Ansible-AD-HOC

ansible安装用epel源
配置文件：
[root@localhost ~]# vim /etc/ansible/ansible.cfg
#inventory = /etc/ansible/hosts #主机列表配置文件
#library = /usr/share/my_modules/ #库文件存放目录
#remote_tmp = ~/.ansible/tmp #临时py文件存放在远程主机目录
#local_tmp = ~/.ansible/tmp #本机的临时执行目录
#forks = 5 #默认并发数
#sudo_user = root # 默认sudo用户
#ask_sudo_pass = True #每次执行是否询问sudo的ssh密码
#ask_pass = True #每次执行是询问ssh密码
#remote_port = 22 #远程主机端口
#module_set_locale = False #跳过检查主机指纹
log_path = /var/log/ansible.log #ansible日志
安装–配置–启动
rpm -qa httpd
pm -qc httpd(查看配置文件)
主机清单：
[root@localhost project1]# ansible mahaohui -m ping -i hosts
192.168.142.142 | FAILED! => {
“msg”: “Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host’s fingerprint to your known_hosts file to manage this host.”
}
PS:报错时（未做ssh免密设置）
ssh-keygen
ssh-copy-id mhh@192.168.142.142
ansible mahaohui -m ping -i hosts
方式2：（常用）
1.mkdir project1/
2.sshpass -p 123 ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.142.142
3.vim hosts
[mahaohui]
192.168.142.142
PS:列出主机情况
ansible mahaohui/all -i hosts --list-host
调整参数：
vim /etc/ansible/ansible.cfg
解除注释：host_key_checking = False
注意：ansible.cfg读取顺序
AD-HOC：
ansible mahaohui -m command -a “df -h(具体命令)” -i hosts
常用模块：
命令 command(默认) shell模块 scripts
安装 yum
配置 copy
启动 service systemd
用户 user group
任务 cron
挂载 mount
防火墙 firewall selinux
command shell 本质上都是执行基础命令（command不支持管道技术）
ansible mahaohui -m command -a “ps aux|grep nginx” -i hosts
ansible mahaohui -m shell -a “ps aux|grep nginx” -i hosts
1.yum模块
ansible-doc yum(查看yum帮助)
（1）安装当前最新的Apache软件，如果存在则更新
ansible mahaohui -m yum -a “name=httpd state=latest” -i hosts
（2）安装当前最新的Apache软件，通过epel仓库安装
ansible mahaohui -m yum -a “name=httpd state=latest enablerepo=epel” -i hosts
（3）通过公网URL安装rpm软件
ansible mahaohui -m yum -a “name=https://mirrors.aliyun.com/centos/8-stream/AppStream/x86_64/os/Packages/pcp-export-zabbix-agent-5.1.1-3.el8.x86_64.rpm?spm=a2c6h.13651111.0.0.1f412f70goBwOa&file=pcp-export-zabbix-agent-5.1.1-3.el8.x86_64.rpm state=latest” -i hosts
（4）更新所有软件包，但排除和kernel相关的
ansible mahaohui -m yum -a “name= state=latest exclude=kernel,foo*” -i hosts
（5）删除Apache软件
ansible mahaohui -m yum -a “name=httpd state=absent” -i hosts
PS:state=persent(正常安装)
=absent(卸载)
=latest(升级)
排除：exclude
指定仓库：enablerep
2.copy模块
以Apache服务为例
1.远程复制Apache主配置文件
scp /etc/httpd/conf/httpd.conf root@192.168.142.142:/root/project1/
2.修改主配置文件listen为非80端口（例：9999）
vim httpd
listen 9999
示例1：将本地的http.conf文件Listen端口修改为9999，然后推送到远端服务
ansible mahaohui -m copy -a “src=./httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=644” -i hosts
示例2：将本地的http.conf文件Listen端口修改为9090，然后推送到远端，检查远端是否存在上一次的备份文件
ansible mahaohui -m copy -a “src=./httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=644 backup=yes” -i hosts
