shell功能模块与一键执行
上节内容回顾加实践
41是管理机：
41----->61
41----->31
1)在41上配置ansible
#!/bin/bash
yum install ansible -y
ssh-keygen -f ~/.ssh/id_rsa -P '' -q
for ip in 31 61
do
sshpass -p123456 ssh-copy-id -f -i ~/.ssh/id_rsa.pub "-o StrictHostKeyChecking=no" 172.16.1.$ip
done
#test
ssh 172.16.1.61 "ifconfig eth0"
ssh 172.16.1.31 "ifconfig eth0"
2)ansible基本配置
[root@backup ~]# cat /etc/ansible/hosts
[oldboy]
172.16.1.31
172.16.1.61
vim /etc/ansible/ansible.cfg +374
结尾增加： -o StrictHostKeyChecking=no
ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no
3）使用ansible
[root@backup ~]# ansible oldboy -m command -a "free -m"
172.16.1.31 | CHANGED | rc=0 >>
total used free shared buff/cache available
Mem: 972 79 791 7 101 757
Swap: 767 0 767
172.16.1.61 | CHANGED | rc=0 >>
total used free shared buff/cache available
Mem: 972 66 768 7 137 754
Swap: 767 0 767
4）查看使用帮助
ansible-doc -l #模块就Linux命令了。
command Executes a command on a remote node
查模块的参数：
ansible-doc -s command #Linux命令参数
2）常用参数说明及实践
[root@m01 ~]# ansible-doc -s command
- name: Executes a command on a remote node
command:
argv: # Allows the user to provide the command as a list vs. a string. Only the
string or the list form can be provided, not
both. One or the other must be provided.
chdir: # Change into this directory before running the command.
creates: # A filename or (since 2.0) glob pattern. If it already exists, this step
*won't* be run.
free_form: # (required) The command module takes a free form command to run. There is no
parameter actually named 'free form'. See the
examples!
removes: # A filename or (since 2.0) glob pattern. If it already exists, this step *will* be run.
stdin: # Set the stdin of the command directly to the specified value.
warn: # If command_warnings are on in ansible.cfg, do not warn about this particular
line if set to `no'.
参数：chdir=/tmp配置相当于cd /tmp
[root@m01 ~]# ansible oldboy -m command -a "pwd chdir=/etc"
ansible oldboy -m shell -a "cd /etc/;pwd"
参数：creates=/etc 相当于条件测试 [ -e /etc ]||pwd 和下面removes相反
[root@m01 ~]# ansible oldboy -m command -a "pwd creates=/etc"
参数：removes=/root 相当于条件测试 [ -e /root ]&&ls /root
ansible oldboy -m command -a "ls /root removes=/root"
ansible oldboy -m shell -a "[ -d /etc ]||pwd"
[root@m01 ~]# ansible oldboy -m command -a "cat /etc/hosts removes=/etc/hosts"
参数：warn=False 忽略警告
[root@m01 ~]# ansible oldboy -m command -a "chmod 000 /etc/hosts warn=False"
==========================
12.2 shell模块功能说明：
功能说明：执行一个命令在远程节点上
shell Execute commands in nodes.
官方链接：http://docs.ansible.com/ansible/latest/shell_module.html
shell:
chdir: # cd into this directory before running the command
creates: # a filename, when it already exists, this step will *not* be
run.
executable: # change the shell used to execute the command. Should be an
absolute path to the
executable.
free_form: # (required) The shell module takes a free form command to run,
as a string. There's not an
actual option named "free
form". See the examples!
removes: # a filename, when it does not exist, this step will *not* be
run.
stdin: # Set the stdin of the command directly to the specified value.
warn: # if command warnings are on in ansible.cfg, do not warn about
this particular line if set to no/false.
