh
|
||||
# nacos账号密码
|
||||
nacos
|
||||
HU#5Zzf7AtReUF3Hg
|
||||
```
|
||||
|
||||
|
||||
|
||||
rust desktop
|
||||
|
||||
gzzn-suse:
|
||||
```
|
||||
_WRu,wekj9/;F.
|
||||
```
|
||||
|
||||
Executable
+296
@@ -0,0 +1,296 @@
|
||||
# 发改委登录信息
|
||||
|
||||
|
||||
## 公司电脑
|
||||
|
||||
rustdesk:
|
||||
|
||||
```
|
||||
3 393 417
|
||||
```
|
||||
|
||||
密码：
|
||||
```
|
||||
4ZZzxrAfwFj5q1
|
||||
```
|
||||
|
||||
中继key
|
||||
```
|
||||
4BWKesxFCiKVPj7j6Zm7qV4JW8FtvRXZY1Zejv4nGxk=
|
||||
```
|
||||
|
||||
opensuse desk:
|
||||
```
|
||||
1 789 035 225
|
||||
```
|
||||
|
||||
```
|
||||
4ZZzxrAfwFj5q1
|
||||
```
|
||||
|
||||
|
||||
|
||||
## VPN
|
||||
|
||||
服务器:
|
||||
|
||||
|
||||
零信任账号：chenzhq1453
|
||||
|
||||
密码：Bianhua@88
|
||||
|
||||
|
||||
112.94.64.30
|
||||
|
||||
new:
|
||||
|
||||
ip:
|
||||
```
|
||||
112.94.64.30
|
||||
```
|
||||
|
||||
```user
|
||||
Lixiaobing3905
|
||||
```
|
||||
|
||||
|
||||
```pass
|
||||
Gxjrapid@2410
|
||||
```
|
||||
|
||||
|
||||
new password: 20250407
|
||||
```password
|
||||
Gxjrapid@2504
|
||||
```
|
||||
|
||||
```
|
||||
Gxjrapid@2507
|
||||
```
|
||||
|
||||
```
|
||||
Gxjrapid@2509
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 二期服务器
|
||||
|
||||
### 二期堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.36.152/ |
|
||||
| 账号 | gzsfgw04 |
|
||||
| 密码 | GzsFgw@0805 |
|
||||
|
||||
```sh
|
||||
# mimagengx
|
||||
GzsFgw@0905
|
||||
```
|
||||
|
||||
```pass
|
||||
GzsFgw@1029
|
||||
```
|
||||
```
|
||||
GzsFgw@250320
|
||||
```
|
||||
|
||||
```
|
||||
GzsFgw@250612
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
GzsFgw@251208
|
||||
```
|
||||
|
||||
|
||||
### 二期服务器
|
||||
|
||||
Gzzwy@%2020$
|
||||
|
||||
```sh
|
||||
Gzzwy@%2020$
|
||||
```
|
||||
|
||||
### 二期数据库
|
||||
|
||||
fgw
|
||||
|
||||
fgw_1QAZ2wsx
|
||||
|
||||
```sh
|
||||
fgw
|
||||
|
||||
fgw_1QAZ2wsx
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三期测试服务器
|
||||
|
||||
### 三期测试堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.201.201.201 |
|
||||
| 账号 | fgwsp_czq |
|
||||
| 密码 | Bianhua@88 |
|
||||
```
|
||||
fgwsp_czq
|
||||
```
|
||||
|
||||
|
||||
```sh
|
||||
# 密码更新
|
||||
Bianhua@99
|
||||
```
|
||||
|
||||
```
|
||||
10.208.209.224
|
||||
```
|
||||
|
||||
```
|
||||
66622
|
||||
```
|
||||
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.209.224 |
|
||||
| 账号 | fgwsp_czq |
|
||||
| 密码 | Bianhua@88 |
|
||||
|
||||
### 三期测试服务器
|
||||
|
||||
| IP | 账号 | 旧密码 | 新密码 |
|
||||
| -------------- | ---- | ------------ | ------------ |
|
||||
| 10.209.246.116 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.117 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.118 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
| 10.209.246.119 | root | Passw0rd@123 | LNTwxy8%%7tE |
|
||||
|
||||
```sh
|
||||
LNTwxy8%%7tE
|
||||
```
|
||||
|
||||
nacos:
|
||||
user: nacos
|
||||
```password
|
||||
BneT!tsdrq&f
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三期正式服务器
|
||||
|
||||
### 三期正式堡垒机
|
||||
|
||||
| | |
|
||||
| ----- | ---------------------- |
|
||||
| 堡垒机地址 | https://10.208.209.224 |
|
||||
| 账号 | gzsfgw23 |
|
||||
| 密码 | sQ3q7NkhTfuAr@^!t2 |
|
||||
ssh: 10.208.209.224 60022
|
||||
```
|
||||
gzsfgw23
|
||||
```
|
||||
|
||||
新密码
|
||||
```
|
||||
FgwV3@Pszx202412
|
||||
```
|
||||
|
||||
```
|
||||
sQ3q7NkhTfuAr@^!t2
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
FgwV3@Pszx202503
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
FgwV3@Pszx202508
|
||||
```
|
||||
|
||||
```
|
||||
FgwV3@Pszx202510
|
||||
```
|
||||
|
||||
```
|
||||
FgwV3@Pszx202512
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### 三期正式服务器
|
||||
|
||||
| IP | 账号 | 旧密码 | 新密码 |
|
||||
| ------------- | ---- | -------------- | ------------------ |
|
||||
| 10.209.42.11 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.12 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.13 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.14 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.15 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.16 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.17 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.18 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.19 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.20 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.21 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.209.42.22 | root | Pass@XC#202304 | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.201.23.102 | root | 123!@#Qwe | 8VLtg#ZYA@AJSFJcPM |
|
||||
| 10.201.23.103 | root | 123!@#Qwe | 8VLtg#ZYA@AJSFJcPM |
|
||||
|
||||
|
||||
```password
|
||||
8VLtg#ZYA@AJSFJcPM
|
||||
```
|
||||
|
||||
|
||||
|
||||
10.209.42.19 新密码：
|
||||
```
|
||||
uve|ph7ro9bieCh#
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
```sh
|
||||
# es导入json文件
|
||||
curl -H "Content-Type: application/json" -XPOST http://elastic:FgwV3202403@10.209.246.118:9200/fgw_law_file_index --data-binary "@/opt/fgw_law_file_index_data.json"
|
||||
|
||||
# es备份
|
||||
elasticdump --input=/opt/fgw_law_file_index_data.json --output=http://elastic:FgwV3202403@10.209.246.118:9200/fgw_law_file_index --all=true --type=data
|
||||
```
|
||||
|
||||
```sh
|
||||
# es服务器用户账密
|
||||
elastic
|
||||
kL7@fJ5-wN3+
|
||||
```
|
||||
|
||||
```sh
|
||||
# harbor账号密码
|
||||
admin
|
||||
CP0!y3frC@
|
||||
```
|
||||
|
||||
```sh
|
||||
# nacos账号密码
|
||||
nacos
|
||||
HU#5Zzf7AtReUF3Hg
|
||||
```
|
||||
|
||||
|
||||
|
||||
达梦：
|
||||
```
|
||||
./disql SYSDBA/'"Hn@dameng123"':5236
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,627 @@
|
||||
Apologies for the confusion caused by the deprecated commands in the MinIO Client (`mc`). The MinIO team periodically updates `mc` to enhance functionality and improve usability, which sometimes leads to changes in command syntax. To ensure compatibility and take advantage of the latest features, it's essential to use the updated commands.
|
||||
|
||||
Below is the **updated guide** for creating an **API user** with **read and write** permissions equivalent to the **root user** using the latest `mc` commands: `mc admin policy create` and `mc admin policy attach`.
|
||||
|
||||
---
|
||||
|
||||
## **Table of Contents**
|
||||
|
||||
1. [Prerequisites](#prerequisites)
|
||||
2. [Understanding MinIO Users and Policies](#understanding-minio-users-and-policies)
|
||||
3. [Installing and Configuring MinIO Client (`mc`)](#installing-and-configuring-minio-client-mc)
|
||||
4. [Creating a Full Access Policy](#creating-a-full-access-policy)
|
||||
5. [Creating the API User and Assigning the Policy](#creating-the-api-user-and-assigning-the-policy)
|
||||
6. [Verifying the API User](#verifying-the-api-user)
|
||||
7. [Best Practices](#best-practices)
|
||||
8. [Example: Creating an API User with Full Access](#example-creating-an-api-user-with-full-access)
|
||||
9. [Additional Resources](#additional-resources)
|
||||
|
||||
---
|
||||
|
||||
## **1. Prerequisites**
|
||||
|
||||
Ensure you have the following before proceeding:
|
||||
|
||||
- **MinIO Server**: Installed and running in production.
|
||||
- **Root Access**: Administrative privileges to manage MinIO users and policies.
|
||||
- **MinIO Client (`mc`)**: Installed on your local machine or a management server.
|
||||
- **Network Access**: Ability to connect to the MinIO server from where `mc` is installed.
|
||||
|
||||
---
|
||||
|
||||
## **2. Understanding MinIO Users and Policies**
|
||||
|
||||
### **a. Users**
|
||||
|
||||
In MinIO, users are entities (applications, services, or individuals) that interact with the MinIO server. Each user has a unique **Access Key** and **Secret Key** used for authentication.
|
||||
|
||||
### **b. Policies**
|
||||
|
||||
Policies define the permissions associated with users. They determine what actions a user can perform and on which resources (buckets or objects). Policies can be **predefined** or **custom**.
|
||||
|
||||
- **Read-Only**: Allows users to read objects but not modify or delete them.
|
||||
- **Write-Only**: Allows users to upload objects but not read or delete them.
|
||||
- **Full Access**: Grants all permissions, including read, write, and delete.
|
||||
|
||||
---
|
||||
|
||||
## **3. Installing and Configuring MinIO Client (`mc`)**
|
||||
|
||||
The MinIO Client (`mc`) is a command-line tool that simplifies managing MinIO servers and performing administrative tasks.
|
||||
|
||||
### **a. Download and Install `mc`**
|
||||
|
||||
1. **Download the Latest Release:**
|
||||
|
||||
```bash
|
||||
wget https://dl.min.io/client/mc/release/linux-amd64/mc
|
||||
```
|
||||
|
||||
2. **Make the Binary Executable:**
|
||||
|
||||
```bash
|
||||
chmod +x mc
|
||||
```
|
||||
|
||||
3. **Move `mc` to a Directory in Your PATH:**
|
||||
|
||||
```bash
|
||||
sudo mv mc /usr/local/bin/
|
||||
```
|
||||
|
||||
4. **Verify Installation:**
|
||||
|
||||
```bash
|
||||
mc --version
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
mc version RELEASE.2023-07-24T16-40-29Z
|
||||
```
|
||||
|
||||
### **b. Configure `mc` to Connect to Your MinIO Server**
|
||||
|
||||
1. **Set Up an Alias for Your MinIO Server:**
|
||||
|
||||
Replace `<ALIAS>`, `<MINIO_ENDPOINT>`, `<YOUR-ACCESS-KEY>`, and `<YOUR-SECRET-KEY>` with your actual details.
|
||||
|
||||
```bash
|
||||
mc alias set <ALIAS> <MINIO_ENDPOINT> <YOUR-ACCESS-KEY> <YOUR-SECRET-KEY> --api S3v4
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc alias set myminio https://minio.example.com Ab3dE6fG9hJkLmN0 Pq8Rs5Tu7Vw9Xy1Z2a3Bc4De5Fg6Hi7J --api S3v4
|
||||
```
|
||||
|
||||
2. **Verify Connection:**
|
||||
|
||||
```bash
|
||||
mc ls myminio
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
If you encounter errors, ensure that:
|
||||
|
||||
- The MinIO server is accessible from your machine.
|
||||
- The access and secret keys are correct.
|
||||
- Network firewalls or security groups allow traffic on MinIO ports (default: 9000 for S3 API).
|
||||
|
||||
---
|
||||
|
||||
## **4. Creating a Full Access Policy**
|
||||
|
||||
To replicate the root user's permissions, you'll need to create a policy that grants **full access** to all resources.
|
||||
|
||||
### **a. Define the Policy JSON**
|
||||
|
||||
1. **Create a File Named `full-access.json`:**
|
||||
|
||||
```bash
|
||||
nano full-access.json
|
||||
```
|
||||
|
||||
2. **Add the Following Content:**
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Policy Breakdown:**
|
||||
|
||||
- **`s3:*`**: Grants all S3 actions (create, read, update, delete).
|
||||
- **`arn:aws:s3:::*`**: Applies to all buckets and objects.
|
||||
|
||||
**_Caution:_** This policy grants **full access**. Ensure that it's only assigned to trusted users.
|
||||
|
||||
3. **Save and Exit:**
|
||||
- Press `CTRL + O`, then `ENTER` to save.
|
||||
- Press `CTRL + X` to exit.
|
||||
|
||||
### **b. Validate the Policy JSON**
|
||||
|
||||
Ensure that the JSON syntax is correct. You can use tools like [JSONLint](https://jsonlint.com/) or run:
|
||||
|
||||
```bash
|
||||
jq empty full-access.json
|
||||
```
|
||||
|
||||
If the command executes without errors, the JSON is valid.
|
||||
|
||||
### **c. Create the Policy in MinIO**
|
||||
|
||||
Use the updated `mc admin policy create` command instead of the deprecated `add` command.
|
||||
|
||||
```bash
|
||||
mc admin policy create <ALIAS> <POLICY_NAME> <POLICY_FILE>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin policy create myminio full-access full-access.json
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access created successfully
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **5. Creating the API User and Assigning the Policy**
|
||||
|
||||
Now that the **full access** policy is defined, you can create a new API user and assign this policy to them.
|
||||
|
||||
### **a. Create the API User**
|
||||
|
||||
Use the `mc` client to create a new user. You will need to generate an **Access Key** and **Secret Key** for the user.
|
||||
|
||||
#### **Method 1: Manual Key Generation**
|
||||
|
||||
1. **Generate an Access Key:**
|
||||
|
||||
```bash
|
||||
ACCESS_KEY=$(openssl rand -hex 8)
|
||||
echo "Access Key: $ACCESS_KEY"
|
||||
```
|
||||
|
||||
2. **Generate a Secret Key:**
|
||||
|
||||
```bash
|
||||
SECRET_KEY=$(openssl rand -hex 16)
|
||||
echo "Secret Key: $SECRET_KEY"
|
||||
```
|
||||
|
||||
**_Sample Output:_**
|
||||
|
||||
```
|
||||
Access Key: a1b2c3d4e5f6g7h8
|
||||
Secret Key: i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
#### **Method 2: Using MinIO Client (`mc`) to Create User with Keys**
|
||||
|
||||
Alternatively, you can let `mc` generate the keys for you.
|
||||
|
||||
```bash
|
||||
mc admin user add <ALIAS> <USERNAME> <SECRET_KEY>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin user add myminio apiuser1 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
**_Note:_** Replace `<USERNAME>` and `<SECRET_KEY>` with your desired username and a strong secret key.
|
||||
|
||||
**_Recommendation:_** Use **Method 1** to generate strong, random keys.
|
||||
|
||||
### **b. Attach the Policy to the User**
|
||||
|
||||
Assign the previously created **full-access** policy to the new user.
|
||||
|
||||
```bash
|
||||
mc admin policy attach <ALIAS> <POLICY_NAME> user=<USERNAME>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin policy attach myminio full-access user=apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access attached to user apiuser1 successfully
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## **6. Verifying the API User**
|
||||
|
||||
Ensure that the new user has been created and has the correct permissions.
|
||||
|
||||
### **a. List Users**
|
||||
|
||||
```bash
|
||||
mc admin user list <ALIAS>
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc admin user list myminio
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
ACCESSKEY USERNAME
|
||||
Ab3dE6fG9hJkLmN0 minioadmin
|
||||
a1b2c3d4e5f6g7h8 apiuser1
|
||||
```
|
||||
|
||||
### **b. Test Access with API User Credentials**
|
||||
|
||||
To confirm that the user has the correct permissions:
|
||||
|
||||
1. **Configure `mc` with the New User:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser myminio https://minio.example.com <ACCESS_KEY> <SECRET_KEY> --api S3v4
|
||||
```
|
||||
|
||||
**Example:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser myminio https://minio.example.com a1b2c3d4e5f6g7h8 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4 --api S3v4
|
||||
```
|
||||
|
||||
2. **List All Buckets:**
|
||||
|
||||
```bash
|
||||
mc ls apiuser
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
3. **Create a New Bucket:**
|
||||
|
||||
```bash
|
||||
mc mb apiuser/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Bucket created successfully `new-bucket`.
|
||||
```
|
||||
|
||||
4. **Upload an Object:**
|
||||
|
||||
```bash
|
||||
mc cp example.txt apiuser/new-bucket/
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Upload Success: example.txt to new-bucket/example.txt
|
||||
```
|
||||
|
||||
5. **Download an Object:**
|
||||
|
||||
```bash
|
||||
mc cp apiuser/new-bucket/example.txt ./example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Download Success: new-bucket/example.txt to example.txt
|
||||
```
|
||||
|
||||
6. **Delete an Object:**
|
||||
|
||||
```bash
|
||||
mc rm apiuser/new-bucket/example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket/example.txt`
|
||||
```
|
||||
|
||||
7. **Remove the Bucket:**
|
||||
|
||||
```bash
|
||||
mc rb apiuser/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket`.
|
||||
```
|
||||
|
||||
**_Note:_** Since the API user has **full access**, all these operations should succeed, mirroring the root user's capabilities.
|
||||
|
||||
---
|
||||
|
||||
## **7. Best Practices**
|
||||
|
||||
To maintain a secure and efficient MinIO environment, adhere to the following best practices when managing API users:
|
||||
|
||||
### **a. Principle of Least Privilege**
|
||||
|
||||
- **Assign Minimal Permissions**: Only grant users the permissions they strictly need.
|
||||
- **Avoid Over-Permissioning**: Do not assign full access unless absolutely necessary.
|
||||
|
||||
**_Note:_** While you're setting up an API user with full access, ensure that this is truly required and that the credentials are handled securely.
|
||||
|
||||
### **b. Regularly Rotate Credentials**
|
||||
|
||||
- **Change Access and Secret Keys Periodically**: Minimizes the risk of compromised credentials.
|
||||
- **Update Dependent Applications**: Ensure that applications using these keys are updated accordingly.