PS:只有配置文件不一样才会备份
示例3：往远端的主机文件中写入内容
ansible mahaohui -m copy -a “content=HttpSever… dest=/var/www/html/index.html” -i hosts
关闭selinux:vim /etc/selinux/confing
SELINUX=disable
PS:
src（源）
dest(目标)
owner（所属主）
group（所属组）
mode（权限）
backup（备份）
content(内容)
3.get—url模块
示例1：下载互联网的软件至本地
http://fj.xuliangwei.com/public/ip.txt
ansible mahaohui -m get_url “url=http://fj.xuliangwei.com/public/ip.txt dest=/var/www/html” -i hosts
示例2：下载互联网文件并进行MD5校验
(1)拿到md5校验值
cd /var/www/html
md5sum ip.txt
(2)
ansible mahaohui -m get_url -a “url=http://fj.xuliangwei.com/public/ip.txt dest=/var/www/html checksum=md5:7b86f423757551574a7499f0aa9d9c2e” -i hosts
4.file模块
示例1：创建文件，并设定属主，属组，权限
ansible mahaohui -m file -a “path=/var/www/html/mahaohui.html state=touch owner=apache group=apache mode=644” -i hosts
示例2：创建目录，并设定属主，属组，权限
ansible mahaohui -m file -a “path=/var/www/html/mahaohui state=directory owner=apache group=apache mode=755” -i hosts
示例3：递归授权目录的方式
（1）递归：ansible mahaohui -m file -a “path=/var/www/html/ owner=apache group=apache mode=755 recurse=yes” -i hosts
（2）未递归：ansible mahaohui -m file -a “path=/var/www/html/ owner=apache group=apache” -i hosts
5.service模块
示例1：启动httpd服务
ansible mahaohui -m service -a “name=httpd state=started” -i hosts
示例2：重载httpd服务
ansible mahaohui -m service -a “name=httpd state=reloaded” -i hosts
示例3：重启httpd服务
ansible mahaohui -m service -a “name=httpd state=restarted” -i hosts
示例4：停止httpd服务
ansible mahaohui -m service -a “name=httpd state=stoped” -i hosts
示例5：启动httpd服务，并加入开机自启/关闭
ansible mahaohui -m service -a “name=httpd state=started enabled=yes/no” -i hosts
PS：
[root@localhost html]# systemctl is-enabled httpd
disabled
6.group模块
示例1：创建news基本组，制定GID为9999
ansible mahaohui -m group -a “name=news gid=9999 state=present” -i hosts
PS:state=present是默认的
示例2：创建http系统组，指定GID8888
ansible mahaohui -m group -a “name=http gid=8888 state=present system=yes” -i hosts
示例3：删除news基本组
ansible mahaohui -m group -a “name=news state=absent” -i hosts
7.user模块
示例1：创建joh用户，UID是1040，主要的组是adm
ansible mahaohui -user -a “name=joh uid=1040 group=adm” -i hosts
示例2:创建joh用户，登录shell是/sbin/nologin，追加bin，sys两个组
ansible mahaohui -user -a “name=joh shell=/sbin/nologin groups=bin,sys” -i hosts
示例3：创建jsm用户，为其添加123作为登录密码，并且创建家目录
(1)生成秘钥
ansible localhost -m debug -a “msg={{‘123’ | password_hash(‘sha512’,‘salt’)}}”
[root@localhost project1]# ansible localhost -m debug -a “msg={{‘123’ | password_hash(‘sha512’,‘salt’)}}”
localhost | SUCCESS => {
“msg”: “$6$salt$jkHSO0tOjmLW0S1NFlw5veSIDRAVsiQQMTrkOKy4xdCCLPNIsHhZkIRlzfzIvKyXeGdOfCBoW1wJZPLyQ9Qx/1”
}
PS:
salt：言，也可以是salt123等其他的
(2)执行
ansible mahaohui -m user -a ‘name=jsm password=$6$salt$jkHSO0tOjmLW0S1NFlw5veSIDRAVsiQQMTrkOKy4xdCCLPNIsHhZkIRlzfzIvKyXeGdOfCBoW1wJZPLyQ9Qx/1 create_home=yes’ -i hosts
