[進階篇] HPE IMC 7.3 在 CentOS 7 的維運實戰：MySQL 8.0 極限調優與 OpenSSH 資安升級指南
[進階篇] HPE IMC 7.3 維運實戰：MySQL 8.0 極限調優 × OpenSSH 資安升級
隨著設備規模擴大，資料庫效能往往成為瓶頸。本篇將執行 MySQL 8.0 升級優化 與 OpenSSH 8.8p1 編譯，修補資安漏洞並徹底釋放系統效能。
🛡️ Part 1：MySQL 8.0 升級與架構轉換
IMC 在處理高負載環境時，MySQL 8.0 的效能表現顯著優於 5.7。以下為切換 Repository 並執行升級的完整流程。
# 1. 移除既有 MySQL 5.7 Repo (避免 Repo 衝突)
yum remove mysql-community-server -y
yum-config-manager --disable mysql57-community
# 2. 下載並安裝 MySQL 8.0 官方 Repository
rpm -Uvh https://repo.mysql.com/mysql80-community-release-el7-3.noarch.rpm
# 3. 檢查 Repo 狀態
yum repolist all | grep mysql
# 4. 安裝 MySQL 8.0 Server
yum install mysql-community-server -y
# 5. 啟動服務
systemctl start mysqld
systemctl enable mysqld
mysqld -V
🛡️ Part 2：MySQL 8.0 核心效能參數調優 (my.cnf)
針對 IMC 的網管大數據寫入特性，優化 innodb_buffer_pool_size 核心參數。
[client]
port = 3306
socket = /var/lib/mysql/mysql.sock
[mysqld]
port = 3306
socket = /var/lib/mysql/mysql.sock
pid-file = /var/run/mysqld/mysqld.pid
server-id = 1
bind_address = 0.0.0.0
character_set_server = latin1
default-storage-engine = INNODB
skip-external-locking
key_buffer_size = 384M
max_allowed_packet = 200M
max_connections = 800
lower_case_table_names = 1
table_open_cache = 512
sort_buffer_size = 2M
read_buffer_size = 2M
read_rnd_buffer_size = 8M
myisam_sort_buffer_size = 64M
thread_cache_size = 8
innodb_buffer_pool_size = 512M
innodb_strict_mode = 0
datadir = /var/lib/mysql
log-error = error.log
default-authentication-plugin = mysql_native_password
local-infile = 1
[mysqldump]
quick
max_allowed_packet = 16M
[mysql]
no-auto-rehash
default_character_set = latin1
local-infile = 1
🛡️ Part 3：OpenSSH 8.8p1 資安加固升級
手動編譯 OpenSSH 8.8p1 以解決 CVE 漏洞威脅。
# 1. 下載原始碼
wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz
wget http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.8p1.tar.gz
tar xf openssl-1.1.1l.tar.gz
tar xf openssh-8.8p1.tar.gz
# 2. 編譯 OpenSSL 1.1.1
mv /usr/bin/openssl{,.bak}
cd openssl-1.1.1l/ && ./config shared && make && make install
ln -s /usr/local/bin/openssl /usr/bin/openssl
echo "/usr/local/lib64" >> /etc/ld.so.conf && /sbin/ldconfig
# 3. 編譯 OpenSSH 8.8p1
cd ../openssh-8.8p1/
./configure --prefix=/usr/local/openssh --sysconfdir=/etc/ssh --with-ssl-dir=/usr/local/lib64 --with-pam && make && make install
# 4. 替換舊版服務
mv /usr/sbin/sshd{,.bak}
ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd
ssh -V
systemctl enable sshd --now
留言
張貼留言