centos升级mysql8漏洞修复

背景

一般情况下,我们在centos6.5、centos7操作系统中安装的mysql 8.0.2的版本比较低.正式发布应用之后,随着时间的推移会暴露出越来越的漏洞,这时候我们就需要将数据库的服务进行升级,这些已知的漏洞便会随之修复,保证我们服务的安全。

一、准备工作

1.注意备份,重要的事情说三遍!

一定要备份之前数据库中的全部数据!

一定要备份之前数据库中的全部数据!

一定要备份之前数据库中的全部数据!。

2.mysql-8.0.33-linux-glibc2.12-x86_64.tar.xz这里可以是最新版本的源码包。

3.新版本服务自启使用的脚本 我这里叫mysql.server。

4.本文章背景为原服务使用3306端口,新版本mysql使用3308端口,仅有在新版本mysql升级成功,并数据成功导入新版本mysql数据库的情况下,才会将本机的原服务停止,并将自启服务改为新版本,如果升级失败或者导入数据时失败,旧版本的mysql服务依然是可用的。

二、安装包下载

下载地址二:

mysql官方下载地址

根据下图选择对应版本及操作系统,点击下载

在这里插入图片描述

下载后需要将mysql-8.0.33-linux-glibc2.12-x86_64.tar.xz 上传至服务器中

三、编译源码

我们将上述的压缩包下载好之后,需要上传到需要升级的linux服务中,使用下面的命令进行解压至 /data/java 文件夹中。

# 解压 这里/data/java是我之前就创建好的文件夹
> cd /data/java
> tar -xvf mysql-8.0.33-linux-glibc2.12-x86_64.tar.xz

#更名
> mv mysql-8.0.33-linux-glibc2.12-x86_64 mysql-8.0.33

#创建目录 data 和 log
> cd /data/java/mysql-8.0.33
> mkdir data
> mkdir log

#修改所属用户
> chown -R mysql.mysql /data/java/mysql-8.0.33
> chown -R mysql.mysql /data/mysql-8.0.33/data
> chgrp -R mysql /data/java/mysql-8.0.33

#备份配置文件
> cp  /etc/my.cnf /etc/my.cnf.back

#编辑配置文件
> vi /data/java/mysql-8.0.33/my.cnf
#此处内容要参考原来的配置文件 关键配置按照下面写 其余配置使用原来的 
#内容如下 关键的配置如下 一定要换端口及datadir
[client]
port = 3308
default-character-set = utf8mb4
[mysqld]
port = 3308
mysqlx_port = 33070
datadir=/data/java/mysql-8.0.33/data
socket=/data/java/mysql-8.0.33/mysql.sock
user = mysql
bind-address = 0.0.0.0
group_concat_max_len = 102400
log-error=/data/java/mysql-8.0.33/log/mysqld.log
pid-file=/data/java/mysql-8.0.33/mysqld.pid
sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES
lower_case_table_names=1
innodb_log_file_size = 512M
innodb_strict_mode = 0
#内容完毕

#执行数据库初始化
> cd /data/java/mysql-8.0.33/bin
> ./mysqld --defaults-file=/data/java/mysql-8.0.33/my.cnf  --basedir=/data/java/mysql-8.0.33 --datadir=/data/java/mysql-8.0.33/data --initialize --user=mysql

## 查询密码
> cat /data/java/mysql-8.0.33/log/mysqld.log

# 安全模式启动数据库
> cd /data/java/mysql-8.0.33
> ./bin/mysqld_safe --defaults-extra-file=/data/java/mysql-8.0.33/my.cnf --user=mysql &

四、尝试连接并导入数据库

在之前的操作中 我们已经成功 初始化并启动了 mysql-8.0.33版本

通过以下命令查询到进程 及端口是否正常

# 进程是否存在
> ps aux | grep mysql
# 结果
[root@localhost ~]# ps aux | grep mysql
root      82902  0.0  0.0  11820  1604 ?        S    Apr27   0:00 /bin/sh /data/java/mysql-8.0.33/bin/mysqld_safe --datadir=/data/java/mysql-8.0.33/data --pid-file=/data/java/mysql-8.0.33/mysqld.pid
mysql     83264  0.6 22.7 2453388 423192 ?      Sl   Apr27 187:58 /data/java/mysql-8.0.33/bin/mysqld --basedir=/data/java/mysql-8.0.33 --datadir=/data/java/mysql-8.0.33/data --plugin-dir=/data/java/mysql-8.0.33/lib/plugin --user=mysql --log-error=/data/java/mysql-8.0.33/log/mysqld.log --pid-file=/data/java/mysql-8.0.33/mysqld.pid --socket=/data/java/mysql-8.0.33/mysql.sock --port=3308
root     104233  0.0  0.0 112712   960 pts/0    S+   23:30   0:00 grep --color=auto mysql


