一、秘钥认证部署流程
1、非交互式
创建秘钥对
ssh-keygen -t ~/.ssh/id_dsa -P ''4
发送秘钥
sshpass -p123456 ssh-copy-id -i /root/.ssh/id_dsa.pub -o StrictHostKeyChecking=no 172.16.1.41
epel给ssh相关客户端提供密码
2、使脚本一键创建、分发、测试秘钥
1）编写脚本：
[root@m01 ~]# vim /server/scripts/sshpass.sh
#!/bin/bash
#ssh-keygen-id
rm -rf ~/.ssh/*
ssh-keygen -t dsa -f ~/.ssh/id_dsa -P '' &>/dev/null
for ip in `cat /server/scripts/ip.txt`
do
echo "++++++++++++++++Connect Start $ip++++++++++++++++"
sshpass -p 123456 ssh-copy-id -i /root/.ssh/id_dsa.pub $ip -o StrictHostKeyChecking=no
&>/dev/null
ssh $ip hostname
if (($?==0))
then
echo "++++++++++++++++$ip connect successed++++++++++++++++"
else
echo "++++++++++++++++$ip connect failed++++++++++++++++"
fi
echo "++++++++++++++++Connect END $ip++++++++++++++++"
done
~
2）执行脚本：
[root@m01 ~]# sh /server/scripts/sshpass.sh
++++++++++++++++Connect Start 172.16.1.7++++++++++++++++
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_dsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Number of key(s) added: 1
Now try logging into the machine, with: "ssh -o 'StrictHostKeyChecking=no' '172.16.1.7'"
and check to make sure that only the key(s) you wanted were added.
web01
++++++++++++++++172.16.1.7 connect successed++++++++++++++++
++++++++++++++++Connect END 172.16.1.7++++++++++++++++
++++++++++++++++Connect Start 172.16.1.8++++++++++++++++
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_dsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: ERROR: ssh: connect to host 172.16.1.8 port 22: No route to host
ssh: connect to host 172.16.1.8 port 22: No route to host
++++++++++++++++172.16.1.8 connect failed++++++++++++++++
++++++++++++++++Connect END 172.16.1.8++++++++++++++++
++++++++++++++++Connect Start 172.16.1.31++++++++++++++++
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_dsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Number of key(s) added: 1
Now try logging into the machine, with: "ssh -o 'StrictHostKeyChecking=no' '172.16.1.31'"
and check to make sure that only the key(s) you wanted were added.
nfs01
++++++++++++++++172.16.1.31 connect successed++++++++++++++++
++++++++++++++++Connect END 172.16.1.31++++++++++++++++
++++++++++++++++Connect Start 172.16.1.41++++++++++++++++
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_dsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Number of key(s) added: 1
Now try logging into the machine, with: "ssh -o 'StrictHostKeyChecking=no' '172.16.1.41'"
and check to make sure that only the key(s) you wanted were added.
backup
++++++++++++++++172.16.1.41 connect successed++++++++++++++++
++++++++++++++++Connect END 172.16.1.41++++++++++++++++
二、ansible 批量管理 批量配置 批量分发
使用前：在管理机上生成秘钥并分发
pssh(pssh prsync)
ansible 和 salstack
对比
共同点
批量管理
基于Python
区别
ansible不需要安装客户端
saltstack 需要安装客户端
puppet
1、使用指南
在管理配置好 秘钥认证
1）ansible文件
/etc/ansible
/etc/ansible/ansible.cfg 配置文件
/etc/ansible/hosts 主机清单（被管理的服务器列表）
/etc/ansible/roles
2）ansible
格式 ：ansible oldboy -m command -a 'hostname'
参数
-m 指定模块
ping 检查 客户端是否存活
command 命令模式（只能执行简单命令 不支持 特殊符号） 默认的模块
-a 模块中命令或参数
3）颜色
绿色 ok 对方没有发送修改
黄色 修改内容（修改成功）
红色 报错
紫色 warning 警告
4、Ansible inventory 主机清单
/etc/ansible/hosts
5、AD-Hoc 批量执行命令
1）单词
src source 源
dest 目标
content 内容 文件内容
state 状态
2）模块
（1）command 命令模块
默认模块，用于执行命令，不支持特殊符号
（2）shell 支持特殊模块 执行脚本
（3）copy 复制模块
src= 源
dest= 目的
owner=所有者
group= 用户组
mode= 权限
backup 是否备份
（4）script 脚本模块
Runs a local script on a remote node after transferring it
先把脚本传送到远端 然后执行
（5）yum
name=软件包名
state
installed，present 安装软件包
removed，absent 移除安装包
latest 安装最新安装包（更新）
file
path 路径或文件名
recure 递归授权
state
directory 目录
touch 文件
absent 删除文件或目录
service
开启 重启 关闭
name 要启动的服务名称
state
started 启动服务
stopped 停止服务
restarted 重启服务
reloaded 重载服务
enable 开机自启动
group 创建用户组
name 指定创建的组名
gid 指定组的gid
state
absent 移除远端主机的组
present 创建远端主机的组
user 添加用户
uid 指定用户的uid
group 指定用户组的名称
shell 指定用户是否能登录
create_home 是否创建家目录
state
absent 删除用户
