环境
三台虚拟机:
192.168.60.128(policy hub) server
192.168.60.129(client) agent1
192.168.60.130(client) agent2
配置完成了,现在准备测试,有以下需求
1.server、agent1建立test用户,agent2删除test用户
2.配置ssh让test用户不能登录
3.同步脚本目录
4.确保脚本具有执行权限
5.安装lamp环境
6.确保apache、mysql服务运行
下面例子是经过测试的,可能需要做一些修改才能使用,这些例子是在server上编写的。
server、agent1建立test用户,agent2删除test用户
- bundle agent user_add_del # 文件名是user_add_del.cf
- {
- vars:
- "users" slist => {"test"};
- classes:
- "add_$(users)" not => userexists("$(users)"); # 用户不存在则建立相应的class
- commands:
- # 如果相应classes存在则增加test用户,这里不能使用echo命令
- # cfengine不能管理简单的命令,最好使用脚本
- # ifvarclass允许在class expression使用变量
- # "cfengine::"这种形式不能使用变量
- "/bin/bash $(sys.workdir)/inputs/shell/useradd.sh $(users)"
- ifvarclass => "add_$(users)&(192_168_60_128|192_168_60_129)";
- # "192_168_60_130"是hard class,有cfengine自动建立
- "/usr/sbin/userdel -rf $(users)"
- ifvarclass => "!add_$(users)&192_168_60_130";
- }
配置ssh让test用户不能登录
- bundle agent config_ssh # 文件名config_ssh.cf
- {
- vars:
- # ssh config file
- "ssh" string => "/etc/ssh/sshd_config";
- # ssh config to set
- "sshd[DenyUsers]" string => "test";
- methods: # methods调用agent bundle,前面说过
- "sshd" usebundle => edit_sshd;
- }
- bundle agent edit_sshd
- {
- files:
- "$(config_ssh.ssh)"
- handle => "edit_sshd",
- comment => "Set desired sshd_config parameters",
- edit_line => set_config_values("config_ssh.sshd"),
- classes => if_repaired("restart_sshd"); # promises处于repaired状态则建立restart_sshd
- commands:
- restart_sshd.!no_restarts::
- "/etc/init.d/sshd reload"
- handle => "sshd_restart",
- comment => "Restart sshd if the configuration file was modified";
- }
- # Sets the RHS of variables in the file of the form # LHS RHS
- bundle edit_line set_config_values(v)
- {
- vars:
- "index" slist => getindices("$(v)");
- "cindex[$(index)]" string => canonify("$(index)"); #canonify除去class非法字符
- replace_patterns:
- "^\s*($(index)\s+(?!$($(v)[$(index)])).*|# ?$(index)\s+.*)$"
- replace_with => value("$(index) $($(v)[$(index)])"),
- classes => always("replace_attempted_$(cindex[$(index)])");
- insert_lines:
- "$(index) $($(v)[$(index)])"
- ifvarclass => "replace_attempted_$(cindex[$(index)])";
- }
- body classes always(x)
- {
- promise_kept => { "$(x)" };
- promise_repaired => { "$(x)" };
- repair_failed => { "$(x)" };
- repair_denied => { "$(x)" };
- repair_timeout => { "$(x)" };
- }
同步脚本目录并确保脚本具有执行权限
- bundle agent copy_shell # 文件名copy_shell.cf
- {
- vars:
- # 这里同步的是masterfiles/shell目录,权限默认开通
- # 如果同步/var/ftp/pub/shell,需要在"bundle server access_rules"开通权限
- "shell_location" string => "/var/cfengine/masterfiles/shell";
- "inputs_location" string => "/var/cfengine/inputs";
- files:
- "$(inputs_location)/shell"
- comment => "copy shell scripts from policy hub",
- handle => "sync_shell_scripts",
- copy_from => secure_cp("$(shell_location)","$(sys.policy_hub)"),
- depth_search => shell_recurse("inf"), # 无限递归
- file_select => shell_files; # 选择那种类型的文件同步,有点类似正则表达式
- "$(inputs_location)/shell"
- comment => "ensure shell scripts have execute permissions",
- handle => "update_shell_files",
- perms => m("755"),
- depth_search => shell_recurse("inf");
- }
- body file_select shell_files
- {
- leaf_name => { ".*.sh" }; # 选择shell脚本同步
- file_result => "leaf_name"; # 以leaf_name为标准同步
- }
- body depth_search shell_recurse(d)
- {
- include_basedir => "true";
- depth => "$(d)";
- }
安装lamp环境
- # 安装依赖包
- bundle agent lamp_pkgs_installed # 文件名是lamp.cf
- {
- vars:
- "desired_pkgs" slist => { "gcc", "gcc-c++",
- "libtermcap-devel",
- "libxml2-devel",
- };
- packages:
- "$(desired_pkgs)"
- package_policy => "add", #没有则安装
- package_method => yum,
- comment => "install desired packages";
- }
- # 删除已经安装的rpm packages
- bundle agent rpm_pkgs_remove
- {
- vars:
- "rpm_lamp" slist => { "httpd", "httpd-devel",
