Mariadb on 七三的小站

Mariadb 二进制版安装与配置

Wed, 05 Mar 2025 00:00:00 +0800

一、准备工作

1.1. 下载 Mariadb

根据系统选择相应版本版本，然后下载解压。

下载地址：https://downloads.mariadb.org/

wget https://mirrors.xtom.com.hk/mariadb//mariadb-11.4.5/bintar-linux-systemd-x86_64/mariadb-11.4.5-linux-systemd-x86_64.tar.gz
sudo tar zxf mariadb-11.4.5-linux-systemd-x86_64.tar.gz -C /usr/local/src
sudo ln -s /usr/local/src/mariadb-11.4.5-linux-systemd-x86_64 /usr/local/mysql

1.2. 安装依赖

# On Ubuntu/Debian:
sudo apt -y install build-essential libaio-dev
sudo apt -y install libncurses5

# On Fedora/RHEL/CentOS:
yum -y install libaio-devel numactl-libs (centos)
dnf -y install ncurses-devel (centos8)
ln -s /usr/lib64/libncurses.so.6 /usr/lib64/libncurses.so.5
ln -s /usr/lib64/libtinfo.so.6 /usr/lib64/libtinfo.so.5

1.3. 新增用户和组

# On Ubuntu/Debian:
sudo addgroup --system --gid 36 mysql
sudo adduser \
    --system \
    --home /var/lib/mysql \
    --shell /bin/false \
    --uid 36 \
    --gecos 'MariaDB Server' \
    --gid 36 \
    --disabled-password \
    mysql

# On Fedora/RHEL/CentOS:
sudo groupadd --system mysql
sudo adduser \
   --system \
   --shell /bin/bash \
   --comment 'MariaDB server' \
   --gid mysql \
   --home-dir /var/lib/mysql \
   --create-home \
   mysql

1.4. 创建工作目录

# 日志目录
sudo mkdir /var/log/mariadb && \
sudo chown mysql:mysql /var/log/mariadb

# 安全目录
sudo mkdir /var/lib/mysql-files && \
sudo chown mysql:mysql /var/lib/mysql-files && \
sudo chmod 750 /var/lib/mysql-files

二、配置文件

2.1. 主配置文件

Configuring MariaDB with Option Files

sudo mkdir -p /etc/mysql/conf.d
sudo vim /etc/mysql/my.cnf

sudo sh -c "cat > /etc/mysql/my.cnf" <<EOF
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/tmp/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/mysql/conf.d/
EOF

2.2. 客户端配置文件

sudo vim /etc/mysql/conf.d/client.cnf

sudo sh -c "cat > /etc/mysql/conf.d/client.cnf" <<EOF
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

2.3. 服务端配置文件

sudo vim /etc/mysql/conf.d/server.cnf

sudo sh -c "cat > /etc/mysql/conf.d/server.cnf" <<EOF
#
# This groups are read by MariaDB server.
# Use it for options that only the server (but not clients)
#
[server]

#
# This group is read both by the MariaDB Server and MySQL Server.
#
[mysqld]

# Basic Settings
datadir=/var/lib/mysql
bind-address=0.0.0.0
pid-file=/var/lib/mysql/mariadb.pid

# Character Settings
character-set-server=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

# InnoDB Settings
# innodb_buffer_pool_size=6G

# Connection settings
# max_connections=500

#
# This group is only read by MariaDB servers, not by MySQL.
#
[mariadb]
server_id=1

# Error Log
log_error=/var/log/mariadb/error.log
aria_log_dir_path=/var/log/mariadb

# General Query Log
general_log=0
general_log_file=/var/log/mariadb/general_query.log

# Binary Log

log-bin=/var/log/mariadb/master-bin
log-bin-index=/var/log/mariadb/master-bin.index
binlog-format=mixed
#binlog-do-db=mydb
#binlog-ignore-db=test
expire-logs-days=3

# Slow Query Log
slow_query_log=1
slow_query_log_file=/var/log/mariadb/slow_query.log
long_query_time=5.0
log_queries_not_using_indexes=0

