Ukubethela ku-MySQL: I-Master Key Rotation

Ngokulindele ukuqala kokubhaliswa okusha kwalesi sifundo "Isizindalwazi" siyaqhubeka nokushicilela uchungechunge lwama-athikili mayelana nokubethela ku-MySQL.

Esihlokweni esandulele salolu chungechunge, sixoxile ukuthi ukubethela kokhiye oyinhloko kusebenza kanjani. Namuhla, ngokusekelwe olwazini olutholwe ngaphambili, ake sibheke ukujikeleza kwezihluthulelo eziyinhloko.

Ukuzungezisa ukhiye oyinhloko kuhilela ukukhiqiza ukhiye oyinhloko omusha kanye nokubethela kabusha okhiye bendawo yetafula (abagcinwe kuzihloko ze-tablespace) ngalo khiye omusha.

Masikhumbule ukuthi inhlokweni yendawo yetafula ebethelwe ibukeka kanjani:

Ukubethela ku-MySQL: I-Master Key Rotation

Kusuka esihlokweni esandulele, siyazi ukuthi iseva ifunda izihloko zazo zonke izindawo zetafula ezibethelwe ekuqaleni futhi ikhumbula i-ID engu-KEY enkulu kunazo zonke. Isibonelo uma sinamathebula amathathu ane-KEYI-ID = 3 kanye netafula elilodwa eline-KEYI-ID = 4, bese i-ID yokhiye omkhulu izoba ngu-4. Masibize le ID KEY - MAX KEY ID.

Ukuzungezisa ukhiye oyinhloko kusebenza kanjani

1. Umsebenzisi usayine u-ALTER INNODB MASTER KEY.

2. Iseva icela ukufakwa kokhiye ukwenza ukhiye oyinhloko omusha ngeseva i-UUID kanye ne-KEYI-ID ilingana nokukodwa kanye no-MAXKEYI-ID. Ngakho sithola i-id yokhiye oyinhloko elingana ne-INNODBKEY-UUID-(MAXKEYID + 1). Ekukhiqizeni ngempumelelo ukhiye oyinhloko, MAX KEY ID inyuswa ngomunye (okungukuthi MAXKEYI-ID=MAXKEYID + 1).

3. Iseva iskena zonke izikhala zetafula ezibethelwe ngokhiye oyinhloko, kanye nendawo yetafula ngayinye:

  • ibhala ngemfihlo ukhiye wendawo yetafula ngokhiye oyinhloko omusha;

  • ibuyekeza i-id yokhiye ku-MAX entshaKEYI-ID;

  • uma i-UUID ihlukile kuseva ye-UUID, buyekeza i-UUID yeseva.

Njengoba sazi, i-ID Yokhiye Oyinhloko esetshenziselwa ukususa ukubhala ngekhodi ithebula iqukethe i-UUID kanye ne-ID engu-KEY efundwa kunhlokweni ye-tablespace. Esikwenzayo manje ukubuyekeza lolu lwazi kunhlokweni yokubethela kwendawo yetafula ukuze iseva ithole ukhiye oyinhloko olungile.

Uma sinezikhala zetafula ezivela ezindaweni ezahlukene, njengezipele ezihlukene, zingase zisebenzise okhiye abakhulu abahlukene. Bonke laba okhiye abakhulu bazodinga ukubuyiswa endaweni yokugcina lapho iseva iqaliswa. Lokhu kunganciphisa ukuqalisa kweseva, ikakhulukazi uma kusetshenziswa isitolo sokhiye oseceleni kweseva. Ngokuzungezisa ukhiye oyinhloko, siphinda sibethela okhiye bendawo yetafula ngokhiye owodwa oyinhloko ofana nazo zonke izikhala zetafula. Iseva kufanele manje ithole ukhiye oyinhloko owodwa kuphela ekuqaleni.

Lokhu, kunjalo, kuwumphumela nje omnandi. Injongo eyinhloko yokuzungezisa ukhiye oyinhloko ukwenza iseva yethu ivikeleke kakhulu. Esimeni lapho ukhiye oyinhloko uye webiwa ngandlela thize ku-vault (ngokwesibonelo, Kuseva ye-Vault), kungenzeka ukukhiqiza ukhiye oyinhloko omusha futhi ubethele kabusha okhiye bendawo yetafula, wenze ukhiye ontshontshiwe ungasebenzi. Siphephile...cishe.

Esihlokweni esandulele, ngikhulume ngokuthi uma ukhiye we-tablespace webiwe kanjani, umuntu wesithathu angawusebenzisa ukuze asuse ukubethela idatha. Kuncike ekutheni kukhona ukufinyelela kudiski yethu. Uma ukhiye oyinhloko webiwa futhi unokufinyelela kudatha ebethelwe, ungasebenzisa ukhiye oyinhloko ontshontshiwe ukuze ususe ukubethela kokhiye we-tablespace futhi uthole idatha esusiwe. Njengoba ubona, ukujikeleza kwe-master key akusizi kulokhu. Siphinde sibethela ukhiye we-tablespace ngokhiye omusha oyinhloko, kodwa ukhiye wangempela osetshenziswe ukubethela/ukususa ukubethela kwedatha uhlala unjalo. Ngakho-ke, "i-hacker" ingaqhubeka nokuyisebenzisa ukususa ukubethela idatha. Ngaphambilini ngikuqaphelile lokho Iseva yePercona ye-MySQL ingenza ukubethela kabusha kwe-tablespace kwangempela, hhayi nje ukubethela kabusha kokhiye we-tablespace elula. Lesi sici sibizwa ngezintambo zokubethela. Nokho, lokhu kusebenza kusahlolwa okwamanje.

Ukuzungezisa ukhiye oyinhloko kuyasiza lapho kwebiwa ukhiye oyinhloko, kodwa ayikho indlela yokuthi umhlaseli awusebenzise futhi asuse ukubethela kokhiye bendawo yetafula.

Bhalisela isifundo sedemo samahhala.

Funda kabanzi:

Source: www.habr.com