|
||||
|
||||
### **c. Use Strong, Unique Credentials**
|
||||
|
||||
- **High Entropy**: Use long and randomly generated keys.
|
||||
- **Avoid Reuse**: Ensure that each user has unique credentials.
|
||||
|
||||
### **d. Monitor and Audit User Activities**
|
||||
|
||||
- **Enable Logging**: Keep track of user actions for auditing purposes.
|
||||
- **Set Up Alerts**: Notify administrators of unusual activities or access patterns.
|
||||
|
||||
### **e. Secure Storage of Credentials**
|
||||
|
||||
- **Use Secret Management Tools**: Tools like [HashiCorp Vault](https://www.vaultproject.io/), [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/), or [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) can securely store and manage credentials.
|
||||
- **Avoid Hardcoding Credentials**: Do not embed access keys in application code or configuration files.
|
||||
|
||||
### **f. Limit User Lifespans**
|
||||
|
||||
- **Temporary Access**: For users that need temporary access, set expiration policies or regularly review and deactivate unused users.
|
||||
|
||||
---
|
||||
|
||||
## **8. Example: Creating an API User with Full Access**
|
||||
|
||||
Let's walk through a practical example where we create an API user named `apiuser1` with **full access** to all buckets and objects, mirroring the root user's permissions.
|
||||
|
||||
### **Step 1: Define the Full Access Policy**
|
||||
|
||||
1. **Create `full-access.json`:**
|
||||
|
||||
```bash
|
||||
nano full-access.json
|
||||
```
|
||||
|
||||
2. **Add the Following Content:**
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
3. **Save and Exit:**
|
||||
- Press `CTRL + O`, then `ENTER` to save.
|
||||
- Press `CTRL + X` to exit.
|
||||
|
||||
4. **Validate the Policy JSON:**
|
||||
|
||||
```bash
|
||||
jq empty full-access.json
|
||||
```
|
||||
|
||||
**No output means the JSON is valid.**
|
||||
|
||||
### **Step 2: Add the Policy to MinIO**
|
||||
|
||||
```bash
|
||||
mc admin policy create myminio full-access full-access.json
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Policy full-access created successfully
|
||||
```
|
||||
|
||||
### **Step 3: Create the API User**
|
||||
|
||||
1. **Generate Access and Secret Keys:**
|
||||
|
||||
```bash
|
||||
ACCESS_KEY=$(openssl rand -hex 8)
|
||||
SECRET_KEY=$(openssl rand -hex 16)
|
||||
echo "Access Key: $ACCESS_KEY"
|
||||
echo "Secret Key: $SECRET_KEY"
|
||||
```
|
||||
|
||||
**Sample Output:**
|
||||
|
||||
```
|
||||
Access Key: a1b2c3d4e5f6g7h8
|
||||
Secret Key: i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
```
|
||||
|
||||
2. **Add the User with the Policy:**
|
||||
|
||||
```bash
|
||||
mc admin user add myminio apiuser1 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
|
||||
mc admin policy attach myminio full-access user=apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
User apiuser1 added successfully
|
||||
Policy full-access attached to user apiuser1 successfully
|
||||
```
|
||||
|
||||
### **Step 4: Test the API User**
|
||||
|
||||
1. **Configure `mc` with the New User:**
|
||||
|
||||
```bash
|
||||
mc alias set apiuser1 myminio https://minio.example.com a1b2c3d4e5f6g7h8 i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4 --api S3v4
|
||||
```
|
||||
|
||||
2. **List All Buckets:**
|
||||
|
||||
```bash
|
||||
mc ls apiuser1
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
[2024-04-25 10:00:00 UTC] Bucket1
|
||||
[2024-04-25 10:00:00 UTC] Bucket2
|
||||
```
|
||||
|
||||
3. **Create a New Bucket:**
|
||||
|
||||
```bash
|
||||
mc mb apiuser1/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Bucket created successfully `new-bucket`.
|
||||
```
|
||||
|
||||
4. **Upload an Object:**
|
||||
|
||||
```bash
|
||||
mc cp example.txt apiuser1/new-bucket/
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Upload Success: example.txt to new-bucket/example.txt
|
||||
```
|
||||
|
||||
5. **Download an Object:**
|
||||
|
||||
```bash
|
||||
mc cp apiuser1/new-bucket/example.txt ./example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Download Success: new-bucket/example.txt to example.txt
|
||||
```
|
||||
|
||||
6. **Delete an Object:**
|
||||
|
||||
```bash
|
||||
mc rm apiuser1/new-bucket/example.txt
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket/example.txt`
|
||||
```
|
||||
|
||||
7. **Remove the Bucket:**
|
||||
|
||||
```bash
|
||||
mc rb apiuser1/new-bucket
|
||||
```
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
```
|
||||
Removed `new-bucket`.
|
||||
```
|
||||
|
||||
**_Note:_** Since the API user has **full access**, all these operations should succeed, mirroring the root user's capabilities.
|
||||
|
||||
---
|
||||
|
||||
## **9. Additional Resources**
|
||||
|
||||
- **MinIO Official Documentation:**
|
||||
- [MinIO Client (`mc`) Quickstart Guide](https://docs.min.io/docs/minio-client-quickstart-guide.html)
|
||||
- [MinIO Admin API](https://docs.min.io/docs/minio-admin-complete-guide.html)
|
||||
- [MinIO Policy Documentation](https://docs.min.io/docs/minio-policy-guide.html)
|
||||
|
||||
- **Security Best Practices:**
|
||||
- [MinIO Security Best Practices](https://docs.min.io/docs/minio-security.html)
|
||||
|
||||
- **Secret Management:**
|
||||
- [HashiCorp Vault](https://www.vaultproject.io/)
|
||||
- [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)
|
||||
- [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret/)
|
||||
|
||||
- **MinIO Community and Support:**
|
||||
- [MinIO GitHub Repository](https://github.com/minio/minio)
|
||||
- [MinIO Community Slack](https://slack.min.io/)
|
||||
|
||||
---
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
By following the updated steps outlined above, you can create an API user in MinIO with **read and write** permissions equivalent to the **root user** using the latest `mc admin policy create` and `mc admin policy attach` commands. This setup allows your applications or services to interact with MinIO seamlessly while maintaining secure and controlled access.
|
||||
|
||||
**_Important Considerations:_**
|
||||
|
||||
- **Security Risks**: Granting full access poses significant security risks. Ensure that the API user's credentials are stored securely and are only accessible to authorized applications.
|
||||
|
||||
- **Audit and Monitoring**: Regularly monitor the API user's activities to detect any unauthorized or unusual behaviors.
|
||||
|
||||
- **Credential Management**: Implement robust credential management practices, including regular rotation and secure storage.
|
||||
|
||||
Always tailor your MinIO user policies to align with your organization's security policies and operational requirements.
|
||||
|
||||
If you encounter any issues or need further assistance, consider reaching out to the [MinIO community](https://min.io/community.html) or consulting the official [MinIO documentation](https://docs.min.io/).
|
||||
@@ -0,0 +1,280 @@
|
||||
|
||||
太好了 — 你已经贴出了 `password-auth` 的当前内容，基于它我会直接给出**可复制的、安全步骤**：先备份，再替换为建议的密码策略（使用 `pam_pwquality`，最小长度 12、`difok=3`、至少 3 类字符、并在 `pam_unix` 上启用密码历史 `remember=5`）。同时我会说明为什么这样改、如何测试，以及如何回滚。
|
||||
|
||||
> 说明：我保留 `pam_pwquality` 为 `requisite`（与你当前一致），因为这会在强度检查失败时立即终止并拒绝密码更改，减少后续模块运行。但如果你希望即使强度检查失败也执行后续模块（例如记录历史或其它处理），可以把它改成 `required`。我在下面也给出小备注。
|
||||
|
||||
---
|
||||
|
||||
## 一步一步来（复制黏贴即可）
|
||||
|
||||
1. 先备份原文件：
|
||||
|
||||
|
||||
```bash
|
||||
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
```
|
||||
|
||||
2. 将下面内容写入临时文件并做替换（安全写入）：
|
||||
|
||||
|
||||
```bash
|
||||
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||||
# /etc/pam.d/password-auth - modified recommended settings
|
||||
auth required pam_kysec.so
|
||||
#%PAM-1.0
|
||||
|
||||
auth required pam_env.so
|
||||
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||||
#auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_unix.so nullok try_first_pass
|
||||
#auth sufficient pam_sss.so use_first_pass
|
||||
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||||
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||||
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||||
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
# Password quality: enforce length, classes, difok
|
||||
# - minlen=12 : minimal length (increase if you want stronger)
|
||||
# - difok=3 : new password must differ in at least 3 characters from old
|
||||
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||||
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||||
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||||
|
||||
# UNIX module performs the actual password change and supports history
|
||||
# remember=5 : prevent reuse of last 5 passwords
|
||||
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||||
|
||||
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||||
#password sufficient pam_sss.so use_authtok
|
||||
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
#session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
#session optional pam_sss.so
|
||||
EOF
|
||||
```
|
||||
|
||||
```bash
|
||||
mv /etc/pam.d/password-auth /etc/pam.d/password-auth.orig.$(date +%F_%T)
|
||||
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||||
chmod 644 /etc/pam.d/password-auth
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
|
||||
```
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 为什么这样改（要点）
|
||||
|
||||
- `pam_pwquality.so minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0`
|
||||
|
||||
- 最短 12 个字符、至少 3 类字符、与旧密码至少 3 个字符不同。`ocredit=0` 表示**特殊字符非强制但建议**（若你要强制特殊字符，将 `ocredit=-1`）。
|
||||
|
||||
- `pam_unix.so ... remember=5`
|
||||
|
||||
- 实际写入 `/etc/shadow` 的模块，`remember=5` 阻止重复最近 5 个密码（提升安全性）。
|
||||
|
||||
- 保留 `pam_faillock`：继续防暴力破解（失败 3 次锁 60 秒）。
|
||||
|
||||
- `pam_deny.so` 保持在最后以确保策略失败时拒绝。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 测试（非常重要）
|
||||
|
||||
在替换后不要立刻登出 root。先用一个普通用户或测试账号验证：
|
||||
|
||||
1. 创建测试用户（如果没有）：
|
||||
|
||||
|
||||
```bash
|
||||
sudo useradd -m testpwuser || true
|
||||
sudo passwd testpwuser # 按提示设置一个弱密码测试（应被拒绝）
|
||||
```
|
||||
|
||||
2. 测试几种密码：
|
||||
|
||||
|
||||
- 尝试 `abc123`（应失败）
|
||||
|
||||
- 尝试 `Abcdef12345`（若满足 minlen & classes 应通过）
|
||||
|
||||
- 尝试重复旧密码（应被 `remember=5` 拒绝）
|
||||
|
||||
|
||||
3. 查看认证日志：
|
||||
|
||||
|
||||
```bash
|
||||
sudo tail -n 200 /var/log/auth.log # 或 /var/log/secure，视系统而定
|
||||
# 或实时监测：
|
||||
sudo tail -f /var/log/auth.log
|
||||
```
|
||||
|
||||
4. 如果你使用 SSH，需要测试 `passwd` 改密是否与 SSH 有影响（通常没有），但如果你的环境有集中认证（SSSD/LDAP），请特别测试这些路径。
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 回滚（若出现问题）
|
||||
|
||||
如果验证失败或导致登录异常，立刻恢复备份：
|
||||
|
||||
```bash
|
||||
# 恢复最初备份
|
||||
sudo cp /etc/pam.d/password-auth.bak.* /etc/pam.d/password-auth
|
||||
# 或恢复刚做的原始文件
|
||||
sudo mv /etc/pam.d/password-auth.orig.* /etc/pam.d/password-auth
|
||||
```
|
||||
|
||||
然后重启相关服务或直接重启机器（如果需要）。
|
||||
|
||||
---
|
||||
|
||||
## 额外建议（可选）
|
||||
|
||||
- 若你希望强制所有四类字符（UPPER+lower+digit+special），把 `ocredit=0` 改成 `ocredit=-1`（并把 `minclass=3` 可留或删）。
|
||||
|
||||
- 如果你更希望**即使强度检查失败也执行后续模块**（例如记录历史、通知或其它逻辑），可把 `password requisite pam_pwquality.so ...` 改为 `password required ...`。
|
||||
|
||||
- 如果系统使用 SSSD/LDAP，请确认是否需要在 `password` 区块保留 `pam_sss.so use_authtok`（我在建议中注释了它，避免在没有 SSSD 测试的系统上造成问题）。若你确实使用 SSSD，请取消注释并测试。
|
||||
|
||||
|
||||
---
|
||||
|
||||
如果你愿意，我可以：
|
||||
|
||||
- 直接检查你当前 `/etc/pam.d/system-auth` 或 `/etc/pam.d/common-password`（如果存在）并给出一致化建议；
|
||||
|
||||
- 或根据你的偏好（更严格：强制特殊字符 / 更宽松：允许 passphrase）把上面的配置调成两个不同的“严格度模板”供你选择并直接生成替换命令。
|
||||
|
||||
|
||||
现在我已经把一个安全性较好的建议给出——要我继续把 `system-auth` / `common-password` 一并对齐吗？
|
||||
|
||||
|
||||
|
||||
项目：4
|
||||
|
||||
|
||||
```bash
|
||||
|
||||
cp /etc/pam.d/password-auth /etc/pam.d/password-auth.bak.$(date +%F_%T)
|
||||
ls -l /etc/pam.d/password-auth*
|
||||
```
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
|
||||
cat <<'EOF' | tee /etc/pam.d/password-auth.new >/dev/null
|
||||
# /etc/pam.d/password-auth - modified recommended settings
|
||||
auth required pam_kysec.so
|
||||
#%PAM-1.0
|
||||
|
||||
auth required pam_env.so
|
||||
auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=60
|
||||
#auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_unix.so nullok try_first_pass
|
||||
#auth sufficient pam_sss.so use_first_pass
|
||||
auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=60
|
||||
auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60
|
||||
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_succeed_if.so uid < 1000 quiet
|
||||
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
# Password quality: enforce length, classes, difok
|
||||
# - minlen=12 : minimal length (increase if you want stronger)
|
||||
# - difok=3 : new password must differ in at least 3 characters from old
|
||||
# - minclass=3: at least 3 character classes (uppercase, lowercase, digit, other)
|
||||
# - u/l/d/ocredit -1 : require at least one of each (set ocredit=0 to make special char optional)
|
||||
password requisite pam_pwquality.so retry=3 minlen=12 difok=3 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=0 local_users_only
|
||||
|
||||
# UNIX module performs the actual password change and supports history
|
||||
# remember=5 : prevent reuse of last 5 passwords
|
||||
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||||
|
||||
# If you have SSSD and want it to accept the token, uncomment below (but test first)
|
||||
#password sufficient pam_sss.so use_authtok
|
||||
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
#session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
#session optional pam_sss.so
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