# MariaDB Audit Plugin
#https://mariadb.com/kb/en/mariadb-audit-plugin-options-and-system-variables
plugin-load=server_audit=server_audit.so
server_audit=FORCE_PLUS_PERMANENT
server_audit_events=CONNECT,QUERY,TABLE
server_audit_logging=ON
server_audit_file_rotate_size=20M
server_audit_file_rotations=10
server_audit_file_path=/var/log/mariadb/audit.log
EOF

三、安装启动

3.1. 初始化数据目录

cd /usr/local/mysql
sudo ./scripts/mariadb-install-db --user=mysql

3.2. 开机自启动

方法1： systemd

sudo cp support-files/systemd/mariadb.service /usr/lib/systemd/system/mariadb.service
sudo systemctl daemon-reload
sudo systemctl enable --now mariadb.service
sudo systemctl disable mariadb.service

方法2：不推荐

sudo cp support-files/mysql.server /etc/init.d/mysql
sudo chkconfig mysql on
sudo service mysql start

方法3：手动启动

export PATH=$PATH:/usr/local/mysql/bin/
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> ~/.bashrc
mysqld_safe --user=mysql &

三、设置 MariaDB

3.1. 初始化设置

MariaDB 10.4+ 以后，root 帐号认证机制已经变更，详见官网说明：

Authentication in MariaDB 10.4 — Understanding the Changes

mysql 帐号登录：

# root@localhost 和 mysql@localhost 均是系统自动创建的账号
sudo mysql #root
mysql #mysql

如果报错 sudo: mysql: command not found 请检查 sudo 配置是否开启了 secure_path

sudo visudo

# 注释以下内容
Defaults secure_path="......"

不想使用 unix_socke 方式登陆？设置 root 密码：

ALTER USER root@localhost IDENTIFIED VIA mysql_native_password USING PASSWORD("verysecret");

MariaDB 10.4 以前版本继续使用以下方法设置root密码：

/usr/local/mysql/bin/mysqladmin -u root -h 'hosts-name' password 'verysecret'
/usr/local/mysql/bin/mysql_secure_installation

3.2. 开启远程登录

sudo mysql
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'verysecret' WITH GRANT OPTION;
FLUSH PRIVILEGES;

3.3. 创建数据库、用户、授权

# 创建数据库
CREATE DATABASE mydb CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

# 创建用户
CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'mypasswd';

# 授权
GRANT ALL ON mydb.* TO 'myuser'@'localhost';

# 刷新生效
FLUSH PRIVILEGES;

3.4. 数据备份

导出为SQL文件

mysqldump -u root -p --opt [database name] > [database name].sql

迁移至另一台主机

mysqldump -u root -pPassword --all-databases | ssh user@new_host.host.com 'cat - | mysql -u root -pPassword'

加密sql文件

zip --encrypt dump.zip db.sql
unzip -P your-password dump.zip

导入SQL文件

mysql -u root -p newdatabase < /path/to/newdatabase.sql

3.5. 其他

错误修复

mysqlcheck --all-databases --check-upgrade --auto-repair
mysql_upgrade -uroot -p --force

官方文档：

Installing MariaDB Binary Tarballs

Server System Variables

Configuring MariaDB with Option Files

MariaDB 常用 SQL 语句

Thu, 07 Nov 2024 00:00:00 +0800

一、MariaDB 账户管理

1.1. 查询在线用户

SHOW processlist;
mysqladmin -u admin -p processlist

1.2. 查询全部用户

SELECT DISTINCT User,Host,Password,plugin FROM mysql.user;

1.3. 创建普通用户

CREATE USER 'wangyan'@'%' IDENTIFIED BY 'xxx';
GRANT ALL PRIVILEGES ON wangyan\_%.* TO 'wangyan'@'%' IDENTIFIED BY 'xxx';

1.4. 删除普通用户

DROP USER 'wangyan'@'%';
DELETE FROM mysql.user WHERE host = '%' AND user = 'wangyan';

1.5. 修改用户密码

SET PASSWORD=PASSWORD("xxx");
SET PASSWORD for "wangyan"@"%"=PASSWORD("xxx");
ALTER USER 'root'@'localhost' IDENTIFIED BY 'xxx';

