KingbaseES V8R6C5集群部署启动securecmdd服务配置案例
案例说明：
对于KingbaseES V8R6C5版本在部集群时，需要建立kingbase、root用户在节点间的ssh互信，如果在生产环境禁用root用户ssh登录，则通过ssh部署会失败；在图形化部署时可以借用securecmdd工具进行节点之间通讯；
数据库版本：
官方文档：
https://help.kingbase.com.cn/stage-api/profile/document/kes/v8r6/html/highly/highly-tools/cluster-use/cluster-use-7.html?highlight=securecmdd
配置SYS_SECURECMDD说明：
SYS_SECURECMDD是集群中自带的工具，集群监控、管理集群时通过SYS_SECURECMDD安全执行命令。SYS_SECURECMDD主要包含以下文件：
sys_securecmdd，服务端二进制，集群中每个节点都有sys_securecmdd进程运行，默认监听8890端口，接受sys_securecmd的连接并执行指定的命令
- sys_securecmd，客户端二进制，集群通过sys_securecmd发送指令给服务端并执行
- sys_HAscmdd.sh，管理sys_securecmdd的脚本，主要负责秘钥协商的初始化、sys_securecmdd进程高可用管理等
- sys_HAscmdd.conf，配置文件，sys_HAscmdd.sh读取此文件
- securecmdd_config，配置文件，sys_securecmdd读取此文件，初始化阶段由sys_HAscmdd.sh自动配置
- securecmd_config，配置文件，sys_securecmd读取此文件，初始化阶段由sys_HAscmdd.sh自动配置
脚本sys_HAscmdd.sh使用方法（都需要root权限执行）：
#初始化，主要初始化sys_securecmdd/sys_securecmd需要的配置文件和秘钥协商
sys_HAscmdd.sh init
#启动sys_securecmdd进程和进程高可用能力
# start_method=systemd 将securecmdd.service服务文件拷贝到/etc/systemd/system目录下，并启动sys_securecmdd服务
# start_method=crontab 在/etc/cron.d/KINGBASECRON中设置sys_securecmdd的定时任务
sys_HAscmdd.sh start
#查看sys_securecmdd进程状态
sys_HAscmdd.sh status
#关闭sys_securecmdd进程和进程高可用能力
sys_HAscmdd.sh stop
#卸载sys_securecmdd的配置文件和服务
sys_HAscmdd.sh uninstall
一、在节点上部署securecmdd工具（all_nodes）
1、查看数据库软件安装包（自带securecmdd工具）
[kingbase@node1 zip]$ pwd
/opt/Kingbase/ES/V8R6_054/ClientTools/guitools/DeployTools/zip
[kingbase@node1 zip]$ ls -lh
total 341M
-rw-rw-r--. 1 kingbase kingbase 338M Apr 7 16:18 db.zip
-rw-rw-r--. 1 kingbase kingbase 9.7K Apr 7 16:18 install.conf
-rw-rw-r--. 1 kingbase kingbase 2.1M Apr 7 16:18 securecmdd.zip
-rwxrwxr-x. 1 kingbase kingbase 4.0K Apr 7 16:18 trust_cluster.sh
-rwxrwxr-x. 1 kingbase kingbase 138K Apr 7 16:18 V8R6_cluster_install.sh
2、将securecmdd.zip拷贝到/home/kingbase/cluster下
[kingbase@node1 zip]$ cp securecmdd.zip /home/kingbase/cluster/
[kingbase@node1 cluster]$ unzip securecmdd.zip
[root@node2 ~]# cd /home/kingbase/cluster/securecmdd/share
[root@node2 bin]# ls -lh
total 2.0M
-rwxr-xr-x 1 kingbase kingbase 34K Apr 7 16:18 sys_HAscmdd.sh
-rwxr-xr-x 1 kingbase kingbase 856K Apr 7 16:18 sys_securecmd
-rwxr-xr-x 1 kingbase kingbase 938K Apr 7 16:18 sys_securecmdd
-rwxr-xr-x 1 kingbase kingbase 149K Apr 7 16:18 sys_secureftp
[root@node2 share]# ls -lh
total 24K
-rw------- 1 kingbase kingbase 381 May 23 10:26 accept_hosts
-rw------- 1 kingbase kingbase 1.7K May 23 10:26 key_file
-rw------- 1 kingbase kingbase 315 May 23 10:26 securecmd_config
-rw------- 1 kingbase kingbase 586 May 23 10:26 securecmdd_config
-rw-r--r-- 1 kingbase kingbase 275 May 23 10:26 securecmdd.service
-rw-r--r-- 1 kingbase kingbase 246 May 23 10:26 sys_HAscmdd.conf
二、执行securecmdd初始化
1、执行sys_HAscmdd.sh init
[root@node2 bin]# sh sys_HAscmdd.sh init
successfully initialized the sys_securecmdd, please use "sys_HAscmdd.sh start" to start the sys_securecmdd