|
||||
mv /etc/pam.d/password-auth.new /etc/pam.d/password-auth
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
ip addr | grep en
|
||||
|
||||
cat /etc/pam.d/password-auth | grep pwq
|
||||
|
||||
```
|
||||
|
||||
|
||||
达梦：
|
||||
```
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSDBA/'"Hn@dameng123"':35236
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
SELECT ROLE$ FROM V$DATABASE;
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SELECT PARA_NAME, PARA_VALUE
|
||||
FROM V$DM_INI
|
||||
WHERE PARA_NAME='ENABLE_AUDIT';
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SP_SET_PARA_VALUE(1, 'ENABLE_AUDIT', 2);
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSAUDITOR/SYSAUDITOR@localhost:35239
|
||||
|
||||
```
|
||||
|
||||
```
|
||||
SP_SET_ENABLE_AUDIT(2);
|
||||
SELECT PARA_NAME, PARA_VALUE, PARA_TYPE
|
||||
FROM V$DM_INI WHERE PARA_NAME='ENABLE_AUDIT';
|
||||
|
||||
```
|
||||
@@ -0,0 +1,340 @@
|
||||
a）应对登录的用户进行身份标识和鉴别，身份标识具有唯一性，身份鉴别信息具有复杂度要求并定期更换；
|
||||
"建议该操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
建议该应用系统设置密码定期更换策略（密码定期更换时间：90天）
|
||||
121.8.227.238
|
||||
|
||||
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时自动退出时间30分钟）。
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（部分用户需要设置登录失败次数和锁定时间FAILED_ATTEMPS=5，LOCK_TIME=5，用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（所有的用户需要设置超时功能CONN_IDLE_TIME=1800，超时退出时间不大于30分钟）。
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录（部分用户的登录失败次数和锁定时间未设置（SYSDBA、SYS、SYSSSO和SYSAUDITOR、FGW_V3、FGW_SECURITY、FGW_IEJMS））；未配置登录连接超时自动退出功能。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能（timeout 0）。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（timeout 30）。
|
||||
|
||||
|
||||
|
||||
该中间件设置登录失败处理功能，未限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（登录连接超时时间：30分钟）。
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
该操作系统涉及到的重要审计数据、重要配置数据未定期进行本地备份，备份策略设置未合理、备份配置设置未正确，备份结果与备份策略未一致，在发生数据丢失时未能够进行数据恢复
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该操作系统涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
该操作系统涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该操作系统涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该操作系统未安装防恶意代码软件，未能对新型的入侵和病毒行为及时进行识别并有效阻断，防恶意代码库未更新至最新版本。
|
||||
建议该操作系统安装防恶意代码软件（云平台提供的青藤云），能对新型的入侵和病毒行为及时进行识别并有效阻断，防恶意代码库更新至最新版本。
|
||||
测评对象
|
||||
文件存储服务器（10.209.42.14）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
|
||||
|
||||
该操作系统未合理设置密码复杂度策略
|
||||
"建议该操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
|
||||
文件存储服务器（10.209.42.14）
|
||||
数据库服务器2（10.201.23.103）
|
||||
应用支撑服务器1（10.209.42.20）
|
||||
服务器4（10.209.42.22）
|
||||
数据库服务器1（10.201.23.102）
|
||||
业务服务器3（10.209.42.13）
|
||||
业务服务器2（10.209.42.12）
|
||||
业务服务器1（10.209.42.11）
|
||||
服务器1（10.209.42.16）
|
||||
服务器2（10.209.42.18）
|
||||
服务器3（10.209.42.19）
|
||||
缓存服务器（10.209.42.15）
|
||||
应用支撑服务器2（10.209.42.21）
|
||||
代理服务器1（10.209.42.17）
|
||||
|
||||
|
||||
该管理终端涉及的鉴别数据在登录时未自动保存和显示历史账号和口令，未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该管理终端涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
|
||||
业务管理终端（172.16.28.233）
|
||||
运维管理终端（172.16.28.239）
|
||||
|
||||
|
||||
该数据库鉴别数据未保证存储空间被释放或重新分配前得到完全清除
|
||||
建议该数据库鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份策略与备份结果未一致，在发生数据丢失时未能够进行数据恢复，近期恢复测试记录未能够进行正常的数据恢复
|
||||
建议该数据库涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份策略与备份结果未一致，在发生数据丢失时未能够进行数据恢复，近期恢复测试记录未能够进行正常的数据恢复
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库审计记录未定期进行备份（dmsql_GRP1_DW_02_SYSDBA），审计记录保存时间未满足6个月
|
||||
建议该数据库审计记录定期进行备份（dmsql_GRP1_DW_02_SYSDBA），审计记录保存时间满足6个月
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库审计记录未定期进行备份，审计记录保存时间未满足6个月
|
||||
建议该数据库审计记录定期进行备份，审计记录保存时间满足6个月
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
该数据库未采用ssl安全传输协议进行远程管理，未能避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该数据库采用ssl安全传输协议进行远程管理，避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未采用安全传输协议，未采用加密安全方式进行远程管理，未能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该数据库采用安全传输协议（如ssl），采用加密安全方式进行远程管理，能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
|
||||
|
||||
|
||||
该数据库未开启密码复杂度功能，未设置密码定期更换策略。
|
||||
建议该数据库启用密码复杂度功能（密码长度大于8位，由数字、字母和特殊字符3种组成），设置定期更换口令周期（定期更换周期不大于90天）。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
redis（10.209.42.15）
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未开启审计功能，审计范围未覆盖每个用户，未对重要的用户行为和重要安全事件进行审计。 该数据库未开启审计功能
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
该数据库未启用安全审计功能（ENABLE_AUDIT=0）
|
||||
建议该数据库启用安全审计功能（ENABLE_AUDIT=2）
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录（部分用户的登录失败次数和锁定时间未设置（SYSDBA、SYS、SYSSSO和SYSAUDITOR、FGW_V3、FGW_SECURITY、FGW_IEJMS））；未配置登录连接超时自动退出功能。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（部分用户需要设置登录失败次数和锁定时间FAILED_ATTEMPS=5，LOCK_TIME=5，用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（所有的用户需要设置超时功能CONN_IDLE_TIME=1800，超时退出时间不大于30分钟）。
|
||||
|
||||
达梦数据库1（10.201.23.102）
|
||||
达梦数据库2（10.201.23.103）
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能（timeout 0）。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（timeout 30）。
|
||||
|
||||
redis（10.209.42.15）
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
该数据库未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能。
|
||||
建议该数据库设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时自动退出时间30分钟）。
|
||||
|
||||
mongodb（10.209.42.20）
|
||||
|
||||
|
||||
|
||||
该应用系统涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息未定期进行本地备份
|
||||
建议该应用系统涉及到的重要审计数据、重要配置数据、重要业务数据、重要个人信息定期进行本地备份
|
||||
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
该应用系统涉及的鉴别数据未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该应用系统涉及的鉴别数据采取相关技术措施保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统审计记录未定期进行备份（未备份登录日志），审计记录保存时间未满足6个月
|
||||
建议该应用系统审计记录定期进行备份（备份登录日志）
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
|
||||
|
||||
该应用系统审计记录未定期进行备份（未备份登录日志，未备份操作日志），审计记录保存时间未满足6个月
|
||||
建议该应用系统审计记录定期进行备份（备份登录日志，备份操作日志）
|
||||
测评对象
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该中间件未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能。 该中间件设置登录失败处理功能，未限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（登录连接超时时间：30分钟）。该中间件未设置密码复杂度策略，未设置密码定期更换策略。
|
||||
建议该中间件设置密码复杂度策略（密码长度大于8位，由数字、字母和特殊字符三种组成），设置密码定期更换策略（定期更换密码策略：90天）
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
|
||||
该中间件未开启审计功能（未具有catalina和localhost-access.log）
|
||||
建议该中间件开启审计功能（具有catalina和localhost-access.log）
|
||||
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
|
||||
|
||||
|
||||
该中间件所在操作系统未合理设置密码复杂度策略
|
||||
"建议该中间件所在操作系统合理设置密码复杂度策略（设置/etc/pam.d/system-auth password requisite pam_cracklib.so difok=3
|
||||
minlen=8 minclass=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1）"
|
||||
测评对象
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
该中间件所在操作系统涉及的鉴别数据未能保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
建议该中间件所在操作系统涉及的鉴别数据保证鉴别信息所在的存储空间被释放或重新分配前得到完全清除
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
该中间件涉及到的重要审计数据、重要配置数据未定期进行本地备份，备份策略未设置合理、备份配置未设置正确，备份结果与备份策略未一致，在发生数据丢失时未能够进行数据恢复。
|
||||
建议该中间件涉及到的重要审计数据、重要配置数据定期进行本地备份，备份策略设置合理、备份配置设置正确，备份结果与备份策略一致，在发生数据丢失时能够进行数据恢复。
|
||||
|
||||
tomcat-mbp-portal（10.209.42.11）
|
||||
nginx-fgw-nginx-mobile（10.209.42.12）
|
||||
nacos（10.209.42.21）
|
||||
tomcat-fgw-review（10.209.42.13）
|
||||
tomcat-fgw-portal（10.209.42.11）
|
||||
nginx（10.209.42.17）
|
||||
|
||||
|
||||
|
||||
该中间件采用http传输协议，未采用加密安全方式进行远程管理，未能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
建议该中间件采用https传输协议，采用加密安全方式进行远程管理，能够避免鉴别数据在网络传输过程中被窃听的风险。
|
||||
nacos（10.209.42.21）
|
||||
|
||||
|
||||
该应用系统未设置密码复杂度功能，未设置密码定期更换策略
|
||||
建议该应用系统设置密码复杂度功能（密码长度8位以上，由字母、数字、特殊字符三种组成），设置密码定期更换策略（密码定期更换时间：90天）
|
||||
测评对象
|
||||
智慧评审系统（https://121.8.227.238/portal/）
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
|
||||
|
||||
该应用系统未设置密码定期更换策略
|
||||
建议该应用系统设置密码定期更换策略（密码定期更换时间：90天）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统未设置登录失败处理功能，未限制用户非法登录；未配置登录连接超时自动退出功能
|
||||
建议该应用系统设置登录失败处理功能，限制用户非法登录（用户登录失败5次锁定5分钟）；配置登录连接超时自动退出功能（超时退出时间：30分钟）
|
||||
测评对象
|
||||
智慧评审系统-粤政易（https://121.8.227.238/fgw-mobile/）
|
||||
"固定资产投资调度管理系统（https://121.8.227.238/
|
||||
http://121.8.227.238/）"
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
该应用系统未开启审计功能（未能区分手机端登录日志，未有操作日志），审计范围未覆盖每个用户，未对重要的用户行为和重要安全事件进行审计。
|
||||
建议该应用系统开启审计功能（区分手机端登录日志，具有操作日志）
|
||||
测评对象
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
该应用系统未采用https传输协议
|
||||
建议该应用系统采用https传输协议测评对象
|
||||
"固定资产投资调度管理系统-粤政易（https://121.8.227.238/mobile/
|
||||
http://121.8.227.238/mobile/）"
|
||||
|
||||
|
||||
|
||||
Executable
+372
@@ -0,0 +1,372 @@
|
||||
|
||||
|
||||
## 一、远程桌面
|
||||
|
||||
### Office Windows Desktop
|
||||
|
||||
- **TeamViewer 设备号**
|
||||
|
||||
```
|
||||
299 885 389
|
||||
```
|
||||
|
||||
- **密码**
|
||||
|
||||
```
|
||||
Admingzzn@1
|
||||
```
|
||||
|
||||
|
||||
|
||||
### VM Windows 10
|
||||
|
||||
- **rdesk**
|
||||
|
||||
```
|
||||
1 269 698 093
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
a4pvYPW2YO3aER
|
||||
```
|
||||
|
||||
todesk
|
||||
|
||||
```
|
||||
487 821 301
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
a4pvYPW2YO3aER=
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### GZZN Opensuse Desktop
|
||||
|
||||
rustdesk
|
||||
```
|
||||
1135993583
|
||||
```
|
||||
|
||||
```
|
||||
4ZZzxrAfwFj5q1
|
||||
```
|
||||
|
||||
rustdesk 中继密码
|
||||
```
|
||||
4BWKesxFCiKVPj7j6Zm7qV4JW8FtvRXZY1Zejv4nGxk=
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 二、服务器信息
|
||||
|
||||
### 服务器密码
|
||||
|
||||
```
|
||||
8VLtg#ZYA@AJSFJcPM
|
||||
```
|
||||
|
||||
### 服务器使用
|
||||
|
||||
- 主机：103
|
||||
|
||||
- 调整内存：100GB
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 三、二期资源
|
||||
|
||||
### 主机 10.194.62.26
|
||||
|
||||
```
|
||||
Gzzwy@%2020$
|
||||
```
|
||||
|
||||
### 内存百分比脚本
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
free -h
|
||||
echo "内存使用百分比： $(free | awk 'NR==2{printf "%.2f%%", $3*100/$2 }')"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 四、工具与探针
|
||||
|
||||
### 工具下载
|
||||
|
||||
```bash
|
||||
curl -k http://10.205.205.26:9092/tools/sh | bash
|
||||
```
|
||||
|
||||
### 探针安装
|
||||
|
||||
```bash
|
||||
curl -k https://10.207.33.1:9000/up-install/up-install.sh | bash -x
|
||||
```
|
||||
|
||||
### 安装失败节点
|
||||
|
||||
- 10.209.42.14
|
||||
|
||||
- 10.209.42.15
|
||||
|
||||
- 10.209.42.18
|
||||
|
||||
- 10.209.42.20
|
||||
|
||||
- 10.209.42.21
|
||||
|
||||
- 10.209.42.22
|
||||
|
||||
|
||||
### 探针测试
|
||||
|
||||
```bash
|
||||
nc -uvz 10.207.33.1 12201
|
||||
systemctl status uniprobe
|
||||
```
|
||||
|
||||
### 手动运行探针
|
||||
|
||||
```bash
|
||||
bash -x /usr/local/bin/uniprobe-worker.sh -n 10.207.33.1:9000 \
|
||||
-a 1qgmg9koe1v2s998jsceikklontia2v9nact3gumfk6mkcd02251 \
|
||||
> /tmp/uniprobe/test.txt 2>&1
|
||||
```
|
||||
|
||||
上传日志：
|
||||
|
||||
```bash
|
||||
rz /tmp/uniprobe/test.txt
|
||||
```
|
||||
|
||||
### 抓包验证
|
||||
|
||||
```bash
|
||||
tcpdump -i any port 12201 -w a.pcap
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 五、数据迁移生产环境
|
||||
|
||||
### 1. MinIO 迁移
|
||||
|
||||
- 迁移桶：**fgw-law**
|
||||
|
||||
- URL: `http://130.120.3.126:9000`
|
||||
|
||||
- key: `GZZNEXAMPLE`
|
||||
|
||||
- secret: `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`
|
||||
|
||||
- bucketName: `fgw-law`
|
||||
|
||||
|
||||
MinIO 客户端配置：
|
||||
|
||||
```bash
|
||||
mc alias set src http://130.120.3.126:9000 GZZNEXAMPLE wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Elasticsearch 迁移
|
||||
|
||||
- 索引：**fgw_law_file_index**
|
||||
|
||||
- uris: `10.100.100.187:9200,10.100.100.188:9200,10.100.100.189:9200`
|
||||
|
||||
- 用户名: `elastic`
|
||||
|
||||
- 密码: `yjj@2022EmS,12`
|
||||
|
||||
|
||||
#### elasticdump 工具
|
||||
|
||||
```bash
|
||||
docker pull elasticdump/elasticsearch-dump
|
||||
```
|
||||
|
||||
**导出 Mapping**
|
||||
|
||||
```bash
|
||||
docker run --rm --network host -v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input=http://elastic:yjj%402022EmS%2C12@localhost:9200/my_index \
|
||||
--output=/dump/my_index_mapping.json \
|
||||
--type=mapping --debug
|
||||
```
|
||||
|
||||
**导出 Mapping + Data**
|
||||
|
||||
```bash
|
||||
# Mapping
|
||||
sudo docker run --rm --network host \
|
||||
-e NODE_TLS_REJECT_UNAUTHORIZED=0 \
|
||||
-v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input="https://elastic:yjj%402022EmS%2C12@127.0.0.1:9200/fgw_law_file_index" \
|
||||
--output="/dump/fgw_law_file_index_mapping.json" \
|
||||
--type=mapping --timeout=300000
|
||||
|
||||
# Data
|
||||
sudo docker run --rm --network host \
|
||||
-e NODE_TLS_REJECT_UNAUTHORIZED=0 \
|
||||
-v "$PWD:/dump" elasticdump/elasticsearch-dump \
|
||||
--input="https://elastic:yjj%402022EmS%2C12@127.0.0.1:9200/fgw_law_file_index" \
|
||||
--output="/dump/fgw_law_file_index_data.json" \
|
||||
--type=data --limit=2000 --concurrency=4 --fileSize=100mb --timeout=300000
|
||||
```
|
||||
|
||||
#### Snapshot 方式
|
||||
|
||||
**注册仓库**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X PUT 'http://127.0.0.1:8200/_snapshot/local_backup' \
|
||||
-d '{"type":"fs","settings":{"location":"/snapshots","compress":true}}'
|
||||
```
|
||||
|
||||
**创建快照**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X PUT 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03?wait_for_completion=true' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"ignore_unavailable": true,
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
**校验快照**
|
||||
|
||||
```bash
|
||||
curl -s 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03?pretty'
|
||||
```
|
||||
|
||||
**打包快照**
|
||||
|
||||
```bash
|
||||
tar czf /opt/elastic/fgw_law_snapshot_2025-09-03.tgz -C /opt/elastic/snapshots .