# 查询3308端口是否占用
> netstat -ano | grep 3308
# 结果
tcp6       0      0 :::3308                 :::*                    LISTEN      off (0.00/0/0)
unix  2      [ ACC ]     STREAM     LISTENING     22006    /data/java/mysql-5.6.51/3308.sock

# 尝试连接
> ./mysql -u root -h 127.0.0.1 -P 3308 -p
> 回车
# 如果正常应该显示如下信息
[root@localhost ~]# mysql -u root -h 127.0.0.1 -P 3308 -p
Enter password: 
#这里的密码应该在这里查询到 cat /data/java/mysql-8.0.33/log/mysqld.log
#mysql8数据库初始化完成时 密码会输出在日志文件中
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 26
Server version: 8.0.33 MySQL Community Server - GPL

Copyright (c) 2000, 2023, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

通过上面的一些列操作,我们可以看到新版数据库已经成功连接。通过下面命令进行数据导入

#需要重置密码
mysql> ALTER USER USER() IDENTIFIED BY 'ccbc@2020';
mysql> CREATE USER 'root'@'%' IDENTIFIED BY 'ccbc@2020';
mysql> grant all privileges on *.* to root@'%' with grant option;
mysql> FLUSH PRIVILEGES;

# 在mysql终端进行数据导入
#创建
mysql> create database testdb DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
#使用
mysql> use testdb;
#导入
mysql> source /root/mysql-data/testdb.sql;

#修改密码
mysql> update mysql.user set password=password('newpass') where user='root';
mysql> flush privileges;

#远程登录
mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'newpass' ;
mysql> flush privileges;

五、系统环境替换

环境变量替换

# 如果有设置环境变量
> vi /root/.bash_profile
#内容如下
#环境变量
MYSQL_HOME=/data/java/mysql-5.6.51
PATH=$PATH:$MYSQL_HOME/bin:
> source /root/.bash_profile

服务替换

# 关闭原服务
> service mysqld stop
> cd /etc/init.d/
# 备份原来的服务
> mv mysqld mysqld.old
# 需要把mysql.server 放在/root目录下 文件内容在下面
> mv /root/mysql.server mysqld
> chmod 777 mysqld
# 查询mysql 进程
> ps aux |grep mysql
# mysql 进程杀死
> kill -9 1123
# 新的服务启动
> service mysqld start
# 重新连接 查看mysql 版本
> mysql -u root -h 127.0.0.1 -P 3308 -p

mysql.server文件内容如下:

#!/bin/sh
# Copyright Abandoned 1996 TCX DataKonsult AB & Monty Program KB & Detron HB
# This file is public domain and comes with NO WARRANTY of any kind

# MySQL daemon start/stop script.

# Usually this is put in /etc/init.d (at least on machines SYSV R4 based
# systems) and linked to /etc/rc3.d/S99mysql and /etc/rc0.d/K01mysql.
# When this is done the mysql server will be started when the machine is
# started and shut down when the systems goes down.

# Comments to support chkconfig on RedHat Linux
# chkconfig: 2345 64 36
# description: A very fast and reliable SQL database engine.

# Comments to support LSB init script conventions
### BEGIN INIT INFO
# Provides: mysql
# Required-Start: $local_fs $network $remote_fs
# Should-Start: ypbind nscd ldap ntpd xntpd
# Required-Stop: $local_fs $network $remote_fs
# Default-Start:  2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop MySQL
# Description: MySQL is a very fast and reliable SQL database engine.
### END INIT INFO
 
# If you install MySQL on some other places than /usr/local/mysql, then you
# have to do one of the following things for this script to work:
#
# - Run this script from within the MySQL installation directory
# - Create a /etc/my.cnf file with the following information:
#   [mysqld]
#   basedir=<path-to-mysql-installation-directory>
# - Add the above to any other configuration file (for example ~/.my.ini)
#   and copy my_print_defaults to /usr/bin
# - Add the path to the mysql-installation-directory to the basedir variable
#   below.
#
# If you want to affect other MySQL variables, you should make your changes
# in the /etc/my.cnf, ~/.my.cnf or other MySQL configuration files.

