Movatterモバイル変換

Set the required data node parameters in the[ndbd default] section of theconfig.ini file, as shown here:

[ndbd default]EncryptedFileSystem= 1

These parameters must be set as shown on all data nodes.

Start the management server with either--initial or--reload to cause it to read the updated configuration file.

Perform a rolling initial start (or restart) of all the data nodes (seeSection 25.6.5, “Performing a Rolling Restart of an NDB Cluster”): Start each data node with--initial; in addition, supply either of the options--filesystem-password or--filesystem-password-from-stdin, plus a password, to each data node process. When you supply the password on the command line, a warning is shown, similar to this one:

> ndbmtd -c 127.0.0.1 --filesystem-password=ndbsecretndbmtd: [Warning] Using a password on the command line interface can be insecure.2022-08-22 16:17:58 [ndbd] INFO     -- Angel connected to '127.0.0.1:1186'2022-08-22 16:17:58 [ndbd] INFO     -- Angel allocated nodeid: 5

--filesystem-password can accept the password form a file,tty, orstdin;--filesystem-password-from-stdin accepts the password fromstdin only. The latter protects the password from exposure on the process command line or in the file system, and allows for the possibility of passing it from another secure application.

You can also place the password in amy.cnf file that can be read by the data node process, but not by other users of the system. Using the same password as in the previous example, the relevant portion of the file should look like this:

[ndbd]filesystem-password=ndbsecret

You can also prompt the user starting the data node process to supply the encryption password when doing so, by using the--filesystem-password-from-stdin option in themy.cnf file instead, like this:

[ndbd]filesystem-password-from-stdin

In this case, the user is prompted for the password when starting the data node process, as shown here:

> ndbmtd -c 127.0.0.1 Enter filesystem password: *********2022-08-22 16:36:00 [ndbd] INFO     -- Angel connected to '127.0.0.1:1186'2022-08-22 16:36:00 [ndbd] INFO     -- Angel allocated nodeid: 5>

Regardless of the method used, the format of the encryption password is the same as that used for passwords for encrypted backups (seeSection 25.6.8.2, “Using The NDB Cluster Management Client to Create a Backup”); the password must be supplied when starting each data node process; otherwise the data node process cannot start. This is indicated by the following message in the data node log:

> tail -n2 ndb_5_out.log 2022-08-22 16:08:30 [ndbd] INFO     -- Data node configured to have encryption but password not provided2022-08-22 16:08:31 [ndbd] ALERT    -- Node 5: Forced node shutdown completed. Occurred during startphase 0.

When restarted as just described, each data node clears its on-disk state, and rebuilds it in encrypted form.

In the[ndbd default] section of theconfig.ini file, setEncryptedFileSystem = OFF.

Restart the management server with--initial or--reload.

Perform a rolling initial restart of the data nodes. Donot use any password-related options when restarting the node binaries.

When restarted, each data node clears its on-disk state, and rebuilds it in unencrypted form.