1.6. ROOT密码找回

vim /etc/my.cnf.d/server.cnf
在Mysqld区域添加skip-grant-table语句，重启
sudo mysql -u root -p #免密码登陆数据库
UPDATE mysql.user SET password = password('123') WHERE user = 'root';
修改完成后将skip-grant-table属性去掉

二、MariaDB 权限管理

2.1. 查询所有权限

SHOW GRANTS FOR wangyan; #查询指定用户权限
SHOW GRANTS FOR 'wangyan'@'%';
FLUSH PRIVILEGES;

2.2. 收回用户授权

REVOKE ALL ON . FROM 'wangyan'@'%';
FLUSH PRIVILEGES;

2.3. 快速创建数据库和用户

DROP USER IF EXISTS 'wangyan'@'%';
DROP DATABASE IF EXISTS wangyan_gitea;
CREATE DATABASE wangyan_gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;

三、MariaDB 数据操作

3.1. 导入导出

mysqldump  -u wangyan -p databasename > databasename.sql
mysql -u wangyan -p databasename < /var/lib/mysql-files/databasename.sql

MariaDB 从 Yum 源安装与配置

Thu, 07 Nov 2024 00:00:00 +0800

一、安装 MariaDB

https://lug.ustc.edu.cn/wiki/mirrors/help/mariadb

1.1. 添加 MariaDB Yum 源

方法一：官方一键设置脚本（推荐）

curl -sS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | bash

方法二：命令行工具

使用 MariaDB Repository Configuration Tool 生成一份配置，保存为 /etc/yum.repos.d/mariadb.repo

cat >/etc/yum.repos.d/mariadb.repo<<'EOF'
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.4/centos8-amd64
module_hotfixes=1
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
EOF

然后执行以下命令替换源地址：

sudo sed -i 's#yum\.mariadb\.org#mirrors.ustc.edu.cn/mariadb/yum#' /etc/yum.repos.d/mariadb.repo
# 建议使用 HTTPS
sudo sed -i 's#http://mirrors\.ustc\.edu\.cn#https://mirrors.ustc.edu.cn#g' /etc/yum.repos.d/mariadb.repo

sudo dnf install MariaDB-server
sudo systemctl start mariadb

1.2. 安装 MariaDB

sudo yum install -y MariaDB-server MariaDB-client MariaDB-shared
sudo apt-get install mariadb-server mariadb-client MariaDB-shared

RHEL 8

yum module install mariadb -y
rpm -qi mariadb-server
systemctl enable --now mariadb

MariaDB MaxScale:（选做）

sudo yum install maxscale
sudo apt-get install maxscale

Percona XtraBackup:

sudo yum install percona-xtrabackup
sudo apt-get install percona-xtrabackup

cracklib_password_check:

https://mariadb.com/kb/en/cracklib-password-check-plugin/

sudo yum install MariaDB-cracklib-password-check

1.3. 启动 MariaDB

sudo systemctl start mariadb
sudo systemctl enable mariadb

二、设置 MariaDB

2.1. 初始化

mysql_secure_installation

初始密码为空，直接回车。
设置 root 密码
是否移除匿名用户
是否禁止 root 远程登录
是否删除 ’test’ 测试数据库

2.2. 解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

/etc/my.cnf

[client]
...
default-character-set = utf8mb4
...
[mysql]
...
default-character-set = utf8mb4

...
[mysqld]
...
character-set-server  = utf8mb4
character-set-filesystem = utf8mb4
collation-server      = utf8mb4_general_ci
...

2.3. 完整配置文件

vim /etc/my.cnf

cat >/etc/my.cnf<<'EOF'
#
# This group is read both by the client and the server
#
[client-server]
port=3306
socket=/dev/shm/mysql.sock

#
# include all files from the config directory
#
!includedir /etc/my.cnf.d
EOF

vim /etc/my.cnf.d/client.cnf

cat >/etc/my.cnf.d/client.cnf<<'EOF'
#
# These two groups are read by the client library
# Use it for options that affect all clients, but not the server
#
[client]
default-character-set = utf8mb4

#
# This group is not read by mysql client library,
#
[client-mariadb]
EOF

/etc/my.cnf.d/mariadb-server.cnf

#
# These groups are read by MariaDB server.
# Use it for options that only the server (but not clients) should see
#
# See the examples of server my.cnf files in /usr/share/mysql/
#

