Configuring Trust Relationships for GBase 8s Database Clusters
To support data transmission and interoperability between the primary and standby servers in a GBase 8s database cluster, you must first establish an operating system-level trust relationship between the two servers before configuring the cluster. This document describes several methods for configuring trust relationships in GBase 8s database clusters.
Environment Information
1. Configuring the hosts.equiv File
The /etc/hosts.equiv file contains a list of hostnames. Each host is a trusted host. Any user with the same account on both the local and remote hosts is allowed to access the remote host from the local host without providing a password.
If a remote host and a user are added, that user (non-root user) on that machine can use rlogin to log in to all non-root accounts on the local machine without a password.
In short, hosts.equiv establishes trust relationships between different hosts, trusting all users on the trusted hosts.
1. Modifying /etc/hosts
On both the primary and standby nodes, use the root user to execute: vi /etc/hosts. Add the IP addresses and hostnames of the primary and standby nodes to the /etc/hosts file. The configuration should be identical on both servers.
The primary node hosts file content is as follows:
The standby node hosts file content is as follows:
2. Modifying /etc/hosts.equiv
On both the primary and standby nodes, use the root user to execute: vi /etc/hosts.equiv. Add the hostnames and trusted usernames of the primary and standby nodes to the /etc/hosts.equiv file. The configuration should be identical on both servers.
The primary node hosts.equiv file content is as follows:
The standby node hosts.equiv file content is as follows:
3. Configuring the sqlhosts File
Configure the sqlhosts file. The sqlhosts file configuration should be identical on both the primary and standby nodes. Use the gbasedbt user to configure it. (Note: Modify the IP address and instance name based on the actual environment.)
The primary node sqlhosts file content is as follows:
The standby node sqlhosts file content is as follows:
4. Trust Relationship Verification Test
On both the primary and standby nodes, use the dbaccess command to access the other database instance through cross-instance access. A successful connection to the other instance indicates that the trust relationship has been configured successfully.
The primary node successfully connects to the standby node instance using dbaccess:
The standby node successfully connects to the primary node instance using dbaccess:
5. Applicable Scenarios
Configuring trust using the hosts.equiv method is suitable for environments with no operating system security requirements, where the security level is the lowest. The operating system does not have any special checks or restrictions on host trust. In this case, you can use the root account to perform the configuration.
2. Configuring the .rhosts File
The .rhosts file in a user's home directory contains trusted {host, user} relationship pairs. This is similar to the trusted hosts in hosts.equiv but provides finer-grained control. Unlike hosts.equiv, which grants trust to all ordinary users on a specific host, it grants trust only to a specific account on a specific host. The user on the trusted host does not need to have an account on the local host.
In short, .rhosts establishes trust for the same user across different hosts, trusting only a specific user on the trusted host.
1. Modifying /etc/hosts
On both the primary and standby nodes, use the root user to execute: vi /etc/hosts. Add the IP addresses and hostnames of the primary and standby nodes to the /etc/hosts file. The configuration should be identical on both servers.
The primary node hosts file content is as follows:
The standby node hosts file content is as follows:
2. Modifying the .rhosts File
Create a .rhosts file in the gbasedbt user's home directory. On both the primary and standby nodes, add each other's hostname and the trusted user gbasedbt to this file.
The primary node .rhosts file content is as follows:
The standby node .rhosts file content is as follows:
3. Configuring the sqlhosts File
Configure the sqlhosts file. The sqlhosts file configuration should be identical on both the primary and standby nodes. Use the gbasedbt user to configure it. (Note: Modify the IP address and instance name based on the actual environment.)
The primary node sqlhosts file content is as follows:
The standby node sqlhosts file content is as follows:
4. Trust Relationship Verification Test
On both the primary and standby nodes, use the dbaccess command to access the other database instance through cross-instance access. A successful connection to the other instance indicates that the trust relationship has been configured successfully.
The primary node successfully connects to the standby node instance using dbaccess:
The standby node successfully connects to the primary node instance using dbaccess:
5. Applicable Scenarios
Configuring trust using the .rhosts method is suitable for environments with relatively low operating system security requirements, where trust needs to be specified at the user level. In cases where root user management is strict, you can use the gbasedbt user to modify the .rhosts file for trust configuration.
3. Configuring the REMOTE_SERVER_CFG Parameter
The REMOTE_SERVER_CFG parameter specifies the name of a file that lists trusted remote host names or IP addresses. This file must be located in the $GBASEDBTDIR/etc directory. If this parameter is set, the /etc/hosts.equiv file will not be used.
1. Creating the hosts.trust File
The primary node adds the hosts.trust file content as follows:
The standby node adds the hosts.trust file content as follows:
2. Modifying the REMOTE_SERVER_CFG Parameter
On both the primary and standby nodes, dynamically modify the parameter using onmode -wf or modify the onconfig file and then restart the database.
The primary node modifies the parameter as follows:
The standby node modifies the parameter as follows:
3. Modifying the sqlhosts File
Configure the sqlhosts file. The sqlhosts file configuration should be identical on both the primary and standby nodes. Use the gbasedbt user to configure it. (Note: Modify the IP address and instance name based on the actual environment.)
The primary node sqlhosts file content is as follows:
The standby node sqlhosts file content is as follows:
4. Trust Relationship Verification Test
On both the primary and standby nodes, use the dbaccess command to access the other database instance through cross-instance access. A successful connection to the other instance indicates that the trust relationship has been configured successfully.
The primary node successfully connects to the standby node instance using dbaccess:
The standby node successfully connects to the primary node instance using dbaccess:
5. Applicable Scenarios
Configuring trust by modifying the REMOTE_SERVER_CFG parameter is suitable for environments with strict operating system security requirements, where the operating system detects trust files such as hosts.equiv and prohibits host trust at the operating system level. In this case, you can configure trust using the database's internal REMOTE_SERVER_CFG parameter.
4. Configuring the REMOTE_USERS_CFG Parameter
The REMOTE_USERS_CFG parameter specifies the name of a file that lists trusted user names. This file must be located in the $GBASEDBTDIR/etc directory. If this parameter is set, the ~/.rhosts file will not be used.
1. Creating the .trust File
The primary node adds the .trust file content as follows:
The standby node adds the .trust file content as follows:
2. Modifying the REMOTE_USERS_CFG Parameter
On both the primary and standby nodes, dynamically modify the parameter using onmode -wf or modify the onconfig file and then restart the database.
The primary node modifies the parameter as follows:
The standby node modifies the parameter as follows:
3. Modifying the sqlhosts File
Configure the sqlhosts file. The sqlhosts file configuration should be identical on both the primary and standby nodes. Use the gbasedbt user to configure it. (Note: Modify the IP address and instance name based on the actual environment.)
The primary node sqlhosts file content is as follows:
The standby node sqlhosts file content is as follows:
4. Trust Relationship Verification Test
On both the primary and standby nodes, use the dbaccess command to access the other database instance through cross-instance access. A successful connection to the other instance indicates that the trust relationship has been configured successfully.
The primary node successfully connects to the standby node instance using dbaccess:
The standby node successfully connects to the primary node instance using dbaccess:
5. Applicable Scenarios
Configuring trust by modifying the REMOTE_USERS_CFG parameter is suitable for environments with strict operating system security requirements, where the operating system detects trust files such as hosts.equiv and prohibits host and user trust at the operating system level, or when trust configuration via the REMOTE_SERVER_CFG parameter fails. In this case, you can configure trust using the database's internal REMOTE_USERS_CFG parameter.
(Note: When using database internal parameters to configure trust relationships, prioritize using the REMOTE_SERVER_CFG parameter.)