Web集群之SSH批量管理
阿新 • • 發佈：2018-11-08
gre linux i++ save only ffffff code ref 圖片 1、什麽是SSH批量管理
在管理機產生公鑰和私鑰，然後把自己的公鑰推送給需要被管理的服務器，然後就可以通過scp和ssh命令，無需輸入密碼即可管理
在管理機產生公鑰和私鑰，然後把自己的公鑰推送給需要被管理的服務器，然後就可以通過scp和ssh命令，無需輸入密碼即可管理
鎖=公鑰，鑰匙=私鑰
企業裏實現ssh方案：
1）直接root ssh key。
條件：系統允許root使用ssh
2）sudo提權來實現沒有權限用戶拷貝
實驗環境：
| hostname | ip | 描述 |
|---|---|---|
| m01 | 172.16.1.61 | 管理機 |
| web01 | 172.16.1.7 | 被管理 |
| nfs | 172.16.1.31 | 被管理 |
| backup | 172.16.1.41 | 被管理 |
所有機器系統環境統一
[root@m01 /]# cat /etc/redhat-release CentOS Linux release 7.5.1804 (Core) [root@m01 /]# uname -r 3.10.0-862.el7.x86_64
1.1 所有的服務器創建普通用戶及密碼
useradd xiaoli
echo "123456" |passwd --stdin xiaoli
id xiaoli
su - xiaoli #<==統一切換到xiaoli用戶1.2 m01產生密鑰
#使用xiaoli用戶來創建私鑰，並且分發公鑰
[xiaoli@m01 ~]$ ssh-keygen -t dsa #<==生成私鑰（一路回車） Generating public/private dsa key pair. Enter file in which to save the key (/home/xiaoli/.ssh/id_dsa): Created directory ‘/home/xiaoli/.ssh‘. #<==私鑰存放的目錄 Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/xiaoli/.ssh/id_dsa. Your public key has been saved in /home/xiaoli/.ssh/id_dsa.pub. The key fingerprint is: SHA256:/UtUhhM++KSQH9OgJyP+MCRz+LhdYfRt/r6384aVLzU xiaoli@m01 The key‘s randomart image is: +---[DSA 1024]----+ | . . . | | . . + * o | | + + O * X o | | O o O O = | | . = S + + .| | o = o . Eo| | . . . o .+o| | . oo.+| | . o*=| +----[SHA256]-----+ [xiaoli@m01 ~]$ pwd /home/xiaoli [xiaoli@m01 ~]$ ls .ssh/ id_dsa id_dsa.pub [xiaoli@m01 ~]$ ll .ssh/ total 8 -rw------- 1 xiaoli xiaoli 672 Nov 5 20:57 id_dsa #<==私鑰 -rw-r--r-- 1 xiaoli xiaoli 600 Nov 5 20:57 id_dsa.pub #<==公鑰
1.3 管理機分發公鑰給客戶端
管理機推送公鑰給backup
[xiaoli@m01 ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected] /bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub" The authenticity of host ‘172.16.1.41 (172.16.1.41)‘ can‘t be established. ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ. ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a. Are you sure you want to continue connecting (yes/no)? yes /bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys [email protected]‘s password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh ‘[email protected]‘" and check to make sure that only the key(s) you wanted were added. #backup上查看是否收到公鑰 [xiaoli@backup ~]$ ls .ssh/authorized_keys .ssh/authorized_key #配置文件默認就是.ssh/authorized_key這個文件名，是由/etc/ssh/sshd_config這個配置文件所定義 [root@backup backup]$ grep authorized_keys /etc/ssh/sshd_config |egrep -v "^#" AuthorizedKeysFile .ssh/authorized_keys
管理機推送公鑰給nfs
[xiaoli@m01 ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub"
The authenticity of host ‘172.16.1.31 (172.16.1.31)‘ can‘t be established.
ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ.
ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]‘s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh ‘[email protected]‘"
and check to make sure that only the key(s) you wanted were added.
#nfs上查看是否收到公鑰
[xiaoli@nfs ~]$ ls -l .ssh/
total 4
-rw------- 1 xiaoli xiaoli 600 Nov 5 21:16 authorized_keys管理機推送公鑰給web01
[xiaoli@m01 ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub"
The authenticity of host ‘172.16.1.7 (172.16.1.7)‘ can‘t be established.
ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ.
ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]‘s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh ‘[email protected]‘"
and check to make sure that only the key(s) you wanted were added.
#web01查看是否收到公鑰
[xiaoli@web01 ~]$ ls -l .ssh/
total 4
-rw------- 1 xiaoli xiaoli 600 Nov 5 21:20 authorized_keys1.4 管理機實現批量獲取參數
單獨查看某一臺客戶端IP地址，如果端口號為22，就不需要加-p
[xiaoli@m01 ~]$ ssh [email protected] /sbin/ifconfig ens33
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.31 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:20:de:ec txqueuelen 1000 (Ethernet)
RX packets 68059 bytes 50182137 (47.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 32722 bytes 6712416 (6.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
#我們可以發現這時執行ssh就不需要輸入密碼創建腳本查看三臺客戶端的IP地址
[xiaoli@m01 ~]$ mkdir seripts
[xiaoli@m01 ~]$ cd seripts
[xiaoli@m01 seripts]$ cat view_ip.sh
#!/bin/sh
User=xiaoli
Ip=(
172.16.1.7
172.16.1.31
172.16.1.41
)
for ((i=0;i<${#Ip[*]};i++))
do
ssh ${User}@${Ip[$i]} /sbin/ifconfig ens33
done
#執行腳本
[xiaoli@m01 seripts]$ sh view_ip.sh
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.7 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::b85a:6444:fdc7:90ef prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:32:88:be txqueuelen 1000 (Ethernet)
RX packets 11633 bytes 2805754 (2.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 6003 bytes 1047269 (1022.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.31 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:20:de:ec txqueuelen 1000 (Ethernet)
RX packets 68065 bytes 50182545 (47.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 32726 bytes 6712704 (6.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.41 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::b85a:6444:fdc7:90ef prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:21:a4:2a txqueuelen 1000 (Ethernet)
RX packets 123357 bytes 15582283 (14.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 130534 bytes 11862139 (11.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
上面結果為成功標誌！連接所有機器，不提示密碼直接可以操作1.5 scp實現批量下發文件
每臺服務器root權限下實施sudo
#切換到root用戶，給xiaoli用戶賦予有rsync的命令執行權限
echo "xiaoli ALL=(ALL) NOPASSWD:/usr/bin/rsync ">>/etc/sudoers
visudo -c將/etc/hosts文件拷貝到家目錄（xiaoli），並修改hosts文件內容
[xiaoli@m01 ~]$ cp /etc/hosts .
[xiaoli@m01 ~]$ tail -5 hosts
172.16.1.7 web01
172.16.1.41 backup
172.16.1.31 nfs
172.16.1.51 m01
################2018-11-5################使用腳本批量分發hosts文件
[xiaoli@m01 ~]$ cat seripts/fenfa_file.sh
#!/bin/sh
User=xiaoli
Ip=(
172.16.1.7
172.16.1.31
172.16.1.41
)
for ((i=0;i<${#Ip[*]};i++))
do
scp ~/hosts ${User}@${Ip[$i]}:~
ssh -t ${User}@${Ip[$i]} sudo rsync ~/hosts /etc/hosts
done
#運行批量分發腳本
[xiaoli@m01 seripts]$ sh fenfa_file.sh
hosts 100% 268 245.5KB/s 00:00
Connection to 172.16.1.7 closed.
hosts 100% 268 47.6KB/s 00:00
Connection to 172.16.1.31 closed.
hosts 100% 268 295.1KB/s 00:00
Connection to 172.16.1.41 closed.客戶端查看結果
#以backup客戶端為例展示結果：
[xiaoli@backup ~]$ tail -5 /etc/hosts
172.16.1.7 web01
172.16.1.41 backup
172.16.1.31 nfs
172.16.1.51 m01
################2018-11-5################擴展：使用rsync通道模式，實現增量、加密
[xiaoli@m01 ~]$ rsync -avz hosts -e ‘ssh -p 22‘ [email protected]
sending incremental file list
hosts
sent 214 bytes received 35 bytes 498.00 bytes/sec
total size is 268 speedup is 1.08Web集群之SSH批量管理