Web叢集之SSH批量管理
阿新 • • 發佈：2018-11-08
1、什麼是SSH批量管理
在管理機產生公鑰和私鑰，然後把自己的公鑰推送給需要被管理的伺服器，然後就可以通過scp和ssh命令，無需輸入密碼即可管理
鎖=公鑰，鑰匙=私鑰
企業裡實現ssh方案：
1）直接root ssh key。
條件：系統允許root使用ssh
2）sudo提權來實現沒有許可權使用者拷貝
實驗環境：
| hostname | ip | 描述 |
|---|---|---|
| m01 | 172.16.1.61 | 管理機 |
| web01 | 172.16.1.7 | 被管理 |
| nfs | 172.16.1.31 | 被管理 |
| backup | 172.16.1.41 | 被管理 |
1.1 所有的伺服器建立普通使用者及密碼
useradd xiaoli
echo "123456" |passwd --stdin xiaoli
id xiaoli
su - xiaoli #<==統一切換到xiaoli使用者1.2 m01產生金鑰
#使用xiaoli使用者來建立私鑰，並且分發公鑰
[[email protected] ~]$ ssh-keygen -t dsa #<==生成私鑰（一路回車）
Generating public/private dsa key pair.
Enter file in which to save the key (/home/xiaoli/.ssh/id_dsa):
Created directory '/home/xiaoli/.ssh'. #<==私鑰存放的目錄
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/xiaoli/.ssh/id_dsa.
Your public key has been saved in /home/xiaoli/.ssh/id_dsa.pub.
The key fingerprint is:
SHA256:/UtUhhM++KSQH9OgJyP+MCRz+LhdYfRt/r6384aVLzU 1.3 管理機分發公鑰給客戶端
管理機推送公鑰給backup
[[email protected] ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub"
The authenticity of host '172.16.1.41 (172.16.1.41)' can't be established.
ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ.
ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
#backup上檢視是否收到公鑰
[[email protected] ~]$ ls .ssh/authorized_keys
.ssh/authorized_key
#配置檔案預設就是.ssh/authorized_key這個檔名，是由/etc/ssh/sshd_config這個配置檔案所定義
[[email protected] backup]$ grep authorized_keys /etc/ssh/sshd_config |egrep -v "^#"
AuthorizedKeysFile .ssh/authorized_keys管理機推送公鑰給nfs
[[email protected] ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub"
The authenticity of host '172.16.1.31 (172.16.1.31)' can't be established.
ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ.
ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
#nfs上檢視是否收到公鑰
[[email protected] ~]$ ls -l .ssh/
total 4
-rw------- 1 xiaoli xiaoli 600 Nov 5 21:16 authorized_keys管理機推送公鑰給web01
[[email protected] ~]$ ssh-copy-id -i .ssh/id_dsa.pub [email protected]
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_dsa.pub"
The authenticity of host '172.16.1.7 (172.16.1.7)' can't be established.
ECDSA key fingerprint is SHA256:9mwPu7qxdn4iuw1GFz5nXmBdpXKRoj0D8dhDo6sp9XQ.
ECDSA key fingerprint is MD5:d2:35:47:86:60:b5:97:16:3f:26:4c:91:78:3a:02:2a.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
#web01檢視是否收到公鑰
[[email protected] ~]$ ls -l .ssh/
total 4
-rw------- 1 xiaoli xiaoli 600 Nov 5 21:20 authorized_keys1.4 管理機實現批量獲取引數
單獨檢視某一臺客戶端IP地址，如果埠號為22，就不需要加-p
[[email protected] ~]$ ssh [email protected] /sbin/ifconfig ens33
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.31 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:20:de:ec txqueuelen 1000 (Ethernet)
RX packets 68059 bytes 50182137 (47.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 32722 bytes 6712416 (6.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
#我們可以發現這時執行ssh就不需要輸入密碼建立指令碼檢視三臺客戶端的IP地址
[[email protected] ~]$ mkdir seripts
[[email protected] ~]$ cd seripts
[[email protected] seripts]$ cat view_ip.sh
#!/bin/sh
User=xiaoli
Ip=(
172.16.1.7
172.16.1.31
172.16.1.41
)
for ((i=0;i<${#Ip[*]};i++))
do
ssh ${User}@${Ip[$i]} /sbin/ifconfig ens33
done
#執行指令碼
[[email protected] seripts]$ sh view_ip.sh
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.7 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::b85a:6444:fdc7:90ef prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:32:88:be txqueuelen 1000 (Ethernet)
RX packets 11633 bytes 2805754 (2.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 6003 bytes 1047269 (1022.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.31 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:20:de:ec txqueuelen 1000 (Ethernet)
RX packets 68065 bytes 50182545 (47.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 32726 bytes 6712704 (6.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.41 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::7ef6:6b6b:fba4:c66c prefixlen 64 scopeid 0x20<link>
inet6 fe80::b85a:6444:fdc7:90ef prefixlen 64 scopeid 0x20<link>
inet6 fe80::f15a:916:1ee7:65e9 prefixlen 64 scopeid 0x20<link>
ether 00:50:56:21:a4:2a txqueuelen 1000 (Ethernet)
RX packets 123357 bytes 15582283 (14.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 130534 bytes 11862139 (11.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
上面結果為成功標誌！連線所有機器，不提示密碼直接可以操作1.5 scp實現批量下發檔案
每臺伺服器root許可權下實施sudo
#切換到root使用者，給xiaoli使用者賦予有rsync的命令執行許可權
echo "xiaoli ALL=(ALL) NOPASSWD:/usr/bin/rsync ">>/etc/sudoers
visudo -c將/etc/hosts檔案拷貝到家目錄（xiaoli），並修改hosts檔案內容
[[email protected] ~]$ cp /etc/hosts .
[[email protected] ~]$ tail -5 hosts
172.16.1.7 web01
172.16.1.41 backup
172.16.1.31 nfs
172.16.1.51 m01
################2018-11-5################使用指令碼批量分發hosts檔案
[[email protected] ~]$ cat seripts/fenfa_file.sh
#!/bin/sh
User=xiaoli
Ip=(
172.16.1.7
172.16.1.31
172.16.1.41
)
for ((i=0;i<${#Ip[*]};i++))
do
scp ~/hosts ${User}@${Ip[$i]}:~
ssh -t ${User}@${Ip[$i]} sudo rsync ~/hosts /etc/hosts
done
#執行批量分發指令碼
[[email protected] seripts]$ sh fenfa_file.sh
hosts 100% 268 245.5KB/s 00:00
Connection to 172.16.1.7 closed.
hosts 100% 268 47.6KB/s 00:00
Connection to 172.16.1.31 closed.
hosts 100% 268 295.1KB/s 00:00
Connection to 172.16.1.41 closed.客戶端檢視結果
#以backup客戶端為例展示結果：
[[email protected] ~]$ tail -5 /etc/hosts
172.16.1.7 web01
172.16.1.41 backup
172.16.1.31 nfs
172.16.1.51 m01
################2018-11-5################擴充套件：使用rsync通道模式，實現增量、加密
[[email protected] ~]$ rsync -avz hosts -e 'ssh -p 22' [email protected]
sending incremental file list
hosts
sent 214 bytes received 35 bytes 498.00 bytes/sec
total size is 268 speedup is 1.08