# this is read by the standalone daemon and embedded servers
[server]

# this is only for the mysqld standalone daemon
# Settings user and group are ignored when systemd is used.
# If you need to run mysqld under a different user or group,
# customize your systemd unit file for mysqld/mariadb according to the
# instructions in http://fedoraproject.org/wiki/Systemd
[mysqld]
datadir=/var/lib/mysql
socket=/var/lib/mysql/mysql.sock
log-error=/var/log/mariadb/mariadb.log
pid-file=/run/mariadb/mariadb.pid
character-set-server=utf8mb4
character-set-system=utf8mb4
character-set-filesystem=utf8mb4
collation-server=utf8mb4_general_ci

#
# * Galera-related settings
#
[galera]
# Mandatory settings
#wsrep_on=ON
#wsrep_provider=
#wsrep_cluster_address=
#binlog_format=row
#default_storage_engine=InnoDB
#innodb_autoinc_lock_mode=2
#
# Allow server to accept connections on all interfaces.
#
#bind-address=0.0.0.0
#
# Optional setting
#wsrep_slave_threads=1
#innodb_flush_log_at_trx_commit=0

# this is only for embedded server
[embedded]

# This group is only read by MariaDB servers, not by MySQL.
# If you use the same .cnf file for MySQL and MariaDB,
# you can put MariaDB-only options here
[mariadb]

# This group is only read by MariaDB-10.3 servers.
# If you use the same .cnf file for MariaDB of different versions,
# use this group for options that older servers don't understand
[mariadb-10.3]

/etc/my.cnf.d/mysql-clients.cnf

#
# These groups are read by MariaDB command-line tools
# Use it for options that affect only one utility
#

[mysql]
default-character-set=utf8mb4

[mysql_upgrade]

[mysqladmin]

[mysqlbinlog]

[mysqlcheck]

[mysqldump]

[mysqlimport]

[mysqlshow]

[mysqlslap]

/etc/my.cnf.d/auth_gssapi.cnf

[mariadb]
plugin-load-add=auth_gssapi.so

/etc/my.cnf.d/enable_encryption.preset

#
# !include this file into your my.cnf (or any of *.cnf files in /etc/my.cnf.d)
# and it will enable data at rest encryption. This is a simple way to
# ensure that everything that can be encrypted will be and your
# data will not leak unencrypted.
#
# DO NOT EDIT THIS FILE! On MariaDB upgrades it might be replaced with a
# newer version and your edits will be lost. Instead, add your edits
# to the .cnf file after the !include directive.
#
# NOTE that you also need to install an encryption plugin for the encryption
# to work. See https://mariadb.com/kb/en/mariadb/data-at-rest-encryption/#encryption-key-management
#
[mariadb]
aria-encrypt-tables
encrypt-binlog
encrypt-tmp-disk-tables
encrypt-tmp-files
loose-innodb-encrypt-log
loose-innodb-encrypt-tables

三、测试 MariaDB

mysqladmin -u root -p version

查看效果

mysql -uroot -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

参考配置文件：/usr/share/mysql/
数据文件夹：/var/lib/mysql/
执行文件：/usr/bin/mysql

参考文档：

Mariadb 启用 TLS 安全连接

Thu, 07 Nov 2024 00:00:00 +0800

一、概述

默认情况下，MariaDB 在服务器和客户端之间传输数据时不加密。当服务器和客户端运行在同一主机上保证处于安全的网络中时，这通常是可以接受的。然而，如果服务器和客户端位于不同的网络上或者位于高风险网络中，缺乏加密确实会带来安全问题，因为恶意行为者可能会窃听通过服务器和客户端之间的网络发送的流量。

为了减轻这种担忧，MariaDB 允许您使用传输层安全 (TLS) 协议对服务器和客户端之间传输的数据进行加密。 TLS 以前称为安全套接字层 (SSL)，但严格来说，SSL 协议是 TLS 的前身，该版本的协议现在被认为是不安全的。MariaDB 文档仍然使用 SSL 术语表述，是出于兼容性原因，但实际上，MariaDB 仅支持 TLS。

