1) 在服務端安裝ansible
|
1
|
[root@ansible-server ~]
# yum install -y ansible
|
2) 配置ansible到遠程主機的ssh無密碼信任關系 (authoried_keys 模塊)
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
批量實現多台服務器之間
ssh
無密碼登錄的相互信任關系, 可以參考之前的文章: https:
//www
.cnblogs.com
/kevingrace/p/9063745
.html
這里采用Ansible 實現批量建立互信, 方法如下:
首先要生成ansible服務端本機
ssh
的key
[root@ansible-server ~]
# ssh-keygen -t rsa //一路回車
[root@ansible-server ~]
# ls /root/.ssh/
id_rsa id_rsa.pub
====================================================
需要注意
ssh
建立互信的命令格式:
# ssh-copy-id -i ~/.ssh/id_rsa.pub username@[ip,hostname]
====================================================
在客戶機比較多的情況下，使用
ssh
-copy-
id
命令的方法顯然是有些費時，使用ansible-playbook 推送 ymal進行批量創建
ssh
互信關系就顯得省事多了，
這里就使用到了ansible的authoried_keys 模塊:
首先要配置ansible清單 (遠程主機的密碼這里為
"123456"
)
[root@ansible-server ~]
# vim /etc/ansible/hosts
................
................
[
ssh
-host]
172.16.60.204
172.16.60.205
172.16.60.206
172.16.60.207
[
ssh
-host:vars]
ansible_ssh_pass=
"123456"
==========================================================
發送公鑰到目標機器命令格式如下:
# ansible ssh-host -m copy -a "src=/root/.ssh/id_rsa.pub dest=/root/.ssh/authorized_keys mode=600"
==========================================================
編寫playbook文件
[root@ansible-server ~]
# vim /opt/ssh_key.yaml
---
- hosts:
ssh
-host
user: root
tasks:
- name:
ssh
-copy
authorized_key: user=root key=
"{{ lookup('file', '/root/.ssh/id_rsa.pub') }}"
注意上面yaml腳本中的
"ssh-key-host"
是在
/etc/ansible/hosts
清單文件里配置的遠程客戶機列表
這里做的是基於遠程主機root用戶的
ssh
互信
執行批量互信
[root@ansible-server ~]
# ansible-playbook /opt/ssh_key.yaml
PLAY [
ssh
-host] ************************************************************************************************************************
TASK [Gathering Facts] *****************************************************************************************************************
ok: [172.16.60.204]
ok: [172.16.60.205]
ok: [172.16.60.206]
ok: [172.16.60.207]
TASK [
ssh
-copy] ************************************************************************************************************************
changed: [172.16.60.205]
changed: [172.16.60.204]
changed: [172.16.60.206]
changed: [172.16.60.207]
PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.205 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.206 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.207 : ok=2 changed=1 unreachable=0 failed=0
最后驗證下
ssh
互信
[root@ansible-server ~]
# ansible -i /etc/ansible/hosts ssh-host -m shell -a "whoami"
172.16.60.204 | SUCCESS | rc=0 >>
root
172.16.60.205 | SUCCESS | rc=0 >>
root
172.16.60.207 | SUCCESS | rc=0 >>
root
172.16.60.206 | SUCCESS | rc=0 >>
root
至此, ansible批量創建到遠程客戶機的
ssh
信任關系已經實現了!
|
3) Ansible批量更新遠程主機用戶密碼方法
方法一: 使用Ansible的user模塊批量修改遠程客戶機的用戶密碼
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
由於在使用ansible修改用戶密碼的時候不能使用明文的方式，需要先加密，所以就需要使用一個方法對輸入的明文的密碼進行加密.
