CentOS 7下安装配置Puppet
实验环境:centos 7.4
Master主机: 192.168.80.102
Client01主机:192.168.80.103
Client02主机:192.168.80.104
注:需联网
使用centos7.4 默认自带的YUM仓库
vi /etc/hostname
master
client01
client02
cd /etc/yum.repos.d/
cp back/* ./
搭建时间同步
service firewalld stop
setenforce 0
yum install ntp -y
service firewalld stop
setenforce 0
yum install ntp -y
vi /etc/ntp.conf
restrict 192.168.80.0 mask 255.255.255.0 nomodify notrap 将前面的“#”去掉,在下面添加下面的内容:
server 127.127.1.0
fudge 127.127.1.0 stratum 8
service ntpd start
systemctl enable ntpd
搭建puppetmaster
vi /etc/hosts
192.168.80.102 master
192.168.80.103 client01
192.168.80.104 client02
yum install -y epel-release
yum -y install ruby ruby-libs ruby-shadow
yum -y install puppet puppet-server facter
puppet服务证书请求与签名
vi /etc/puppet/puppet.conf //在[main]下新增
modulepath = /etc/puppet/modules:/usr/share/puppet/modules
systemctl start puppetmaster
systemctl enable puppetmaster
netstat -anpt | grep 8140
搭建puppetClient
在客户端Client01:
service firewalld stop
setenforce 0
yum install ntp -y
ntpdate 192.168.80.102 //同步时钟源
vi /etc/hosts //添加
192.168.80.100 master
192.168.80.101 client01
192.168.80.102 client02
yum install -y epel-release
yum install -y puppet
vi /etc/puppet/puppet.conf //在[agent]下添加,末尾添加
server = master
service puppet start
systemctl enable puppet
ps aux | grep pupp
Client02的配置过程与此相似 注意主机名改为client02
service firewalld stop
setenforce 0
yum install ntp -y
ntpdate 192.168.80.102
vi /etc/hosts //添加
192.168.80.100 master
192.168.80.101 client01
192.168.80.102 client02
yum install -y epel-release
yum install -y puppet
vi /etc/puppet/puppet.conf //在[agent]下添加
server = master
service puppet start
systemctl enable puppet
ps aux | grep puppet //查看puppet的进程
申请与注册
client上操作–接着在服务器上授权
在client上:申请注册
puppet agent --server=master --no-daemonize --verbose --debug
在master上:
puppet cert --list //查看申请的客户端
看到这说明是正确的
puppet cert sign --all //将未注册的客户端进行注册
ll /var/lib/puppet/ssl/ca/signed/ //查看已经注册的客户端
注:认证报错后
find /var/lib/puppet -type f -print0 |xargs -0r rm //删除认证ssl
将删除语句执行在了master主机上,客户端连接报以下错
重启puppetmaster即可
在客户端看到类似这样才是正确的结果
配置实例:
为了保护linux的ssh端口,批量修改客户端sshd端口,将22端口修改为9922,并实现重启工作。
1、创建必要的目录
在master上:
mkdir -p /etc/puppet/modules/ssh/{manifests,templates,files}
//创建ssh模块,模块下面有三个文件:manifests、templates和files
mkdir /etc/puppet/manifests/nodes //创建节点目录
mkdir /etc/puppet/modules/ssh/files/ssh //创建ssh模块目录
chown -R puppet /etc/puppet/modules/
ll /etc/puppet/modules/ssh/
看到这三个说明创建成功
2、创建模块配置文件install.pp
vi /etc/puppet/modules/ssh/manifests/install.pp //新建文件(首先确定客户端安装ssh服务)
class ssh::install{
package{“openssh”:
ensure => present,
}
}
vi /etc/puppet/modules/ssh/manifests/config.pp//新建文件
class ssh::config{
file {"/etc/ssh/sshd_config":
ensure => present,
owner => “root”,
group => “root”,
mode => “0600”,
source => “puppet://$puppetserver/modules/ssh/ssh/sshd_config”,
require => Class[“ssh::install”],
notify => Class[“ssh::service”],
}
}
vi /etc/puppet/modules/ssh/manifests/service.pp //新建文件
class ssh::service {
service {“sshd”:
ensure=>running,
hasstatus=>true,
hasrestart=>true,
enable=>true,
require=>Class[“ssh::config”]
}
}
vi /etc/puppet/modules/ssh/manifests/init.pp //新建文件
class ssh{
include ssh::install,ssh::config,ssh::service
}
ll /etc/puppet/modules/ssh/manifests/ //下面有四个文件
cp /etc/ssh/sshd_config /etc/puppet/modules/ssh/files/ssh/
chown puppet /etc/puppet/modules/ssh/files/ssh/sshd_config //修改权限
vi /etc/puppet/manifests/nodes/ssh.pp
node ‘client02’ {
include ssh
}
node ‘client01’ {
include ssh
}
vi /etc/puppet/manifests/site.pp //新建文件
import “nodes/ssh.pp”
vi /etc/puppet/modules/ssh/files/ssh/sshd_config //修改(13)
Port 9922
service puppetmaster restart //重新启动puppet
client客户端主动拉取
puppet agent -t
cat /etc/ssh/sshd_config //验证如下
从上图,可以看出更换了ssh的端口。
netstat -tunlp| grep ssh //查看服务器ssh服务是否重启,端口是否生效
配置服务器推送同步
在客户端上:
vi /etc/puppet/puppet.conf //最后一行添加
listen = true
vi /etc/puppet/auth.conf //最后一行添加
allow *
service puppet restart //启动puppet客户端
cat /etc/ssh/sshd_config //查看
netstat -tunlp| grep ssh //确认启动ssh服务
在master上
puppet kick master //开始往客户端推送
vi /etc/ssh/sshd_config //在master上查看,验证如下
netstat -tunlp| grep sshd //master上查看,查看服务器ssh服务是否重启,端口是否生效