二、创建自签署证书

OpenSSL 自签署证书生成

生成服务器证书和客户端证书

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert
cd /tmp/gen-ssl-cert
make init

# 根证书
make gen-ca-key
make gen-ca-csr
make gen-ca-cert

# 中间证书
make gen-ica-key
make gen-ica-csr
make gen-ica-cert
make gen-ica-chain

# 服务器证书
make gen-server-key
make gen-server-csr
make gen-server-cert

# 客户端证书
make gen-client-key
make gen-client-csr
make gen-client-cert
make gen-client-pkcs12

准备证书文件

#准备目录
sudo mkdir /etc/my.cnf.d/certificates && \
sudo chmod 777 /etc/my.cnf.d/certificates && \
sudo chmod o+t /etc/my.cnf.d/certificates

# 服务端证书
cp /tmp/gen-ssl-cert/ica/certs/ica-chain-cert.crt /etc/my.cnf.d/certificates/ca.pem && \
cp /tmp/gen-ssl-cert/ica/certs/server-cert.crt /etc/my.cnf.d/certificates/server-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/server-key.pem /etc/my.cnf.d/certificates/server-key.pem

# 客户端证书
cp /tmp/gen-ssl-cert/ica/certs/client-cert.crt /etc/my.cnf.d/certificates/client-cert.pem && \
cp /tmp/gen-ssl-cert/ica/private/client-key.pem /etc/my.cnf.d/certificates/client-key.pem

# 修改权限
sudo chown mysql:mysql -R /etc/my.cnf.d/certificates/

二、MariaDB 服务端启用 TLS

ssl_cert 设置服务器的 X509 证书的路径。

ssl_key 设置服务器私钥的路径。

ssl_ca 设置证书颁发机构 (CA) 链的路径，用来验证服务器证书。

sudo sh -c "cat >/etc/my.cnf.d/enable_tls.cnf" <<EOF
[mariadb]
# Use Secure Connections to transfer data
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl_cert = /etc/my.cnf.d/certificates/server-cert.pem
ssl_key = /etc/my.cnf.d/certificates/server-key.pem
EOF

重启 & 检查

# 重启
sudo systemctl restart mariadb

# 动态刷新证书，可不用重启
FLUSH SSL

# 检查 TLS 是否已启用
SHOW GLOBAL VARIABLES LIKE 'have_ssl';
SHOW SESSION STATUS LIKE 'Ssl_cipher';

三、MariaDB 客户端启用 TLS

3.1. 什么是证书验证？

服务端证书验证

客户端根据证书中的某些属性检查服务器的主机名和 IP 地址来验证服务器证书。对于大多数客户端，默认情况下禁用服务器证书验证，并且仅在指定选项（例如ssl-verify-server-cert指定）时才启用它。
为了验证服务器的证书，客户端和实用程序将根据服务器的主机名和 IP 地址检查位于证书主题字段中的通用名称 (CN)属性。如果公用名 (CN)与其中任何一个匹配，则证书通过验证。
使用主题备用名称 (SAN) 也叫 subjectAltName 进行服务器证书验证。当使用支持使用 subjectAltName 字段进行服务器证书验证的客户端时，如果服务器证书包含任何 subjectAltName 字段，则还将根据服务器的主机名和 IP 地址检查这些字段。

客户端证书验证

服务器通过SUBJECT根据客户端证书中的主题属性检查客户端的已知信息来验证客户端证书。

3.2. 双向 TLS

双向 TLS 意味着客户端和服务器都提供私钥和 X509 证书，客户端和服务器都要验证彼此身份。

即客户端要对服务端证书进行验证。同时，服务端也要对客户端的证书进行验证。

（1）通过配置文件：

sudo sh -c "cat >>/etc/my.cnf.d/enable_tls.cnf" <<EOF

[client-mariadb]
ssl_cert = /etc/my.cnf.d/certificates/client-cert.pem
ssl_key = /etc/my.cnf.d/certificates/client-key.pem
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert
EOF

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-cert=/etc/my.cnf.d/certificates/client-cert.pem \
   --ssl-key=/etc/my.cnf.d/certificates/client-key.pem \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.3. 单向 TLS

