深圳品牌网站建设公司有哪些,使用wordpress,常德百竞seo,郑州十大网站建设公司按照集团运维信息安全制度, 需要每个一段时间对线上服务器密码进行一次变更#xff0c;通过shell脚本部署比较繁琐#xff0c;所以决定采用ansible脚本对远程主机root密码进行批量重置#xff0c;该脚本已经在稳定运行在正式环境下。具体方法如下:
1) 在服务端安装ansible …按照集团运维信息安全制度, 需要每个一段时间对线上服务器密码进行一次变更通过shell脚本部署比较繁琐所以决定采用ansible脚本对远程主机root密码进行批量重置该脚本已经在稳定运行在正式环境下。具体方法如下:
1) 在服务端安装ansible
[rootansible-server ~]# yum install -y ansible
2) 配置ansible到远程主机的ssh无密码信任关系 (authoried_keys 模块)
批量实现多台服务器之间ssh无密码登录的相互信任关系, 可以参考之前的文章: https://www.cnblogs.com/kevingrace/p/9063745.html
这里采用Ansible 实现批量建立互信, 方法如下:首先要生成ansible服务端本机ssh的key
[rootansible-server ~]# ssh-keygen -t rsa //一路回车
[rootansible-server ~]# ls /root/.ssh/
id_rsa id_rsa.pub
需要注意ssh建立互信的命令格式:
# ssh-copy-id -i ~/.ssh/id_rsa.pub username[ip,hostname]
在客户机比较多的情况下使用 ssh-copy-id命令的方法显然是有些费时使用ansible-playbook 推送 ymal进行批量创建ssh互信关系就显得省事多了
这里就使用到了ansible的authoried_keys 模块: 首先要配置ansible清单 (远程主机的密码这里为123456)
[rootansible-server ~]# vim /etc/ansible/hosts
................
................
[ssh-host]
172.16.60.204
172.16.60.205
172.16.60.206
172.16.60.207[ssh-host:vars]
ansible_ssh_pass123456
发送公钥到目标机器命令格式如下:
# ansible ssh-host -m copy -a src/root/.ssh/id_rsa.pub dest/root/.ssh/authorized_keys mode600
编写playbook文件
[rootansible-server ~]# vim /opt/ssh_key.yaml
---- hosts: ssh-hostuser: roottasks:- name: ssh-copyauthorized_key: userroot key{{ lookup(file, /root/.ssh/id_rsa.pub) }}注意上面yaml脚本中的ssh-key-host是在/etc/ansible/hosts清单文件里配置的远程客户机列表
这里做的是基于远程主机root用户的ssh互信执行批量互信
[rootansible-server ~]# ansible-playbook /opt/ssh_key.yamlPLAY [ssh-host] ************************************************************************************************************************TASK [Gathering Facts] *****************************************************************************************************************
ok: [172.16.60.204]
ok: [172.16.60.205]
ok: [172.16.60.206]
ok: [172.16.60.207]TASK [ssh-copy] ************************************************************************************************************************
changed: [172.16.60.205]
changed: [172.16.60.204]
changed: [172.16.60.206]
changed: [172.16.60.207]PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok2 changed1 unreachable0 failed0
172.16.60.205 : ok2 changed1 unreachable0 failed0
172.16.60.206 : ok2 changed1 unreachable0 failed0
172.16.60.207 : ok2 changed1 unreachable0 failed0最后验证下ssh互信
[rootansible-server ~]# ansible -i /etc/ansible/hosts ssh-host -m shell -a whoami
172.16.60.204 | SUCCESS | rc0
root172.16.60.205 | SUCCESS | rc0
root172.16.60.207 | SUCCESS | rc0
root172.16.60.206 | SUCCESS | rc0
root至此, ansible批量创建到远程客户机的ssh信任关系已经实现了!
3) Ansible批量更新远程主机用户密码方法
方法一: 使用Ansible的user模块批量修改远程客户机的用户密码
由于在使用ansible修改用户密码的时候不能使用明文的方式需要先加密所以就需要使用一个方法对输入的明文的密码进行加密.
废话不多说了. 下面直接记录下操作方法:[rootansible-server ~]# vim /opt/root_passwd.yaml
---- hosts: ssh-hostgather_facts: falsetasks:- name: change user passwduser: name{{ item.name }} password{{ item.chpass | password_hash(sha512) }} update_passwordalwayswith_items:- { name: root, chpass: kevin123 }- { name: app, chpass: bjop123 }注意上面在yaml文件中修改了远程客户机的root用户密码, app用户密码.
