Ansible-构建用户级Ansible操作环境(续上一章)

最新推荐文章于 2024-05-28 09:56:05 发布
最新推荐文章于 2024-05-28 09:56:05 发布
阅读量670 收藏 1
点赞数 1
分类专栏： ansible 文章标签： linux centos
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_66461008/article/details/125956035
版权

一. 实验前准备：

1.1 给服务端主机连接另外两台主机客户端主机node1,node2做免密。

[root@ansible mnt]# yum install expect -y
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
dvd                                                                                                                                                 | 4.3 kB  00:00:00     
epel                                                                                                                                                | 4.7 kB  00:00:00     
Resolving Dependencies
......
Installed:
  expect.x86_64 0:5.45-14.el7_1                                                                                                                                            

Dependency Installed:
  tcl.x86_64 1:8.5.13-8.el7                                                                                                                                                

Complete!
[root@ansible mnt]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:AU9YrhxMy99A2C/m0K3xWCNQnf5zYHpyEa9ihQ5eZpk root@ansible
The key's randomart image is:
+---[RSA 2048]----+
|      o*=. .     |
|     ++B. o .    |
|      =o=+ + o   |
|     ..+B+E = .  |
|      o=S#.* +   |
|        = B * .  |
|         . = o   |
|                 |
|                 |
+----[SHA256]-----+

[root@node1 ~]# cat ssh_keygen.sh 
#!/bin/bash
AUTOSSH()
{
/usr/bin/expect <<EOF
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.32.$i
expect {
"yes/no" { send "yes\r";exp_continue }
"password" { send "westos\r" }
}
  
expect eof
EOF
}
 
for i in 11 12
do
       AUTOSSH
done

[root@ansible mnt]# sh ssh_keygen.sh 
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.32.11
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '172.25.32.11 (172.25.32.11)' can't be established.
ECDSA key fingerprint is SHA256:cxguNL6GA/BmJr4mD3W2Q2f6BkBBFPGKMPjOlEjWhDU.
ECDSA key fingerprint is MD5:fe:01:b4:23:61:3f:1e:c8:e4:6c:18:2c:0a:f8:c1:ae.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.25.32.11's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@172.25.32.11'"
and check to make sure that only the key(s) you wanted were added.

spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.32.12
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '172.25.32.12 (172.25.32.12)' can't be established.
ECDSA key fingerprint is SHA256:cxguNL6GA/BmJr4mD3W2Q2f6BkBBFPGKMPjOlEjWhDU.
ECDSA key fingerprint is MD5:fe:01:b4:23:61:3f:1e:c8:e4:6c:18:2c:0a:f8:c1:ae.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.25.32.12's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@172.25.32.12'"
and check to make sure that only the key(s) you wanted were added.

1.2 免密测验


[root@ansible mnt]# ssh 172.25.32.11
Last login: Sat Jul 23 15:35:36 2022 from foundation31.ilt.example.com
[root@node1 ~]# exit
logout
Connection to 172.25.32.11 closed.
[root@ansible mnt]# ssh 172.25.32.12
Last login: Sat Jul 23 15:35:50 2022 from foundation31.ilt.example.com
[root@node2 ~]# exit
logout
Connection to 172.25.32.12 closed.

2. 将之前对文件/etc/ansible/hosts添加的清单组还原

[root@ansible mnt]# vim /etc/ansible/hosts 
[root@ansible mnt]# tail /etc/ansible/hosts 
## db01.intranet.mydomain.net
## db02.intranet.mydomain.net
## 10.25.1.56
## 10.25.1.57