[root@m01 ~]# cat /etc/ansible/hosts
[oldboy]
172.16.1.31
172.16.1.41
实践：增加文本文件
[root@m01 ~]# ansible oldboy -m shell -a "echo oldboy >/tmp/tmp.txt"
172.16.1.41 | CHANGED | rc=0 >>
172.16.1.31 | CHANGED | rc=0 >>
[root@m01 ~]# ansible oldboy -m shell -a "cat /tmp/tmp.txt"
172.16.1.41 | CHANGED | rc=0 >>
oldboy
172.16.1.31 | CHANGED | rc=0 >>
oldboy
要执行的脚本必须在远程机器上存在：
[root@m01 ~]# ansible oldboy -m shell -a "sh /server/scripts/bak.sh"
172.16.1.41 | FAILED | rc=127 >>
sh: /server/scripts/bak.sh: 没有那个文件或目录non-zero return code
172.16.1.31 | CHANGED | rc=0 >>
实践1：把/etc/hosts拷贝到/opt下，权限设置400，用户和组设置root
ansible oldboy -m copy -a "src=/etc/hosts dest=/opt mode=0400 owner=root group=root backup=yes"
实践2：把/etc/passwd拷贝/tmp下改名为oldgirl，用户和组为oldboy，权限600，如果有存在同名文件覆盖
ansible oldboy -m copy -a "src=/etc/passwd dest=/tmp/oldgirl.txt owner=oldboy group=oldboy mode=0600 force=yes"
批量分发host需求，操作前备份：
ansible oldboy -m copy -a "src=/etc/hosts dest=/etc/hosts mode=0644 owner=root group=root backup=yes"
结果：
[root@backup /tmp]# ls /etc/hosts* -l
-rw-r--r-- 1 root root 353 4月 24 10:49 /etc/hosts
---------- 1 root root 332 4月 12 11:24 /etc/hosts.21951.2019-04-24@10:49:00~
项目实践作业：
1、写好rsync一键客户端配置，一键服务端配置。
2、写好nfs一键服务端端配置，一键客户端挂载，并且加到自启动文件里（/etc/rc.local,/etc/fstab）。
shell模块远程执行脚本：脚本必须在远端存在
ansible oldboy -m shell -a "/bin/bash /server/scripts/setup.sh"
12.3 script模块功能说明：
功能说明：远程节点上运行本地脚本模块
官方链接：http://docs.ansible.com/ansible/latest/script_module.html
参数说明：
ansible oldboy -m shell -a "sh /server/scripts/bak.sh"
[root@m01 /server/scripts]# ansible oldboy -m shell -a "sh /server/scripts/bak.sh"
172.16.1.41 | FAILED | rc=127 >>
sh: /server/scripts/bak.sh: 没有那个文件或目录non-zero return code
172.16.1.31 | FAILED | rc=127 >>
sh: /server/scripts/bak.sh: 没有那个文件或目录non-zero return code
[root@m01 /server/scripts]# cat new.sh
#!/bin/sh
echo oldboy >/tmp/oldboy.txt
本地脚本，在远端执行。
[root@m01 /server/scripts]# ansible oldboy -m script -a "/server/scripts/new.sh"
12.4 copy模块功能说明：
功能说明：复制文件到远程主机
官方链接：http://docs.ansible.com/ansible/latest/copy_module.html
参数说明：
[root@m01 ~]# ansible oldboy -m shell -a "sh /server/scripts/bak.sh"
172.16.1.31 | FAILED | rc=127 >>
sh: /server/scripts/bak.sh: 没有那个文件或目录non-zero return code
172.16.1.41 | FAILED | rc=127 >>
sh: /server/scripts/bak.sh: 没有那个文件或目录non-zero return code
ansible oldboy -m copy -a "src=/server/scripts/bak.sh dest=/server/scripts/ mode=ugo+x"
12.5 file模块功能说明：
功能说明：设置文件属性
官方链接：http://docs.ansible.com/ansible/latest/copy_module.html
参数实践：创建数据文件（普通文件 目录 软链接文件）
ansible oldboy -m file -a "dest=/tmp/oldboy_dir state=directory"
ansible oldboy -m command -a "mkdir -p /tmp/oldboy_dir1 warn=false"
ansible oldboy -m file -a "dest=/tmp/oldboy1 state=touch"
ansible oldboy -m command -a "touch /tmp/oldboy_file1.txt warn=false"
================================================================
替代方案：
ansible oldboy -m command -a "chmod 777 /etc/hosts warn=false"
ansible oldboy -m command -a "chmod 644 /etc/hosts warn=false"