示例4：移除joh用户
ansible mahaohui -m user -a “name=joh state=absent remove=yes” -i hosts
PS:remove是删不删除家目录
示例5：创建http用户，并为该用户创建2048字节的私钥，存放在~/http/.ssh/id_rsa
ansible mahaohui -m user -a “name=http generate_ssh_key=yes ssh_key_bits=2048 ssh_key_file=.ssh/id_rsa” -i hosts
PS:
generate_ssh_key：是否创建秘钥
ssh_key_bits：秘钥长度
ssh_key_file：存放路径
8.cron模块
示例1：添加定时任务。每分钟执行一次ls 。* * * * * ls >/dev/null
ansible mahaohui -m cron -a “name=job1 job=‘ls >/dev/null’” -i hosts
PS:* * * * *分时日月周
示例2：添加定时任务，每天凌晨2点和凌晨5点执行一次ls。“0 5,2 * * ls >/dev/null”
ansible mahaohui -m cron -a “name=job2 minute=0 hour=2,5 job=‘ls >/dev/null’” -i hosts
示例3：关闭定时任务，使定时任务失效
ansible mahaohui -m cron -a “name=job2 minute=0 hour=2,5 job=‘ls >/dev/null’ disabled=yes” -i hosts
PS:停止时，任务怎么定义的命令原封不动打上去
9.mount模块
环境准备：
（1）将192.168.142.135作为nfs服务端，192.168.142.142作为nfs客户端进行挂载
ansible mahaohui -m yum -a “name=nfs-utils state=present”
或者先在客户端上下好服务：
yum install -y nfs-utils rpcbind(rpcbind是nfs的依赖)
（2)创建要共享的目录
mkdir /data
（3）编写nfs配置文件
vim /etc/exports
/data 192.168.142.142/24(rw,sync,all_squash)
（4）重启服务
systemctl restart nfs-server
present 开机挂载，仅将挂载配置写入/etc/fstab
mounted 挂载设备，并将挂载配置写入/etc/fstab
absent 卸载设备，会清除 /etc/fstab写入的配置
unmounted 卸载设备，不会清除 /etc/fstab写入的配置
PS:
src:本地或远程设备的路径
path:设备挂载至本地的路径
fstype:文件系统类型
opts:挂载的参数（defaults/默认,rw/读写等）
state:挂载的状态
示例1：挂载nfs存储至本地的/opt目录，并实现开机自动挂载
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=present” -i hosts
示例2：临时卸载nfs的挂载，但不会清理/etc/fstab
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=unmounted” -i hosts
示例3：永久卸载nfs的挂载，会清理/etc/fstab
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=absent” -i hosts
10.selinux模块
示例：关闭selinux
ansinle mahaohui -m selinux -a “state=disabled” -i hosts
11.firewalld模块
1.启动防火墙
ansible mahaohui -m service -a “name=firewalld state=started” -i hosts
示例1：永久放行https的流量，只有重启才会生效
ansible mahaohui -m firewalld -a “zone=public service=https permanent=yes state =enabled” -i hosts
示例2：永久放行8080端口的流量，只有重启才会生效
ansible mahaohui -m firewalld -a “zone=public port=8080/tcp permanent=yes state=enabled” -i hosts
示例3：放行8080-8090的所有tcp端口流量，临时和永久都生效
ansible mahaohui -m firewalld -a “zone=public port=8080-8090/tcp permanent=yes immediate=yes state=enabled” -i hosts
permanent：永久的
immediate：立即

测试：
（1）安装http服务
ansible mahaohui -m yum -a “name=httpd state=latest” -i hosts
（2）编写简单网页测试内容
ansible mahaohui -m copy -a “content=马浩珲你真帅 dest=/var/www/html/index.html” -i hosts
（3）启动服务并加入开机自启
ansible mahaohui -m service -a “name=httpd state=started enabled=yes” -i hosts
（4）放行firewalld对应的端口
ansible mahaohui -m firewalld -a “zone=public port=9090/tcp permanent=yes immediate=yes state=enabled” -i hosts