# Here's another example of host ranges, this time there are no
# leading 0s:

## db-[99:101]-node.example.com

3. 更改ssh_keygen.sh 文件

[root@ansible mnt]# cat ssh_keygen.sh 
#!/bin/bash
AUTOSSH()
{
/usr/bin/expect <<EOF
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.32.$i 
expect {
"yes/no" { send "yes\r";exp_continue }
"password" { send "westos\r" }
}
  
expect eof
EOF
}
 
for i in 11 12
do
       ssh -l root 172.25.32.$i rm -rf /root/.ssh
done

二. 开始实验

root用户中实验

1. 编辑ansible配置文件

[root@ansible mnt]# vim /etc/ansible/ansible.cfg
.......
 14 inventory       = /etc/ansible/hosts,/mnt/inventory
.......
 71 host_key_checking = False

2. 在文件inventory中书写清单

[root@ansible mnt]# cat inventory 
[westos]
172.25.32.11
172.25.32.12

3. 使用ansible ping清单组中的ip地址；-k 输密码

[root@ansible mnt]# ansible westos -m ping -k
SSH password: 
172.25.32.12 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.25.32.11 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

建立一个普通用户admin实验

1. 1建立普通用户admin

[root@ansible ansible]# useradd admin
[root@ansible ansible]# su - admin 
[admin@ansible ~]$ mkdir .ansible
[admin@ansible ~]$ cd .ansible/

1.2. 书写清单

[admin@ansible .ansible]$ vim inventory
[admin@ansible .ansible]$ cat inventory 
[westos]
172.25.32.11
 
[westos1]
172.25.32.12

1. 3. 编辑配置文件（此文件不存在，可以复制root用户里/etc/ansible/ansible.cfg）

[admin@ansible .ansible]$ cat ansible.cfg 
[defaults]
inventory = ~/.ansible/inventory
host_key_checking = False
remote_user = admin
module_name = shell
[admin@ansible .ansible]$ ansible all --list   ##列出所有清单
  hosts (2):
    172.25.32.11
    172.25.32.12

1. 4.使用ansible中shell模块给清单中的主机建立admin用户

[admin@ansible .ansible]$ ansible westos -m shell -a 'useradd admin' -k -u root   ##建立用户
SSH password: 
172.25.32.11 | CHANGED | rc=0 >>

172.25.32.12 | CHANGED | rc=0 >>

[admin@ansible .ansible]$ ansible westos -m shell -a 'echo westos | passwd --stdin
admin' -k -u root    ##给建立的用户设置密码
SSH password: 
172.25.32.11 | CHANGED | rc=0 >>
Changing password for user admin.
passwd: all authentication tokens updated successfully.
172.25.32.12 | CHANGED | rc=0 >>
Changing password for user admin.
passwd: all authentication tokens updated successfully.
[admin@ansible .ansible]$ ansible westos -m shell -a 'echo "admin ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' -k -u root     ##赋予新建用户权力
SSH password: 
172.25.32.11 | CHANGED | rc=0 >>

172.25.32.12 | CHANGED | rc=0 >>

修改用户身份

1.1 查看用户身份为admin

[admin@ansible .ansible]$ ansible westos -m shell -a 'whoami' -k
SSH password: 
172.25.32.11 | CHANGED | rc=0 >>
admin
172.25.32.12 | CHANGED | rc=0 >>
admin

1.2 修改用户身份为root

[admin@ansible .ansible]$ cat ansible.cfg 
[defaults]
inventory = ~/.ansible/inventory
host_key_checking = False
remote_user = admin
module_name = shell

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False

1.3 再次查看身份为root

[admin@ansible .ansible]$ ansible westos -m shell -a 'whoami' -k
SSH password: 
172.25.32.12 | CHANGED | rc=0 >>
root
172.25.32.11 | CHANGED | rc=0 >>
root

1.4 查看目录地下的文件，正常是没有的

[admin@ansible .ansible]$ ansible westos -m shell -a 'ls /home/admin/.ssh' -k
SSH password: 
172.25.32.11 | FAILED | rc=2 >>
ls: cannot access /home/admin/.ssh: No such file or directorynon-zero return code
172.25.32.12 | FAILED | rc=2 >>
ls: cannot access /home/admin/.ssh: No such file or directorynon-zero return code