- "mysql", "mysql-server", "mysql-devel",
- "php", "php-devel", "php-mysql", "php-common",
- };
- packages:
- "$(rpm_lamp)"
- package_policy => "delete",
- package_method => yum,
- comment => "remove rpm version packages";
- }
- bundle agent mysql_install # 文件名是mysql_install.cf
- {
- vars:
- "install_dir" string => "/usr/local/lamp/mysql";
- "config_file" string => "/etc/my.cnf";
- "shell_dir" string => "/mnt/public/shell"; #安装脚本的位置
- classes:
- "mysql_install_dir_exists"
- expression => fileexists("$(install_dir)");
- "mysql_config_file_exists"
- expression => fileexists("$(config_file)");
- reports:
- !mysql_install_dir_exists::
- "$(install_dir) is not present.";
- commands:
- # 安装目录不存在则调用脚本安装,这里一定要注意时间的安排
- # 因为脚本运行的时间比较长,必须在下次评估前安装完
- # 脚本运行期间不要运行cf-agent,这样会出错的
- !mysql_install_dir_exists.Hr16.Min00_05::
- "$(shell_dir)/install_mysql.sh";
- # 配置文件不存在则拷贝
- mysql_install_dir_exists&!mysql_config_file_exists::
- "/bin/cp $(install_dir)/share/mysql/my-large.cf $(config_file)";
- "/bin/chown root:root $(config_file)";
- "/bin/chmod 644 $(config_file)";
- }
- # 结构和mysql_install.cf类似
- bundle agent apache_install # apache_install.cf
- {
- vars:
- "install_dir" string => "/usr/local/lamp/apache";
- "config_file" string => "/etc/httpd.conf";
- "shell_dir" string => "/mnt/public/shell";
- classes:
- "apache_install_dir_exists"
- expression => fileexists("$(install_dir)");
- "apache_config_file_exists"
- expression => fileexists("$(config_file)");
- reports:
- !apache_install_dir_exists::
- "$(install_dir) is not present.";
- commands:
- !apache_install_dir_exists.Hr17.Min00_05::
- "$(shell_dir)/install_apache.sh";
- apache_install_dir_exists&!apache_config_file_exists::
- "/bin/ln -s $(install_dir)/conf/httpd.conf /etc/httpd.conf";
- }
- # 结构和mysql_install.cf类似
- bundle agent php_install # php_install.cf
- {
- vars:
- "install_dir" string => "/usr/local/lamp/php";
- "mysql_dir" string => "/usr/local/lamp/mysql";
- "apache_dir" string => "/usr/local/lamp/apache";
- "config_file" string => "/etc/php.ini";
- "shell_dir" string => "/mnt/public/shell";
- classes:
- "php_install_dir_exists"
- expression => fileexists("$(install_dir)");
- "mysql_install_dir_exists"
- expression => fileexists("$(mysql_dir)");
- "apache_install_dir_exists"
- expression => fileexists("$(apache_dir)");
- "php_config_file_exists"
- expression => fileexists("$(config_file)");
- reports:
- !php_install_dir_exists::
- "$(install_dir) is not present.";
- commands:
- # php必须等mysql、apache安装完后才能安装,因为有依赖性
- !php_install_dir_exists.mysql_install_dir_exists.apache_install_dir_exists.Hr18.Min00_05::
- "$(shell_dir)/install_php.sh";
- php_install_dir_exists&!php_config_file_exists::
- "/bin/ln -s $(install_dir)/etc/php.ini /etc/php.ini";
- }
确保apache、mysql服务运行
- bundle agent start_process
- {
- vars:
- "processes" slist => {"httpd", "mysqld"};
- classes:
- "$(processes)_exist" expression => fileexists("/etc/init.d/$(processes)");
- processes:
- "$(processes)" restart_class => canonify("start_$(processes)");
- commands:
- "/etc/init.d/$(processes) start"
- ifvarclass => "start_$(processes)&$(processes)_exist";
- reports:
- cfengine::
- "--> apache is not running on $(sys.fqhost)"
- ifvarclass => "!httpd_exist";
- "--> mysql is not running on $(sys.fqhost)"
- ifvarclass => "!mysqld_exist";
- }
把上面的文件都放在masterfiles目录并在masterfiles里修改promises.cf
- bundlesequence => {
- "main", "user_add_del", "config_ssh",
- "copy_shell",
- "lamp_pkgs_installed", "mysql_install", "apache_install",
- "php_install",
- };
- inputs => {
- "cfengine_stdlib.cf",
- "user_add_del.cf",
- "config_ssh.cf",
- "copy_shell.cf",
- "lamp/lamp.cf",
- "lamp/mysql_install.cf",
- "lamp/apache_install.cf",
- "lamp/php_install.cf",
- };
lamp安装脚本在附件中,使用Notepad++打开,把脚本复制到/mnt/public/shell中