|
||||
```
|
||||
|
||||
**恢复（相同索引名）**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X POST 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03/_restore' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
**恢复（新索引名）**
|
||||
|
||||
```bash
|
||||
curl -s -H 'Content-Type: application/json' \
|
||||
-X POST 'http://127.0.0.1:8200/_snapshot/local_backup/fgw_2025_09_03/_restore' \
|
||||
-d '{
|
||||
"indices": "fgw_law_file_index",
|
||||
"rename_pattern": "fgw_law_file_index",
|
||||
"rename_replacement": "fgw_law_file_index_restored",
|
||||
"include_global_state": false
|
||||
}'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3. MongoDB 迁移
|
||||
|
||||
- 数据库：**fgw_v3**
|
||||
|
||||
- host: `10.100.101.101`
|
||||
|
||||
- 用户名: `fgw_v3`
|
||||
|
||||
- 密码: `Fgw@2024`
|
||||
|
||||
- 端口: `27017`
|
||||
|
||||
|
||||
**导出**
|
||||
|
||||
```bash
|
||||
/opt/mongodb/mongodb-database-tools-100.9.4/bin/mongodump \
|
||||
--host 10.100.101.101 --port 27017 \
|
||||
-u 'fgw_v3' -p 'Fgw@2024' \
|
||||
--db fgw_v3 \
|
||||
--authenticationDatabase fgw_v3 \
|
||||
--authenticationMechanism SCRAM-SHA-256 \
|
||||
--archive=/opt/mongodb/export/fgw_v3_$(date +%F).archive.gz \
|
||||
--gzip
|
||||
```
|
||||
|
||||
**另一种导出方式**
|
||||
|
||||
```bash
|
||||
sudo mongodb-database-tools-100.9.4/bin/mongodump -u fgw_v3 -p Fgw@2024 -h localhost \
|
||||
--db fgw_v3 --archive=fgw_v3-$(date +%F).gz --gzip
|
||||
```
|
||||
|
||||
**导入**
|
||||
|
||||
```bash
|
||||
/data/soft/mongodb-database-tools-100.9.4/bin/mongorestore \
|
||||
--host localhost --port 27017 \
|
||||
-u 'fgw_v3' -p 'FgwV3@202403' \
|
||||
--authenticationDatabase fgw_v3 \
|
||||
--authenticationMechanism SCRAM-SHA-256 \
|
||||
--archive=/data/tmp/fgw_v3.archive.gz --gzip
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
10.209.42.20 mongo
|
||||
|
||||
```
|
||||
VOLUME_DB=$(docker inspect mongodb | jq -r '.[0].Mounts[] | select(.Destination=="/data/db") | .Source')
|
||||
echo $VOLUME_DB
|
||||
ls -l $VOLUME_DB
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
更新监控软件
|
||||
```bash
|
||||
curl -k http://10.205.205.26:9092/tools/sh | bash
|
||||
```
|
||||
|
||||
```bash
|
||||
systemctl status pp-monitor
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
服务器移交：
|
||||
10.209.42.19 （zookeeper）
|
||||
新密码:
|
||||
|
||||
```
|
||||
uve|ph7ro9bieCh#
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
echo -e 'uve|ph7ro9bieCh#\nuve|ph7ro9bieCh#' | passwd
|
||||
```
|
||||
@@ -0,0 +1,201 @@
|
||||
|
||||
|
||||
应用系统名称： 广州市投资项目信息化平台
|
||||
用户单位: 广州市发展和改革委员会
|
||||
使用架构（单机/主备/读写分离/其他） ：2节点主备（自动切换）
|
||||
正式or测试环境：正式环境
|
||||
物理机or虚拟机：物理机
|
||||
操作系统：Kylin Linux Advanced Server release V10 (Tercel)
|
||||
CPU信息：Kunpeng-920
|
||||
CPU(s): 96
|
||||
内存：254G
|
||||
备份是否独立磁盘：否
|
||||
备份策略 --暂未配置
|
||||
存储信息：
|
||||
|
||||
--主库
|
||||
文件系统 容量 已用 可用 已用% 挂载点
|
||||
/dev/mapper/data-data 1.0T 18G 1007G 2% /data
|
||||
|
||||
--备库
|
||||
文件系统 容量 已用 可用 已用% 挂载点
|
||||
/dev/mapper/data-data 1.0T 18G 1007G 2% /data
|
||||
|
||||
|
||||
2节点主备集群，自动切换模式
|
||||
10.201.23.102 主库
|
||||
10.201.23.103 备库
|
||||
10.209.42.16 监控
|
||||
|
||||
|
||||
1、数据库基本信息：
|
||||
数据库页大小：32K
|
||||
数据库簇大小：32K
|
||||
数据库字符集：UTF-8
|
||||
数据库大小写是否敏感：不敏感
|
||||
数据库实例名：GRP1_DW_01/GRP1_DW_02
|
||||
数据库名：dmdb
|
||||
数据库超级管理员账号/密码：SYSDBA/Hn@dameng123 #数据库系统用户密码修改后妥善保存，一旦丢失无法找回。
|
||||
数据库审计员账号/密码：SYSAUDITOR/SYSAUDITOR
|
||||
数据库安全员账号/密码：SYSSSO/SYSSSO
|
||||
数据库默认端口：35239
|
||||
数据库安装版本：
|
||||
---------- -----------------------------------------
|
||||
1 --05134284194-20240814-239099-20108 Pack10
|
||||
---------- ---------------------------------
|
||||
1 DM Database Server 64 V8
|
||||
2 8.4
|
||||
3 安全版
|
||||
4 DB Version: 0x7000c
|
||||
5 05134284194-20240814-239099-20108
|
||||
6 Msg Version: 12
|
||||
7 Gsu level(5) cnt: 0
|
||||
|
||||
|
||||
授权编号：2B01108287 (测试授权)
|
||||
产品有效期：2024-12-25
|
||||
数据库软件安装路径：/home/dmdba/dmdbms
|
||||
数据库数据文件路径：/data/dmdata/
|
||||
数据库归档文件路径：/data/dmdata/dmarch
|
||||
归档空间限制：100G #如果不够可调整
|
||||
数据库备份文件路径：暂未配置备份
|
||||
数据库驱动路径：/home/dmdba/dmdbms/drivers
|
||||
数据库文档路径：/home/dmdba/dmdbms/doc
|
||||
数据库日志路径：/home/dmdba/dmdbms/log
|
||||
dmdba用户密码: Hn@dameng123
|
||||
|
||||
|
||||
注意：请创建新的表空间和用户供业务使用，切勿使用系统默认的用户（SYSDBA）和表空间（main）。
|
||||
|
||||
2、数据库客户端命令工具:
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
./disql SYSDBA/'"Hn@dameng123"':5236
|
||||
说明：密码含特殊字符使用单引号+双引号包围起来
|
||||
|
||||
3、数据库图形化管理工具：
|
||||
客户端管理工具：manager
|
||||
cd /home/dmdba/dmdbms/tool
|
||||
./manager
|
||||
|
||||
4、数据库数据迁移工具：
|
||||
./dts
|
||||
|
||||
5、数据库服务重启步骤：
|
||||
切换至dmdba用户：
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
|
||||
关闭确认监视器（监视器服务器）： ./DmMonitorServiceGRP1 stop
|
||||
|
||||
关闭主库守护进程：./DmWatcherServiceGRP1 stop
|
||||
关闭备库守护进程：./DmWatcherServiceGRP1 stop
|
||||
关闭主库实例：./DmServicedmdb stop
|
||||
关闭备库实例：./DmServicedmdb stop
|
||||
|
||||
启动主库实例：./DmServicedmdb start
|
||||
启动备库实例：./DmServicedmdb start
|
||||
启动主库守护进程：./DmWatcherServiceGRP1 start
|
||||
启动备库守护进程：./DmWatcherServiceGRP1 start
|
||||
|
||||
启动确认监视器（监视器服务器）： ./DmMonitorServiceGRP1 start
|
||||
|
||||
|
||||
查看数据库服务进程
|
||||
ps -ef|grep dmserver
|
||||
|
||||
|
||||
6，管理工具的安装使用（管理工具可跟商务申请）
|
||||
##管理工具下载（WIN）
|
||||
https://eco.dameng.com/download/
|
||||
##管理工具的安装使用（安装选择组件，只安装客户端就行）
|
||||
https://eco.dameng.com/document/dm/zh-cn/start/install-dm-windows-prepare.html
|
||||
|
||||
7、应用配置链接主备集群的配置：
|
||||
方法一：
|
||||
在中间件或者应用服务器上，新建/etc/dm_svc.conf配置文件。
|
||||
|
||||
①文件存放：
|
||||
Linux：将dm_svc.conf文件放在应用服务器和中间件服务器/etc目录下。
|
||||
Windows32位：将dm_svc.conf文件放在应用服务器system32目录下。
|
||||
Windows64位：将dm_svc.conf文件放在应用服务器system32和syswow64目录下。
|
||||
|
||||
vi /etc/dm_svc.conf
|
||||
|
||||
TIME_ZONE=(480)
|
||||
LANGUAGE=(cn)
|
||||
DMDW=(10.201.23.102:35239,10.201.23.103:35239)
|
||||
[DMDW]
|
||||
LOGIN_ENCRYPT=(0)
|
||||
LOGIN_MODE=(1)
|
||||
|
||||
说明：客户端程序连接数据库时，需要指定 IP 端口处替换为服务名即可，
|
||||
例如：disql SYSDBA/'"Hn@dameng123"'@DMDW。jdbc的url为：jdbc:dm://DMDW
|
||||
|
||||
注意：
|
||||
1)当修改了 dm_svc.conf 内容后，需要重启客户端程序，修改的配置才能生效。
|
||||
2)请把该文件路径授予666权限。
|
||||
|
||||
|
||||
方法二：
|
||||
集群连接服务名和ip配置参数直接配置在URL连接串
|
||||
JDBC服务连接配置说明
|
||||
配置应用连接串：（JDBC连接串选项请参考《DM程序员手册》中的4.5.4 DM 扩展连接属性的使用）
|
||||
|
||||
主备集群：
|
||||
非xml文件：
|
||||
jdbc:dm://DMDW?DMDW=(10.201.23.102:35239,10.201.23.103:35239)&LOGIN_MODE=(1)
|
||||
xml文件：
|
||||
jdbc:dm://DMDW?DMDW=(10.201.23.102:35239,10.201.23.103:35239)&LOGIN_MODE=(1)
|
||||
|
||||
|
||||
|
||||
8，创建用户和表空间，禁止使用系统默认的用户（SYSDBA）和表空间（main）存放业务数据。
|
||||
示例：
|
||||
- 创建用户
|
||||
create user test identified by "Hn@dameng123";
|
||||
|
||||
- 用户角色分配，管理工具上看有什么角色，根据具体情况而定，DBA角色应该是不用分配给应用账号的。
|
||||
grant resource,public,soi,vti,svi to test;
|
||||
|
||||
select * from dba_role_privs where grantee='TEST';
|
||||
|
||||
|
||||
-创建表空间，指定用户的默认表空间
|
||||
（数据文件存放在跟其他数据文件一样的就行，注意文件名不能一样，以下指定每个数据文件10G，视实际情况而定，不够再加数据文件，要留意空间是否足够）
|
||||
|
||||
select * from v$tablespace;
|
||||
select path from v$datafile;
|
||||
|
||||
//数据表空间
|
||||
create tablespace test datafile '/data/dmdata/dmdb/test01.dbf' size 1024 autoextend on next 128 maxsize 10240;
|
||||
alter tablespace test add datafile '/data/dmdata/dmdb/test02.dbf' size 128 autoextend on next 128 maxsize 10240;
|
||||
|
||||
//索引表空间
|
||||
create tablespace test_index datafile '/data/dmdata/dmdb/test_index01.dbf' size 128 autoextend on next 128 maxsize 10240;
|
||||
|
||||
//设置用户的默认表空间
|
||||
alter user test default tablespace test;
|
||||
alter user test default index tablespace test_index;
|
||||
|
||||
//查询用户表空间信息
|
||||
select username,user_id,default_tablespace,default_index_tablespace
|
||||
from dba_users;
|
||||
|
||||
====普通监视器查看集群状态
|
||||
在主备节点均部署普通监视器，可以用于日常查看集群状态
|
||||
|
||||
切换dmdba用户
|
||||
su - dmdba
|
||||
cd /home/dmdba/dmdbms/bin
|
||||
dmmonitor /data/dmdata/dmdb/dmmonitor_GRP1.ini
|
||||
|
||||
=== 手动切换主库（打开监视器后）
|
||||
示例：
|
||||
dmmonitor /data/dmdata/dmdb/dmmonitor_GRP1.ini
|
||||
|
||||
login
|
||||
用户名:SYSDBA
|
||||
密码:Hn@dameng123
|
||||
|
||||
switchover GRP1.GRP1_DW_02
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
|
||||
todesk:
|
||||
732 079 023
|
||||
Admin@12345
|
||||
|
||||
服务器是192.168.2.101
|
||||
|
||||
sudo pass: Admin12345
|
||||
@@ -0,0 +1,49 @@
|
||||
|
||||
|
||||
|
||||
```nginx
|
||||
|
||||
http {
|
||||
limit_conn_zone $binary_remote_addr zone=limitperip:10m;
|
||||
|
||||
#large_client_header_buffers 2 1k;
|
||||
large_client_header_buffers 4 8k;
|
||||
|
||||
#keepalive_timeout 55;
|
||||
keepalive_timeout 60s;
|
||||
|
||||
#client_header_timeout 10;
|
||||
client_header_timeout 20s;
|
||||
|
||||
#client_header_buffer_size 1k;
|
||||
client_header_buffer_size 4k;
|
||||
|
||||
#client_body_buffer_size 1K;
|
||||
client_body_buffer_size 16k;
|
||||
|
||||
#client_max_body_size 1k;
|
||||
client_max_body_size 50m;
|
||||
|
||||
server_tokens off; # Disable version information globally
|
||||
|
||||
#client_body_timeout 10；
|
||||
client_body_timeout 60s;
|
||||
|
||||
#send_timeout 10;
|
||||
send_timeout 60s;
|
||||
|
||||
server {
|
||||
#limit_conn limitperip 10;
|
||||
if ( $http_referer ~* (babes|forsale|girl|jewelry|love|nudit|organic|poker|porn|sex|teen) ) {
|
||||
return 403;
|
||||
}
|
||||
location / {
|
||||
limit_conn limitperip 10;
|
||||
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE)$) {
|
||||
return 405; # Method Not Allowed
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
Executable
+146
@@ -0,0 +1,146 @@
|
||||
|
||||
|
||||
堡垒机 账号：
|
||||
luoxin
|
||||
Luox@!fh202406
|
||||
|
||||
[https://10.8.82.16/](https://10.8.82.16/)
|
||||
|
||||
lizx
|
||||
7Ghjb@DF1,OgdN
|
||||
|
||||
|
||||
|
||||
远程桌面：
|
||||
远程机Todesk：
|
||||
847422402
|
||||
gzZn@2023
|
||||
|
||||
|
||||
广汽云的，南基区
|
||||
【广汽云中心】您的vpn账户已开通，
|
||||
账号： caojinhua@ds.cn
|
||||
初始密码为：uStfuNFai6!
|
||||
|
||||
|
||||
Mysql 更新
|
||||
8.0.35->8.4.1
|
||||
|
||||
公司环境：
|
||||
10.100.100.95
|
||||
root
|
||||
gzzn@123
|
||||
|
||||
|
||||
公司测试升级：
|
||||
local docker install mysql 8.0.35
|
||||
use data
|
||||
upgrade docker 8.4.1
|
||||
|
||||
|
||||
生产环境：85、86
|
||||
|
||||
应用：88
|
||||
veigue:
|
||||
docker stack rm gqxm就好了吧
|
||||
|
||||
|
||||
|
||||
启动在 /opt/apps/gqxm/deploy.sh
|
||||
|
||||
The error code MY-002061 in MySQL 8.4.1 typically relates to an issue with the replication setup, particularly with the authentication plugin being used. Here are the steps you can take to resolve this issue:
|
||||
|
||||
1. **Change the Authentication Plugin**: Since MySQL 8.4 does not enable the `mysql_native_password` plugin by default, and it is completely removed in MySQL 9.0, you need to update your replication user to use the `caching_sha2_password` plugin.
|
||||
|
||||
```sql
|
||||
ALTER USER 'replication_user'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'your_password';
|
||||
```
|
||||
|
||||
This ensures that the user is using an authentication method compatible with MySQL 8.4 and later versions【7†source】【8†source】.
|
||||
|
||||
2. **Update the Replication Configuration**: You may also need to modify the replication configuration to use the new authentication method. Add `GET_MASTER_PUBLIC_KEY=1` to your `CHANGE MASTER TO` statement:
|
||||
|
||||
```sql
|
||||
CHANGE MASTER TO MASTER_HOST='source_host',
|
||||
MASTER_USER='replication_user',
|
||||
MASTER_PASSWORD='your_password',
|
||||
MASTER_AUTO_POSITION=1,
|
||||
GET_MASTER_PUBLIC_KEY=1;
|
||||
```
|
||||
|
||||
This command configures the replica to request the master's public key, which is necessary for secure connections【6†source】【9†source】.
|
||||
|
||||
3. **Verify User Plugins**: Ensure that there are no users still relying on the deprecated `mysql_native_password` plugin by running the following query:
|
||||
|
||||
```sql
|
||||
SELECT user, host, plugin FROM mysql.user WHERE plugin='mysql_native_password';
|
||||
```
|
||||
|
||||
Update any users found by this query to use the `caching_sha2_password` plugin as shown in the first step【7†source】.
|
||||
|
||||
4. **Check Master and Slave Configuration**: Ensure that both the master and slave servers are configured correctly, especially regarding the paths and permissions of key files. Verify the configuration with:
|
||||
|
||||
```sql
|
||||
SHOW GLOBAL VARIABLES LIKE 'caching_sha2_password_public_key_path';
|
||||
```
|
||||
|
||||
Copy the public key file from the master to the slave if necessary, and adjust the `CHANGE MASTER TO` statement accordingly to specify the path to the public key on the slave【6†source】.
|
||||
|
||||
By following these steps, you should be able to resolve the MY-002061 error and get your MySQL replication working properly. If issues persist, consider checking the MySQL error log for more detailed messages that might provide additional insights into the problem.
|
||||
|
||||
|
||||
CREATE USER "repluser"@"%" IDENTIFIED BY "P@ssw0rd";
|
||||
|
||||
|
||||
|
||||
CHANGE MASTER TO MASTER_HOST='10.8.62.85',
|
||||
MASTER_USER='repluser',
|
||||
MASTER_PASSWORD='P@ssw0rd',
|
||||
MASTER_AUTO_POSITION=1,
|
||||
GET_MASTER_PUBLIC_KEY=1;
|
||||
|
||||
ALTER USER 'repluser'@'%' IDENTIFIED WITH 'caching_sha2_password' BY 'P@ssw0rd';
|
||||
|
||||
FLUSH PRIVILEGES;
|
||||
|
||||
SELECT user, host, plugin FROM mysql.user WHERE user = 'repluser' AND host = '%';
|
||||
|
||||
SELECT user, host, plugin
|
||||
FROM mysql.user
|
||||
WHERE plugin NOT IN ('caching_sha2_password', 'mysql_native_password', 'sha256_password');
|
||||
|
||||
|
||||
CHANGE MASTER TO MASTER_HOST = '10.8.62.85', MASTER_USER = 'repluser', MASTER_PASSWORD = 'P@ssw0rd', MASTER_AUTO_POSITION = 1, GET_MASTER_PUBLIC_KEY = 1;
|
||||
|
||||
change master to master_host='10.8.62.85', master_port=3386, master_user='repl', master_password='P@ssw0rd', MASTER_AUTO_POSITION = 1, GET_MASTER_PUBLIC_KEY = 1;
|
||||
|
||||
CHANGE REPLICATION SOURCE TO SOURCE_HOST = '10.8.62.85', SOURCE_USER = 'repluser', SOURCE_PASSWORD = 'Pssw0rd' , SOURCE_PORT = 3886, GET_SOURCE_PUBLIC_KEY = 1, SOURCE_AUTO_POSITION =1;
|
||||
|
||||
CHANGE REPLICATION SOURCE TO SOURCE_HOST = '10.8.62.85', SOURCE_USER = 'repluser', SOURCE_PASSWORD = 'P@ssw0rd' , SOURCE_PORT = 3886, GET_SOURCE_PUBLIC_KEY = 1;
|
||||
|
||||
|
||||
nacos 更新
|
||||
|
||||
|
||||
复测：
|
||||
|
||||
漏洞检测：
|
||||
Linux kernel 权限提升漏洞(CVE-2024-1086)
|
||||
云服务商提供操作系统更新支持
|
||||
|
||||
runc: CVE-2024-21626
|
||||
升级docker ?
|
||||
升级runc ?