当在没有客户端证书的情况下使用 TLS 时，称为单向 TLS，因为只有服务器提供私钥和 X509 证书，因此只能在一个方向进行身份验证。然而，双向加密仍然是可能的。服务器证书验证是指客户端验证证书是否属于服务器。

（1）通过配置文件：

[client-mariadb]
...
ssl_ca = /etc/my.cnf.d/certificates/ca.pem
ssl-verify-server-cert

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl-ca=/etc/my.cnf.d/certificates/ca.pem \
   --ssl-verify-server-cert

3.4. 双向 vs 单向

不管是双向还是单向，都要对服务器证书进行验证。区别在于单向没有指定客户端证书，因此，服务器不能验证客户端，但客户端都能验证服务端。

当然了，还有一种情况是，启用了单向 TLS，但是也不验证服务器证书

方法如下：

（1）通过配置文件：

[client-mariadb]
...
ssl

（2）通过命令行：

mariadb -u myuser -p -h myserver.mydomain.com \
   --ssl

四、强制使用 TLS

4.1. 特定用户帐户使用 TLS

您可以为特定用户帐户设置 TLS 相关的限制，例如，需要访问敏感数据的用户帐户。可以使用 CREATE USER、ALTER USER 或 GRANT 语句为用户帐户启用这些限制。

(1) 必须通过 TLS 连接

ALTER USER 'alice'@'%' 
   REQUIRE SSL;

(2) 必须通过 TLS 且是有效的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE X509;

(3) 必须通过 TLS 且是特定的客户端证书

ALTER USER 'alice'@'%' 
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland';

4.2 特定主机的特定帐户使用 TLS

CREATE USER 'alice'@'localhost' 
   REQUIRE NONE;

CREATE USER 'alice'@'%'
   REQUIRE SUBJECT '/CN=alice/O=My Dom, Inc./C=US/ST=Oregon/L=Portland'
   AND ISSUER '/C=FI/ST=Somewhere/L=City/ O=Some Company/CN=Peter Parker/emailAddress=p.parker@marvel.com'
   AND CIPHER 'ECDHE-ECDSA-AES256-SHA384';

# 初始化
git clone https://code.wangyan.cloud//wangyan/gen-ssl-cert.git /tmp/gen-ssl-cert

参考文档

Secure Connections Overview

Securing Connections for Client and Server

Connecting to MariaDB

Mariadb 日志审计与密码插件

Thu, 07 Nov 2024 00:00:00 +0800

一、启用日志

1.1. 错误日志

Error Log

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# Error Log
log_error=/var/log/mariadb/error.log
log_warnings=3

日志详细程度：0-9，默认值为 2

1.2. 通用查询日志

General Query Log

通用查询日志是从客户端接收到的每个 SQL 查询以及每个客户端连接和断开连接的日志。由于它是服务器收到的每个查询的记录，因此它可能会很快变大。

但是，如果您只想记录更改数据的查询，那么最好使用二进制日志。一个重要的区别是，二进制日志仅在服务器提交事务时记录查询，而通用查询日志在服务器接收到查询后立即记录查询。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
# General Query Log
general_log
log_output=FILE
general_log_file=/var/log/mariadb/queries.log
log_disabled_statements='slave,sp'

1.3. 二进制日志

Binary Log

二进制日志包含对数据库的所有更改（数据和结构）以及每个语句执行所需时间的记录。它由一组二进制日志文件和一个索引组成。

这意味着诸如 CREATE、ALTER、INSERT、UPDATE 和 DELETE 之类的语句将被记录，但对数据没有影响的语句（如 SELECT 和 SHOW ）将不会被记录。如果您想记录这些（以性能为代价），请使用通用查询日志。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
# Binary Log
# datadir/log-basename-bin
log_bin=ON
log_basename=mariadb
binlog_format=mixed
expire_logs_days=90
max_binlog_size=512M
max_binlog_total_size=5G
--binlog-ignore-db=database_name

1.4. 清除二进制日志

PURGE BINARY LOGS

# 列出所有日志
SHOW BINARY LOGS;

# 查看正在读取的文件
SHOW SLAVE STATUS;

# 删除所有二进制日志文件
RESET MASTER;

# 清除到指定位置
PURGE BINARY LOGS TO 'mariadb-bin.000057';

# 清除指定日期之前的
PURGE BINARY LOGS BEFORE '2019-04-02 22:46:26';

# 清除3天前的日志
#SELECT DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE MASTER LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);
PURGE BINARY LOGS BEFORE DATE_SUB(CURRENT_DATE, INTERVAL 3 DAY);

