KingbaseES V8R6 集群运维案例 -- 禁止普通用户su到root

案例说明：

在集群管理中，会使用到root权限（如ip、aring命令等）,为安全需要，有的生产环境禁止普通用户su切换到root，本案例测试了禁止普通用户su切换到root对集群管理带来的影响。

集群节点信息：

 ID | Name    | Role    | Status    | Upstream | repmgrd | PID  | Paused? | Upstream last seen
----+---------+---------+-----------+----------+---------+------+---------+--------------------
 1  | node200 | primary | * running |          | running | 4459 | no      | n/a
 2  | node201 | standby |   running | node200  | running | 3106 | no      | 0 second(s) ago

集群状态信息：

[kingbase@node1 bin]$ ./repmgr cluster show
ID | Name    | Role    | Status    | Upstream | Location | Priority | Timeline | Connection string
----+---------+---------+-----------+----------+----------+----------+----------+---------------------------------------------------------------------------------------------------------------------------------------------------
1  | node200 | primary | * running |          | default  | 100      | 17       | host=192.168.8.200 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3
2  | node201 | standby |   running | node200  | default  | 100      | 17       | host=192.168.8.201 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3

一、配置系统禁用su切换到root

[kingbase@node1 bin]$ cat /etc/pam.d/su |grep use_uid
#auth           sufficient      pam_wheel.so trust use_uid
auth            required        pam_wheel.so use_uid
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet

su用户切换测试：

[kingbase@node1 bin]$ su -
Password:
su: Permission denied

二、集群管理测试

1、集群停止测试

[kingbase@node1 bin]$ ./sys_monitor.sh stop
2022-12-05 11:37:53 Ready to stop all DB ...
.......
2022-12-05 11:38:07 Done.

#集群停止后，自动注释KINGBASECRON文件中的计划任务
[kingbase@node1 bin]$ cat /etc/cron.d/KINGBASECRON 

#*/1 * * * * kingbase . /etc/profile;/home/kingbase/cluster/R6C/R6HA/kingbase/bin/kbha -A daemon -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf

2、集群启动测试

[kingbase@node1 bin]$ ./sys_monitor.sh start
2022-12-05 11:38:43 Ready to start all DB ...
......

2022-12-05 11:39:19 repmgrd on "[192.168.8.200]" start success.
 ID | Name    | Role    | Status    | Upstream | repmgrd | PID  | Paused? | Upstream last seen
----+---------+---------+-----------+----------+---------+------+---------+--------------------
 1  | node200 | primary | * running |          | running | 4459 | no      | n/a
 2  | node201 | standby |   running | node200  | running | 3106 | no      | 0 second(s) ago
[2022-12-05 11:39:34] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6C/R6HA/kingbase/log/kbha.log"

[2022-12-05 11:39:27] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6C/R6HA/kingbase/log/kbha.log"

2022-12-05 11:39:29 Done.

#集群启动后，KINGBASECRON计划任务被启动
[kingbase@node1 bin]$ cat /etc/cron.d/KINGBASECRON 

*/1 * * * * kingbase . /etc/profile;/home/kingbase/cluster/R6C/R6HA/kingbase/bin/kbha -A daemon -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf

3、主备switchover切换测试

---如下所示，主备switchover可以正常切换。

[kingbase@node2 bin]$ ./repmgr standby switchover -h 192.168.8.200 -U esrep -d esrep
WARNING: following problems with command line parameters detected:
  database connection parameters not required when executing UNKNOWN ACTION
NOTICE: executing switchover on node "node201" (ID: 2)
.......
INFO: unpause node "node200" (ID 1) successfully
INFO: unpausing repmgrd on node "node201" (ID 2)
INFO: unpause node "node201" (ID 2) successfully
NOTICE: STANDBY SWITCHOVER has completed successfully

[kingbase@node2 bin]$ ./repmgr cluster show
 ID | Name    | Role    | Status    | Upstream | Location | Priority | Timeline | Connection string
----+---------+---------+-----------+----------+----------+----------+----------+---------------------------------------------------------------------------------------------------------------------------------------------------
 1  | node200 | standby |   running | node201  | default  | 100      | 17       | host=192.168.8.200 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3
 2  | node201 | primary | * running |          | default  | 100      | 18       | host=192.168.8.201 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3

4、主备failover切换测试

----如下所示，主备failover切换成功。

[kingbase@node2 bin]$ ./repmgr cluster show
 ID | Name    | Role    | Status    | Upstream | Location | Priority | Timeline | Connection string
----+---------+---------+-----------+----------+----------+----------+----------+---------------------------------------------------------------------------------------------------------------------------------------------------
 1  | node200 | standby |   running | node201  | default  | 100      | 17       | host=192.168.8.200 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3
 2  | node201 | primary | * running |          | default  | 100      | 18       | host=192.168.8.201 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3

[kingbase@node2 bin]$ ./sys_ctl stop -D ../data
waiting for server to shut down...... done
server stopped

 [kingbase@node2 bin]$ ./repmgr cluster show
 ID | Name    | Role    | Status    | Upstream | Location | Priority | Timeline | Connection string
----+---------+---------+-----------+----------+----------+----------+----------+-----------------------------------------------------------------------------------------------------------------------------------------------------
 1  | node200 | primary | * running |          | default  | 100      | 19       | host=192.168.8.200 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=10 keepalives_idle=10 keepalives_interval=10 keepalives_count=3
 2  | node201 | standby |   running | node200  | default  | 100      | 19       | host=192.168.8.201 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=10 keepalives_idle=10 keepalives_interval=10 keepalives_count=3