1.5 给westos清单组名称下的ip建立多级目录

[admin@ansible .ansible]$ ansible westos -m shell -a 'mkdir -p  /home/admin/.ssh' -k
SSH password: 
[WARNING]: Consider using the file module with state=directory rather than running 'mkdir'.  If you need to use command because file is insufficient you can add 'warn:
false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
172.25.32.12 | CHANGED | rc=0 >>

172.25.32.11 | CHANGED | rc=0 >>

1.6 修改westos清单组名称下的ip拥有者和拥有组

[admin@ansible .ansible]$ ansible westos -m shell -a 'chown admin.admin /home/admin/.ssh' -k 
SSH password: 
[WARNING]: Consider using the file module with owner rather than running 'chown'.  If you need to use command because file is insufficient you can add 'warn: false' to
this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
172.25.32.12 | CHANGED | rc=0 >>

172.25.32.11 | CHANGED | rc=0 >>

[admin@ansible .ansible]$ ansible westos -m shell -a 'chmod 700 /home/admin/.ssh' -k
SSH password: 
[WARNING]: Consider using the file module with mode rather than running 'chmod'.  If you need to use command because file is insufficient you can add 'warn: false' to
this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
172.25.32.12 | CHANGED | rc=0 >>

172.25.32.11 | CHANGED | rc=0 >>

1.7 赋予权限

[admin@ansible .ansible]$ ansible westos -m shell -a 'chmod 700 /home/admin/.ssh' -k
SSH password: 
[WARNING]: Consider using the file module with mode rather than running 'chmod'.  If you need to use command because file is insufficient you can add 'warn: false' to
this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
172.25.32.12 | CHANGED | rc=0 >>

172.25.32.11 | CHANGED | rc=0 >>

给ansible主机中的admin用户连接node1, node2 中新建的admin用户设置免密

1.1 生成密钥


[admin@ansible .ansible]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/admin/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/admin/.ssh/id_rsa.
Your public key has been saved in /home/admin/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:HaC/KE02Yw3utHiGETWt+LATbrOgrqek6dAEM4tL/5U admin@ansible
The key's randomart image is:
+---[RSA 2048]----+
|      o..        |
|     . o..       |
|+   ..o.  .      |
|.=  +o.+ . .     |
|o....=O S .      |
|.+o *@.=..       |
|oo.+++BE.        |
|=.. o+.          |
|O=   .           |
+----[SHA256]-----+

1.2 远程传输刚才生成的密钥 src是复制的地方，dest是复制到哪里

[admin@ansible .ansible]$ ansible westos -m copy -a 'src=/home/admin/.ssh/id_rsa.pub dest=/home/admin/.ssh/authorized_keys mode=0600 owner=admin group=admin' -k
SSH password: 
172.25.32.12 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "93959fdd05d54b7f3ca507b361419e3cb8b1e513", 
    "dest": "/home/admin/.ssh/authorized_keys", 
    "gid": 1000, 
    "group": "admin", 
    "md5sum": "7daa6a4595417e9067fc620299852039", 
    "mode": "0600", 
    "owner": "admin", 
    "size": 395, 
    "src": "/home/admin/.ansible/tmp/ansible-tmp-1658628612.95-15337-90791827283952/source", 
    "state": "file", 
    "uid": 1000
}
172.25.32.11 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "93959fdd05d54b7f3ca507b361419e3cb8b1e513", 
    "dest": "/home/admin/.ssh/authorized_keys", 
    "gid": 1000, 
    "group": "admin", 
    "md5sum": "7daa6a4595417e9067fc620299852039", 
    "mode": "0600", 
    "owner": "admin", 
    "size": 395, 
    "src": "/home/admin/.ansible/tmp/ansible-tmp-1658628612.94-15335-275291527424141/source", 
    "state": "file", 
    "uid": 1000
}