1.5. 慢查询日志

Slow Query Log

慢查询日志是执行时间较长的 SQL 查询的记录。

请注意，如果您的查询包含用户的密码，则慢查询日志也可能包含密码。因此，应该对其进行保护。

# /etc/my.cnf.d/mariadb-logs.cnf
[mariadb]
......
## Slow Query Log
log_output=FILE
slow_query_log
slow_query_log_file=/var/log/mariadb/slow.log
long_query_time=5.0
log_queries_not_using_indexes=ON
log_slow_admin_statements=ON
log_slow_rate_limit=10

long_query_time 定义慢速查询的时间
log_queries_not_using_indexes 记录不使用索引的查询
log_slow_admin_statements 记录缓慢的管理语句
log_slow_rate_limit 限制每10次慢查询才记录一次

二、轮换日志

2.1. Logrotate

2.1.1. 身份验证

使用 MariaDB 进行身份验证的最简单方法是将用户帐户配置 root@localhost 为使用 unix_socket 身份验证。

在MariaDB 10.4及更高版本不许设置

ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket;

2.1.2. 配置文件

/etc/logrotate.conf
/etc/logrotate.d/

$ sudo tee /etc/logrotate.d/mariadb <<EOF
/var/log/mysql/* {
        su mysql mysql
        missingok
        create 660 mysql mysql
        notifempty
        daily
        minsize 1M
        maxsize 100M
        rotate 30
        dateext
        dateformat .%Y-%m-%d-%H-%M-%S
        compress
        delaycompress
        sharedscripts 
        olddir archive/
        createolddir 770 mysql mysql # only use with logrotate >= 3.8.9
    postrotate
        # just if mysqld is really running
        if test -x /usr/local/mysql/bin/mysqladmin && \
           /usr/local/mysql/bin/mariadb-admin ping &>/dev/null
        then
           /usr/local/mysql/bin/mariadb-admin --local flush-error-log \
              flush-engine-log flush-general-log flush-slow-log
        fi
    endscript
}
EOF

重要参数：

daily：每天轮换每个日志文件一次。
minsize 1M：该指令将其配置为在日志轮转期间跳过小于 1 MB 的日志文件。
maxsize 100M：此指令将其配置为在日志文件增长超过 100 MB 时比每天更频繁地轮换日志文件。
rotate 30：该指令将其配置为保留每个日志文件的 30 个旧副本。
dateext：该指令将其配置为使用日期作为扩展名，而不仅仅是数字。
olddir archive/：该指令将其配置为将轮换日志文件存档在/var/log/mariadb/archive/.

2.2. Journal

systemd-journal 是一个改进型的日志管理服务。

常见用法如下：

# 查看文件情况
du -h --max-depth=1 /var/log

# 日志总体磁盘占用情况
journalctl --disk-usage

# 硬性指定日志总体体积，删除超出部分
journalctl --vacuum-size=10M

# 只保留近一周的日志
journalctl --vacuum-time=1w

# 直接删除 /var/log/journal/ 目录下的日志文件
rm -rf /var/log/journal/f9d400c5e1e8c3a8209e990d887d4ac1

三、启用审计

3.1. 查看当前开启审计

show variables like '%audit%';

如果没有，则先查看审计插件目录

SHOW VARIABLES LIKE 'plugin_dir';

3.2. 启用审计

具体参数详见官方文档：

MariaDB Audit Plugin Options and System Variables

# /etc/my.cnf.d/server-audit.cnf

[mariadb]
## MariaDB Audit Plugin
server_audit_events=CONNECT,QUERY,TABLE,QUERY_DDL,QUERY_DML,QUERY_DCL,QUERY_DML_NO_SELECT
server_audit_file_path=/var/log/mariadb/server_audit.log
server_audit_file_rotate_size=100M
server_audit_file_rotations=10
server_audit_logging=ON
server_audit_output_type=file
server_audit=FORCE_PLUS_PERMANENT