|
||||
|
||||
fastjson:
|
||||
由于autotype开关的限制可被绕过，通过开启safeMode配置完全禁用autoType。三种配置SafeMode的方式如下:
|
||||
|
||||
1）加上JVM启动参数： -Dfastjson.parser.safeMode=true
|
||||
|
||||
2）通过类路径的fastjson.properties文件来配置： fastjson.parser.safeMode=true
|
||||
|
||||
3）在代码中配置： ParserConfig.getGlobalInstance().setSafeMode(true);
|
||||
需要核实
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
|
||||
# install
|
||||
|
||||
```bash
|
||||
mkdir -p mytb-data && sudo chown -R 799:799 mytb-data
|
||||
mkdir -p mytb-logs && sudo chown -R 799:799 mytb-logs
|
||||
docker run -it -p 8080:9090 -p 7070:7070 -p 1883:1883 -p 5683-5688:5683-5688/udp -v mytb-data:/data \
|
||||
-v mytb-logs:/var/log/thingsboard --name mytb --restart unless-stopped thingsboard/tb-postgres
|
||||
```
|
||||
|
||||
@@ -0,0 +1,119 @@
|
||||
|
||||
|
||||
一、培训整体框架
|
||||
- 培训目的：面向实施/运维人员，讲解在物联网AIoT平台完成设备/网关/平台三种接入模式的配置与落地，包含账号与权限、网络组件、产品与物模型、设备创建与绑定、Topic订阅、数据入库与告警规则等完整流程。
|
||||
- 方法论：
|
||||
- 优先原则：鼓励“设备/平台主动推送到本平台”（稳定、低耦合）；“平台主动采集/消费对方MQTT/HTTP”作为兜底方案，尽量少用以减少平台负载与复杂度。
|
||||
- N+1思路：网关场景下，先建“网关产品与网关设备”，再为下挂的N台子设备分别建“设备产品与设备设备”。
|
||||
|
||||
二、接入模式与术语
|
||||
- 接入模式（南向）：
|
||||
1) 设备直连：设备自身具备网络能力（常见MQTT、HTTP），直接上报至平台。
|
||||
2) 平台直连：第三方平台承接设备数据后，推送至本平台（HTTP/MQTT）或本平台主动去消费其MQTT/HTTP。
|
||||
3) 网关接入：低功耗、无网设备通过网关汇聚后，网关推送或第三方平台转发到本平台；网关承担多设备数据的代理。
|
||||
- 北向分发：本平台将数据提供给上级或其它业务系统（省厅、市级平台等），作为北向系统输出。
|
||||
- 设备编码（deviceId）：数据路由的唯一关键；平台中需全局唯一，与上报数据字段一致；入库及路由依赖此字段，不能缺失或混用。
|
||||
- 物模型：定义产品数据结构（标准字段+业务字段）；产品发布时自动在时序库创建超级表（字段按物模型生成）。
|
||||
- Topic（MQTT）：消息主题的层级规范；实施过程中常出现“实际Topic有中间层级/示例不完整”的情况，需客户端校验并使用“+”通配符。
|
||||
|
||||
三、账号与权限（运营起步）
|
||||
- 管理策略：
|
||||
- 按项目、单位或技术服务商创建独立账号，实现数据隔离与便于运营管理（如番禺救援项目单独账号，城中村、水务局分别账号）。
|
||||
- 管理员具备全局视图；生产环境严格管理账号与设备归属，避免混用。
|
||||
- 使用场景：
|
||||
- 技术服务商自助入驻：提供平台账号与使用指引，由对方自行创建设备、配置网关与订阅。
|
||||
- 项目维度管理：平台管理员创建项目账号并分配权限，项目侧仅可查看与管理自身设备与数据。
|
||||
|
||||
四、网络组件配置（培训明确步骤）
|
||||
- 目标：配置与第三方平台/设备的网络连接（MQTT/HTTP）以便采集或接收数据。
|
||||
- 必备技术资料：
|
||||
- 服务地址与端口、认证方式（账号/密码/密钥/签名）、Topic规范、数据结构示例（含设备编码）、是否需要脚本/加密。
|
||||
- 操作要点：
|
||||
- MQTT常用：mqt协议为物联网常见；也支持HTTP（对方平台较老或仅支持HTTP上报时使用）。
|
||||
- 对于“平台主动消费对方MQTT”的场景，需要在网络组件中保存对方服务与认证信息，并在网关设备中配置订阅Topic。
|
||||
- ClientId、连接URL可按文档要求设置；数据转换通常不需额外配置，除非对方格式特殊。
|
||||
|
||||
五、产品与物模型（网关/设备双模型）
|
||||
- 产品类型：
|
||||
- 网关产品：用于承载“平台主动采集/消费”或“网关直推”的数据入口。
|
||||
- 设备产品（物联设备）：真实现场设备的产品定义，用于建立设备实例与业务字段承载。
|
||||
- 发布动作：
|
||||
- 产品发布会“动态建库”，在时序库创建超级表（字段来自物模型）；发布成功后方可创建设备并正常入库。
|
||||
- 物模型设计细节：
|
||||
- 网关物模型：通常比设备物模型复杂，需包含设备ID（如“sip”或设备编码字段）与外层结构，用于路由解析；同时包含type（类型/事件枚举）、告警信息、时间戳等。
|
||||
- 设备物模型：可不重复配置设备ID（网关路由已确定归属），保留业务核心字段即可（如告警类型、子类、事件时间等）。
|
||||
- 类型字段建议使用枚举；时间戳字段需勾选时序时间属性（long）。
|
||||
- 字段命名与对方对齐，避免与平台保留关键字冲突。
|
||||
|
||||
六、设备创建与绑定（网关模式详解）
|
||||
- 网关设备（基于网关产品）：
|
||||
- 接入方式：选择“平台记录”（平台主动消费）或“网关直推”；在培训2实例中为“网关记录”（表示设备数据通过网关代理上报）。
|
||||
- 协议备注：标注MQTT（便于识别）；数据方向对网关产品通常为“采集”。
|
||||
- 订阅Topic：配置对方提供的Topic；如文档与现场不一致，使用“+”通配符适配中间层级；实施前用MQTT客户端验证。
|
||||
- 子设备（N台设备）：
|
||||
- 创建设备实例（基于设备产品），选择接入方式为“网关记录”（表示数据经网关代理到此设备）。
|
||||
- 填写设备编码（与上报字段一致、平台唯一）；选择所属网关；保持必要业务信息（行业、位置等）。
|
||||
- 数据方向：子设备为“上报”（通过网关代理上报）。
|
||||
- 简化原则（培训2强调）：
|
||||
- 设备侧无需重复配置设备ID（路由已确定）；避免冗余存储无用字段。
|
||||
- 枚举值保持一致性；时间字段规范化。
|
||||
|
||||
七、真实案例与操作脉络（安全帽案例）
|
||||
- 技术方案：安全帽设备→推到其自有MQTT服务→本平台作为消费者订阅其MQTT（平台主动采集）。
|
||||
- 实施步骤：
|
||||
1) 获取技术文档与账号（MQTT地址、认证、Topic规范、数据示例）。
|
||||
2) 管理员创建项目或服务商账号，分配权限。
|
||||
3) 在平台网络组件中配置对方MQTT连接。
|
||||
4) 建立网关产品，发布（建表）。
|
||||
5) 建立网关设备，绑定网络组件，配置订阅Topic（必要时使用“+”通配符）。
|
||||
6) 建立设备产品（与网关物模型一致或适当简化），发布。
|
||||
7) 为每个安全帽创建设备实例（选择“网关记录”），填写设备编码，与网关关联。
|
||||
8) 启用网关与设备，开始接收并入库。
|
||||
- 实施建议：
|
||||
- 此“平台主动采集”方案为兜底，不建议作为默认；优先引导“设备/平台主动推送到本平台”。
|
||||
|
||||
八、规则配置与工作量（培训1说明）
|
||||
- 告警规则并非统一套用到所有设备：
|
||||
- 同一产品在不同部署场景要求不一，规则需按设备维度配置。
|
||||
- 批量设备多时，需逐台配置（可考虑后续优化工具/模板导入）。
|
||||
- 实操建议：
|
||||
- 先“学会怎么用”，工作量问题后续再评估；规则配置入口位于设备维度。
|
||||
|
||||
九、常见问题与排障清单
|
||||
- 未收到数据：
|
||||
- 检查网络组件连通与认证（地址、端口、账号/密钥/签名）。
|
||||
- 检查订阅Topic是否正确；使用MQTT客户端现场验证真实Topic与数据样例。
|
||||
- 路由不正确：
|
||||
- 网关物模型中设备ID解析是否正确；
|
||||
- 子设备是否绑定对应网关；
|
||||
- 通配符“+”是否覆盖中间层级。
|
||||
- 入库异常：
|
||||
- 物模型字段名/类型是否与实际数据对齐；
|
||||
- 时间字段是否设为时序时间；
|
||||
- 设备编码与上报是否一致，平台唯一索引是否冲突。
|
||||
- 性能与稳定性：
|
||||
- 尽量使用设备/平台主动推送；平台主动采集会增加任务负载；
|
||||
- 大量设备接入需评估服务器资源（示例提到当前仅32G内存），必要时扩容。
|
||||
|
||||
十、实施与管理建议
|
||||
- 接入前置清单：必须先拿到技术文档、真实数据样例、Topic清单与认证信息；先用客户端验证再在平台配置。
|
||||
- 账号治理：生产环境严控账号与设备归属；按项目或服务商进行隔离。
|
||||
- 模型与字段规范：保持与对方对齐命名与枚举；避免保留字；时间统一为long。
|
||||
- 批量导入：产品发布后，再批量导入设备，减少手工工作量。
|
||||
- 通配符使用：在订阅中用“+”处理中间层级差异，降低实施摩擦。
|
||||
|
||||
十一、培训中的关键原话要点（摘录式复原）
|
||||
- “两种模式：别人平台推、我们去消费别人数据（安全帽案例为我们消费对方MQTT）。”
|
||||
- “网关模式是N+1：网关产品+设备产品；网关设备承载多台子设备。”
|
||||
- “设备编码是数据路由核心，平台唯一，数据包必须携带，不支持一个数据包混入多设备。”
|
||||
- “设备产品侧可不再配置设备ID（已由网关路由确定），避免冗余。”
|
||||
- “平台主动采集是备选兜底方案，为减少平台负载不建议默认采用。”
|
||||
- “同产品不同现场规则不一，规则需按设备维度配置。”
|
||||
|
||||
十二、可输出的交付物（如需请告知）
|
||||
- 设备/网关接入操作手册（带步骤截图与示例字段表）
|
||||
- 接入资料清单模板（对方需提供的地址、认证、Topic、示例数据）
|
||||
- 网关订阅与通配符指南（含常见Topic偏差案例）
|
||||
- 物模型设计规范与示例（网关与设备双模型、枚举/时间字段设置）
|
||||
- 排障速查表（采集-解析-路由-入库）
|
||||
|
||||
@@ -0,0 +1,162 @@
|
||||
|
||||
|
||||
|
||||
一、前置准备（必须先完成）
|
||||
- 必要资料（向设备方/平台方索取）
|
||||
- 接入模式：设备直连 / 网关代理 / 平台采集（本平台去消费对方MQTT/HTTP）
|
||||
- 协议与地址：MQTT/HTTP服务地址与端口
|
||||
- 认证信息：账号/密码或密钥/签名算法、ClientId要求（若有）
|
||||
- Topic清单：含层级规范与变量段说明（设备编码所在层级）
|
||||
- 数据样例：真实上报JSON（至少包含设备编码、事件类型、事件时间、示例字段）
|
||||
- 物模型草案：关键字段清单、字段类型、枚举值、时间戳格式
|
||||
- 平台账号与权限
|
||||
- 建议按项目或服务商使用独立账号；确认账号具备网络组件、产品、设备的增改权限
|
||||
|
||||
二、总体流程总览
|
||||
1) 配置网络组件（MQTT/HTTP）
|
||||
2) 创建产品与物模型
|
||||
- 网关产品（如用网关或平台采集方案）
|
||||
- 设备产品（真实设备）
|
||||
- 发布产品（自动建表）
|
||||
3) 创建设备实例
|
||||
- 网关设备（如有）
|
||||
- 子设备（N台）
|
||||
4) 绑定网络与Topic
|
||||
5) 启用与验证（数据入库校验）
|
||||
说明：
|
||||
- 直连设备：可不建网关产品/设备，设备产品直连绑定网络并上报
|
||||
- 网关/平台采集：需先建网关产品/网关设备，再建子设备并绑定到网关
|
||||
|
||||
三、步骤详解（以“网关代理/平台采集”通用流程为例）
|
||||
步骤1：配置网络组件
|
||||
- 入口：平台-网络管理-新增网络组件
|
||||
- 填写项
|
||||
- 类型：MQTT（常用）或HTTP
|
||||
- 地址/端口：对方提供
|
||||
- 认证：账号/密码或密钥/签名（按文档要求）
|
||||
- ClientId/连接参数：若对方有格式要求需按要求填写
|
||||
- 备注：建议标注项目/厂商名称，便于后续识别
|
||||
- 校验要点
|
||||
- 先用MQTT客户端连通测试（能订阅到任意公开主题最佳）
|
||||
- 认证失败优先检查账号状态、白名单、TLS/证书要求
|
||||
|
||||
步骤2：创建网关产品（如使用网关或平台采集）
|
||||
- 入口：平台-产品管理-新增产品（类型：网关）
|
||||
- 物模型设计建议
|
||||
- 必含设备标识字段：如 deviceId 或 sip（用于路由到子设备）
|
||||
- 事件类字段：type（枚举）、subType/desc（可选）、eventTime（long时间戳）
|
||||
- 其它业务字段：按对方数据样例补充
|
||||
- 发布产品
|
||||
- 发布后平台自动在时序库创建超级表；未发布将导致后续入库失败
|
||||
- 检查
|
||||
- 确认字段名与对方数据一致，时间字段勾选为时间列
|
||||
|
||||
步骤3：创建设备产品（真实设备）
|
||||
- 入口：平台-产品管理-新增产品（类型：设备）
|
||||
- 物模型设计建议
|
||||
- 不重复设备标识字段（已由网关路由确定）
|
||||
- 保留设备侧关注的业务字段，如 type、alertSubType、eventTime 等
|
||||
- 将 eventTime 设为时间列；枚举值与对方对齐
|
||||
- 发布产品
|
||||
- 发布后生成对应设备超级表
|
||||
|
||||
步骤4：创建设备实例-网关设备
|
||||
- 入口：平台-设备管理-新增设备（选择网关产品）
|
||||
- 关键配置
|
||||
- 接入方式：网关记录 或 平台记录
|
||||
- 网关记录：数据由“网关代理”上报至平台
|
||||
- 平台记录：平台主动去对方平台消费（安全帽MQTT消费属此类）
|
||||
- 协议：MQTT（并备注厂商/平台名称）
|
||||
- 绑定网络组件：选择步骤1创建的网络组件
|
||||
- 订阅Topic：填写对方提供的Topic；中间层级不确定用“+”通配
|
||||
- 示例：/vendor/helmet/+/alarm
|
||||
- 启用：保存后先不启用，待子设备创建完一起启用
|
||||
- 校验要点
|
||||
- 用MQTT客户端实测该Topic能收到与样例一致的数据
|
||||
- Topic变量段确定设备编码位置，便于后续路由
|
||||
|
||||
步骤5：创建设备实例-子设备（N台）
|
||||
- 入口：平台-设备管理-新增设备（选择步骤3的设备产品）
|
||||
- 关键配置
|
||||
- 设备编码：与上报数据中的设备标识一致，平台全局唯一
|
||||
- 接入方式：网关记录（通过网关代理）
|
||||
- 所属网关：选择步骤4的网关设备
|
||||
- 其它信息：名称、位置、单位、行业分类等
|
||||
- 批量建议
|
||||
- 若数量大，先准备模板CSV后批量导入（如平台支持批量）
|
||||
- 注意
|
||||
- 子设备不绑定网络组件与Topic，由网关设备统一订阅与路由
|
||||
|
||||
步骤6：启用与联调
|
||||
- 入口：设备列表/网关设备详情
|
||||
- 操作
|
||||
- 启用网关设备
|
||||
- 启用子设备
|
||||
- 观察监控页/日志：确认网关连接成功、订阅成功、消息接收正常
|
||||
- 入库校验
|
||||
- 在平台查询实时/历史数据或直连时序库查询对应表
|
||||
- 核对字段映射是否正确、eventTime是否生效排序
|
||||
|
||||
四、直连设备（无网关）的差异化步骤
|
||||
- 产品：仅需设备产品（可将设备编码作为辅助字段或不存储，视平台实现）
|
||||
- 设备实例：接入方式选“直连”，直接绑定网络组件
|
||||
- Topic：在设备实例上配置其专属Topic（若每台设备一个Topic），或采用平台方提供的统一Topic+设备编码路由
|
||||
- 其余校验同上
|
||||
|
||||
五、平台推送（第三方向本平台推送HTTP/MQTT）
|
||||
- 网络组件：配置为“平台接收”端点（若平台提供专属接入地址与认证）
|
||||
- 安全策略：为对方创建独立账号与密钥，限制可见与写入范围
|
||||
- 物模型与设备：与网关模式的设备侧一致
|
||||
- 验证：让对方用真实报文调用接入地址，平台查收并入库
|
||||
|
||||
六、字段与物模型设计清单（避免入库失败）
|
||||
- 必备
|
||||
- 路由字段：deviceId/sip（在网关模型中必需）
|
||||
- 时间字段：eventTime（long，设为时间列）
|
||||
- 类型字段：type（枚举或字符串，保持与对方一致）
|
||||
- 不建议
|
||||
- 在设备模型中重复定义设备ID（已由路由确定）
|
||||
- 使用平台保留关键字作为字段名
|
||||
- 变更
|
||||
- 发布后字段调整需评估对历史数据表结构影响，慎重变更；必要时新建版本产品
|
||||
|
||||
七、Topic与通配符配置指引
|
||||
- 常见差异：文档与现场Topic中间多一层（如项目号/渠道号）
|
||||
- 处理方法
|
||||
- 优先使用“+”单层通配匹配中间层
|
||||
- 样例：/v1/device/+/alarm 或 /org/+/helmet/+/event
|
||||
- 验证
|
||||
- 使用MQTT客户端先订阅通配符Topic，确认能收到期望设备的数据
|
||||
|
||||
八、启用后的自检与排障
|
||||
- 收不到数据
|
||||
- 网络组件未连通或认证失败：检查账号/密码/证书/白名单
|
||||
- Topic错误：客户端验证；核对通配层级数量
|
||||
- 未启用：确认网关与子设备均为启用状态
|
||||
- 入库异常
|
||||
- 物模型字段名不一致/类型不匹配：对照样例修正
|
||||
- 未发布产品/表未生成：检查发布动作是否成功
|
||||
- 时间列未设置：导致排序/查询异常
|
||||
- 路由失败
|
||||
- 网关模型中未正确解析设备编码
|
||||
- 子设备未创建或设备编码不一致（唯一索引冲突或找不到匹配）
|
||||
- 性能问题
|
||||
- 平台主动采集负载高：优先引导改为对方推送
|
||||
- 大批量设备：提前估算队列/缓存资源，必要时分批启用
|
||||
|
||||
九、最佳实践与建议
|
||||
- 先证后配：先用客户端验证MQTT/HTTP链路与Topic，再在平台录入配置
|
||||
- N+1建模：网关产品+网关设备（1）+子设备（N），清晰解耦
|
||||
- 简化字段：设备模型只保留必要业务字段；网关模型承载路由与原始结构
|
||||
- 命名一致：字段名与对方对齐；枚举提前对表
|
||||
- 批量导入：产品发布后，再批量导入设备，减少重复劳动
|
||||
- 审计与隔离：项目/厂商独立账号与密钥；便于问题定位与权限控制
|
||||
|
||||
十、快速清单（实施现场可打印）
|
||||
- 我是否拿到：地址/端口、认证、Topic、真实样例、设备编码列表？
|
||||
- 我是否：创建了网络组件、创建并发布了网关/设备产品？
|
||||
- 我是否：创建了网关设备并配置了Topic与网络组件？
|
||||
- 我是否：为每台设备创建了子设备并与网关绑定，设备编码一致？
|
||||
- 我是否：启用设备与网关、用监控与日志确认已接收到消息？
|
||||
- 我是否：在平台或库中查到实时/历史数据，字段与时间正确？
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
|
||||
http://10.100.100.210/portal/
|
||||
|
||||
aiot aiot123@Admin
|
||||
@@ -0,0 +1,13 @@
|
||||
|
||||
|
||||
生产环境：
|
||||
```
|
||||
https://218.20.201.147/portal/#/login?backurl=%2F&local=true
|
||||
```
|
||||
|
||||
|
||||
物联网：https://wlw.panyu.gd.cn
|
||||
账号：aiot pyqzhsw@PYQ123
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
vpn:
|
||||
easyconnect
|
||||
|
||||
|
||||
# 堡垒机
|
||||
|
||||
https://10.160.32.248/#/login
|
||||
|
||||
user: chenm
|
||||
|
||||
```password
|
||||
Pycredit@202407
|
||||
```
|
||||
|
||||
|
||||
|
||||
# 番禺住健服务器密码更新
|
||||
|
||||
## 服务器
|
||||
|
||||
172.25.1.21
|
||||
user: root
|
||||
```password
|
||||
41&0zU8@Ua8S!gNW
|
||||
```
|
||||
|
||||
22:
|
||||
root:
|
||||
```
|
||||
J5fXVgZ@r!O.OCgW
|
||||
```
|
||||
|
||||
|
||||
|
||||
```sh
|
||||
# ip
|
||||
172.25.101.39
|
||||
# 原密码
|
||||
1qaz@WSX3edc$RFV$#@!