ansible oldboy -m command -a "chown oldboy /etc/hosts warn=false"
ansible oldboy -m command -a "chown root /etc/hosts warn=false"
创建目录：mkdir /tmp/oldboy_dir
ansible oldboy -m file -a "dest=/tmp/oldboy_dir state=directory"
递归设置权限：
ansible oldboy -m file -a "dest=/tmp/oldboy_dir state=directory mode=644 recurse=yes"
创建文件：touch /tmp/oldboy_file
ansible oldboy -m file -a "dest=/tmp/oldboy_file state=touch"
删除文件：rm -f /tmp/oldboy_file
ansible oldboy -m file -a "dest=/tmp/oldboy_file state=absent"
创建链接文件：ln -s /etc/hosts /tmp/link_file
ansible oldboy -m file -a "src=/etc/hosts dest=/tmp/link_file state=link"
ansible oldboy -m file -a "dest=/tmp/oldboy_file state=touch owner=oldboy group=oldboy mode=000"
ansible oldboy -m file -a "dest=/tmp/oldboy_file state=touch owner=oldboy group=oldboy mode=ugo=rwx"
12.6 yum模块功能说明：
功能说明：yum包管理模块
官方链接：http://docs.ansible.com/ansible/latest/yum_module.html
ansible oldboy -m command -a "yum install nginx -y"
ansible oldboy -m yum -a "name=nginx state=installed"
ansible oldboy -m yum -a "name=nc state=installed"
[root@nfs01 oldboy_dir]# rpm -qa nginx
nginx-1.10.2-1.el6.x86_64
###不要用yum卸载，可用rpm -e卸载。
ansible系统类型模块说明
12.7 systemd模块功能说明：(service模块)
功能说明：yum包管理模块
官方链接：http://docs.ansible.com/ansible/latest/service_module.html
参数说明：
service nfs restart
/etc/init.d/nfs restart
systemctl restart nfs
[root@backup /server/scripts]# ansible-doc -s systemd
- name: Manage services
systemd:
daemon_reload: # run daemon-reload before doing any other operations, to make sure systemd has read any
changes.
enabled: # Whether the service should start on boot. *At least one of state and enabled are
required.*
force: # Whether to override existing symlinks.
masked: # Whether the unit should be masked or not, a masked unit is impossible to start.
name: # Name of the service. When using in a chroot environment you always need to specify the full name i.e. (crond.service).
no_block: # Do not synchronously wait for the requested operation to finish. Enqueued job will
continue without Ansible blocking on its completion.
scope: # run systemctl within a given service manager scope, either as the default system scope
(system), the current user's scope (user), or the scope of
all users (global). For systemd to work with 'user', the
executing user must have its own instance of dbus started
(systemd requirement). The user dbus process is normally
started during normal login, but not during the run of
Ansible tasks. Otherwise you will probably get a 'Failed
to connect to bus: no such file or directory' error.
state: # `started'/`stopped' are idempotent actions that will not run commands unless necessary.
`restarted' will always bounce the service. `reloaded'
will always reload.
user: # (deprecated) run ``systemctl`` talking to the service manager of the calling user, rather
than the service manager of the system. This option is
deprecated and will eventually be removed in 2.11. The
``scope`` option should be used instead.
