自动化运维之 - puppet server端与client端结合

 

客户端:

 

客户端发送请求证书

 

[root@web01 puppet-2.7.21]# puppetd --test --server Centos-server

err: Could not retrieve catalog from remote server: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: centos-server]  报错



[root@web01 puppet-2.7.21]# rm -rf /var/lib/puppet/ssl/

[root@web01 puppet-2.7.21]# puppetd --test --server Centos-server

info: Creating a new SSL key for web01.localdomain

info: Caching certificate for ca

info: Creating a new SSL certificate request for web01.localdomain

info: Certificate Request fingerprint (md5): 93:00:78:65:06:C4:A7:60:46:2D:AF:49:A7:43:DA:81

Exiting; no certificate found and waitforcert is disabled

 

 

 

 

 

验证证书

 

[root@web01 ~]# md5sum /var/lib/puppet/ssl/certs/web01.localdomain.pem

3e3caddfa5f7a48e9b94a8c536f2ecdc  /var/lib/puppet/ssl/certs/web01.localdomain.pem

 

 

 

 

 

 

 

 

 

 

 

 

服务器端:

 

查看当前待批准证书列表

 

[root@Centos-server ~]# puppetca -l

  "web01.localdomain" (93:00:78:65:06:C4:A7:60:46:2D:AF:49:A7:43:DA:81)

  

批准当前证书  

 

[root@Centos-server ~]# puppetca -s web01.localdomain

notice: Signed certificate request for web01.localdomain

notice: Removing file Puppet::SSL::CertificateRequest web01.localdomain at '/var/lib/puppet/ssl/ca/requests/web01.localdomain.pem'

 

 

查看验证签名,注意前面的+号，说明已经签名

 

[root@Centos-server ~]# puppetca -a --list

+ "centos-server"             (67:FB:EB:79:FC:9A:F8:FC:37:EB:4B:07:8B:91:D4:14)

+ "centos-server.localdomain" (8B:60:F1:FF:7A:17:B0:66:88:72:F8:B5:C0:97:FF:5A) (alt names: "DNS:Centos-server.localdomain", "DNS:centos-server.localdomain", "DNS:puppet", "DNS:puppet.localdomain")

+ "web01.localdomain"         (E4:89:58:EE:2F:95:58:34:4A:6F:2D:73:1A:DC:35:A7)





[root@Centos-server ~]# puppetca -s -a   //对所有客户端全部签名

 

puppet 如何全客户端自动签名

 

[root@Centos-server ~]# vim /etc/puppet/puppet.conf

    autosign = true                                         服务端就自动签证书

    autosing=/etc/puppet/autosign.conf

[root@Centos-server manifests]# vim /etc/puppet/autosign.conf

172.16.10.0/24

 

 

其中添加 * 表示所有，或者添加域名,IP或者网段

*

*.test.com

192.168.0.1/24

 

    

 

[root@Centos-server ~]# /etc/init.d/puppetmaster restart

Stopping puppetmaster:                                     [  OK  ]

Starting puppetmaster:                                     [  OK  ]

验证证书

 

[root@Centos-server ~]# md5sum /var/lib/puppet/ssl/ca/signed/web01.localdomain.pem

3e3caddfa5f7a48e9b94a8c536f2ecdc  /var/lib/puppet/ssl/ca/signed/web01.localdomain.pem