|
||||
# 新密码
|
||||
5XWUsQm9@htNW3.8zSG5
|
||||
|
||||
# ip
|
||||
172.25.101.113
|
||||
# 原密码
|
||||
1qaz@WSX3edc$RFV$#@!
|
||||
# 新密码
|
||||
5XWUsQm9@htNW3.8zSG5
|
||||
|
||||
# ip
|
||||
172.25.1.45
|
||||
# 原密码
|
||||
1qaz@WSX3edc$RFV$#@!
|
||||
# 新密码
|
||||
5XWUsQm9@htNW3.8zSG5
|
||||
|
||||
```
|
||||
|
||||
```password
|
||||
5XWUsQm9@htNW3.8zSG5
|
||||
```
|
||||
|
||||
|
||||
nacos:
|
||||
```
|
||||
nacos
|
||||
```
|
||||
|
||||
```
|
||||
Gzzn@2023/
|
||||
```
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,42 @@
|
||||
|
||||
Easy Connect:
|
||||
## vpn
|
||||
|
||||
https://218.20.201.210
|
||||
user: znkj
|
||||
pass:
|
||||
```
|
||||
znkj@panyu.com
|
||||
```
|
||||
|
||||
# 堡垒机
|
||||
|
||||
https://10.160.32.248/#/login
|
||||
|
||||
user: chenm
|
||||
|
||||
```password
|
||||
Pycredit@202407
|
||||
```
|
||||
|
||||
|
||||
172.25.1.21
|
||||
user: root
|
||||
```password
|
||||
41&0zU8@Ua8S!gNW
|
||||
```
|
||||
|
||||
|
||||
|
||||
172.25.1.28
|
||||
user:root
|
||||
```
|
||||
Z.qqhi!QQs8@ADkG
|
||||
```
|
||||
|
||||
|
||||
172.25.1.29
|
||||
```
|
||||
r81dXJ41yq@1.8!C
|
||||
```
|
||||
|
||||
Executable
+10
@@ -0,0 +1,10 @@
|
||||
# 堡垒机
|
||||
|
||||
https://10.160.32.248/#/login
|
||||
|
||||
user: chenm
|
||||
|
||||
```password
|
||||
Pycredit@202407
|
||||
```
|
||||
|
||||
Executable
+99
@@ -0,0 +1,99 @@
|
||||
|
||||
堡垒机：
|
||||
https://10.160.32.248
|
||||
gwjh
|
||||
1@qwaSzx202407
|
||||
|
||||
| | | |
|
||||
|---|---|---|
|
||||
|
||||
VPN：
|
||||
|[https://218.20.201.210](https://218.20.201.210/)
|
||||
gwjhgzzn
|
||||
gzpy135.com
|
||||
new:
|
||||
```
|
||||
Pygwjh@202409
|
||||
```
|
||||
|
||||
|
||||
|
||||
114:
|
||||
root
|
||||
114gZgw$jH0510M
|
||||
|
||||
115:
|
||||
root
|
||||
gZg115w$jH0510M
|
||||
|
||||
116:
|
||||
root
|
||||
gZgw116$jH0510M
|
||||
|
||||
176:
|
||||
root
|
||||
g@W2024.Jh
|
||||
|
||||
177:
|
||||
Gw@Jh2023.K
|
||||
|
||||
|
||||
|
||||
|
||||
三台minio服务，端口9000
|
||||
10.160.20.114、10.160.20.115、10.160.20.116
|
||||
三台NGINX，端口80和443
|
||||
10.160.20.176、10.160.20.177
|
||||
|
||||
|
||||
|
||||
firewalld whitelist
|
||||
|
||||
```bash
|
||||
|
||||
firewall-cmd --new-zone=whitelist --permanent
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
14 firewall:
|
||||
```
|
||||
firewall-cmd --permanent --add-port=9000/tcp
|
||||
firewall-cmd --permanent --add-port=9001/tcp
|
||||
firewall-cmd --permanent --add-port=9100/tcp
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
|
||||
176/177:
|
||||
```bash
|
||||
|
||||
firewall-cmd --permanent --add-service=http
|
||||
firewall-cmd --permanent --add-service=https
|
||||
firewall-cmd --reload
|
||||
|
||||
```
|
||||
|
||||
|
||||
new white list:
|
||||
ip list:
|
||||
10.160.20.112-119
|
||||
10.160.20.102
|
||||
10.160.20.107
|
||||
10.160.20.110
|
||||
10.160.20.176
|
||||
10.160.20.177
|
||||
|
||||
```bash
|
||||
firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.160.20.0/24" accept' --permanent
|
||||
firewall-cmd --reload
|
||||
```
|
||||
|
||||
|
||||
remove:
|
||||
|
||||
```shell
|
||||
firewall-cmd --zone=public --list-rich-rules --permanent
|
||||
firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="10.160.20.0/24" accept' --permanent
|
||||
firewall-cmd --reload
|
||||
firewall-cmd --list-all
|
||||
```
|
||||
@@ -0,0 +1,64 @@
|
||||
|
||||
|
||||
mysql:
|
||||
|
||||
```
|
||||
CREATE USER 'tduck'@'172.25.%' IDENTIFIED BY 'Tduck@20220725/';
|
||||
GRANT ALL PRIVILEGES ON *.* to 'tduck'@'172.25.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
create user 'iflow'@'172.25.242.%' identified by 'Gzzn@2024';
|
||||
grant all privileges on *.* to 'iflow'@'172.25.242.%';
|
||||
flush privileges;
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
select name from mysql.proc where db = 'tduck_pre' and `type` = 'PROCEDURE';
|
||||
```
|
||||
|
||||
|
||||
|
||||
```
|
||||
SHOW CREATE PROCEDURE 'schedule_del_status_230417'
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
|
||||
SHOW PROCEDURE STATUS;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
GRANT SYSTEM_USER ON *.* TO 'root'@'172.25.242.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
SELECT EVENT_SCHEMA, EVENT_NAME, DEFINER
|
||||
FROM information_schema.EVENTS
|
||||
WHERE EVENT_SCHEMA = 'tduck_pre' AND EVENT_NAME = 'schedule_del_status_230417';
|
||||
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
ALTER DEFINER = 'root'@'172.25.242.%' EVENT `tduck_pre`.`schedule_del_status_230417`
|
||||
ON SCHEDULE EVERY 1 DAY STARTS '2023-04-20 00:10:00'
|
||||
DO
|
||||
DELETE FROM py_car_cnclxx
|
||||
WHERE S_STATUS = 2 AND TO_DAYS(NOW()) - TO_DAYS(s_last_updated) > 1;
|
||||
```
|
||||
|
||||
|
||||
```
|
||||
CREATE USER 'pypc'@'172.25.%' IDENTIFIED BY 'PyPc@20220722.';
|
||||
GRANT ALL PRIVILEGES ON pypc.* to 'pypc'@'172.25.%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
Executable
+54
@@ -0,0 +1,54 @@
|
||||
# 番禺城中城服务器登陆流程
|
||||
|
||||
### vpn
|
||||
|
||||
```sh
|
||||
https://218.20.201.210
|
||||
|
||||
znkj
|
||||
|
||||
znkj@panyu.com
|
||||
```
|
||||
|
||||
|
||||
|
||||
### 堡垒机
|
||||
|
||||
```sh
|
||||
https://10.160.32.248/#/login
|
||||
|
||||
yanggj
|
||||
|
||||
89@ghrw#2A1wq
|
||||
|
||||
# 手机验证码需找技术经理陆旋支持
|
||||
```
|
||||
|
||||
```
|
||||
89@ghrw#2A1wq
|
||||
```
|
||||
|
||||
|
||||
### 服务器
|
||||
|
||||
| ip地址 | 密码 |
|
||||
| --------------------------------------- | -------------------- |
|
||||
| 172.25.242.178 （nginx、redis、mysql） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.45 （tduck-api） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.46 （docker swarm（副）） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.47 （备份服务器） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.204 （docker swarm（主）） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.215 （minion） | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.242.61 | 1qaz@WSX3edc$RFV$#@! |
|
||||
| 172.25.101.16 （nginx、mysql、redis（车场专用）） | PYzsj@101.47*429 |
|
||||
|
||||
```
|
||||
1qaz@WSX3edc$RFV$#@!
|
||||
```
|
||||
|
||||
### 登陆顺序
|
||||
|
||||
> 服务器登陆顺序为：vpn --> 堡垒机 --> 172.25.242.178 --> 其他服务器（在178上面ssh过去）
|
||||
>
|
||||
> 注：因当前策略问题，178无法跳转至16服务器，需要先从178到204然后再跳转16 （策略需项目经理去开通）
|
||||
|
||||
Executable
+204
@@ -0,0 +1,204 @@
|
||||
# 番禺政务中心配置信息
|
||||
|
||||
Maintainer：lizx
|
||||
|
||||
Date：2022-07-20
|
||||
|
||||
## VPN
|
||||
|
||||
> https://218.20.201.210
|
||||
>
|
||||
> 账号：znkj
|
||||
>
|
||||
> 密码：znkj@panyu.com
|
||||
|
||||
## 堡垒机
|
||||
|
||||
> https://10.160.20.248/#/login
|
||||
>
|
||||
> 账号：yanggj
|
||||
>
|
||||
> 密码：5@ghrw#2A1wq
|
||||
|
||||
## 服务器登录账号密码
|
||||
|
||||
> 172.25.242.178
|
||||
>
|
||||
> Account：root
|
||||
>
|
||||
> Password：1qaz@WSX3edc$RFV$#@!
|
||||
|
||||
## 数据库信息
|
||||
|
||||
> 数据库 172.25.242.178
|
||||
>
|
||||
> 端口：3306
|
||||
>
|
||||
> 本地DBA用户
|
||||
>
|
||||
> 用户：root
|
||||
>
|
||||
> 密码：gZZn@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：mbp
|
||||
>
|
||||
> 密码：mBp@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：pypc
|
||||
>
|
||||
> 密码：PyPc@20220722.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：tduck
|
||||
>
|
||||
> 密码：Tduck@20220725/
|
||||
>
|
||||
> +--------------------+
|
||||
> | Database |
|
||||
> +--------------------+
|
||||
> | information_schema |
|
||||
> | mbp |
|
||||
> | mysql |
|
||||
> | performance_schema |
|
||||
> | pypc |
|
||||
> | sys |
|
||||
> | tduck_pre |
|
||||
> | vincity |
|
||||
> +--------------------+
|
||||
|
||||
|
||||
|
||||
## Redis信息
|
||||
|
||||
>数据库 172.25.242.178
|
||||
>
|
||||
>端口：6879
|
||||
>
|
||||
>启动命令：redis-server /opt/redis/redis-7.0.4/redis.conf
|
||||
>
|
||||
>关闭命令：redis-cli -p 6879 --> auth 密码 --> shutdown
|
||||
>
|
||||
>客户端登录：redis-cli -p 6879
|
||||
>
|
||||
>密码：gZzn.2022A
|
||||
|
||||
|
||||
|
||||
## Naocs信息
|
||||
|
||||
> 172.25.242.178:8848/nacos
|
||||
>
|
||||
> 部署位置：/opt/nacos
|
||||
>
|
||||
> JDK位置：/opt/jdk1.8.0_311
|
||||
>
|
||||
> 启动命令：./startup.sh -m standalone
|
||||
>
|
||||
> 关闭命令：./shutdown.sh
|
||||
>
|
||||
> 端口：8848
|
||||
>
|
||||
> 用户名：nacos
|
||||
>
|
||||
> 密码：nacos
|
||||
>
|
||||
> H@rJ4cwnz5bydxyT
|
||||
>
|
||||
> 请配置时及时更改密码为强口令！！！！
|
||||
|
||||
## ES信息
|
||||
|
||||
> 172.25.242.178:9200
|
||||
>
|
||||
> 部署位置：/opt/soft/es
|
||||
>
|
||||
> JDK位置：es内置jdk
|
||||
>
|
||||
> 启动命令：./elasticsearch -d （启动时需要切换elastic用户，密码：Gzzn@20220725/）
|
||||
>
|
||||
> 端口：9200
|
||||
>
|
||||
> 账号：elastic
|
||||
>
|
||||
> 启动时自动生成的默认密码：7qOBYCqDrx_q3Ib*Vyb=
|
||||
|
||||
## nginx信息
|
||||
|
||||
> 172.25.242.178:80
|
||||
>
|
||||
> 部署位置：/usr/local/nginx
|
||||
>
|
||||
> 配置文件位置：/usr/local/nginx/conf/nginx.conf
|
||||
>
|
||||
> 启动命令：./nginx
|
||||
|
||||
## minio信息
|
||||
|
||||
> 172.25.242.215:9000
|
||||
>
|
||||
> 部署位置：/data/minio
|
||||
>
|
||||
> 管理用户：minioadmin/lRFG4YWitlthJQ+
|
||||
>
|
||||
> 容器启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> docker run -p 9000:9000 -p 9090:9090 \
|
||||
> --net=host \
|
||||
> --name minio \
|
||||
> -d --restart=always \
|
||||
> -e "MINIO_ROOT_USER=minioadmin" \
|
||||
> -e "MINIO_ROOT_PASSWORD=lRFG4YWitlthJQ+" \
|
||||
> -v /data/minio/data:/data \
|
||||
> -v /data/minio/config:/root/.minio \
|
||||
> minio/minio server \
|
||||
> /data --console-address ":9090" -address ":9000"
|
||||
> ```
|
||||
>
|
||||
>
|
||||
|
||||
## mongo信息
|
||||
|
||||
> ip: 172.25.242.47
|
||||
>
|
||||
> 端口：27017
|
||||
>
|
||||
> 部署位置：/data/mongodb
|
||||
>
|
||||
> 管理用户：root
|
||||
>
|
||||
> 密码：root/Pyczc@Root2023
|
||||
>
|
||||
> 启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> # 启动
|
||||
> service mongod start
|
||||
> # 停止
|
||||
> service mongod stop
|
||||
> # 重启
|
||||
> service mongod restart
|
||||
> ```
|
||||
>
|
||||
> 业务用户：data_quality
|
||||
|
||||
> 密码：Pyczc@data_quality2023
|
||||
|
||||
# 测试环境
|
||||
|
||||
## zookeeper
|
||||
|
||||
> ip :172.25.242.61
|
||||
>
|
||||
> 用户：zookeeper/Zook@admin2023
|
||||
>
|
||||
> post: 2181
|
||||
>
|
||||
> 部署位置：/opt/apache-zookeeper
|
||||
>
|
||||
> 数据位置：/data/zookeeper
|
||||
Executable
+27
@@ -0,0 +1,27 @@
|
||||
|
||||
|
||||
| | | | | | | | | |
|
||||
|---|---|---|---|---|---|---|---|---|
|
||||
|
||||
堡垒机|
|
||||
https://10.160.32.248
|
||||
lizx
|
||||
P@2024.Lksdhg
|
||||
|
||||
zhangcb
|
||||
1@qwaSzx240611
|
||||
|
||||
|
||||
|
||||
VPN
|
||||
https://218.20.201.210
|
||||
znkj
|
||||
znkj@panyu.com
|
||||
|
||||
|
||||
22：
|
||||
root
|
||||
8hXxWket*W.fR!zo
|
||||
|
||||
|
||||
semanage port -a -t mysqld_port_t -p tcp 3359
|
||||
Executable
+316
@@ -0,0 +1,316 @@
|
||||
|
||||
|
||||
---
|
||||
|
||||
```markdown
|
||||
# 小鹏汽车数据流向与系统架构分析
|
||||
*面向系统分析员 · {{date}}*
|
||||
|
||||
---
|
||||
|
||||
## 🧭 一、总体说明（Overview）
|
||||
|
||||
> 小鹏汽车的软件体系是一套“以数据流为核心”的智能系统。
|
||||
> 系统所有功能（自动驾驶、座舱AI、云端训练、OTA）均围绕数据生命周期展开。
|
||||
|
||||
数据闭环由以下阶段组成：
|
||||
|
||||
```
|
||||
|
||||
生成 → 采集 → 上传 → 存储 → 处理 → 学习 → 部署 → 执行 → 反馈
|
||||
|
||||
````
|
||||
|
||||
---
|
||||
|
||||
## 🚘 二、数据流向全景（End-to-End Data Flow）
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A[车辆传感器与控制系统] --> B[车端计算与中间件]
|
||||
B --> C[Telemetry Agent]
|
||||
C --> D[云端数据接入层]
|
||||
D --> E[数据湖与特征仓库]
|
||||
E --> F[AI训练与仿真验证平台]
|
||||
F --> G[模型注册与OTA系统]
|
||||
G --> H[OTA分发至车辆]
|
||||
H --> I[车辆执行与运行反馈]
|
||||
I --> D
|
||||
````
|
||||
|
||||
---
|
||||
|
||||
## 🧩 三、数据生命周期分析（Data Lifecycle）
|
||||
|
||||
### 1️⃣ 数据生成（On-Vehicle Generation）
|
