CN111083166A

CN111083166A - Method and device for setting white list in cloud database and computer storage medium

Info

Publication number: CN111083166A
Application number: CN201911409482.5A
Authority: CN
Inventors: 张辰
Original assignee: Unicloud Nanjing Digital Technology Co Ltd
Current assignee: Unicloud Nanjing Digital Technology Co Ltd
Priority date: 2019-12-31
Filing date: 2019-12-31
Publication date: 2020-04-28

Abstract

A method and a device for setting a white list of a cloud database are provided. The method comprises the steps that in the instantiation process of a database, a database agent receives a request for adding a white list, which is sent by a user, wherein the request comprises an IP address; and adding the IP address received in the request into a firewall rule, and updating the firewall rule. The scheme of the invention utilizes the firewall of the virtual computing environment to control the access and the operation authority of the cloud database, thereby protecting the reliability and the safety of the user data.

Description

Method and device for setting white list in cloud database and computer storage medium

Technical Field

The invention belongs to the field of computers, and particularly relates to a method and a device for setting a white list in a cloud database and a computer-readable storage medium.

Background

The MySQL cloud database is a product combining a traditional database and a cloud computing technology, can provide virtualization of data resources, provides database services on the basis of virtualization, and needs a white list to limit access rights of users due to the consideration of user and information security.

The currently commonly used white list is controlled by MySQL rights, and the server accepts a connection only if the Host and User columns recorded by the User table match the client hostname and username and provide the correct password. Another approach is to modify the configuration file my. cnf of MySQL to control permissions. Both of these methods are limited at the level of the MySQL database, or risky, and the user can still destroy the database by connecting it remotely to the virtual computing environment in which the database is located.

Disclosure of Invention

In view of the above-mentioned deficiencies of the prior art, it is an object of the present invention to improve security and reliability of cloud database access.

The embodiment of the invention discloses a method for setting a white list of a cloud database, wherein in the instantiation process of the database, a database agent receives a request for adding the white list, which is sent by a user, wherein the request comprises an IP address; and adding the IP address received in the request into a firewall rule, and updating the firewall rule.

In one possible embodiment, a firewall command line is invoked to add and validate the whitelist in accordance with the request.

In a possible embodiment, before the database proxy agent receives the request for adding the white list sent by the user, the method further includes invoking a firewall command to initialize the firewall rule.

The embodiment of the invention also discloses a device for setting the white list of the cloud database, which comprises a receiving module, a white list adding module and a white list setting module, wherein the receiving module is used for receiving a request for adding the white list sent by a user by a database agent in the instantiation process of the database, and the request comprises an IP address; and the processing module is used for adding the IP address received in the request into the firewall rule and updating the firewall rule.

In one possible embodiment, the processing module is further configured to invoke a firewall command line to add and validate the whitelist according to the request.

In one possible embodiment, the firewall system further comprises an initialization module for calling the firewall command and initializing the firewall rule.

The invention also discloses a computer readable storage medium, wherein a computer program is stored on the computer readable storage medium, and when the computer program is executed by a processor, the method for setting the white list of the cloud database is realized.

The invention has the beneficial effects that: the scheme of the invention utilizes the firewall of the virtual computing environment to control the access and the operation authority of the cloud database, thereby protecting the reliability and the safety of the user data.

Drawings

FIG. 1 is a flow chart of a method according to an embodiment of the present invention;

fig. 2 is a schematic structural diagram of an apparatus according to an embodiment of the present invention.

Detailed Description

In order to facilitate understanding of those skilled in the art, the present invention will be further described with reference to the following examples and drawings, which are not intended to limit the present invention.

Based on a firewall of a virtual resource environment and based on database service under a linux system, in the process of initializing a database instance, only releasing the SSH authority of a management network to the instance, and after the instance is successfully created, controlling a white list of the instance by matching with an agent in the instance.

Specifically, the embodiment of the invention discloses a method for setting a white list for a cloud database, and as shown in fig. 1, the method includes:

s101, in the process of instantiating the database, the database agent receives a request for adding a white list, which is sent by a user, wherein the request comprises an IP address.

Before the database agent receives the request for adding the white list sent by the user, the method also comprises the steps of calling a firewall command and initializing the firewall rule. Specifically, after receiving the creation request, the database agent first initializes a firewall access white list, such as a network IP address field of the management network, a port number required for a service of the management network, and the like.

S102, adding the IP address received in the request into a firewall rule, and updating the firewall rule.

Specifically, a firewall command line is called according to the request to add the white list and enable the white list to take effect. The command to invoke firewall-cmd in the database proxy program adds a white list, and the following command lines may be used:

(1)firewall-cmd--permanent--add-rich-rule＝"rule family＝"ipv4"sourceaddress＝"192.168.0.2port＝"3306"accept

(2)firewall-cmd–reload。

after the addition is completed, a restart command of firewall-cmd needs to be called again, namely the restart command can take effect after the reload.

By the scheme, the access and operation authority of the cloud database is controlled by using the firewall of the virtual computing environment, so that the reliability and the safety of user data are protected.

The embodiment of the present invention further discloses a device 10 for setting a white list in a cloud database, as shown in fig. 2, including: the receiving module 101 is configured to receive, by a database agent, a request for adding a white list sent by a user in a database instantiation process, where the request includes an IP address; the processing module 102 is configured to add the IP address received in the request to the firewall rule, and update the firewall rule.

For specific implementation of the apparatus 100, reference may be made to the method embodiment, which is not described in detail herein.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described embodiments are merely illustrative, and for example, a division of a unit is merely a division of a logic function, and an actual implementation may have another division, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed.

While the invention has been described in terms of its preferred embodiments, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

1. A method for setting a white list of a cloud database is characterized in that in the instantiation process of the database, a database agent receives a request for adding the white list, which is sent by a user, wherein the request comprises an IP address; and adding the IP address received in the request into a firewall rule, and updating the firewall rule.

2. The method of claim 1, wherein invoking a firewall command line according to the request adds and validates the whitelist.

3. The method of claim 1, further comprising, prior to the database agent receiving the request to add a whitelist sent by the user, invoking a firewall command to initialize a firewall rule.

4. The device for setting the white list of the cloud database is characterized by comprising a receiving module, a processing module and a processing module, wherein the receiving module is used for receiving a request for adding the white list, which is sent by a user, by a database agent in the instantiation process of the database, and the request comprises an IP address; and the processing module is used for adding the IP address received in the request into the firewall rule and updating the firewall rule.

5. The apparatus of claim 4, wherein the processing module is further to invoke a firewall command line to add and validate the whitelist according to the request.

6. The apparatus of claim 4, further comprising an initialization module to invoke a firewall command to initialize firewall rules.

7. A computer storage medium having stored thereon a computer program which, when executed by a processor, implements the method of white listing a cloud database according to any of the preceding claims 1 to 3.