# If you change base dir, you must also change datadir. These may get
# overwritten by settings in the MySQL configuration files.

basedir=/data/java/mysql-8.0.33
datadir=/data/java/mysql-8.0.33/data

# Default value, in seconds, afterwhich the script should timeout waiting
# for server start. 
# Value here is overriden by value in my.cnf. 
# 0 means don't wait at all
# Negative numbers mean to wait indefinitely
service_startup_timeout=900

# Lock directory for RedHat / SuSE.
lockdir='/var/lock/subsys'
lock_file_path="$lockdir/mysql"

# The following variables are only set for letting mysql.server find things.

# Set some defaults
mysqld_pid_file_path=
if test -z "$basedir"
then
  basedir=/data/java/mysql-8.0.33
  bindir=/data/java/mysql-8.0.33/bin
  if test -z "$datadir"
  then
    datadir=/data/java/mysql-8.0.33/data
  fi
  sbindir=/data/java/mysql-8.0.33/bin
  libexecdir=/data/java/mysql-8.0.33/mysql/bin
else
  bindir="$basedir/bin"
  if test -z "$datadir"
  then
    datadir="$basedir/data"
  fi
  sbindir="$basedir/sbin"
  libexecdir="$basedir/libexec"
fi

# datadir_set is used to determine if datadir was set (and so should be
# *not* set inside of the --basedir= handler.)
datadir_set=

#
# Use LSB init script functions for printing messages, if possible
#
lsb_functions="/lib/lsb/init-functions"
if test -f $lsb_functions ; then
  . $lsb_functions
else
  log_success_msg()
  {
    echo " SUCCESS! $@"
  }
  log_failure_msg()
  {
    echo " ERROR! $@"
  }
fi

PATH="/sbin:/usr/sbin:/bin:/usr/bin:$basedir/bin"
export PATH

mode=$1    # start or stop

[ $# -ge 1 ] && shift


other_args="$*"   # uncommon, but needed when called from an RPM upgrade action
           # Expected: "--skip-networking --skip-grant-tables"
           # They are not checked here, intentionally, as it is the resposibility
           # of the "spec" file author to give correct arguments only.

case `echo "testing\c"`,`echo -n testing` in
    *c*,-n*) echo_n=   echo_c=     ;;
    *c*,*)   echo_n=-n echo_c=     ;;
    *)       echo_n=   echo_c='\c' ;;
esac

parse_server_arguments() {
  for arg do
    case "$arg" in
      --basedir=*)  basedir=`echo "$arg" | sed -e 's/^[^=]*=//'`
                    bindir="$basedir/bin"
		    if test -z "$datadir_set"; then
		      datadir="$basedir/data"
		    fi
		    sbindir="$basedir/sbin"
		    libexecdir="$basedir/libexec"
        ;;
      --datadir=*)  datadir=`echo "$arg" | sed -e 's/^[^=]*=//'`
		    datadir_set=1
	;;
      --pid-file=*) mysqld_pid_file_path=`echo "$arg" | sed -e 's/^[^=]*=//'` ;;
      --service-startup-timeout=*) service_startup_timeout=`echo "$arg" | sed -e 's/^[^=]*=//'` ;;
    esac
  done
}

wait_for_pid () {
  verb="$1"           # created | removed
  pid="$2"            # process ID of the program operating on the pid-file
  pid_file_path="$3" # path to the PID file.

  i=0
  avoid_race_condition="by checking again"

  while test $i -ne $service_startup_timeout ; do

    case "$verb" in
      'created')
        # wait for a PID-file to pop into existence.
        test -s "$pid_file_path" && i='' && break
        ;;
      'removed')
        # wait for this PID-file to disappear
        test ! -s "$pid_file_path" && i='' && break
        ;;
      *)
        echo "wait_for_pid () usage: wait_for_pid created|removed pid pid_file_path"
        exit 1
        ;;
    esac