||||
|
||||
**来源：**
|
||||
|
||||
- 感知层：Camera、LiDAR、Radar、IMU、GPS
|
||||
|
||||
- 控制层：加速度、制动、转向、功率数据
|
||||
|
||||
- 座舱层：语音指令、界面交互、AI助手行为
|
||||
|
||||
- 系统层：XOS 日志、诊断数据、错误码
|
||||
|
||||
|
||||
**数据类型：**
|
||||
|
||||
|类别|说明|特征|
|
||||
|---|---|---|
|
||||
|感知数据|图像、点云、环境感知|高频、原始体量大|
|
||||
|车辆状态|控制信号、CAN 报文|实时性要求极高|
|
||||
|用户交互|语音、触控、行为日志|可匿名化上传|
|
||||
|系统日志|软件状态与错误码|用于稳定性评估|
|
||||
|
||||
---
|
||||
|
||||
### 2️⃣ 数据处理与分发（Vehicle Computing）
|
||||
|
||||
- 感知栈（Perception Stack）执行 XNet 模型推理；
|
||||
|
||||
- 规划栈（Planning Stack）生成轨迹与控制策略；
|
||||
|
||||
- DDS（RTI Connext Drive）实现模块间异步消息传递；
|
||||
|
||||
- 重要事件由 **Telemetry Agent** 抽样上传。
|
||||
|
||||
|
||||
**实时路径：**
|
||||
|
||||
```
|
||||
Sensors → Perception → Fusion → Planning → Control
|
||||
```
|
||||
|
||||
**本地缓存策略：**
|
||||
|
||||
- 高频短期缓存（RAM）
|
||||
|
||||
- 关键片段写入本地Flash（用于回传）
|
||||
|
||||
- 事件触发上传机制（低频）
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 3️⃣ 数据上行（Vehicle → Cloud）
|
||||
|
||||
**通信协议：** MQTT / HTTPS / gRPC
|
||||
**网络层：** 5G / LTE / V2X
|
||||
**安全层：** TLS + PKI + 签名验证
|
||||
|
||||
**上报数据包括：**
|
||||
|
||||
- 感知片段与异常场景
|
||||
|
||||
- 驾驶日志与控制参数
|
||||
|
||||
- 车辆状态与健康信息
|
||||
|
||||
- 用户交互与座舱事件
|
||||
|
||||
- 软件运行与错误日志
|
||||
|
||||
|
||||
**云端接入流程：**
|
||||
|
||||
```
|
||||
Vehicle → API Gateway → Kafka → Flink/Spark → Data Lake
|
||||
```
|
||||
|
||||
- Kafka：高并发数据流缓冲
|
||||
|
||||
- Flink：实时聚合与清洗
|
||||
|
||||
- Metadata Service：管理数据标签与时间戳
|
||||
|
||||
- Validation Service：完整性与签名验证
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 4️⃣ 数据存储与管理（Data Lake & Feature Store）
|
||||
|
||||
**数据分层：**
|
||||
|
||||
```
|
||||
raw/ → 原始传感器数据
|
||||
processed/ → 清洗与对齐后的数据
|
||||
features/ → 特征化结果
|
||||
models/ → 模型输出与版本
|
||||
logs/ → 系统运行记录
|
||||
```
|
||||
|
||||
**管理策略：**
|
||||
|
||||
- Schema-on-Read 模式（灵活扩展）
|
||||
|
||||
- 按时间、车型、场景分区
|
||||
|
||||
- 数据血缘追踪与元数据索引
|
||||
|
||||
- 隐私合规（GDPR / 数据出境审计）
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 5️⃣ 数据学习与建模（AI Training & Simulation）
|
||||
|
||||
**训练流程：**
|
||||
|
||||
1. 数据清洗与增强（Data Cleaning & Augmentation）
|
||||
|
||||
2. 特征提取与标签化（Feature Engineering）
|
||||
|
||||
3. 模型训练（Distributed GPU, PyTorch / TensorFlow）
|
||||
|
||||
4. 仿真验证（Carla / Unity / OpenSCENARIO）
|
||||
|
||||
5. 模型注册与评估（MLflow / Kubeflow）
|
||||
|
||||
|
||||
**云端架构：**
|
||||
|
||||
```
|
||||
Data Lake → Feature Store → Training Cluster → Model Registry
|
||||
```
|
||||
|
||||
- MLOps：实现模型版本控制与持续训练
|
||||
|
||||
- 分布式计算：Ray / Horovod
|
||||
|
||||
- 模型评估：自动化指标测试、精度报告生成
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 6️⃣ 模型与软件下发（Cloud → Vehicle）
|
||||
|
||||
**OTA 下发机制：**
|
||||
|
||||
```
|
||||
Model Registry → OTA Service → CDN Edge → Vehicle OTA Agent
|
||||
```
|
||||
|
||||
- 分模块差分更新（模型、应用、固件分离）
|
||||
|
||||
- 灰度发布机制（按车型/地区批量推送）
|
||||
|
||||
- 签名校验 + HSM 保障完整性
|
||||
|
||||
- 热重载与回滚机制保证安全性
|
||||
|
||||
|
||||
**车端行为：**
|
||||
|
||||
- XOS 校验包完整性
|
||||
|
||||
- OTA Manager 调度模块重启或模型替换
|
||||
|
||||
- 上报更新结果至云端（Update Report）
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 7️⃣ 数据反馈与闭环优化（Feedback & Continuous Learning）
|
||||
|
||||
闭环目标：形成 **自演化 AI 系统**
|
||||
即车辆使用数据 → 云端优化 → OTA 更新 → 再次反馈
|
||||
|
||||
|阶段|输入|输出|作用|
|
||||
|---|---|---|---|
|
||||
|运行阶段|实际驾驶数据|异常样本|数据补充|
|
||||
|分析阶段|大规模日志|优化场景集|精准再训练|
|
||||
|训练阶段|特征数据|新模型|性能提升|
|
||||
|部署阶段|模型/软件包|OTA 更新|功能增强|
|
||||
|反馈阶段|实际指标|改进决策|自我优化|
|
||||
|
||||
---
|
||||
|
||||
## ☁️ 四、系统架构支撑视图（Architecture Support View）
|
||||
|
||||
### 架构逻辑
|
||||
|
||||
小鹏的架构以数据流为主线，通过以下系统支撑：
|
||||
|
||||
1. **车端：实时计算与分布式通信**
|
||||
|
||||
- 构建 SOA 化车载平台（DDS + 容器化）
|
||||
|
||||
- 以中间件实现“数据即服务”
|
||||
|
||||
2. **云端：数据与模型生命周期管理**
|
||||
|
||||
- 数据湖 → 特征仓库 → 模型训练 → OTA
|
||||
|
||||
3. **研发支撑：CI/CD + MLOps**
|
||||
|
||||
- 形成从代码、模型到数据的统一流水线
|
||||
|
||||
4. **安全与合规体系**
|
||||
|
||||
- 全链路加密、身份认证、隐私治理
|
||||
|
||||
|
||||
---
|
||||
|
||||
### 架构分层（系统视图）
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
subgraph Vehicle
|
||||
V1[传感器与控制] --> V2[感知/融合/规划模块]
|
||||
V2 --> V3[DDS中间件通信层]
|
||||
V3 --> V4[XOS操作系统]
|
||||
end
|
||||
subgraph Cloud
|
||||
C1[API Gateway / Kafka]
|
||||
C1 --> C2[数据湖 & 特征仓库]
|
||||
C2 --> C3[AI训练与仿真平台]
|
||||
C3 --> C4[Model Registry / OTA Service]
|
||||
end
|
||||
subgraph DevOps
|
||||
D1[CI/CD + MLOps Pipeline]
|
||||
D1 --> C3
|
||||
end
|
||||
V3 --> C1
|
||||
C4 --> V4
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🧮 五、系统分析要点（System Analyst Focus）
|
||||
|
||||
|分析维度|说明|
|
||||
|---|---|
|
||||
|**数据流向**|架构的主线；所有系统围绕数据生命周期设计|
|
||||
|**边界清晰**|车端与云端通过安全通道分离职责|
|
||||
|**解耦性**|车内 DDS 与云端微服务相互独立|
|
||||
|**一致性策略**|数据与模型版本同步控制|
|
||||
|**非功能性关注**|实时性、安全性、可靠性、可扩展性|
|
||||
|**演化能力**|架构支持快速OTA与模型迭代|
|
||||
|**治理与合规**|全链路审计、数据脱敏与访问控制|
|
||||
|
||||
---
|
||||
|
||||
## 🔁 六、总结（Summary）
|
||||
|
||||
> 从数据流角度看，小鹏的软件系统是一个以 **数据驱动决策与学习** 为核心的闭环架构。
|
||||
|
||||
**核心特征：**
|
||||
|
||||
- 数据是系统的主导对象；
|
||||
|
||||
- 架构的所有层次都服务于数据流动；
|
||||
|
||||
- 软件更新是数据反馈的自然结果；
|
||||
|
||||
- 系统目标是实现“持续学习、持续优化、持续交付”。
|
||||
|
||||
|
||||
最终实现：
|
||||
|
||||
> **Software Defined Vehicle = Data Driven + Model Driven + Continuous Evolution**
|
||||
|
||||
---
|
||||
Executable
+253
@@ -0,0 +1,253 @@
|
||||
|
||||
|
||||
> **「小鹏汽车系统架构（System Architecture）」**
|
||||
|
||||
结构清晰、语义标准，格式完全适配 **Obsidian Markdown**。
|
||||
内容聚焦在系统架构本身：分层结构、逻辑与物理视图、关键子系统、非功能性约束，以及架构演化路线。
|
||||
|
||||
---
|
||||
|
||||
```markdown
|
||||
# 小鹏汽车系统架构（System Architecture of XPENG Motors）
|
||||
*面向系统分析员 · {{date}}*
|
||||
|
||||
---
|
||||
|
||||
## 🧭 一、系统定位与架构目标（System Context & Goals）
|
||||
|
||||
### 系统定位
|
||||
小鹏汽车是一个 **“云-车一体化” 的软件定义汽车系统（Software Defined Vehicle, SDV）**。
|
||||
整体由两大系统域组成：
|
||||
- **车端系统（On-Vehicle System）**：负责实时感知、决策、控制与人机交互；
|
||||
- **云端系统（In-Cloud System）**：负责数据采集、分析、模型训练、OTA分发与远程运维。
|
||||
|
||||
两者通过安全通信通道（5G / V2X / TLS）形成 **闭环数据架构**，
|
||||
实现从感知到学习、从更新到再优化的持续演进。
|
||||
|
||||
---
|
||||
|
||||
### 架构目标
|
||||
| 架构属性 | 目标描述 | 指标或机制 |
|
||||
|-----------|-----------|-------------|
|
||||
| **可演化性** | 支持软件持续迭代与OTA更新 | 模块化 / 接口稳定 / 热更新 |
|
||||
| **实时性** | 满足自动驾驶与控制环路响应 | <10ms 延迟（DDS QoS） |
|
||||
| **安全性** | 满足功能安全 + 网络安全 | ISO 26262 + TLS + HSM |
|
||||
| **可扩展性** | 支撑多车型、多功能复用 | 微服务 + 容器化 |
|
||||
| **可用性** | 高可用冗余与自愈 | 双通道通信 + 监控回退 |
|
||||
| **一致性** | 云车状态与数据同步 | 双向版本控制机制 |
|
||||
|
||||
---
|
||||
|
||||
## 🧩 二、系统总体结构（System Decomposition）
|
||||
|
||||
小鹏系统采用“**双域四层**”结构：
|
||||
|
||||
```
|
||||
|
||||
Cloud System (云端)
|
||||
├─ 数据采集与管道层
|
||||
├─ 数据湖与特征仓库层
|
||||
├─ AI训练与仿真层
|
||||
└─ OTA与运维服务层
|
||||
|
||||
Vehicle System (车端)
|
||||
├─ 感知与决策层
|
||||
├─ 通信中间件层
|
||||
├─ 操作系统与座舱层
|
||||
└─ 硬件抽象与控制层
|
||||
|
||||
````
|
||||
|
||||
---
|
||||
|
||||
## 🚗 三、车端系统架构（On-Vehicle Architecture）
|
||||
|
||||
### 分层结构
|
||||
```mermaid
|
||||
graph TD
|
||||
A[应用层: 自动驾驶 / 座舱AI / 车控逻辑]
|
||||
B[服务层: SOA 服务管理 / 语音 / 导航]
|
||||
C[通信层: DDS / RTI Connext / IPC]
|
||||
D[系统层: XOS / Linux / QNX]
|
||||
E[硬件抽象层: ECU / Sensors / Actuators]
|
||||
A --> B --> C --> D --> E
|
||||
````
|
||||
|
||||
### 主要组成模块
|
||||
|
||||
|模块|功能说明|技术要点|
|
||||
|---|---|---|
|
||||
|**自动驾驶栈 (XPILOT / XNGP)**|感知、预测、规划、控制|XNet 感知模型 + Turing 芯片|
|
||||
|**车载操作系统 (XOS)**|座舱交互、语音助手、小P|Linux + QNX + 应用容器|
|
||||
|**通信中间件 (DDS)**|模块间消息分发与服务发现|RTI Connext Drive|
|
||||
|**E/E 电子架构**|中央计算 + Zonal Controller|与大众 CEA 架构协同|
|
||||
|**车控与诊断系统**|电机/制动/能量管理|CAN / LIN / Ethernet|
|
||||
|**安全机制**|功能安全 + 网络加密|HSM / PKI / TLS|
|
||||
|
||||
### 架构特征
|
||||
|
||||
- SOA化设计（Service-Oriented Architecture）
|
||||
|
||||
- 模块以服务形式存在，通过 DDS 异步通信
|
||||
|
||||
- 容器化运行环境，支持模块级 OTA
|
||||
|
||||
- 实时调度与安全隔离（QNX + Linux 双核架构）
|
||||
|
||||
|
||||
---
|
||||
|
||||
## ☁️ 四、云端系统架构（In-Cloud Architecture）
|
||||
|
||||
### 云端逻辑结构
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[Telemetry Ingestion 层]
|
||||
B[数据湖 / 特征仓库]
|
||||
C[AI 训练与仿真平台]
|
||||
D[模型注册 / MLOps 管理]
|
||||
E[OTA 分发与运维平台]
|
||||
A --> B --> C --> D --> E
|
||||
```
|
||||
|
||||
### 云端核心子系统
|
||||
|
||||
|模块|功能说明|技术栈 / 架构模式|
|
||||
|---|---|---|
|
||||
|**数据采集与接入层**|接收车端上报数据|MQTT / Kafka / Flink|
|
||||
|**数据湖与仓库层**|存储与管理全量数据|S3 / Hive / DeltaLake|
|
||||
|**AI 训练平台**|模型训练与优化|PyTorch / TensorFlow / Ray|
|
||||
|**仿真测试系统**|模拟驾驶场景验证算法|Carla / Unity / OpenSCENARIO|
|
||||
|**MLOps 管理平台**|模型版本与部署管理|MLflow / Kubeflow|
|
||||
|**OTA 系统**|OTA 打包与分发|微服务 + CDN + 签名验证|
|
||||
|**监控与运维**|实时监测与异常分析|Prometheus / Grafana / ELK|
|
||||
|
||||
### 架构特征
|
||||
|
||||
- 微服务化 + 事件驱动架构（EDA）
|
||||
|
||||
- 支持实时流处理与批量分析（Lambda Architecture）
|
||||
|
||||
- 模型与软件分层管理（解耦版本）
|
||||
|
||||
- 数据闭环支持持续学习（DataOps + MLOps）
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 🔗 五、云车交互与数据闭环（Cloud-Vehicle Interaction）
|
||||
|
||||
### 数据闭环流程
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A[车辆传感器] --> B[车端计算与决策]
|
||||
B --> C[Telemetry Agent 上报]
|
||||
C --> D[云端数据管道 Kafka/Flink]
|
||||
D --> E[数据湖 / 特征仓库]
|
||||
E --> F[AI 训练 / 仿真平台]
|
||||
F --> G[模型注册 / OTA系统]
|
||||
G --> H[OTA 分发]
|
||||
H --> I[车辆端接收更新]
|
||||
I --> B
|
||||
```
|
||||
|
||||
**说明：**
|
||||
|
||||
- 上行：车辆 → 云端 → 数据湖
|
||||
|
||||
- 下行：云端 → OTA → 车辆
|
||||
|
||||
- 闭环：通过反馈数据持续优化模型与策略
|
||||
|
||||
|
||||
---
|
||||
|
||||
## 🧠 六、系统架构视图（Architectural Views）
|
||||
|
||||
### 1️⃣ 逻辑视图（Logical View）
|
||||
|
||||
展示功能模块与交互关系：
|
||||
|
||||
```
|
||||
[自动驾驶] ─ [座舱系统] ─ [通信中间件]
|
||||
│ │
|
||||
└─────→ 云端数据平台 ←─────┘
|
||||
```
|
||||
|
||||
### 2️⃣ 物理视图（Physical View）
|
||||
|
||||
```
|
||||
车辆端：中央计算单元 + 区域控制器
|
||||
云 端：Kubernetes 集群 + GPU 训练集群
|
||||
通信通道：5G / MQTT / HTTPS / OTA
|
||||
```
|
||||
|
||||
### 3️⃣ 过程视图（Process View）
|
||||
|
||||
- 实时管线：传感器 → 感知 → 规划 → 控制
|
||||
|
||||
- 异步事件：消息总线 DDS
|
||||
|
||||
- 后台任务：日志上传、诊断上报、OTA更新
|
||||
|
||||
- 云端任务：数据清洗 → 模型训练 → 部署 → 下发
|
||||
|
||||
|
||||
---
|
||||
|
||||
## ⚙️ 七、非功能性需求（NFR Support）
|
||||
|
||||
|类别|架构应对方式|
|
||||
|---|---|
|
||||
|**性能**|中央计算 + DDS 实时通信|
|
||||
|**安全**|端到端加密 + OTA 签名验证|
|
||||
|**可靠性**|模块冗余 + 服务回退机制|
|
||||
|**可维护性**|模块化服务与标准化接口|
|
||||
|**可测试性**|仿真测试 + 数字孪生验证|
|
||||
|**可扩展性**|微服务 + K8s 弹性伸缩|
|
||||
|**合规性**|数据脱敏 + 日志审计|
|
||||
|
||||
---
|
||||
|
||||
## 🧭 八、架构演化路线（Architecture Evolution Roadmap）
|
||||
|
||||
|阶段|架构形态|关键演进|
|
||||
|---|---|---|
|
||||
|**V1 分域架构**|多ECU、功能分散|向域控制器集中|
|
||||
|**V2 域融合架构**|多域整合、服务化|引入DDS与SOA|
|
||||
|**V3 中央计算架构（当前）**|单一计算平台 + 容器化服务|实现统一调度与OTA|
|
||||
|**V4 智能体架构（目标）**|大模型驱动、自演化系统|云车协同AI原生架构|
|
||||
|
||||
---
|
||||
|
||||
## 🔍 九、系统分析要点（Analyst Summary）
|
||||
|
||||
|分析维度|关键结论|
|
||||
|---|---|
|
||||
|**系统类型**|分布式智能系统（Cyber-Physical + Cloud）|
|
||||
|**通信模型**|异步事件驱动 + 服务编排|
|
||||
|**核心驱动**|数据闭环与模型持续学习|
|
||||
|**解耦策略**|SOA / 微服务 / DDS 消息总线|
|
||||
|**安全架构**|PKI + OTA签名 + 可信执行环境|
|
||||
|**研发体系**|DevOps + MLOps + Digital Twin|
|
||||
|**关键特征**|数据驱动、AI原生、自演化|
|
||||
|
||||
---
|
||||
|
||||
## 🧩 十、总结（Summary）
|
||||
|
||||
> 小鹏汽车的系统架构是一种 **数据驱动 + 服务化 + AI原生** 的分布式智能体系。
|
||||
> 它的本质是通过云车数据闭环实现智能进化：
|
||||
|
||||
**软件定义汽车 = 数据流动 + 模型迭代 + OTA持续交付**
|
||||
|
||||
架构目标：
|
||||
|
||||
- 解耦与复用；
|
||||
|
||||
- 实时与可靠；
|
||||
|
||||
- 安全与演化。
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
# 虚拟数据中心总线测试环境_20240523
|
||||
|
||||
---
|
||||
|
||||
[TOC]
|
||||
|
||||
---
|
||||
|
||||
## 一、应用服务（zms、zmsm）
|
||||
|
||||
服务器IP：130.120.3.148
|
||||
|
||||
部署路径：`/opt/zms/`
|
||||
|
||||
配置文件：`/opt/zms/conf/application.conf`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/zms
|
||||
bash start.sh
|
||||