实践：
ansible oldboy -m systemd -a "name=crond.service enabled=no state=stopped "
ansible oldboy -m command -a "systemctl status crond"
ansible oldboy -m systemd -a "name=crond.service enabled=yes state=started"
百度 ansible systemd
https://hoxis.github.io/ansible-system-modules.html
https://www.cnblogs.com/mcsiberiawolf/articles/10083626.html
[root@backup ~]# service crond restart
Redirecting to /bin/systemctl restart crond.service
#service模块功能说明：
功能说明：启动停止服务
官方链接：http://docs.ansible.com/ansible/latest/service_module.html
#相当于
#service crond stop|/etc/init.d/crond stop
#chkconfig crond off
ansible oldboy -m service -a "name=crond state=stop enabled=no"
#相当于/etc/init.d/crond start
chkconfig crond on
ansible oldboy -m service -a "name=crond state=started enabled=yes"
ansible oldboy -m command -a "name=crond state=started enabled=yes"
12.8 cron模块功能说明：
功能说明：管理定时任务条目信息模块
cron Manage cron.d and crontab entries
官方链接：http://docs.ansible.com/ansible/latest/cron_module.html
定时任务格式：
* * * * * CMD
[root@backup ~]# ansible-doc -s cron
- name: Manage cron.d and crontab entries
cron:
backup: # If set, create a backup of the crontab before it is modified.
The location of the backup is
returned in the `backup_file'
variable by this module.
cron_file: # If specified, uses this file instead of an individual user's
crontab. If this is a relative
path, it is interpreted with
respect to /etc/cron.d. (If it
is absolute, it will typically
be /etc/crontab). Many linux
distros expect (and some
require) the filename portion
to consist solely of upper- and
lower-case letters, digits,
underscores, and hyphens. To
:...skipping...
- name: Manage cron.d and crontab entries
cron:
backup: # If set, create a backup of the crontab before it is modified.
The location of the backup is returned in the `backup_file'
variable by this module.
cron_file: # If specified, uses this file instead of an individual user's
crontab. If this is a relative
path, it is interpreted with
respect to /etc/cron.d. (If it
is absolute, it will typically
be /etc/crontab). Many linux
distros expect (and some
require) the filename portion
to consist solely of upper- and
lower-case letters, digits,
underscores, and hyphens. To
use the `cron_file' parameter
you must specify the `user' as
well.
disabled: # If the job should be disabled (commented out) in the crontab.
Only has effect if `state=present'.
env: # If set, manages a crontab's environment variable. New
variables are added on top of
crontab. "name" and "value"
parameters are the name and the
value of environment variable.
insertafter: # Used with `state=present' and `env'. If specified, the
environment variable will be
inserted after the declaration
of specified environment
variable.
insertbefore: # Used with `state=present' and `env'. If specified, the
environment variable will be
inserted before the declaration
of specified environment
variable.
name: # Description of a crontab entry or, if env is set, the name of
environment variable. Required if state=absent. Note that if
name is not set and state=present, then a new
crontab entry will always be
created, regardless of existing
ones.
reboot: # If the job should be run at reboot. This option is deprecated.
Users should use special_time.
special_time: # Special time specification nickname.
state: # Whether to ensure the job or environment variable is present
or absent.
user: # The specific user whose crontab should be modified.
定时任务格式：
* * * * * CMD
定时任务时间参数：
minute: # Minute when the job should run ( 0-59, *, */2, etc )
hour: # Hour when the job should run ( 0-23, *, */2, etc )
day: # Day of the month the job should run ( 1-31, *, */2, etc )
month: # Month of the year the job should run ( 1-12, *, */2, etc )
weekday: # Day of the week that the job should run ( 0-6 for Sunday-Saturday, *, etc )
job: # The command to execute or, if env is set, the value of environment variable. The
command should not contain line breaks. Required if state=present.