1.3 连接清单组中包含的ip时，不需要输入密码

[admin@ansible .ansible]$ ssh -l admin 172.25.32.11
Last login: Sun Jul 24 02:10:14 2022 from vm10
[admin@node1 ~]$ exit
logout
Connection to 172.25.32.11 closed.
[admin@ansible .ansible]$ ssh -l admin 172.25.32.12
Last login: Sun Jul 24 02:10:13 2022 from vm10
[admin@node2 ~]$ exit
logout
Connection to 172.25.32.12 closed.
[admin@ansible .ansible]$ ansible westos -m ping
172.25.32.11 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.25.32.12 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

给清单组中的主机建立文件

1.1 建立文件

[admin@ansible .ansible]$ ansible westos -m shell -a 'touch /mnt/file{1..10}'
[WARNING]: Consider using the file module with state=touch rather than running 'touch'.  If you need to use command because file is insufficient you can add 'warn: false'
to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message.
172.25.32.12 | CHANGED | rc=0 >>

172.25.32.11 | CHANGED | rc=0 >>

1.2 在清单组中的主机查看建立的文件

node1:

[admin@node1 ~]$ cd /mnt
[admin@node1 mnt]$ ls
file1  file10  file2  file3  file4  file5  file6  file7  file8  file9

node2:

