暂无图片
暂无图片
暂无图片
暂无图片
暂无图片
首页 / TiDB之修改root密码

TiDB之修改root密码

原创 ZXM 2022-03-05
4272

当忘记TiDB root 密码时，可以通过设置skip-grant-table参数来跳过密码验证，登录成功以后再修改root密码。

方法一：

修改tidb-server的配置文件 

vi /tidb-deploy/tidb-4000/conf/tidb.toml
# WARNING: This file is auto-generated. Do not edit! All your modification will be overwritten!
# You can use 'tiup cluster edit-config' and 'tiup cluster reload' to update the configuration
# All configuration items you want to change can be added to:
# server_configs:
#   tidb:
#     aa.b1.c3: value
#     aa.b2.c4: value
[security]
skip-grant-table = true
~

直接修改配置文件需要重启tidb-server服务才能生效 连接到中控机，使用tiup关闭该节点的tidb-server服务

[root@node1 ~]# tiup cluster stop  tidb-test -N 192.168.233.82:4000
tiup is checking updates for component cluster ...
Starting component `cluster`: /root/.tiup/components/cluster/v1.9.1/tiup-cluster /root/.tiup/components/cluster/v1.9.1/tiup-cluster stop tidb-test -N 192.168.233.82:4000
Will stop the cluster tidb-test with nodes: 192.168.233.82:4000, roles: .
Do you want to continue? [y/N]:(default=N) y

+ [ Serial ] - SSHKeySet: privateKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa, publicKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa.pub
  ....
+ [ Serial ] - StopCluster
  Stopping component tidb
        Stopping instance 192.168.233.82
        Stop tidb 192.168.233.82:4000 success
  Stopping component node_exporter
  Stopping component blackbox_exporter
  Stopped cluster `tidb-test` successfully

由于添加了skip-grant-table = true 无法直接通过tiup来启动192.168.233.82上的 tidb-server

[root@node1 ~]# tiup cluster start  tidb-test -N 192.168.233.82:4000
tiup is checking updates for component cluster ...
Starting component `cluster`: /root/.tiup/components/cluster/v1.9.1/tiup-cluster /root/.tiup/components/cluster/v1.9.1/tiup-cluster start tidb-test -N 192.168.233.82:4000
Starting cluster tidb-test...
+ [ Serial ] - SSHKeySet: privateKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa, publicKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa.pub
....
+ [ Serial ] - StartCluster
Starting component tidb
        Starting instance 192.168.233.82:4000

Error: failed to start tidb: failed to start: 192.168.233.82 tidb-4000.service, please check the instance's log(/tidb-deploy/tidb-4000/log) for more detail.: timed out waiting for port 4000 to be started after 2m0s

Verbose debug logs has been written to /root/.tiup/logs/tiup-cluster-debug-2022-03-05-07-50-08.log.

官方文档说明：设置 skip-grant-table 之后，启动 TiDB 进程会增加操作系统用户检查，只有操作系统的 root 用户才能启动 TiDB 进程。

查看tidb-server的日志

[root@node2 log]# tailf -n 10 tidb_stderr.log
load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege
load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege
load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege
load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege
load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege

连接到tidb-server所在的服务器，手工执行启动脚本

/tidb-deploy/tidb-4000/scripts/run_tidb.sh
再打开一个新会话，就可以免密登录了
[root@node2 ~]# mysql -h 192.168.233.82 -P 4000 -uroot
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.7.25-TiDB-v5.0.0 TiDB Server (Apache License 2.0) Community Edition, MySQL 5.7 compatible

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]>

为一个已存在的账户修改密码，可以通过 SET PASSWORD FOR 或者 ALTER USER 语句完成：

SET PASSWORD FOR 'root'@'%' = 'xxx';

或者：

ALTER USER 'test'@'localhost' IDENTIFIED BY 'mypass';

修改成功以后，在执行启动脚本的会话里执行ctrl+c,然后删除添加的参数

再使用tiup重新启动tidb-server

[root@node1 ~]# tiup cluster start  tidb-test -N 192.168.233.82:4000
tiup is checking updates for component cluster ...
Starting component `cluster`: /root/.tiup/components/cluster/v1.9.1/tiup-cluster /root/.tiup/components/cluster/v1.9.1/tiup-cluster start tidb-test -N 192.168.233.82:4000
Starting cluster tidb-test...
+ [ Serial ] - SSHKeySet: privateKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa, publicKey=/root/.tiup/storage/cluster/clusters/tidb-test/ssh/id_rsa.pub
.....
+ [ Serial ] - StartCluster
Starting component tidb
        Starting instance 192.168.233.82:4000
        Start instance 192.168.233.82:4000 success
Starting component node_exporter
        Starting instance 192.168.233.82
        Start 192.168.233.82 success
Starting component blackbox_exporter
        Starting instance 192.168.233.82
        Start 192.168.233.82 success
+ [ Serial ] - UpdateTopology: cluster=tidb-test
Started cluster `tidb-test` successfully