创建定时任务：
ansible oldboy -m cron -a "name='sync time' minute=00 hour=00 job='/usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1'"
[root@backup ~]# crontab -l
#crond-id-001:time sync by oldboy
*/5 * * * * /usr/sbin/ntpdate ntp3.aliyun.com >/dev/null 2>&1
#Ansible: sync time
00 00 * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1
结果：
#Ansible: sync time
00 00 * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1
添加如下定时任务：
05 03 * * * /bin/sh /server/scripts/backup.sh >/dev/null 2>&1
命令如下：
ansible oldboy -m cron -a "name='backup data' minute=05 hour=03 job='/bin/sh /server/scripts/backup.sh >/dev/null 2>&1'"
结果：
#Ansible: backup data
05 03 * * * /bin/sh /server/scripts/backup.sh /server/scripts/list >/dev/null 2>&1
删除定时任务：state=absent backup=yes
ansible oldboy -m cron -a "name='backup data' state=absent backup=yes"
名字不变的前提下，修改ansible参数内容，就是修改定时任务。
查看结果：
[root@nfs01 /server/scripts]# crontab -l
#crond-id-001:time sync by oldboy
*/5 * * * * /usr/sbin/ntpdate ntp3.aliyun.com >/dev/null 2>&1
##bak config by oldboy at 2020.10.10
00 00 * * * /bin/sh /server/scripts/bak.sh >/dev/null 2>&1
[root@nfs01 /server/scripts]#
[root@nfs01 /server/scripts]# cat /tmp/crontabdMTe3e
#crond-id-001:time sync by oldboy
*/5 * * * * /usr/sbin/ntpdate ntp3.aliyun.com >/dev/null 2>&1
##bak config by oldboy at 2020.10.10
00 00 * * * /bin/sh /server/scripts/bak.sh >/dev/null 2>&1
#Ansible: backup data
05 03 * * * /bin/sh /server/scripts/backup.sh >/dev/null 2>&1
注释定时任务：disabled=yes
[root@m01 ~]# ansible oldboy -m cron -a "name='backup data' minute=05 hour=04 job='/bin/sh /server/scripts/backup.sh' disabled=yes"
============================================
管理配置好：
1、创建分发秘钥
2、安装ansible工具。
3、一键执行各服务脚本
具体服务一键实现的几个步骤：
1、计划要做。
2、单机安装好，步骤抽出来。
3、写成脚本，一键安装。
4、拿到管理机安装
1）一键完成rsync服务端安装。
剧本：
#1）安装
#yum install rsync -y
#2）配置配置文件/etc/rsyncd.conf
cp /etc/rsyncd.conf{,.ori}
cat>/etc/rsyncd.conf< #rsync_config_______________start #created by oldboy #site: http://www.oldboyedu.com uid = rsync gid = rsync use chroot = no fake super = yes max connections = 200 timeout = 600 pid file = /var/run/rsyncd.pid lock file = /var/run/rsync.lock log file = /var/log/rsyncd.log ignore errors read only = false list = false hosts allow = 172.16.1.0/24 hosts deny = 0.0.0.0/32 auth users = rsync_backup secrets file = /etc/rsync.password [backup] comment = welcome to oldboyedu backup! path = /backup/ EOF #3)创建用户和备份目录 useradd rsync id rsync mkdir -p /backup chown -R rsync.rsync /backup/ ls -ld /backup/ #4）启动和检查 systemctl start rsyncd systemctl enable rsyncd systemctl status rsyncd ps -ef|grep sync|grep -v grep #检查进程 netstat -lntup|grep 873 #检查端口 #5）配置密码文件 echo "rsync_backup:oldboy" > /etc/rsync.password chmod 600 /etc/rsync.password cat /etc/rsync.password ls -l /etc/rsync.password #rsync服务端配置完成。 #最终脚本路径/server/scripts/install_rsync_server.sh，需提前测试成功。 2）一键完成rsync客户端安装。 #方法1：认证密码文件 echo "oldboy" > /etc/rsync.password chmod 600 /etc/rsync.password cat /etc/rsync.password ls -l /etc/rsync.password rsync -avz /etc/hosts [email protected]::backup --password-file=/etc/rsync.password #最终脚本路径/server/scripts/install_rsync_client.sh，需提前测试成功。 