    # if server isn't running, then pid-file will never be updated
    if test -n "$pid"; then
      if kill -0 "$pid" 2>/dev/null; then
        :  # the server still runs
      else
        # The server may have exited between the last pid-file check and now.  
        if test -n "$avoid_race_condition"; then
          avoid_race_condition=""
          continue  # Check again.
        fi

        # there's nothing that will affect the file.
        log_failure_msg "The server quit without updating PID file ($pid_file_path)."
        return 1  # not waiting any more.
      fi
    fi

    echo $echo_n ".$echo_c"
    i=`expr $i + 1`
    sleep 1

  done

  if test -z "$i" ; then
    log_success_msg
    return 0
  else
    log_failure_msg
    return 1
  fi
}

# Get arguments from the my.cnf file,
# the only group, which is read from now on is [mysqld]
if test -x "$bindir/my_print_defaults";  then
  print_defaults="$bindir/my_print_defaults"
else
  # Try to find basedir in /etc/my.cnf
  conf=/etc/my.cnf
  print_defaults=
  if test -r $conf
  then
    subpat='^[^=]*basedir[^=]*=\(.*\)$'
    dirs=`sed -e "/$subpat/!d" -e 's//\1/' $conf`
    for d in $dirs
    do
      d=`echo $d | sed -e 's/[ 	]//g'`
      if test -x "$d/bin/my_print_defaults"
      then
        print_defaults="$d/bin/my_print_defaults"
        break
      fi
    done
  fi

  # Hope it's in the PATH ... but I doubt it
  test -z "$print_defaults" && print_defaults="my_print_defaults"
fi

#
# Read defaults file from 'basedir'.   If there is no defaults file there
# check if it's in the old (depricated) place (datadir) and read it from there
#

extra_args=""
if test -r "$basedir/my.cnf"
then
  extra_args="-e $basedir/my.cnf"
fi

parse_server_arguments `$print_defaults $extra_args mysqld server mysql_server mysql.server`

#
# Set pid file if not given
#
if test -z "$mysqld_pid_file_path"
then
  mysqld_pid_file_path=$datadir/`hostname`.pid
else
  case "$mysqld_pid_file_path" in
    /* ) ;;
    * )  mysqld_pid_file_path="$datadir/$mysqld_pid_file_path" ;;
  esac
fi

case "$mode" in
  'start')
    # Start daemon

    # Safeguard (relative paths, core dumps..)
    cd $basedir

    echo $echo_n "Starting MySQL"
    if test -x $bindir/mysqld_safe
    then
      # Give extra arguments to mysqld with the my.cnf file. This script
      # may be overwritten at next upgrade.
      $bindir/mysqld_safe --datadir="$datadir" --pid-file="$mysqld_pid_file_path" $other_args >/dev/null &
      wait_for_pid created "$!" "$mysqld_pid_file_path"; return_value=$?

      # Make lock for RedHat / SuSE
      if test -w "$lockdir"
      then
        touch "$lock_file_path"
      fi

      exit $return_value
    else
      log_failure_msg "Couldn't find MySQL server ($bindir/mysqld_safe)"
    fi
    ;;

  'stop')
    # Stop daemon. We use a signal here to avoid having to know the
    # root password.

    if test -s "$mysqld_pid_file_path"
    then
      # signal mysqld_safe that it needs to stop
      touch "$mysqld_pid_file_path.shutdown"

      mysqld_pid=`cat "$mysqld_pid_file_path"`

      if (kill -0 $mysqld_pid 2>/dev/null)
      then
        echo $echo_n "Shutting down MySQL"
        kill $mysqld_pid
        # mysqld should remove the pid file when it exits, so wait for it.
        wait_for_pid removed "$mysqld_pid" "$mysqld_pid_file_path"; return_value=$?
      else
        log_failure_msg "MySQL server process #$mysqld_pid is not running!"
        rm "$mysqld_pid_file_path"
      fi

      # Delete lock for RedHat / SuSE
      if test -f "$lock_file_path"
      then
        rm -f "$lock_file_path"
      fi
      exit $return_value
    else
      log_failure_msg "MySQL server PID file could not be found!"
    fi
    ;;