廢話不多說了. 下面直接記錄下操作方法:
[root@ansible-server ~]
# vim /opt/root_passwd.yaml
---
- hosts:
ssh
-host
gather_facts:
false
tasks:
- name: change user
passwd
user: name={{ item.name }} password={{ item.chpass | password_hash(
'sha512'
) }} update_password=always
with_items:
- { name:
'root'
, chpass:
'kevin@123'
}
- { name:
'app'
, chpass:
'bjop123'
}
注意上面在yaml文件中修改了遠程客戶機的root用戶密碼, app用戶密碼.
如果還想要修改其他用戶密碼, 則繼續按照上面規則添加即可!
執行ansible-play
[root@ansible-server ~]
# ansible-playbook /opt/root_passwd.yaml
PLAY [
ssh
-host] ************************************************************************************************************************
TASK [change user
passwd
] **************************************************************************************************************
changed: [172.16.60.204] => (item={u
'chpass'
: u
'kevin@123'
, u
'name'
: u
'root'
})
changed: [172.16.60.205] => (item={u
'chpass'
: u
'kevin@123'
, u
'name'
: u
'root'
})
changed: [172.16.60.204] => (item={u
'chpass'
: u
'bjop123'
, u
'name'
: u
'app'
})
changed: [172.16.60.205] => (item={u
'chpass'
: u
'bjop123'
, u
'name'
: u
'app'
})
changed: [172.16.60.206] => (item={u
'chpass'
: u
'kevin@123'
, u
'name'
: u
'root'
})
changed: [172.16.60.206] => (item={u
'chpass'
: u
'bjop123'
, u
'name'
: u
'app'
})
changed: [172.16.60.207] => (item={u
'chpass'
: u
'kevin@123'
, u
'name'
: u
'root'
})
changed: [172.16.60.207] => (item={u
'chpass'
: u
'bjop123'
, u
'name'
: u
'app'
})
PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.205 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.206 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.207 : ok=1 changed=1 unreachable=0 failed=0
|
方法二: 修改遠程主機的單個用戶密碼使用此方法比較方便
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
編寫playbook文件
[root@ansible-server ~]
# vim /opt/root_passwd2.yaml
---
- hosts:
ssh
-host
gather_facts:
false
tasks:
- name: Change password
user: name={{ name1 }} password={{ chpass | password_hash(
'sha512'
) }} update_password=always
執行ansible-playbook, 使用-e參數傳遞用戶名和密碼給劇本，其中root為用戶名，admin
#123就是修改后的root密碼
[root@ansible-server ~]
# ansible-playbook /opt/root_passwd2.yaml -e "name1=root chpass=admin#123"
PLAY [
ssh
-host] ************************************************************************************************************************
TASK [Change password] *****************************************************************************************************************
changed: [172.16.60.204]
changed: [172.16.60.205]
changed: [172.16.60.206]
changed: [172.16.60.207]
PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.205 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.206 : ok=1 changed=1 unreachable=0 failed=0
172.16.60.207 : ok=1 changed=1 unreachable=0 failed=0
|
方法三: 使用如下Ansible腳本, 適用於修改清單中部分遠程主機的用戶密碼
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
編寫ansible-playbook腳本 (需要注意下面腳本中
"ens192"
是客戶機ip所在的網卡設備名稱, 這個要根據自己實際環境去配置, 比如eth0, eth1等)
[root@ansible-server ~]
# cat /opt/root_passwd4.yaml
- hosts:
test
-host
remote_user: root
tasks:
- name: change password
for
root
shell:
echo
'{{ item.password }}'
|
passwd
--stdin root
when: ansible_ens192.ipv4.address ==
'{{ item.ip }}'
with_items:
- { ip:
"172.16.60.220"
, password:
'haha@123'
}
- { ip:
"172.16.60.221"
, password:
'kevin@123'
}
- { ip:
"172.16.60.222"
