自动化运维之Puppet

CentOS 7下安装配置Puppet

实验环境：centos 7.4
Master主机： 192.168.80.102
Client01主机：192.168.80.103
Client02主机：192.168.80.104

注：需联网
使用centos7.4 默认自带的YUM仓库
vi /etc/hostname
master
client01
client02

cd /etc/yum.repos.d/
cp back/* ./

搭建时间同步
service firewalld stop
setenforce 0
yum install ntp -y

service firewalld stop
setenforce 0
yum install ntp -y

vi /etc/ntp.conf
restrict 192.168.80.0 mask 255.255.255.0 nomodify notrap 将前面的“#”去掉，在下面添加下面的内容：
server 127.127.1.0
fudge 127.127.1.0 stratum 8

service ntpd start
systemctl enable ntpd

搭建puppetmaster
vi /etc/hosts
192.168.80.102 master
192.168.80.103 client01
192.168.80.104 client02

yum install -y epel-release
yum -y install ruby ruby-libs ruby-shadow
yum -y install puppet puppet-server facter
puppet服务证书请求与签名
vi /etc/puppet/puppet.conf //在[main]下新增
modulepath = /etc/puppet/modules:/usr/share/puppet/modules

systemctl start puppetmaster
systemctl enable puppetmaster

netstat -anpt | grep 8140

搭建puppetClient
在客户端Client01：
service firewalld stop
setenforce 0
yum install ntp -y
ntpdate 192.168.80.102 //同步时钟源

vi /etc/hosts //添加
192.168.80.100 master
192.168.80.101 client01
192.168.80.102 client02

yum install -y epel-release
yum install -y puppet
vi /etc/puppet/puppet.conf //在[agent]下添加，末尾添加
server = master

service puppet start
systemctl enable puppet
ps aux | grep pupp

Client02的配置过程与此相似 注意主机名改为client02
service firewalld stop
setenforce 0
yum install ntp -y
ntpdate 192.168.80.102

vi /etc/hosts //添加
192.168.80.100 master
192.168.80.101 client01
192.168.80.102 client02

yum install -y epel-release
yum install -y puppet

vi /etc/puppet/puppet.conf //在[agent]下添加
server = master

service puppet start
systemctl enable puppet
ps aux | grep puppet //查看puppet的进程

申请与注册
client上操作–接着在服务器上授权

在client上：申请注册
puppet agent --server=master --no-daemonize --verbose --debug

在master上：
puppet cert --list //查看申请的客户端

看到这说明是正确的
puppet cert sign --all //将未注册的客户端进行注册
ll /var/lib/puppet/ssl/ca/signed/ //查看已经注册的客户端

注：认证报错后
find /var/lib/puppet -type f -print0 |xargs -0r rm //删除认证ssl
将删除语句执行在了master主机上，客户端连接报以下错
重启puppetmaster即可
在客户端看到类似这样才是正确的结果

配置实例：
为了保护linux的ssh端口，批量修改客户端sshd端口，将22端口修改为9922，并实现重启工作。
1、创建必要的目录
在master上：
mkdir -p /etc/puppet/modules/ssh/{manifests,templates,files}
//创建ssh模块，模块下面有三个文件：manifests、templates和files

mkdir /etc/puppet/manifests/nodes //创建节点目录
mkdir /etc/puppet/modules/ssh/files/ssh //创建ssh模块目录
chown -R puppet /etc/puppet/modules/
ll /etc/puppet/modules/ssh/

看到这三个说明创建成功
2、创建模块配置文件install.pp
vi /etc/puppet/modules/ssh/manifests/install.pp //新建文件（首先确定客户端安装ssh服务）

class ssh::install{
package{“openssh”:
ensure => present,
}
}
vi /etc/puppet/modules/ssh/manifests/config.pp//新建文件
class ssh::config{
file {"/etc/ssh/sshd_config":
ensure => present,
owner => “root”,
group => “root”,
mode => “0600”,
source => “puppet://$puppetserver/modules/ssh/ssh/sshd_config”,
require => Class[“ssh::install”],
notify => Class[“ssh::service”],
}
}

vi /etc/puppet/modules/ssh/manifests/service.pp //新建文件
class ssh::service {
service {“sshd”:
ensure=>running,
hasstatus=>true,
hasrestart=>true,
enable=>true,
require=>Class[“ssh::config”]
}
}

vi /etc/puppet/modules/ssh/manifests/init.pp //新建文件
class ssh{
include ssh::install,ssh::config,ssh::service
}
ll /etc/puppet/modules/ssh/manifests/ //下面有四个文件

cp /etc/ssh/sshd_config /etc/puppet/modules/ssh/files/ssh/
chown puppet /etc/puppet/modules/ssh/files/ssh/sshd_config //修改权限

vi /etc/puppet/manifests/nodes/ssh.pp
node ‘client02’ {
include ssh
}
node ‘client01’ {
include ssh
}
vi /etc/puppet/manifests/site.pp //新建文件
import “nodes/ssh.pp”

vi /etc/puppet/modules/ssh/files/ssh/sshd_config //修改（13）
Port 9922

service puppetmaster restart //重新启动puppet
client客户端主动拉取
puppet agent -t
cat /etc/ssh/sshd_config //验证如下

从上图，可以看出更换了ssh的端口。
netstat -tunlp| grep ssh //查看服务器ssh服务是否重启，端口是否生效
配置服务器推送同步
在客户端上：
vi /etc/puppet/puppet.conf //最后一行添加
listen = true

vi /etc/puppet/auth.conf //最后一行添加
allow *
service puppet restart //启动puppet客户端
cat /etc/ssh/sshd_config //查看

netstat -tunlp| grep ssh //确认启动ssh服务
在master上
puppet kick master //开始往客户端推送
vi /etc/ssh/sshd_config //在master上查看，验证如下

netstat -tunlp| grep sshd //master上查看，查看服务器ssh服务是否重启，端口是否生效