2、查看初始化生成的文件
systemctl管理资源配置文件：（用于systemctl管理）*
[root@node2 bin]# ls -lh /etc/systemd/system/securecmdd.service
-rw-r--r-- 1 root root 312 May 23 15:20 /etc/systemd/system/securecmdd.service
# 查看securecmdd.service
[root@node2 bin]# cat /etc/systemd/system/securecmdd.service
[Unit]
Description=KingbaseES - sys_securecmdd daemon
After=network.target
[Service]
Type=simple
ExecStart=/home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd_config
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=always
RestartSec=10s
[Install]
WantedBy=multi-user.target
查看认证配置文件：
[root@node2 bin]# ls -lh /etc/.kes/
total 8.0K
drwxr-xr-x 2 root root 6 May 23 11:36 empty
-rwxr-xr-x 1 root root 315 May 23 15:20 securecmd_config
-rwxr-xr-x 1 root root 603 May 23 15:20 securecmdd_config
You have new mail in /var/spool/mail/root
[root@node2 bin]# date
Mon May 23 15:21:36 CST 2022
[root@node2 bin]# ls -lh /root/.es
total 8.0K
-rw------- 1 root root 381 May 23 15:20 accept_hosts
-rw------- 1 root root 1.7K May 23 15:20 key_file
[root@node2 bin]# ls -lh /home/kingbase/.es
total 8.0K
-rw------- 1 kingbase kingbase 381 May 23 15:20 accept_hosts
-rw------- 1 kingbase kingbase 1.7K May 23 15:20 key_file
- 查看securecmdd服务配置文件：
[root@node2 .kes]# cat securecmdd_config
Port 8890
HostKey ~/.es/key_file
AuthorizedKeysFile .es/accept_hosts
PidFile /var/run/sys_securecmdd.pid
AddressFamily any
LogLevel QUIET
PasswordAuthentication yes
IgnoreUserKnownHosts yes
ChallengeResponseAuthentication no
X11Forwarding no
Subsystem sftp /home/kingbase/cluster/securecmdd/bin/sys_secureftp
# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
MaxStartups 128:10:256
UsePAM yes
三、启动securecmdd服务
[root@node2 bin]# sh sys_HAscmdd.sh start
[root@node2 bin]# ps -ef |grep secure
root 30443 1 0 15:23 ? 00:00:00 sys_securecmdd: /home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd_config [listener] 0 of 128-256 startups
root 30719 28302 0 15:23 pts/3 00:00:00 grep --color=auto secure
You have new mail in /var/spool/mail/root
[root@node2 bin]# netstat -antlp |grep 8890
tcp 0 0 0.0.0.0:8890 0.0.0.0:* LISTEN 30443/sys_securecmd
tcp6 0 0 :::8890 :::* LISTEN 30443/sys_securecmd
[root@node2 bin]# systemctl status securecmdd
● securecmdd.service - KingbaseES - sys_securecmdd daemon
Loaded: loaded (/etc/systemd/system/securecmdd.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2022-05-23 15:23:28 CST; 16min ago
Main PID: 30443 (sys_securecmdd)
CGroup: /system.slice/securecmdd.service
└─30443 sys_securecmdd: /home/kingbase/cluster/securecmdd/bin/sys_securecmdd -f /etc/.kes/securecmdd...
May 23 15:23:28 node2 systemd[1]: Started KingbaseES - sys_securecmdd daemon.
May 23 15:23:28 node2 systemd[1]: Starting KingbaseES - sys_securecmdd daemon...
四、执行图形化集群部署
=在所有节点都启动securecmdd服务后，在图形化部署集群时，就可以选择以下方式添加节点。=
KINGBASE研究院