3）配置管理机61-m01： 1）实现批量分发秘钥，免秘钥管理 #!/bin/bash yum install ansible -y #含sshpass [ ~/.ssh/id_rsa ]&& rm -fr ~/.ssh ssh-keygen -f ~/.ssh/id_rsa -P '' -q for ip in 31 41 7 8 do sshpass -p123456 ssh-copy-id -f -i ~/.ssh/id_rsa.pub "-o StrictHostKeyChecking=no" 172.16.1.$ip ssh 172.16.1.$ip "ifconfig eth0" done #脚本路径/server/scripts/create_key.sh 4)实现文件分发和命令管理 方法1：脚本开发分发工具 [root@m01 /server/scripts]# cat fenfa.sh #!/bin/sh . /etc/init.d/functions if [ $# -ne 2 ] then echo "usage:/bin/sh $0 localfile remotedir" exit 1 fi for n in `cat /etc/ssh/hosts` do scp -P 22 -rp $1 root@$n:$2 &>/dev/null if [ $? -eq 0 ] then action "$n successful" /bin/true else action "$n failure" /bin/false fi done ============= [root@m01 /server/scripts]# cat fenfa.sh #!/bin/sh for n in 7 31 41 do scp -P 22 -rp $1 root@$n:$2 &>/dev/null done [root@m01 /server/scripts]# cat cmd.sh for n in 31 41 7 do echo "=====172.16.1.$n======" ssh 172.16.1.$n "$1" done 方法2：使用ansible工具 yum install ansible -y [root@m01 /server/scripts]# cat /etc/ansible/hosts [oldboy] 172.16.1.31 172.16.1.41 172.16.1.7 2）优化所有机器SSH 优化目标sshd_config [root@m01 /server/scripts]# sed -n '17,22p' /etc/ssh/sshd_config ####Start by oldboy#2020-04-26### PermitEmptyPasswords no UseDNS no GSSAPIAuthentication no #ListenAddress 172.16.1.7:22 ####End by oldboy#2018-04-26### 方法1：脚本分发 [root@m01 /server/scripts]# sh fenfa.sh /etc/ssh/sshd_config /etc/ssh/ 7 successful [ 确定 ] 31 successful [ 确定 ] 41 successful [ 确定 ] [root@m01 /server/scripts]# [root@m01 /server/scripts]# [root@m01 /server/scripts]# [root@m01 /server/scripts]# sh cmd.sh "systemctl restart sshd" =====172.16.1.31====== =====172.16.1.41====== =====172.16.1.7====== 方法2：使用ansible分发 ansible oldboy -m copy -a "src=/etc/ssh/sshd_config dest=/etc/ssh/sshd_config backup=yes" ansible oldboy -m shell -a "systemctl restart sshd" 从管理机实现一键安装install_rsync_server.sh ansible 172.16.1.41 -m script -a "/server/scripts/install_rsync_server.sh" [root@m01 /server/scripts]# cat /etc/ansible/hosts [oldboy] 172.16.1.31 172.16.1.41 172.16.1.7 172.16.1.8 [rsync_client] 172.16.1.31 172.16.1.8 ansible rsync_client -m script -a "/server/scripts/install_rsync_client.sh" 实现从管理机一键完成安装rsync服务端和客户端 3）一键完成nfs服务端。 4）一键完成nfs客户端。 5）一键完成sersync服务端。 6）一键完成sersync客户端。 一个脚本one_key.sh或者一个ansible命令。完成 项目实践作业： rsync服务端写成脚本 r1.sh rsync客户端写成脚本 r2.sh nfs服务端写成脚本 n1.sh nfs客户端写成脚本 n2.sh sersync服务端写成脚本 s1.sh sersync客户端写成脚本 s2.sh /server/scripts/one_key_gaoding.sh ansible r1 -m copy -a "src=/server/scripts/r1.sh dest=/server/scripts/ mode=ugo+x" ansible r1 -m shell -a "sh /server/scripts/r1.sh" ansible r1 -m copy -a "src=/server/scripts/r2.sh dest=/server/scripts/ mode=ugo+x" ansible r2 -m shell -a "sh /server/scripts/r2.sh" ansible n1 -m shell -a "sh /server/scripts/n1.sh" ansible n2 -m shell -a "sh /server/scripts/n2.sh" ansible s1 -m shell -a "sh /server/scripts/s1.sh" ansible s2 -m shell -a "sh /server/scripts/s2.sh" /bin/sh /server/scripts/one_key_gaoding.sh 也可以使用script模块，替代copy+shell模块