5、repmgrd进程管理

---如下所示，在节点repmgrd进程异常退出时，通过KINGBASECRON中计划任务，被kbha进程自动启动 。

#查看节点repmgr进程
[kingbase@node2 sys_log]$ ps -ef |grep repmgr
kingbase  3106     1  0 11:39 ?        00:00:59 /home/kingbase/cluster/R6C/R6HA/kingbase/bin/repmgrd -d -v -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf
kingbase  3610     1  0 11:39 ?        00:00:16 /home/kingbase/cluster/R6C/R6HA/kingbase/bin/kbha -A daemon -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf

#模拟repmgr进程异常退出
[kingbase@node2 sys_log]$ kill -9 3106  3610

#repmgr进程被启动
[kingbase@node2 sys_log]$ ps -ef |grep repmgr
kingbase 14254     1  0 14:28 ?        00:00:00 /home/kingbase/cluster/R6C/R6HA/kingbase/bin/kbha -A daemon -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf
kingbase 14878     1  0 14:28 ?        00:00:00 /home/kingbase/cluster/R6C/R6HA/kingbase/bin/repmgrd -d -v -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf

6、物理备份测试

---如下所示 ，在主库执行sys_backup.sh init的备份初始化成功。

[kingbase@node1 bin]$ ./sys_backup.sh init
# generate single sys_rman.conf...DONE
# update single archive_command with sys_rman.archive-push...DONE
# create stanza and check...(maybe 60+ seconds)
# create stanza and check...DONE
# initial first full backup...(maybe several minutes)
# initial first full backup...DONE
# Initial sys_rman OK.
'sys_backup.sh start' should be executed when need back-rest feature.

#创建物理备份计划任务
[kingbase@node1 bin]$ ./sys_backup.sh start
Enable some sys_rman in crontab-daemon
Set full-backup in 7 days
Set incr-backup in 1 days
0 2 */7 * * kingbase /home/kingbase/cluster/R6C/R6HA/kingbase/bin/sys_rman --config=/home/kingbase/kbbr6_repo/sys_rman.conf --stanza=kingbase --archive-copy --type=full backup >> /home/kingbase/cluster/R6C/R6HA/kingbase/log/sys_rman_backup_full.log 2>&1
0 4 */1 * * kingbase /home/kingbase/cluster/R6C/R6HA/kingbase/bin/sys_rman --config=/home/kingbase/kbbr6_repo/sys_rman.conf --stanza=kingbase --archive-copy --type=incr backup >> /home/kingbase/cluster/R6C/R6HA/kingbase/log/sys_rman_backup_incr.log 2>&1

#查看计划任务
[kingbase@node1 bin]$ cat /etc/cron.d/KINGBASECRON 

*/1 * * * * kingbase . /etc/profile;/home/kingbase/cluster/R6C/R6HA/kingbase/bin/kbha -A daemon -f /home/kingbase/cluster/R6C/R6HA/kingbase/bin/../etc/repmgr.conf
0 2 */7 * * kingbase /home/kingbase/cluster/R6C/R6HA/kingbase/bin/sys_rman --config=/home/kingbase/kbbr6_repo/sys_rman.conf --stanza=kingbase --archive-copy --type=full backup >> /home/kingbase/cluster/R6C/R6HA/kingbase/log/sys_rman_backup_full.log 2>&1
0 4 */1 * * kingbase /home/kingbase/cluster/R6C/R6HA/kingbase/bin/sys_rman --config=/home/kingbase/kbbr6_repo/sys_rman.conf --stanza=kingbase --archive-copy --type=incr backup >> /home/kingbase/cluster/R6C/R6HA/kingbase/log/sys_rman_backup_incr.log 2>&1

测试计划任务自动备份：

自动备份完成 ：

[kingbase@node1 bin]$ /home/kingbase/cluster/R6C/R6HA/kingbase/bin/sys_rman --config=/home/kingbase/kbbr6_repo/sys_rman.conf --stanza=kingbase info
stanza: kingbase
    status: ok
    cipher: none

    db (current)
        wal archive min/max (V008R006C005B0023-1): 000000110000000200000032/000000130000000200000038

        full backup: 20221205-113404F
            timestamp start/stop: 2022-12-05 11:34:04 / 2022-12-05 11:35:58
            wal start/stop: 000000110000000200000033 / 000000110000000200000033
            database size: 710.9MB, backup size: 710.9MB
            repository size: 54.9MB, repository backup size: 54.9MB

        full backup: 20221205-144102F
            timestamp start/stop: 2022-12-05 14:41:02 / 2022-12-05 14:42:38
            wal start/stop: 000000130000000200000038 / 000000130000000200000038
            database size: 807MB, backup size: 807MB
            repository size: 61MB, repository backup size: 61MB

三、总结

通过以上对集群管理的测试可知，系统禁用普通用户su切换到root用户，集群日常管理不受影响。集群管理需要用到root用户，但是通过ssh远程执行的，而ssh配置在集群时就配置好，在集群管理时不需要用到su权限。