因为密码信息是存储再TiKV中的，所以当密码修改成功以后，所有的TiDB-server节点都可以使用新密码登录

方法二：

使用tiup 来修改配置文件

tiup cluster edit-config tidb-test

global:
  user: tidb
  ssh_port: 22
  ssh_type: builtin
  deploy_dir: /tidb-deploy
  data_dir: /tidb-data
  os: linux
  arch: amd64
server_configs:
 tidb:
  security.skip-grant-table: true
monitored:
  node_exporter_port: 9100
  blackbox_exporter_port: 9115
  deploy_dir: /tidb-deploy/monitor-9100

下面是添加的内容（注意折行）

server_configs:
 tidb:
  security.skip-grant-table: true

添加完成以后，需要执行reload语句来同步到节点上去。

Please check change highlight above, do you want to apply the change? [y/N]:(default=N) y
Applying changes...
Applied successfully, please use `tiup cluster reload tidb-test [-N <nodes>] [-R <roles>]` to reload config.
[root@node1 ~]# tiup cluster reload tidb-test
  - Generate config pd -> 192.168.233.83:2379 ... Done
  - Generate config tikv -> 192.168.233.81:20160 ... Done
  - Generate config tikv -> 192.168.233.82:20160 ... Done
  - Generate config tikv -> 192.168.233.83:20160 ... Done
  - Generate config tidb -> 192.168.233.82:4000 ... Error
  - Generate config tidb -> 192.168.233.83:4000 ... Error
  - Generate config prometheus -> 192.168.233.81:9090 ... Done
  - Generate config grafana -> 192.168.233.81:3000 ... Done
  - Generate config alertmanager -> 192.168.233.81:9093 ... Done

Error: init config failed: 192.168.233.83:4000: executor.ssh.execute_failed: Failed to execute command over SSH for 'tidb@192.168.233.83:22' {ssh_stderr: load config file: /tidb-deploy/tidb-4000/conf/tidb.toml
invalid config TiDB run with skip-grant-table need root privilege
, ssh_stdout: , ssh_command: export LANG=C; PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin /tidb-deploy/tidb-4000/bin/tidb-server --config-check --config=/tidb-deploy/tidb-4000/conf/tidb.toml }, cause: Process exited with status 1: check config failed

由于权限的问题，并不能是参数生效，不过tidb-server节点还是可用状态

[root@node1 ~]# tiup cluster display tidb-test
tiup is checking updates for component cluster ...
Starting component `cluster`: /root/.tiup/components/cluster/v1.9.1/tiup-cluster /root/.tiup/components/cluster/v1.9.1/tiup-cluster display tidb-test
Cluster type:       tidb
Cluster name:       tidb-test
Cluster version:    v5.0.0
Deploy user:        tidb
SSH type:           builtin
Dashboard URL:      http://192.168.233.83:2379/dashboard
ID                    Role          Host            Ports        OS/Arch       Status  Data Dir                      Deploy Dir
--                    ----          ----            -----        -------       ------  --------                      ----------
192.168.233.81:9093   alertmanager  192.168.233.81  9093/9094    linux/x86_64  Up      /tidb-data/alertmanager-9093  /tidb-deploy/alertmanager-9093
192.168.233.81:3000   grafana       192.168.233.81  3000         linux/x86_64  Up      -                             /tidb-deploy/grafana-3000
192.168.233.81:2379   pd            192.168.233.81  2379/2380    linux/x86_64  Up      /tidb-data/pd-2379            /tidb-deploy/pd-2379
192.168.233.82:2379   pd            192.168.233.82  2379/2380    linux/x86_64  Up|L    /tidb-data/pd-2379            /tidb-deploy/pd-2379
192.168.233.83:2379   pd            192.168.233.83  2379/2380    linux/x86_64  Up|UI   /tidb-data/pd-2379            /tidb-deploy/pd-2379
192.168.233.81:9090   prometheus    192.168.233.81  9090         linux/x86_64  Up      /tidb-data/prometheus-9090    /tidb-deploy/prometheus-9090
192.168.233.82:4000   tidb          192.168.233.82  4000/10080   linux/x86_64  Up      -                             /tidb-deploy/tidb-4000
192.168.233.83:4000   tidb          192.168.233.83  4000/10080   linux/x86_64  Up      -                             /tidb-deploy/tidb-4000
192.168.233.81:20160  tikv          192.168.233.81  20160/20180  linux/x86_64  Up      /tidb-data/tikv-20160         /tidb-deploy/tikv-20160
192.168.233.82:20160  tikv          192.168.233.82  20160/20180  linux/x86_64  Up      /tidb-data/tikv-20160         /tidb-deploy/tikv-20160
192.168.233.83:20160  tikv          192.168.233.83  20160/20180  linux/x86_64  Up      /tidb-data/tikv-20160         /tidb-deploy/tikv-20160

还是需要跟方法一样，将一个tidb-server节点关闭以后，手动使用root用户执行启动脚本。

tidb
「喜欢这篇文章，您的关注和赞赏是给作者最好的鼓励」
关注作者
【版权声明】本文为墨天轮用户原创内容，转载时必须标注文章的来源（墨天轮），文章链接，文章作者等基本信息，否则作者和墨天轮有权追究责任。如果您发现墨天轮中有涉嫌抄袭或者侵权的内容，欢迎发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。

评论