KingbaseES V8R6C5集群部署启动securecmdd服务配置案例

案例说明：

对于KingbaseES V8R6C5版本在部集群时，需要建立kingbase、root用户在节点间的ssh互信，如果在生产环境禁用root用户ssh登录，则通过ssh部署会失败；在图形化部署时可以借用securecmdd工具进行节点之间通讯；

数据库版本：

官方文档：

https://help.kingbase.com.cn/stage-api/profile/document/kes/v8r6/html/highly/highly-tools/cluster-use/cluster-use-7.html?highlight=securecmdd

配置SYS_SECURECMDD说明：

SYS_SECURECMDD是集群中自带的工具，集群监控、管理集群时通过SYS_SECURECMDD安全执行命令。SYS_SECURECMDD主要包含以下文件：

sys_securecmdd，服务端二进制，集群中每个节点都有sys_securecmdd进程运行，默认监听8890端口，接受sys_securecmd的连接并执行指定的命令

• sys_securecmd，客户端二进制，集群通过sys_securecmd发送指令给服务端并执行
• sys_HAscmdd.sh，管理sys_securecmdd的脚本，主要负责秘钥协商的初始化、sys_securecmdd进程高可用管理等
• sys_HAscmdd.conf，配置文件，sys_HAscmdd.sh读取此文件
• securecmdd_config，配置文件，sys_securecmdd读取此文件，初始化阶段由sys_HAscmdd.sh自动配置
• securecmd_config，配置文件，sys_securecmd读取此文件，初始化阶段由sys_HAscmdd.sh自动配置

脚本sys_HAscmdd.sh使用方法（都需要root权限执行）：

#初始化，主要初始化sys_securecmdd/sys_securecmd需要的配置文件和秘钥协商
sys_HAscmdd.sh init

#启动sys_securecmdd进程和进程高可用能力
#   start_method=systemd     将securecmdd.service服务文件拷贝到/etc/systemd/system目录下，并启动sys_securecmdd服务
#   start_method=crontab     在/etc/cron.d/KINGBASECRON中设置sys_securecmdd的定时任务
sys_HAscmdd.sh start

#查看sys_securecmdd进程状态
sys_HAscmdd.sh status

#关闭sys_securecmdd进程和进程高可用能力
sys_HAscmdd.sh stop

#卸载sys_securecmdd的配置文件和服务
sys_HAscmdd.sh uninstall

一、在节点上部署securecmdd工具（all_nodes）

1、查看数据库软件安装包（自带securecmdd工具）

[kingbase@node1 zip]$ pwd
/opt/Kingbase/ES/V8R6_054/ClientTools/guitools/DeployTools/zip

[kingbase@node1 zip]$ ls -lh
total 341M
-rw-rw-r--. 1 kingbase kingbase 338M Apr  7 16:18 db.zip
-rw-rw-r--. 1 kingbase kingbase 9.7K Apr  7 16:18 install.conf
-rw-rw-r--. 1 kingbase kingbase 2.1M Apr  7 16:18 securecmdd.zip
-rwxrwxr-x. 1 kingbase kingbase 4.0K Apr  7 16:18 trust_cluster.sh
-rwxrwxr-x. 1 kingbase kingbase 138K Apr  7 16:18 V8R6_cluster_install.sh

2、将securecmdd.zip拷贝到/home/kingbase/cluster下

[kingbase@node1 zip]$ cp securecmdd.zip /home/kingbase/cluster/
[kingbase@node1 cluster]$ unzip securecmdd.zip
[root@node2 ~]# cd /home/kingbase/cluster/securecmdd/share

[root@node2 bin]# ls -lh
total 2.0M
-rwxr-xr-x 1 kingbase kingbase  34K Apr  7 16:18 sys_HAscmdd.sh
-rwxr-xr-x 1 kingbase kingbase 856K Apr  7 16:18 sys_securecmd
-rwxr-xr-x 1 kingbase kingbase 938K Apr  7 16:18 sys_securecmdd
-rwxr-xr-x 1 kingbase kingbase 149K Apr  7 16:18 sys_secureftp