如果还想要修改其他用户密码, 则继续按照上面规则添加即可!执行ansible-play
[rootansible-server ~]# ansible-playbook /opt/root_passwd.yaml PLAY [ssh-host] ************************************************************************************************************************TASK [change user passwd] **************************************************************************************************************
changed: [172.16.60.204] (item{uchpass: ukevin123, uname: uroot})
changed: [172.16.60.205] (item{uchpass: ukevin123, uname: uroot})
changed: [172.16.60.204] (item{uchpass: ubjop123, uname: uapp})
changed: [172.16.60.205] (item{uchpass: ubjop123, uname: uapp})
changed: [172.16.60.206] (item{uchpass: ukevin123, uname: uroot})
changed: [172.16.60.206] (item{uchpass: ubjop123, uname: uapp})
changed: [172.16.60.207] (item{uchpass: ukevin123, uname: uroot})
changed: [172.16.60.207] (item{uchpass: ubjop123, uname: uapp})PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok1 changed1 unreachable0 failed0
172.16.60.205 : ok1 changed1 unreachable0 failed0
172.16.60.206 : ok1 changed1 unreachable0 failed0
172.16.60.207 : ok1 changed1 unreachable0 failed0
方法二: 修改远程主机的单个用户密码使用此方法比较方便
编写playbook文件
[rootansible-server ~]# vim /opt/root_passwd2.yaml
---- hosts: ssh-hostgather_facts: falsetasks:- name: Change passworduser: name{{ name1 }} password{{ chpass | password_hash(sha512) }} update_passwordalways执行ansible-playbook, 使用-e参数传递用户名和密码给剧本其中root为用户名admin#123就是修改后的root密码
[rootansible-server ~]# ansible-playbook /opt/root_passwd2.yaml -e name1root chpassadmin#123 PLAY [ssh-host] ************************************************************************************************************************TASK [Change password] *****************************************************************************************************************
changed: [172.16.60.204]
changed: [172.16.60.205]
changed: [172.16.60.206]
changed: [172.16.60.207]PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok1 changed1 unreachable0 failed0
172.16.60.205 : ok1 changed1 unreachable0 failed0
172.16.60.206 : ok1 changed1 unreachable0 failed0
172.16.60.207 : ok1 changed1 unreachable0 failed0
方法三: 使用如下Ansible脚本, 适用于修改清单中部分远程主机的用户密码
编写ansible-playbook脚本 (需要注意下面脚本中ens192是客户机ip所在的网卡设备名称, 这个要根据自己实际环境去配置, 比如eth0, eth1等)
[rootansible-server ~]# cat /opt/root_passwd4.yaml
- hosts: test-hostremote_user: roottasks:- name: change password for rootshell: echo {{ item.password }} |passwd --stdin rootwhen: ansible_ens192.ipv4.address {{ item.ip }}with_items:- { ip: 172.16.60.220, password: haha123 }- { ip: 172.16.60.221, password: kevin123 }- { ip: 172.16.60.222, password: bobo123 }执行ansible-playbook:[rootansible-server ansible]# ansible-playbook /opt/root_passwd3.yamlPLAY [ssh-host] ************************************************************************************************************************TASK [Gathering Facts] *****************************************************************************************************************
ok: [172.16.60.204]
ok: [172.16.60.205]
ok: [172.16.60.206]
ok: [172.16.60.207]TASK [change password for root] ********************************************************************************************************[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address{{ item.ip }}[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address{{ item.ip }}skipping: [172.16.60.205] (item{uip: u172.16.60.204, upassword: uhaha123}) [WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address{{ item.ip }}skipping: [172.16.60.206] (item{uip: u172.16.60.204, upassword: uhaha123})
skipping: [172.16.60.206] (item{uip: u172.16.60.205, upassword: ukevin123}) [WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}. Found: ansible_eth0.ipv4.address{{ item.ip }}skipping: [172.16.60.207] (item{uip: u172.16.60.204, upassword: uhaha123})
skipping: [172.16.60.207] (item{uip: u172.16.60.205, upassword: ukevin123})
skipping: [172.16.60.207] (item{uip: u172.16.60.206, upassword: ubobo123})
changed: [172.16.60.205] (item{uip: u172.16.60.205, upassword: ukevin123})
skipping: [172.16.60.205] (item{uip: u172.16.60.206, upassword: ubobo123})
changed: [172.16.60.204] (item{uip: u172.16.60.204, upassword: uhaha123})
skipping: [172.16.60.204] (item{uip: u172.16.60.205, upassword: ukevin123})
skipping: [172.16.60.204] (item{uip: u172.16.60.206, upassword: ubobo123})
changed: [172.16.60.206] (item{uip: u172.16.60.206, upassword: ubobo123})PLAY RECAP *****************************************************************************************************************************
172.16.60.204 : ok2 changed1 unreachable0 failed0
172.16.60.205 : ok2 changed1 unreachable0 failed0
172.16.60.206 : ok2 changed1 unreachable0 failed0
172.16.60.207 : ok1 changed0 unreachable0 failed0
如果ansible服务端没有和远程主机做ssh信任关系, 则可以在hosts清单配置里直接指明用户名和密码.
如果使用普通用户, 并且允许sudo, 则需要提前在客户机里的/etc/sudoers文件里配置好该普通用户的sudo配置, 即允许该普通用户有sudo权限.[rootansible-server ~]# vim /etc/ansible/hosts
................
[test-host]
172.16.60.220 ansible_ssh_userroot ansible_ssh_pass123456 ansible_ssh_port22
172.16.60.221 ansible_ssh_userroot ansible_ssh_passbo123 ansible_ssh_port22
172.16.60.222 ansible_ssh_userapp ansible_ssh_passbj123 ansible_ssh_port22 ansible_sudo_passbj123即172.16.60.220客户机上要提前配置, 允许app用户具有sudo权限.执行:
[rootansible-server ~]# ansible test-host -m shell -a hostname
172.16.60.222 | SUCCESS | rc0
k8s-node02172.16.60.220 | SUCCESS | rc0
k8s-master01172.16.60.221 | SUCCESS | rc0
k8s-node01[rootansible-server ~]# ansible -i /etc/ansible/hosts test-host -m shell -a hostname
172.16.60.222 | SUCCESS | rc0
k8s-node02172.16.60.220 | SUCCESS | rc0
k8s-master01172.16.60.221 | SUCCESS | rc0
k8s-node01
