ssh
https://medium.com/@paulskarseth/ansible-bastion-host-proxycommand-e6946c945d30#.rauzlfv0z
http://blog.scottlowe.org/2015/12/24/running-ansible-through-ssh-bastion-host
https://10mi2.wordpress.com/2015/01/14/using-ssh-through-a-bastion-host-transparently/
https://gagor.pl/2016/04/use-bastion-host-with-ansible
http://www.cweye.net/2015/07/17/ansible-jumper.html
http://my.oschina.net/foreverich/blog/657075html
sudo
http://tech-sketch.jp/2016/06/ssh_sudo_su.htmlvim
案例
有A B两个数据中心,每一个数据中心仅1台服务器(jumphost)有公网ip,其余服务器均为内网地址。bash
控制机
1 conctrol 生成带password的key服务器
ssh-keygen -f a.pem -N '@ansible' ssh-keygen -f b.pem -N '@ansible'
2 A jumphost & targethostssh
useradd ansible su - ansible -c 'mkdir .ssh' su - ansible -c 'curl http://install.local/a.pem.pub -O .ssh/authorized_keys' su - ansible -c 'chmod 600 .ssh/authorized_keys' su - ansible -c 'chmod 700 .ssh'
3 B jumphost & targethostcurl
useradd ansible su - ansible -c 'mkdir .ssh' su - ansible -c 'curl http://install.local/b.pem.pub -O .ssh/authorized_keys' su - ansible -c 'chmod 600 .ssh/authorized_keys' su - ansible -c 'chmod 700 .ssh'
4 control ssh_configide
# A Host 69.xx.xx.xx User ansible Port 29922 #IdentityFile keys/dc.pem ControlMaster auto ControlPath keys/ansible-%r@%h:%p ControlPersist 15m ForwardAgent yes StrictHostKeyChecking no Host 10.150.1.* User ansible Port 29922 #IdentityFile keys/dc.pem ProxyCommand ssh -p 29922 %r@69.xx.xx.xx -W %h:%p ForwardAgent yes StrictHostKeyChecking no # B Host 173.xx.xx.xx User ansible Port 29922 #IdentityFile keys/dc.pem ControlMaster auto ControlPath keys/ansible-%r@%h:%p ControlPersist 15m ForwardAgent yes StrictHostKeyChecking no Host 10.160.1.* User ansible Port 29922 #IdentityFile keys/la.pem ProxyCommand ssh -p 29922 %r@173.xx.xx.xx -W %h:%p ForwardAgent yes StrictHostKeyChecking no
5 control loginwordpress
# 私钥加入内存,用于ssh agent forward #ssh-agent bash ssh-add keys/a.pem Enter passphrase for keys/a.pem: ssh-add keys/b.pem Enter passphrase for keys/b.pem: # 分别登陆A B跳板机和内网主机 ssh -F ssh_config 69.xx.xx.xx ssh -F ssh_config 10.150.1.35 ssh -F ssh_config 173.xx.xx.xx ssh -F ssh_config 10.160.1.35 # 删除内存私匙 ssh-add -D
6 jumphost & targethost sudoui
cat > /etc/sudoers.d/ansible << _EOF_ Defaults:ansible,%operator !requiretty Cmnd_Alias SU = /bin/su* Cmnd_Alias SUDO = /usr/bin/vim /etc/sudoers*, /bin/vi /etc/sudoers*, /bin/su*, /usr/sbin/visudo Cmnd_Alias ACCOUNT = /usr/sbin/adduser*, /usr/sbin/useradd*, /usr/sbin/groupadd*, /usr/sbin/userdel* Cmnd_Alias SHELLS = /bin/sh, /bin/ksh, /bin/bash, /bin/zsh, /bin/csh, /bin/tcsh, /usr/bin/login ansible ALL = (ALL) NOPASSWD: ALL, !SU %operator ALL = (ALL) NOPASSWD: ALL, !SHELLS, !SU, !SUDO, !ACCOUNT _EOF_ chmod 440 /etc/sudoers.d/ansible groupadd operator
/etc/pam.d/su #auth required pam_wheel.so use_uid -> auth required pam_wheel.so use_uid
/etc/ssh/sshd_config PermitRootLogin no RSAAuthentication yes PubkeyAuthentication yes PasswordAuthentication yes
7 jumphost & targethost user (ansible控制)url
1 创建用户 useradd ken 加入operator组 usermod -G operator ken 用户.ssh/authorized_keys写入用户公匙 ken.gem -> .ssh/authorized_keys 2 用户使用私匙登陆 local> ssh-add ken.gem local> ssh -p 29922 -A ken@69.xx.xx.xx 69> ssh -p 29922 -A ken@10.150.1.xx 3 删除用户
登陆自动启动ssh-agent
cat > /etc/profile.d/ssh-agent.sh << EOF #!/bin/bash if [ ! -S ~/.ssh/ssh_auth_sock ]; then eval \`ssh-agent\` ln -sf "\$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock fi export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock EOF
手动执行ssh-add加入sshkey,只要不重启sshkey一直存在内存中
登陆自动加载带密码的sshkey 密码输入没有解决
echo "echo '@ansible'" > /opt/ansible/keys/.passphrase && chmod 700 /opt/ansible/keys/.passphrase ssh-add -l | grep 'The agent has no identities' && cat /opt/ansible/keys/{dc.pem,la.pem} | SSH_ASKPASS=/opt/ansible/keys/.passphrase ssh-add -
ssh-add 将私匙加入内存,公匙分别加入堡垒机及内网机,加入代理转发,能够登陆任意服务器 ssh -p 29922 ansible@192.168.1.22 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \ -o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes ssh -p 29922 ansible@192.168.1.23 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \ -o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes \ -o ProxyCommand='ssh -p 29922 %r@192.168.1.22 -W %h:%p' ssh -p 22 ansible@192.168.1.24 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \ -o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes \ -o ProxyCommand='ssh -p 29922 %r@192.168.1.22 -W %h:%p'