[root@node2 share]# ls -lh
total 24K
-rw------- 1 kingbase kingbase  381 May 23 10:26 accept_hosts
-rw------- 1 kingbase kingbase 1.7K May 23 10:26 key_file
-rw------- 1 kingbase kingbase  315 May 23 10:26 securecmd_config
-rw------- 1 kingbase kingbase  586 May 23 10:26 securecmdd_config
-rw-r--r-- 1 kingbase kingbase  275 May 23 10:26 securecmdd.service
-rw-r--r-- 1 kingbase kingbase  246 May 23 10:26 sys_HAscmdd.conf

二、执行securecmdd初始化

1、执行sys_HAscmdd.sh init

[root@node2 bin]# sh sys_HAscmdd.sh  init
successfully initialized the sys_securecmdd, please use "sys_HAscmdd.sh start" to start the sys_securecmdd

2、查看初始化生成的文件

systemctl管理资源配置文件：（用于systemctl管理）*

[root@node2 bin]# ls -lh /etc/systemd/system/securecmdd.service
-rw-r--r-- 1 root root 312 May 23 15:20 /etc/systemd/system/securecmdd.service

# 查看securecmdd.service
[root@node2 bin]# cat /etc/systemd/system/securecmdd.service
[Unit]
Description=KingbaseES - sys_securecmdd daemon
After=network.target

[Service]
Type=simple
ExecStart=/home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd_config
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=always
RestartSec=10s

[Install]
WantedBy=multi-user.target

查看认证配置文件：

[root@node2 bin]# ls -lh /etc/.kes/
total 8.0K
drwxr-xr-x 2 root root   6 May 23 11:36 empty
-rwxr-xr-x 1 root root 315 May 23 15:20 securecmd_config
-rwxr-xr-x 1 root root 603 May 23 15:20 securecmdd_config
You have new mail in /var/spool/mail/root
[root@node2 bin]# date
Mon May 23 15:21:36 CST 2022
[root@node2 bin]# ls -lh /root/.es
total 8.0K
-rw------- 1 root root  381 May 23 15:20 accept_hosts
-rw------- 1 root root 1.7K May 23 15:20 key_file
[root@node2 bin]# ls -lh /home/kingbase/.es
total 8.0K
-rw------- 1 kingbase kingbase  381 May 23 15:20 accept_hosts
-rw------- 1 kingbase kingbase 1.7K May 23 15:20 key_file

• 查看securecmdd服务配置文件：

[root@node2 .kes]# cat securecmdd_config
Port 8890
HostKey ~/.es/key_file
AuthorizedKeysFile      .es/accept_hosts
PidFile /var/run/sys_securecmdd.pid
AddressFamily any
LogLevel QUIET
PasswordAuthentication yes
IgnoreUserKnownHosts yes
ChallengeResponseAuthentication no
X11Forwarding no
Subsystem sftp /home/kingbase/cluster/securecmdd/bin/sys_secureftp
# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
MaxStartups 128:10:256
UsePAM yes

三、启动securecmdd服务

[root@node2 bin]# sh sys_HAscmdd.sh start
[root@node2 bin]# ps -ef |grep secure
root     30443     1  0 15:23 ?        00:00:00 sys_securecmdd: /home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd_config [listener] 0 of 128-256 startups
root     30719 28302  0 15:23 pts/3    00:00:00 grep --color=auto secure
You have new mail in /var/spool/mail/root
[root@node2 bin]# netstat -antlp |grep 8890
tcp        0      0 0.0.0.0:8890            0.0.0.0:*               LISTEN      30443/sys_securecmd
tcp6       0      0 :::8890                 :::*                    LISTEN      30443/sys_securecmd 

[root@node2 bin]# systemctl status securecmdd
● securecmdd.service - KingbaseES - sys_securecmdd daemon
   Loaded: loaded (/etc/systemd/system/securecmdd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-05-23 15:23:28 CST; 16min ago
 Main PID: 30443 (sys_securecmdd)
   CGroup: /system.slice/securecmdd.service
           └─30443 sys_securecmdd: /home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd...

May 23 15:23:28 node2 systemd[1]: Started KingbaseES - sys_securecmdd daemon.
May 23 15:23:28 node2 systemd[1]: Starting KingbaseES - sys_securecmdd daemon...

四、执行图形化集群部署

=在所有节点都启动securecmdd服务后，在图形化部署集群时，就可以选择以下方式添加节点。=