3.3. 重启

sudo systemctl restart mariadb

四、密码插件

Password Validation Plugin API

4.1. simple_password_check

Simple Password Check Plugin

# /etc/my.cnf.d/simple_password_check.cnf
[mariadb]
# Password Validation
plugin_load_add = simple_password_check.so
simple_password_check_digits=1
simple_password_check_letters_same_case=1
simple_password_check_minimal_length=8
simple_password_check_other_characters=1

4.2. cracklib_password_check

Cracklib Password Check Plugin

sudo yum install MariaDB-cracklib-password-check
sudo apt-get install mariadb-plugin-cracklib-password-check

安装

[mariadb]
...
plugin_load_add = cracklib_password_check

CentOS 从二进制版安装配置 Mariadb

Wed, 15 Mar 2017 00:00:00 +0800

一、MariaDB 准备

1.1 下载

根据系统选择相应版本版本，然后下载解压。

# CentOS 7
mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz 

# Debian 8+, Ubuntu 15.04+
mariadb-10.2.6-linux-systemd-x86_64.tar.gz

下载地址：https://downloads.mariadb.org/

1.2 安装依赖

yum -y install libaio-devel

1.3 配置文件

# 删除旧的
rm -f /etc/my.cnf

# 复制新的
cp /usr/local/mysql/support-files/my-medium.cnf /etc/my.cnf

二、安装 MariaDB

2.1 添加用户组

groupadd mysql
useradd -g mysql -M -s /sbin/nologin mysql

2.2 安装

tar -zxf mariadb-10.2.6-linux-glibc_214-x86_64.tar.gz
ln -s mariadb-10.2.6-linux-glibc_214-x86_64 mysql
cd mysql
./scripts/mysql_install_db --user=mysql
chown -R root .
chown -R mysql data

2.3 开机自启动

cp support-files/mysql.server /etc/init.d/mysql
chkconfig mysql on
service start mysql

手动启动

export PATH=$PATH:/usr/local/mysql/bin/
echo 'export PATH=$PATH:/usr/local/mysql/bin/' >> .bashrc
mysqld_safe --user=mysql &

三、设置 MariaDB

安全设置

/usr/local/mysql/bin/mysqladmin -u root password '新密码'
/usr/local/mysql/bin/mysqladmin -u root -h s1.dmfy.gov.cn password '新密码'
/usr/local/mysql/bin/mysql_secure_installation

开启远程登录

mysql -uroot -p
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '新密码' WITH GRANT OPTION;

解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

vim /etc/my.cnf

[client]
...
default-character-set=utf8
...
[mysql]
...
default-character-set=utf8
...
[mysqld]
...
character-set-server  = utf8
collation-server      = utf8_general_ci
character_set_server  = utf8
collation_server      = utf8_general_ci
...

查看效果

mysql -uroot -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

https://mariadb.com/kb/en/mariadb/installing-mariadb-binary-tarballs/

CentOS 从 Yum 源安装配置 Mariadb

Wed, 01 Mar 2017 00:00:00 +0800

一、安装 MariaDB

1.添加 MariaDB Yum 源

cat >/etc/yum.repos.d/MariaDB.repo<<'EOF'
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.1/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
EOF

2.安装 MariaDB

sudo yum install -y MariaDB-server MariaDB-client

3.启动 MariaDB

sudo systemctl start mariadb
sudo systemctl enable mariadb

二、设置 MariaDB

mysql_secure_installation

初始密码为空，直接回车。
设置 root 密码
是否移除匿名用户
是否禁止 root 远程登录
是否删除 ’test’ 测试数据库

三、测试 MariaDB

mysqladmin -u root -p version

四、解决 MariaDB 中文乱码

https://mariadb.com/kb/en/mariadb/setting-character-sets-and-collations/

[client]
...
default-character-set=utf8
...
[mysql]
...
default-character-set=utf8
...
[mysqld]
...
character-set-server  = utf8
collation-server      = utf8_general_ci
character_set_server  = utf8
collation_server      = utf8_general_ci
...

测试

mysql -u root -p
SHOW VARIABLES WHERE Variable_name LIKE 'character\_set\_%' OR Variable_name LIKE 'collation%';

参考文档：