How do I install and use Galera and MariaDB >= version 10.1 with TLS on RHEL 7 or CentOS 7 and keep SELinux enabled in enforcing mode without using SCL (software collections)?
How do I install and use Galera and MariaDB 10.1 on RHEL or CentOS with SELinux Enabled
centos;rhel;ssl;selinux;mariadb
AssumptionsYou are not using RHEL 7 SCL (software collections) or rh-mariadb101{,-galera}You have RHEL 7 / CentOS 7 servers with EPEL already installedSELinux is required, running, and enforcingFirewalld is running and blocks by defaultYour 3 host IPs are 1.2.3.4, 1.2.3.5, and 1.2.3.6Firewall ConfigurationThe ports required for Galera & MariaDB to function properly are TCP ports 4444, 4567, and 4568 and UDP port 4567.  MariaDB requires TCP port 3306.  In this configuration we assume hosts 1.2.3.4, 1.2.3.5, and 1.2.3.6 are permitted to be part of the cluster, as well as a future host IP 1.2.3.7.  This configuration also assumes any host is allowed to connect on port 3306.  Login and su - to root.  Run the following commands.# firewall-cmd --zone=public --add-port=3306/tcp# firewall-cmd --zone=public --add-port=3306/tcp --permanent# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4444 protocol=tcp accept'# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4444 protocol=tcp accept' --permanent# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4567 protocol=tcp accept'# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4567 protocol=tcp accept' --permanent# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4568 protocol=tcp accept'# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4568 protocol=tcp accept' --permanent# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4567 protocol=udp accept'# firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=1.2.3.4/30 port port=4567 protocol=udp accept' --permanentSELinux Policy PreparationLogin and su - to root.  Run or perform the following steps.  The last line is only required for a non-default data location.  Note that if you set a data location within /home or /usr systemd will prohibit MariaDB from writing and MariaDB will fail.  To work around this, set ProtectSystem=false in the unit file /lib/systemd/system/mariadb.service.  Then run systemctl daemon-reload.# mkdir selinux && cd selinux# cat > galera.te << XYZZYmodule galera 1.0;require {        type unconfined_t;        type initrc_tmp_t;        type rsync_exec_t;        type init_t;        type mysqld_t;        class process setpgid;        class file { execute execute_no_trans getattr open read };        class service enable;}#============= mysqld_t ==============allow mysqld_t initrc_tmp_t:file open;allow mysqld_t rsync_exec_t:file { execute execute_no_trans getattr open read };allow mysqld_t self:process setpgid;#============= unconfined_t ==============allow unconfined_t init_t:service enable;XYZZY# checkmodule -M -m galera.te -o galera.mod# semodule_package -m galera.mod -o galera.pp# semodule -i galera.pp# semanage port -m -t mysqld_port_t -p tcp 4567# semanage port -m -t mysqld_port_t -p udp 4567# semanage port -m -t mysqld_port_t -p tcp 4444# semanage port -m -t mysqld_port_t -p tcp 4568# semanage fcontext -a -t mysqld_db_t /alternate/path/to/data/mysql(/.*)?MariaDB Repository Addition, Package Installation, ConfigurationDownload https://yum.mariadb.org/RPM-GPG-KEY-MariaDB.  Ensure that web server giving you this key is trustworthy; the security of your new repository depends on this.# cp RPM-GPG-KEY-MariaDB /etc/pki/rpm-gpg/ ; chmod ugo+r /etc/pki/rpm-gpg/RPM-GPG-KEY-MariaDB# cat > /etc/yum.repos.d/mariadb.repo << XYZZY[mariadb]name = MariaDBbaseurl = http://yum.mariadb.org/10.1/rhel7-amd64gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-MariaDBgpgcheck = 1enabled = 1XYZZY# chmod ugo+r /etc/yum.repos.d/mariadb.repo# yum install MariaDB-server galeraOnce youve got the packages installed, you must configure MariaDB per normal procedure before creating the cluster.  The first line below is only necessary if you wish to use a different data location from the default.# mysql_install_db --user=mysql --group=mysql --ldata=/alternate/path/to/data/mysql# systemctl start mariadb# mysql_secure_installation# systemctl stop mariadb# galera_new_clusterCheck to see if MariaDB + Galera is running.  If so, you can configure the next two hosts.  Install the SELinux rules and software packages as before, but immediately add the following lines to the [galera] section in /etc/my.cnf.d/server.cnf.  Assumes the original galera servers IP is 1.2.3.4 and its peers will be 1.2.3.5 and 1.2.3.6.  Set the cache size to something appropriate for your systems.[galera]wsrep_on=ONwsrep_provider=/usr/lib64/galera/libgalera_smm.sowsrep_provider_options=gcache.size=1024M; gcache.page_size=1024Mwsrep_cluster_address=gcomm://1.2.3.4,1.2.3.5,1.2.3.6binlog_format=rowdefault_storage_engine=InnoDBinnodb_autoinc_lock_mode=2# systemctl start mariadbAt this point, logs should indicate that data has replicated from the first server to the current server.  Repeat these steps on the remaining server(s).  Now stop MariaDB on the original server and add the galera configuration to /etc/my.cnf.d/server.cnf.  Restart MariaDB on the original server.  Verify that data is synchronizing between the peers.Enable TLSThis optional section assumes that you have already generated an X.509v3 certificate and corresponding private key.  Both the certificate and key should be stored in unencrypted PEM format.  For this example the filenames are assumed to be server.crt and server.key respectively.# cp server.crt /etc/pki/tls/certs/ ; chmod ugo+r /etc/pki/tls/certs/server.crt ; cp server.key /etc/pki/tls/private/server.key ; chmod 640 /etc/pki/tls/private/server.key ; chgrp mysql /etc/pki/tls/private/server.keyAdd the following lines into /etc/my.cnf.d/server.cnf in the [mysqld] section:    ssl_cert=/etc/pki/tls/certs/server.crt    ssl_key=/etc/pki/tls/private/server.keyCreate /etc/systemd/system/mariadb.service.d/TLS.conf with the following content:[service]Environment=MYSQLD_OPTS=--sslSystemd is as systemd does, so run systemctl daemon-reload again to read the new configuration.Server restart is required in order for MariaDB to accept TLS connections.  Note that TLS is available, but not required at this stage of configuration.Check the logs to verify that MariaDB loaded with TLS enabled: journalctl _SYSTEMD_UNIT=mariadb.service.  Failure to start TLS is only logged as a [Warning] :^(This is my first pass at this.  I'll be happy to incorporate improvements :^)