将 Compute Engine 上的 PHP 代码安全连接到 Cloud SQL

2022-01-23 00:00:00 google-compute-engine mysql google-cloud-sql drupal-7

我正在尝试将在计算实例上运行的 drupal cms 连接到 Cloud SQL 数据库，但我尝试的每个组合都失败了.我可以从另一台服务器连接到 Cloud SQl，但我不确定 MySQL 连接从我的实例到 Cloud SQL 的路径，但我还想尽可能安全地配置与 db 服务器的连接

I'm trying to connect drupal cms running on a Compute Instance to Cloud SQL database but every combination I try fails. I can connect to Cloud SQl from another server but I'm not sure what path the MySQL connection takes from my instance to Cloud SQL but also want to configure as secure as possible connection to and from the db server

这是我的配置

服务器

  • 已分配外部 IP 地址的 Cloud SQL.也授权计算实例的外部 IP 地址 &独立服务器的IP连接地址.
  • 具有外部 IP 地址的计算实例运行 apache &php成功上网
  • 尝试按照 https://drupal.org 的第 4 步从 Web 浏览器配置数据库连接/documentation/install/run-script 用于在计算实例上运行的 drupal 代码
  • 具有可访问 Internet 的 IP 地址的独立服务器
  • Cloud SQL with external IP address assigned. Also authorized external IP address of compute instance & Independent Server's IP address to connect.
  • Compute Instance with external IP address running apache & php successfully on the internet
  • Trying to configure database connection from web browser as per step 4 of https://drupal.org/documentation/install/run-script for drupal code running on compute instance
  • Independent Server with internet accessible IP address

用户

  • 已设置 SQL Root 用户密码并成功用于连接使用 Workbench 的独立服务器
  • 创建了来自主机 % 的 Db 用户以访问 drupal 数据库，并且可以使用工作台从独立服务器成功连接
  • 同一数据库用户不会从计算实例连接

网络

  • 在计算实例上运行 ifconfig 只显示私有 IP 地址
  • 我已经在谷歌防火墙和实例防火墙上开启了3306

我的问题是如何通过提供 dbname、dbusername、dbuserpwd、host(IPAddress) 让计算实例连接到云 SQL，以便它完全像工作台一样连接，但仍然尽可能受到限制?问题是否出在计算实例的配置、使用提供的连接设置或云 sql

My question is how do I get the compute instance to connect to cloud SQL by supplying the dbname, dbusername, dbuserpwd,host(IPAddress) so that it connects exactly like workbench but still have as restricted as possible? Does the issue lie with the configuration of the compute instance, the connection settings used supplied or cloud sql

推荐答案

这看起来是由安装程序丢弃或忽略主机值的 drupal 问题和限制远程 db 连接的 SELinux 保护强制问题的组合CentOS 这是我使用的客户操作系统

It looks to be a combination of a drupal issue where the host value is discarded or omitted by the installer and an SELinux protection enforcement issue that restricts remote db connections from CentOS which is the guest OS I was using

在将文件添加到 Web 根文件夹后，可能还需要使用正确的 SELinux 标签重新标记文件

There is also may be a need to relabel files with their correct SELinux label after adding them to the web root folder

要解决它:自己编辑 drupal 7 settings.php 以包含 mysql 连接

To resolve it: Edit the drupal 7 settings.php yourself to include a mysql connection 

$databases = array (
  'default' =>
  array (
    'default' =>
    array (
      'database' => 'dbname',
      'username' => 'dbuser',
      'password' => 'dbpassword',
      'host' => 'CloudSQLIPAddress',
      'port' => '',
      'driver' => 'mysql',
      'prefix' => '',
    ),
  ),
);

并从运行 CentOS 的 GCE 实例中的 ssh 运行以下命令以允许 db 连接，我认为此设置不会在服务器重新启动后继续存在，但我可以根据需要使用它

and from ssh inside the GCE instance running CentOS run the command below to allow db connections out, I don't think this setting will survive a server reboot but I can live with it for my needs

 setsebool httpd_can_network_connect_db=1

要将 SElinux 上下文重新应用于复制的文件，请运行此

To reapply SElinux context to copied files run this 

restorecon -rv /var/www/html

相关文章