|
||||
#关闭命令
|
||||
cd /opt/zms
|
||||
bash killZms.sh
|
||||
```
|
||||
|
||||
|
||||
|
||||
服务器IP：10.100.100.152
|
||||
|
||||
部署路径：`/opt/apps/zmsm`
|
||||
|
||||
配置文件：`/opt/apps/zmsm/config/application-pro.yml`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
docker run -d -p 82:8080 --restart unless-stopped -v /opt/apps/zmsm:/opt/myapp --name zmsm gzzn/zmsm
|
||||
|
||||
#关闭命令
|
||||
docker stop zmsm
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 二、数据库
|
||||
|
||||
### MYSQL
|
||||
|
||||
服务器IP：130.120.3.158
|
||||
|
||||
端口：3306
|
||||
|
||||
账号：zmsm
|
||||
|
||||
密码：123456
|
||||
|
||||
|
||||
|
||||
### Redis
|
||||
|
||||
服务器IP：10.100.100.172
|
||||
|
||||
端口：6379
|
||||
|
||||
密码：Gzzn..2024
|
||||
|
||||
```bash
|
||||
systemctl start redis
|
||||
systemctl stop redis
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 三、支撑组件（Kafka、Zookeeper）
|
||||
|
||||
### Kafka
|
||||
|
||||
服务器IP：130.120.3.133、130.120.3.134、130.120.3.135
|
||||
|
||||
端口：9092
|
||||
|
||||
部署路径：`/opt/kafka_2.12-1.0.0`
|
||||
|
||||
配置文件：`/opt/kafka_2.12-1.0.0/config/server.properties`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
nohup /opt/kafka_2.12-1.0.0/bin/kafka-server-start.sh /opt/kafka_2.12-1.0.0/config/server.properties > /dev/null 2>&1 &
|
||||
|
||||
#关闭命令
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
ps -ef|grep kafka|grep -v grep|awk '{print $2}'
|
||||
kill #上一步获取的PID
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
#start
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
bash start
|
||||
```
|
||||
|
||||
```bash
|
||||
#stop
|
||||
cd /opt/kafka_2.12-1.0.0/
|
||||
bash stop
|
||||
```
|
||||
|
||||
### Zookeeper
|
||||
|
||||
服务器IP：130.120.3.133、130.120.3.134、130.120.3.135
|
||||
|
||||
端口：2181
|
||||
|
||||
部署路径：`/opt/apache-zookeeper-3.9.2-bin`
|
||||
|
||||
配置文件：`/opt/apache-zookeeper-3.9.2-bin/conf/zoo.cfg`
|
||||
|
||||
```shell
|
||||
#启动命令
|
||||
cd /opt/apache-zookeeper-3.9.2-bin/bin
|
||||
bash zkServer.sh start
|
||||
|
||||
#关闭命令
|
||||
cd /opt/apache-zookeeper-3.9.2-bin/bin
|
||||
bash zkServer.sh stop
|
||||
```
|
||||
|
||||
Executable
+55
@@ -0,0 +1,55 @@
|
||||
|
||||
motion pro
|
||||
|
||||
59.41.9.12
|
||||
账号 baiweijie
|
||||
密码 Gzzn@202409
|
||||
|
||||
todesk: 393588704
|
||||
密码 b4fyvit4
|
||||
|
||||
堡垒机：
|
||||
https://10.208.36.250/login
|
||||
ssh 10.208.36.250:60022
|
||||
|
||||
账号 zwzx_xnsj
|
||||
密码 Gzzn@202409
|
||||
|
||||
|
||||
------
|
||||
ToDesk:
|
||||
设备代码:
|
||||
```
|
||||
806 786 342
|
||||
```
|
||||
|
||||
临时密码:
|
||||
```
|
||||
tt8hiz34
|
||||
```
|
||||
|
||||
向日葵：
|
||||
115 120 019 9
|
||||
```
|
||||
8y7g0e
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
84, 122,123,125,127
|
||||
:
|
||||
suops
|
||||
|
||||
```
|
||||
&7DTxtgl
|
||||
```
|
||||
|
||||
|
||||
104, 222:
|
||||
root
|
||||
```
|
||||
Gzzn@202409
|
||||
```
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,5 @@
|
||||
|
||||
proxysql --version
|
||||
ProxySQL version 1.4.12-9-g216b872, codename Truls
|
||||
|
||||
|
||||
Executable
+1059
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,137 @@
|
||||
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
## **Updates to this file are now at https://github.com/giovtorres/kvm-install-vm.**
|
||||
## **This updated version has more options and less hardcoded variables.**
|
||||
|
||||
# Take one argument from the commandline: VM name
|
||||
if ! [ $# -eq 1 ]; then
|
||||
echo "Usage: $0 <node-name>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if domain already exists
|
||||
virsh dominfo $1 > /dev/null 2>&1
|
||||
if [ "$?" -eq 0 ]; then
|
||||
echo -n "[WARNING] $1 already exists. "
|
||||
read -p "Do you want to overwrite $1 (y/[N])? " -r
|
||||
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
||||
echo ""
|
||||
virsh destroy $1 > /dev/null
|
||||
virsh undefine $1 > /dev/null
|
||||
else
|
||||
echo -e "\nNot overwriting $1. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Directory to store images
|
||||
DIR=~/virt/images
|
||||
|
||||
# Location of cloud image
|
||||
IMAGE=$DIR/CentOS-7-x86_64-GenericCloud.qcow2
|
||||
|
||||
# Amount of RAM in MB
|
||||
MEM=768
|
||||
|
||||
# Number of virtual CPUs
|
||||
CPUS=1
|
||||
|
||||
# Cloud init files
|
||||
USER_DATA=user-data
|
||||
META_DATA=meta-data
|
||||
CI_ISO=$1-cidata.iso
|
||||
DISK=$1.qcow2
|
||||
|
||||
# Bridge for VMs (default on Fedora is virbr0)
|
||||
BRIDGE=virbr0
|
||||
|
||||
# Start clean
|
||||
rm -rf $DIR/$1
|
||||
mkdir -p $DIR/$1
|
||||
|
||||
pushd $DIR/$1 > /dev/null
|
||||
|
||||
# Create log file
|
||||
touch $1.log
|
||||
|
||||
echo "$(date -R) Destroying the $1 domain (if it exists)..."
|
||||
|
||||
# Remove domain with the same name
|
||||
virsh destroy $1 >> $1.log 2>&1
|
||||
virsh undefine $1 >> $1.log 2>&1
|
||||
|
||||
# cloud-init config: set hostname, remove cloud-init package,
|
||||
# and add ssh-key
|
||||
cat > $USER_DATA << _EOF_
|
||||
#cloud-config
|
||||
|
||||
# Hostname management
|
||||
preserve_hostname: False
|
||||
hostname: $1
|
||||
fqdn: $1.example.local
|
||||
|
||||
# Remove cloud-init when finished with it
|
||||
runcmd:
|
||||
- [ yum, -y, remove, cloud-init ]
|
||||
|
||||
# Configure where output will go
|
||||
output:
|
||||
all: ">> /var/log/cloud-init.log"
|
||||
|
||||
# configure interaction with ssh server
|
||||
ssh_svcname: ssh
|
||||
ssh_deletekeys: True
|
||||
ssh_genkeytypes: ['rsa', 'ecdsa']
|
||||
|
||||
# Install my public ssh key to the first user-defined user configured
|
||||
# in cloud.cfg in the template (which is centos for CentOS cloud images)
|
||||
ssh_authorized_keys:
|
||||
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBil2QzORhDcnKiVVNpO5daOSYVp8nshcIc7aTEkdlqCRir2Oni8BEStK7x7bvh0jrp9KptlHPeos87fQs//VXEb1FEprL2c6fPWmVdtjmYw3yzSkaFKMksL7FdUoEiwF6t8pQAg2mU0Qj9emSHBKg5ttdGqNoSvXc92k7iOzgauda7jdNak+Dx9dPhR3FJwHMcZSlQHO4cweZcK63bZitxlFkJ/FJdry/TBirDhRcXslOJ3ECU2xiyRXJVPs3VNLjMdOTTAoMmZj+GraUBbQ9VIqe683xe02sM83th5hj2C4gW3qXUoFkNLfKAMRxXLRMEwI3ABFB/AAUhACxyTJp giovanni@throwaway
|
||||
_EOF_
|
||||
|
||||
echo "instance-id: $1; local-hostname: $1" > $META_DATA
|
||||
|
||||
echo "$(date -R) Copying template image..."
|
||||
cp $IMAGE $DISK
|
||||
|
||||
# Create CD-ROM ISO with cloud-init config
|
||||
echo "$(date -R) Generating ISO for cloud-init..."
|
||||
genisoimage -output $CI_ISO -volid cidata -joliet -r $USER_DATA $META_DATA &>> $1.log
|
||||
|
||||
echo "$(date -R) Installing the domain and adjusting the configuration..."
|
||||
echo "[INFO] Installing with the following parameters:"
|
||||
echo "virt-install --import --name $1 --ram $MEM --vcpus $CPUS --disk
|
||||
$DISK,format=qcow2,bus=virtio --disk $CI_ISO,device=cdrom --network
|
||||
bridge=virbr0,model=virtio --os-type=linux --os-variant=rhel7 --noautoconsole"
|
||||
|
||||
virt-install --import --name $1 --ram $MEM --vcpus $CPUS --disk \
|
||||
$DISK,format=qcow2,bus=virtio --disk $CI_ISO,device=cdrom --network \
|
||||
bridge=virbr0,model=virtio --os-type=linux --os-variant=rhel7 --noautoconsole
|
||||
|
||||
MAC=$(virsh dumpxml $1 | awk -F\' '/mac address/ {print $2}')
|
||||
while true
|
||||
do
|
||||
IP=$(grep -B1 $MAC /var/lib/libvirt/dnsmasq/$BRIDGE.status | head \
|
||||
-n 1 | awk '{print $2}' | sed -e s/\"//g -e s/,//)
|
||||
if [ "$IP" = "" ]
|
||||
then
|
||||
sleep 1
|
||||
else
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# Eject cdrom
|
||||
echo "$(date -R) Cleaning up cloud-init..."
|
||||
virsh change-media $1 hda --eject --config >> $1.log
|
||||
|
||||
# Remove the unnecessary cloud init files
|
||||
rm $USER_DATA $CI_ISO
|
||||
|
||||
echo "$(date -R) DONE. SSH to $1 using $IP with username 'centos'."
|
||||
|
||||
popd > /dev/null
|
||||
```
|
||||
@@ -0,0 +1,190 @@
|
||||
# 番禺政务中心配置信息
|
||||
|
||||
## 服务器登录账号密码
|
||||
|
||||
> 172.25.242.178
|
||||
>
|
||||
> Account：root
|
||||
>
|
||||
> Password：1qaz@WSX3edc$RFV$#@!
|
||||
|
||||
## 数据库信息
|
||||
|
||||
## 数据库账号密码
|
||||
172.25.242.178 root/Pyczc@Admin2023
|
||||
172.25.242.61 root/Gzzn@2023
|
||||
|
||||
|
||||
> 数据库 172.25.242.178
|
||||
>
|
||||
> 端口：3306
|
||||
>
|
||||
> 本地DBA用户
|
||||
>
|
||||
> 用户：root
|
||||
>
|
||||
> 密码：gZZn@2022.
|
||||
> Gzzn@202406
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：mbp
|
||||
>
|
||||
> 密码：mBp@2022.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：pypc
|
||||
>
|
||||
> 密码：PyPc@20220722.
|
||||
>
|
||||
> 业务用户
|
||||
>
|
||||
> 用户：tduck
|
||||
>
|
||||
> 密码：Tduck@20220725/
|
||||
>
|
||||
> +--------------------+
|
||||
> | Database |
|
||||
> +--------------------+
|
||||
> | information_schema |
|
||||
> | mbp |
|
||||
> | mysql |
|
||||
> | performance_schema |
|
||||
> | pypc |
|
||||
> | sys |
|
||||
> | tduck_pre |
|
||||
> | vincity |
|
||||
> +--------------------+
|
||||
|
||||
|
||||
|
||||
## Redis信息
|
||||
|
||||
>数据库 172.25.242.178
|
||||
>
|
||||
>端口：6879
|
||||
>
|
||||
>启动命令：redis-server /opt/redis/redis-7.0.4/redis.conf
|
||||
>
|
||||
>关闭命令：redis-cli -p 6879 --> auth 密码 --> shutdown
|
||||
>
|
||||
>客户端登录：redis-cli -p 6879
|
||||
>
|
||||
>密码：gZzn.2022A
|
||||
|
||||
|
||||
|
||||
## Naocs信息
|
||||
|
||||
> 172.25.242.178:8848/nacos
|
||||
>
|
||||
> 部署位置：/opt/nacos
|
||||
>
|
||||
> JDK位置：/opt/jdk1.8.0_311
|
||||
>
|
||||
> 启动命令：./startup.sh -m standalone
|
||||
>
|
||||
> 关闭命令：./shutdown.sh
|
||||
>
|
||||
> 端口：8848
|
||||
>
|
||||
> 用户名：nacos
|
||||
>
|
||||
> 密码：nacos
|
||||
>
|
||||
> H@rJ4cwnz5bydxyT
|
||||
>
|
||||
> 请配置时及时更改密码为强口令！！！！
|
||||
|
||||
## ES信息
|
||||
|
||||
> 172.25.242.178:9200
|
||||
>
|
||||
> 部署位置：/opt/soft/es
|
||||
>
|
||||
> JDK位置：es内置jdk
|
||||
>
|
||||
> 启动命令：./elasticsearch -d （启动时需要切换elastic用户，密码：Gzzn@20220725/）
|
||||
>
|
||||
> 端口：9200
|
||||
>
|
||||
> 账号：elastic
|
||||
>
|
||||
> 启动时自动生成的默认密码：7qOBYCqDrx_q3Ib*Vyb=
|
||||
|
||||
## nginx信息
|
||||
|
||||
> 172.25.242.178:80
|
||||
>
|
||||
> 部署位置：/usr/local/nginx
|
||||
>
|
||||
> 配置文件位置：/usr/local/nginx/conf/nginx.conf
|
||||
>
|
||||
> 启动命令：./nginx
|
||||
|
||||
## minio信息
|
||||
|
||||
> 172.25.242.215:9000
|
||||
>
|
||||
> 部署位置：/data/minio
|
||||
>
|
||||
> 管理用户：minioadmin/lRFG4YWitlthJQ+
|
||||
>
|
||||
> 容器启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> docker run -p 9000:9000 -p 9090:9090 \
|
||||
> --net=host \
|
||||
> --name minio \
|
||||
> -d --restart=always \
|
||||
> -e "MINIO_ROOT_USER=minioadmin" \
|
||||
> -e "MINIO_ROOT_PASSWORD=lRFG4YWitlthJQ+" \
|
||||
> -v /data/minio/data:/data \
|
||||
> -v /data/minio/config:/root/.minio \
|
||||
> minio/minio server \
|
||||
> /data --console-address ":9090" -address ":9000"
|
||||
> ```
|
||||
>
|
||||
>
|
||||
|
||||
## mongo信息
|
||||
|
||||
> ip: 172.25.242.47
|
||||
>
|
||||
> 端口：27017
|
||||
>
|
||||
> 部署位置：/data/mongodb
|
||||
>
|
||||
> 管理用户：root
|
||||
>
|
||||
> 密码：root/Pyczc@Root2023
|
||||
>
|
||||
> 启动命令：
|
||||
>
|
||||
> ```sh
|
||||
> # 启动
|
||||
> service mongod start
|
||||
> # 停止
|
||||
> service mongod stop
|
||||
> # 重启
|
||||
> service mongod restart
|
||||
> ```
|
||||
>
|
||||
> 业务用户：data_quality
|
||||
>
|
||||
> 密码：Pyczc@data_quality2023
|
||||
|
||||
# 测试环境
|
||||
|
||||
## zookeeper
|
||||
|
||||
> ip :172.25.242.61
|
||||
>
|
||||
> 用户：zookeeper/Zook@admin2023
|
||||
>
|
||||
> post: 2181
|
||||
>
|
||||
> 部署位置：/opt/apache-zookeeper
|
||||
>
|
||||
> 数据位置：/data/zookeeper
|
||||
Reference in New Issue
Block a user