KingbaseES V8R6集群维护案例之--修改securecmdd工具服务端口

案例说明：

在一些生产环境，为了系统安全，不支持ssh互信，或限制root用户使用ssh登录，KingbaseES V8R6可以使用securecmdd工具支持主机之间的通讯。securecmdd工具默认使用的是8890服务端口，有的生产环境可能需要修改此端口号，此案例讲述了如何在集群部署前或部署后修改securecmdd工具的服务端口，以便用户参考。

适用版本：

KingbaseES V8R6

一、集群部署前修改

1、securecmdd部署需要修改的配置

=== securecmdd工具部署参考：https://www.cnblogs.com/kingbase/p/16336505.html ===

1）配置文件存储路径

[kingbase@node101 share]$ pwd
/home/kingbase/cluster/securecmdd/share

2）相关的配置文件

[kingbase@node101 share]$ cat securecmd_config |grep -i port
Port 8890
[kingbase@node101 share]$ cat securecmdd_config |grep -i port
Port 8890
[kingbase@node101 share]$ cat sys_HAscmdd.conf |grep -i port
# the port of sys_securecmdd
scmd_port=8890
scmd_port=8890

Tips：

以上配置文件，在securecmdd部署前，在所有节点修改服务端口号即可。

2、部署集群修改

1）图形化部署集群时，可以直接在部署界面修改

2）脚本部署集群时修改

=需要修改部署配置文件install.conf 中scmd_port参数。=

[kingbase@node101 r6_install]$ cat install.conf |grep port
##                 3. db.zip package decompression is completed at the directory level such as lib, bin, share, there can not be one more layer of directories in the middle, the directory like "kingbase/bin" can not be supported.
## zip、tar and tar.gz package can be supported.
db_port="54321"                  # the port of database, defaults is 54321
ssh_port="22"                    # the port of ssh, default is 22
scmd_port="8890"                 # the port of sys_securecmdd, default is 8890

二、集群部署后修改securecmdd服务端口号

1、修改securecmdd配置文件（所有节点）

# 配置文件位置
root@node101 .kes]# pwd
/etc/.kes

# 配置文件信息
[root@node101 .kes]# ls -lh
total 8.0K
drwxr-xr-x 2 root root   6 Mar 29 14:14 empty
-rwxr-xr-x 1 root root 315 Apr  7 11:16 securecmd_config
-rwxr-xr-x 1 root root 620 Apr  7 11:16 securecmdd_config

# 本案例将8890端口修改为8899.

2、修改端口后重启securecmdd服务

# 重启服务前端口号
[root@node101 .kes]# netstat -an |grep 8890
tcp        0      0 0.0.0.0:8890            0.0.0.0:*               LISTEN

# 查看服务状态
[root@node101 .kes]# systemctl status securecmdd
● securecmdd.service - KingbaseES - sys_securecmdd daemon
   Loaded: loaded (/etc/systemd/system/securecmdd.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-06-16 14:33:24 CST; 6min ago
 Main PID: 410 (sys_securecmdd)
   CGroup: /system.slice/securecmdd.service
           └─410 sys_securecmdd: /home/kingbase/cluster/R6HA/kha/kingbase/bin/sys_securecmdd -f /etc/.kes/securecmdd_config [list...

Jun 16 14:33:24 node101 systemd[1]: Started KingbaseES - sys_securecmdd daemon.
Jun 16 14:33:24 node101 systemd[1]: Starting KingbaseES - sys_securecmdd daemon.

# 重启服务
[root@node101 .kes]# systemctl restart securecmdd

# 重启后服务端口号
[root@node101 .kes]# netstat -an|grep 889
tcp        0      0 0.0.0.0:8899            0.0.0.0:*               LISTEN
tcp6       0      0 :::8899                 :::*                    LISTEN

[root@node101 .kes]# systemctl status securecmdd
● securecmdd.service - KingbaseES - sys_securecmdd daemon
   Loaded: loaded (/etc/systemd/system/securecmdd.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-06-16 14:41:09 CST; 17s ago
 Main PID: 2668 (sys_securecmdd)
   CGroup: /system.slice/securecmdd.service
           └─2668 sys_securecmdd: /home/kingbase/cluster/R6HA/kha/kingbase/bin/sys_securecmdd -f /etc/.kes/securecmdd_config [lis...

Jun 16 14:41:09 node101 systemd[1]: Started KingbaseES - sys_securecmdd daemon.
Jun 16 14:41:09 node101 systemd[1]: Starting KingbaseS - sys_securecmdd daemon...

3、修改repmgr.conf配置文件

[kingbase@node102 etc]$ cat repmgr.conf |grep scmd
scmd_options='-q -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o ServerAliveInterval=2 -o ServerAliveCountMax=5 -p 8899'
use_scmd='on'

# use_cmd=‘on’，说明集群主机通讯使用了securecmdd工具，如果是‘off’，则使用ssh通讯。

4、重启集群

[kingbase@node101 bin]$ ./sys_monitor.sh restart
2022-06-16 14:47:51 Ready to stop all DB ...
.......
2022-06-16 14:48:28 repmgrd on "[192.168.1.102]" start success.
 ID | Name    | Role    | Status    | Upstream | repmgrd | PID   | Paused? | Upstream last seen
----+---------+---------+-----------+----------+---------+-------+---------+--------------------
 1  | node101 | primary | * running |          | running | 6834  | no      | n/a
 2  | node102 | standby |   running | node101  | running | 20437 | no      | 0 second(s) ago
[2022-06-16 14:48:32] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6HA/kha/kingbase/log/kbha.log"
[2022-06-16 14:48:32] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6HA/kha/kingbase/log/kbha.log"
2022-06-16 14:48:42 Done.

三、总结

在部署完成集群后，如果修改securecmdd工具端口号，会涉及到集群配置文件repmgr.conf中参数的修改，必须重启集群才能生效，所以，对于生产环境，修改需注意，尽量在部署前确定号服务端口号。