[admin@node2 ~]$ cd /mnt/
[admin@node2 mnt]$ ls
file1  file10  file2  file3  file4  file5  file6  file7  file8  file9
溪野~~
关注
  • 1
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
专栏目录
Ansible安装部署
退！退！的博客
10-20 229
Ansible安装部署
Ansible--1.Ansible的安装及部署
Rabbit_hyl的博客
05-27 230
Ansible--1.Ansible的安装及部署前言一、环境配置二、Ansible安装三、构建ansible清单四、Ansible配置文件及参数详解五、构建用户级ansible操作环境总结 前言 本章我们将要学习linux系统中重要的自动化部署–ansible。在我们的日常工作中，经常需要管理维护多台机器，对每一台机器一对一的部署和操作显然是不理想的。Ansible自动化部署可以替我们实现用户级一对多的操作，对企业的工作具有很大意义。 本章主要内容包括ansible的安装、构建清单、配置文件参数详解以及用
ansible常用模块之 -- user模块 – 管理用户帐户
weixin_44762073的博客
11-14 650
ansible常用模块之 -- user模块 – 管理用户帐户
Ansible第一章：ansible的安装及部署
m0_62341392的博客
12-02 1355
本章实验需要两台或者两台以上的主机： 主控机---> nodea【ansible】172.25.254.117 被控机---> nodeb:172.25.254.217 主控机有一台，被控机可以有很多台 1.Ansible对于企业运维的重大意义：一对多 2.Ansible的安装epel源dnf install ansible -yansible --viersion 实验：nodea中 【在教室没有网的情况可以用老师主机里之前下载的源】 cd /mnt wget ...
第一章、Ansible的详细介绍与安装
qq_36306519的博客
12-06 464
第一章、Ansible的详细介绍与安装
Ansible之Playbook
xiaoyu070321的博客
06-23 1097
Playbook 也通常被⼤家翻译成剧本。可以认为它是Ansible ⾃定义的⼀⻔语⾔(可以将 Playbook ⽐作Linux 中的 shell，⽽ Ansible 中的 Module 可以⽐作为 Linux 中的各种命令。PlayBook遵循YAML 的语法格式。由于Playbook 是由⼀个或者多个Play组成,那么如果我们熟悉Play的写法，就⾃然掌握了我们这章的PlayBook。那如何定义⼀个Play呢？每⼀个Play 都是以短横杠开始的每⼀个Play 都是⼀个YAML 字典格式。
CHAPTER 7 Ansible playbook（四）
u010230019的博客
01-05 512
角色
ANSIBLE大全
weixin_52190986的博客
09-21 508
YAML是一个可读性高的用来表达资料序列的格式。YAML参考了其他多种语言，包括：XML、C语言、Python、Perl以及电子邮件格式RFC2822等。Clark Evans在2001年在首次发表了这种语言，另外Ingy döt Net与Oren Ben-Kiki也是这语言的共同设计者YAML Ain't Markup Language，即YAML不是XML。不过，在开发的这种语言时，YAML的意思其实是："Yet Another Markup Language"（仍是一种标记语言）特性。
Ansible第六章：ansible中的角色使用
m0_62341392的博客
12-07 201
ansible roles ansible 角色简介 * Ansible roles 是为了层次化，结构化的组织Playbook * roles就是通过分别将变量、文件、任务、模块及处理器放置于单独的目录中，并可以便捷地include它们 * roles一般用于基于主机构建服务的场景中，在企业复杂业务场景中应用的频率很高 * 以特定的层级目录结构进行组织的tasks、variables、handlers、templates、files等；相当于函数的调用把各个功能切割成片段来执行。 roles.
ansible-tower 3.8.6 authorization
05-24
(以前叫’AWX’)是能够帮助任何IT团队更容易使用Ansible的解决方案。该方案基于web。 Tower允许对用户进行权限控制，即使某用户不能传送某SSH凭证，你也可以通过Tower来对该用户共享该凭证。我们可以通过图形化界面...
Ansible-ansible-junos-ztp.zip
09-18
Ansible-ansible-junos-ztp.zip,使用ansible自动设置和管理ztp服务器以向junos设备提供软件和启动配置的示例项目。,ansible是一个简单而强大的自动化引擎。它用于帮助配置管理、应用程序部署和任务自动化。
docker-ansible-playbook：用于创建执行ansible-playbook的基本控制节点的Docker容器
02-18
使用范例从DockerHub抓取图像docker pull isometimescode/ansible-playbook:latest 从DockerHub获取特定版本的Ansible docker pull isometimescode/ansible-playbook:2.10.3 运行一个容器并检查ansible的安装版本...
Ansible-Ansible-roles.zip
09-18
Ansible-Ansible-roles.zip,责任角色责任角色？,ansible是一个简单而强大的自动化引擎。它用于帮助配置管理、应用程序部署和任务自动化。
Linux环境ansible-2.9.7安装包及其依赖包全资源，执行脚本自动安装
02-23
Linux环境ansible-2.9.7安装包及其依赖包全资源 执行下载的ansibleinstall.sh脚本实现自动安装 步骤：解压下载的压缩包，在解压后的文件中执行脚本即可完成安装。安装后ansible的配置文件在/etc/ansible下
Linux - 磁盘的分区和挂载
weixin_45735487的博客
05-27 803
逻辑分区只能在拓展分区上划分，编号5-15。拓展分区编号1-4，拓展分区不能格式化。rescue 恢复分区,对于误删的分区进行恢复,语法: rescue 起始 结束。rm 删除分区,后接要删除的分区编号。（L） 在主分区和拓展分区划分完之后，默认提示划分逻辑分区。n 进行磁盘分区，这里会默认MBR标签。（p） msdos下，会默认选择先划分主分区。
linux 之dma_buf (4)- mmap
最新发布
z20230508的博客
05-28 926
前面几篇都是在 kernel space 对 dma-buf 进行访问的，本篇我们将一起来学习，如何在 user space 访问 dma-buf。当然，user space 访问 dma-buf 也属于 CPU Access 的一种。
FTP协议——LightFTP安装（Linux）
计算机硕士的博客
05-27 357
FTP协议——LightFTP安装（Linux）。
【Linux】升级GCC（版本9.3），补充：binutils
yannan20190313的博客
05-27 842
【Linux】升级GCC（版本9.3），补充：binutils
下载安装ansible-core ansible-navigator
04-26
2. ansible-navigator：ansible-navigator是一个基于文本的用户界面（TUI），用于更方便地使用Ansible。它提供了一个交互式的界面，可以浏览和执行Ansible Playbooks，并提供了一些额外的功能，如搜索、过滤和导航。...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

溪野~~

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值