, password:
'bobo@123'
}
執行ansible-playbook:
[root@ansible-server ansible]
# ansible-playbook /opt/root_passwd3.yaml
PLAY [
ssh
-host] ************************************************************************************************************************
TASK [Gathering Facts] *****************************************************************************************************************
ok: [172.16.60.204]
ok: [172.16.60.205]
ok: [172.16.60.206]
ok: [172.16.60.207]
TASK [change password
for
root] ********************************************************************************************************
[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address
==
'{{ item.ip }}'
[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address
==
'{{ item.ip }}'
skipping: [172.16.60.205] => (item={u
'ip'
: u
'172.16.60.204'
, u
'password'
: u
'haha@123'
})
[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address
==
'{{ item.ip }}'
skipping: [172.16.60.206] => (item={u
'ip'
: u
'172.16.60.204'
, u
'password'
: u
'haha@123'
})
skipping: [172.16.60.206] => (item={u
'ip'
: u
'172.16.60.205'
, u
'password'
: u
'kevin@123'
})
[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address
==
'{{ item.ip }}'
skipping: [172.16.60.207] => (item={u
'ip'
: u
'172.16.60.204'
, u
'password'
: u
'haha@123'
})
skipping: [172.16.60.207] => (item={u
'ip'
: u
'172.16.60.205'
, u
'password'
: u
'kevin@123'
})
skipping: [172.16.60.207] => (item={u
'ip'
: u
'172.16.60.206'
, u
'password'
: u
'bobo@123'
})
changed: [172.16.60.205] => (item={u
'ip'
: u
'172.16.60.205'
, u
'password'
: u
'kevin@123'
})
skipping: [172.16.60.205] => (item={u
'ip'
: u
'172.16.60.206'
, u
'password'
: u
'bobo@123'
})
changed: [172.16.60.204] => (item={u
'ip'
: u
'172.16.60.204'
, u
'password'
: u
'haha@123'
})
skipping: [172.16.60.204] => (item={u
'ip'
: u
'172.16.60.205'
, u
'password'
: u
'kevin@123'
})
skipping: [172.16.60.204] => (item={u
'ip'
: u
'172.16.60.206'
, u
'password'
: u
'bobo@123'
})
changed: [172.16.60.206] => (item={u
'ip'
: u
'172.16.60.206'
, u
'password'
: u
'bobo@123'
})
PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.205 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.206 : ok=2 changed=1 unreachable=0 failed=0
172.16.60.207 : ok=1 changed=0 unreachable=0 failed=0
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
如果ansible服務端沒有和遠程主機做
ssh
信任關系, 則可以在hosts清單配置里直接指明用戶名和密碼.
如果使用普通用戶, 並且允許
sudo
, 則需要提前在客戶機里的
/etc/sudoers
文件里配置好該普通用戶的
sudo
配置, 即允許該普通用戶有
sudo
權限.
[root@ansible-server ~]
# vim /etc/ansible/hosts
................
[
test
-host]
172.16.60.220 ansible_ssh_user=root ansible_ssh_pass=123456 ansible_ssh_port=22
172.16.60.221 ansible_ssh_user=root ansible_ssh_pass=bo@123 ansible_ssh_port=22
172.16.60.222 ansible_ssh_user=app ansible_ssh_pass=bj@123 ansible_ssh_port=22 ansible_sudo_pass=bj@123
即172.16.60.220客戶機上要提前配置, 允許app用戶具有
sudo
權限.
執行:
[root@ansible-server ~]
# ansible test-host -m shell -a "hostname"
172.16.60.222 | SUCCESS | rc=0 >>
k8s-node02
172.16.60.220 | SUCCESS | rc=0 >>
k8s-master01
172.16.60.221 | SUCCESS | rc=0 >>
k8s-node01
[root@ansible-server ~]
# ansible -i /etc/ansible/hosts test-host -m shell -a "hostname"
172.16.60.222 | SUCCESS | rc=0 >>
k8s-node02
172.16.60.220 | SUCCESS | rc=0 >>
k8s-master01
172.16.60.221 | SUCCESS | rc=0 >>
k8s-node01
|