案例分析：
在KingbaseES V8R6集群部署时，需要建立节点之间ssh互信（或者使用securecmdd工具），在有的生产环境，为了安全起见会修改ssh的默认端口；KingbaseES V8R6集群部署提供了脚本用于创建ssh互信，如果修改了系统的ssh端口号后，也需要修改对应的脚本。
适用版本：
KingbaseES V8R6
一、集群节点信息
[root@node101 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.101 node101
192.168.1.102 node102
192.168.1.103 node103
二、配置系统修改ssh端口
[root@node101 ~]# cat /etc/ssh/sshd_config|grep -i port
# If you want to change the port on a SELinux system, you have to tell
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
Port 222
[root@node101 ~]# cat /etc/services|grep ssh
ssh 222/tcp # The Secure Shell (SSH) Protocol
ssh 222/udp # The Secure Shell (SSH) Protocol
---如上所示，将ssh默认端口22改为222。
三、系统测试ssh连接
[root@node101 ~]# ssh -p 222 node102
root@node102's password:
Last login: Tue May 23 14:41:48 2023 from 192.168.1.101
[kingbase@node102 ~]$ ssh node101 -p 222
kingbase@node101's password:
Last login: Tue May 23 14:42:51 2023 from 192.168.1.102
---如上所示，可以通过ssh 222端口建立连接。
三、修改部署脚本ssh端口
1、查看脚本文件
# 如下所示，trust_cluster.sh用于创建ssh互信。
[kingbase@node101 r6_install]$ ls -lh
total 264M
-rw-rw-r-- 1 kingbase kingbase 261M Apr 7 2022 db.zip
-rw-rw-r-- 1 kingbase kingbase 9.0K Aug 8 2022 install.conf
-rwxr-x--- 1 kingbase kingbase 3.4K Apr 7 14:07 license.dat
-rw-rw-r-- 1 kingbase kingbase 2.1M Apr 7 2022 securecmdd.zip
-rwxrwxr-x 1 kingbase kingbase 3.3K Apr 7 2022 trust_cluster.sh
-rwxr-xr-x 1 kingbase kingbase 87K Aug 8 2022 V8R6_cluster_install.sh
2、查看脚本中ssh配置
如下所示：trust_cluster.sh脚本中指定ssh端口的位置，需要读取install.conf文件中ssh_port参数。
3、修改配置文件install.conf和脚本
[kingbase@node101 r6_install]$ cat install.conf |grep ssh_port
ssh_port="222" # the port of ssh, default is 22
[kingbase@node101 r6_install]$ cat trust_cluster.sh |grep 222
[ "${ssh_port}"x = ""x ] && ssh_port=222
ssh -q -o Batchmode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o ServerAliveInterval=2 -o ServerAliveCountMax=5 -p 222 root@localhost "/bin/true 2>/dev/null || /usr/bin/true 2>/dev/null"
四、执行脚本创建ssh互信
[root@node101 ~]# cd /home/kingbase/r6_install/
[root@node101 r6_install]# sh trust_cluster.sh
Generating public/private rsa key pair.
Your identification hasbeen saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:yYAYwVk2GWG4ywfSWftgnmz8BUAbYWR5eW4Ftor9Dw0 root@node101
The key's randomart image is:
+---[RSA 2048]----+
| .oB#* .o. |
| +B==o.... |
| ..+o+.o.. |
|. = +o.+o. |
| o B.+ooE |
| o B ...o |
| o . .o . |
| . o |
| . |
+----[SHA256]-----+
root@192.168.1.102's password:
root@192.168.1.102's password:
Generating public/private rsa key pair.
Created directory '/root/.ssh'.
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:IskHNGjXdEmbN+ONH7XWDOBimvD3cdsLYFRidNDMYBk root@node102
The key's randomart image is:
+---[RSA 2048]----+
| .oo..o..EXo |
| o......ooo+= |
| . .. . o *.. o |
| . o o *.* . = |
| + o S +o+ + o|
| o . ..o.= o |
| o.. .|
| . .|
| . |
+----[SHA256]-----+
root@192.168.1.102's password:
authorized_keys 100% 394 739.7KB/s 00:00
id_rsa 100% 1679 4.0MB/s 00:00
id_rsa.pub 100% 394 1.5MB/s 00:00
known_hosts 100% 372 1.1MB/s 00:00
The authenticity of host '[192.168.1.101]:222 ([192.168.1.101]:222)' can't be established.
ECDSA key fingerprint is SHA256:ACjDx1phzBUWGNOtXaeDl+NS6L5FGdUKXh4kjzWwVyk.
ECDSA key fingerprint is MD5:bb:98:fe:fb:94:fc:cf:3c:99:72:7f:09:91:25:64:23.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.1.101]:222' (ECDSA) to the list of known hosts.
五、测试ssh互信
如下所示，root用户及kingbase用户的ssh互信创建成功。
[root@node101 r6_install]# ssh node102
Last login: Tue May 23 14:44:29 2023 from 192.168.1.101
[root@node101 r6_install]# su - kingbase
Last login: Tue May 23 14:44:53 CST 2023 on pts/0
[kingbase@node101 ~]$ ssh node102
Last login: Tue May 23 14:43:48 2023 from 192.168.1.101
[kingbase@node102 ~]$ ssh node101
Last login: Tue May 23 14:49:36 2023 from 192.168.1.102
[kingbase@node101 r6_install]$ ssh -p 222 root@node102
Last login: Tue May 23 14:48:35 2023 from 192.168.1.101
六、总结
对于集群环境修改了ssh端口后，注意系统和脚本都要做相应的修改，才能完成ssh互信的创建。