  'restart')
    # Stop the service and regardless of whether it was
    # running or not, start it again.
    if $0 stop  $other_args; then
      $0 start $other_args
    else
      log_failure_msg "Failed to stop running server, so refusing to try to start."
      exit 1
    fi
    ;;

  'reload'|'force-reload')
    if test -s "$mysqld_pid_file_path" ; then
      read mysqld_pid <  "$mysqld_pid_file_path"
      kill -HUP $mysqld_pid && log_success_msg "Reloading service MySQL"
      touch "$mysqld_pid_file_path"
    else
      log_failure_msg "MySQL PID file could not be found!"
      exit 1
    fi
    ;;
  'status')
    # First, check to see if pid file exists
    if test -s "$mysqld_pid_file_path" ; then 
      read mysqld_pid < "$mysqld_pid_file_path"
      if kill -0 $mysqld_pid 2>/dev/null ; then 
        log_success_msg "MySQL running ($mysqld_pid)"
        exit 0
      else
        log_failure_msg "MySQL is not running, but PID file exists"
        exit 1
      fi
    else
      # Try to find appropriate mysqld process
      mysqld_pid=`pidof $libexecdir/mysqld`

      # test if multiple pids exist
      pid_count=`echo $mysqld_pid | wc -w`
      if test $pid_count -gt 1 ; then
        log_failure_msg "Multiple MySQL running but PID file could not be found ($mysqld_pid)"
        exit 5
      elif test -z $mysqld_pid ; then 
        if test -f "$lock_file_path" ; then 
          log_failure_msg "MySQL is not running, but lock file ($lock_file_path) exists"
          exit 2
        fi 
        log_failure_msg "MySQL is not running"
        exit 3
      else
        log_failure_msg "MySQL is running but PID file could not be found"
        exit 4
      fi
    fi
    ;;
    *)
      # usage
      basename=`basename "$0"`
      echo "Usage: $basename  {start|stop|restart|reload|force-reload|status}  [ MySQL server options ]"
      exit 1
    ;;
esac

exit 0

替换系统命令 开机自启服务等

#替换 /usr/bin/mysql
#替换 原来服务使用的mysql mysqldump my.cnf等
> mv /usr/bin/mysql /usr/bin/mysql-back
> ln -s /data/java/mysql-8.0.33/bin/mysql /usr/bin/mysql
> mv /usr/bin/mysqldump /usr/bin/mysqldump-back
# mysqldump命令
> ln -sf /data/java/mysql-8.0.33/bin/mysqldump /usr/bin/mysqldump
> mv /usr/sbin/mysqld /usr/bin/mysqld-back
# mysqld 命令
> ln -s /data/java/mysql-8.0.33/bin/mysqld /usr/sbin/mysqld
> mv /etc/my.cnf /etc/my.cnf.back
> cp /data/java/mysql-8.0.33/my.cnf  /etc
# 自启服务备份
> mv /usr/lib/systemd/system/mysqld.service /usr/lib/systemd/system/mysqld.service.back
> systemctl daemon-reload

#重启
> service myqld restart

总结

一定要保留和备份原来的mysql 数据库服务及 数据,只有新的mysql服务启动并导入数据成功后,在进行服务替换操作。确保本机原来的服务停止,新的服务占用3308端口,配置和原来保持一致。新服务可用后,将开机自启服务替换为新的服务

可能遇到的问题

问题1:ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/tmp/mysql.sock’ (2)

# 需要创建如下软连接
> ln -s /data/java/mysql-8.0.33/mysql.sock /tmp/mysql.sock

问题2: 无法远程登录

# 关闭防火墙并配置mysql可以远程
# mysql终端配置一下
mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'mima' ;
mysql> flush privileges;

问题3 Authentication plugin ‘caching_sha2_password’ cannot be loaded

mysql> ALTER USER 'root'@'%' IDENTIFIED WITH mysql_native_password BY 'mima';
mysql> Query OK, 0 rows affected (0.01 sec)

mysql> FLUSH PRIVILEGES;
mysql> Query OK, 0 rows affected (0.00 sec)

参考

参考1
参考2

声明

本文中资源全部收集整理于网络并无偿提供,仅可用于个人学习交流;请勿转载、售卖或商用;侵权联删!

猜你喜欢

转载自blog.csdn.net/qq_36378416/article/details/130717878