SaltStack之salt-ssh salt-ssh介绍salt-ssh的特点salt-ssh远程管理的方式 salt-ssh管理通过使用用户名密码的SSH实现远程管理免密登录通过salt-ssh初始化系统安装salt-minion
salt-ssh介绍
salt-ssh可以让我们不需要在受控机上安装salt-minion客户端也能够实现管理操作。
salt-ssh的特点 远程系统需要Python支持，除非使用-r选项发送原始ssh命令salt-ssh是一个软件包，需安装之后才能使用，命令本身也是salt-sshsalt-ssh不会取代标准的Salt通信系统，它只是提供了一个基于SSH的替代方案，不需要ZeroMQ和agent salt-ssh远程管理的方式
salt-ssh有两种方式实现远程管理，一种是在配置文件中记录所有客户端的信息，诸如 IP 地址、端口号、用户名、密码以及是否支持sudo等；另一种是使用密钥实现远程管理，不需要输入密码。
salt-ssh管理
在 master 上安装 salt-ssh
[[email protected] ~]# yum -y install salt-ssh 通过使用用户名密码的SSH实现远程管理
修改配置文件，添加受控机信息
# Sample salt-ssh config file #web1: # host: 192.168.42.1 # The IP addr or DNS hostname # user: fred # Remote executions will be executed as user fred # passwd: foobarbaz # The password to use for login, if omitted, keys are used # sudo: True # Whether to sudo to root, not enabled by default #web2: # host: 192.168.42.2 node1: host: 192.168.172.143 user: root passwd: 8
第一次联通需要很长时间，所以我们可以写一个config文件，让它进行非交互方式登录
[[email protected] ~]# vim ~/.ssh/config StrictHostKeyChecking no
测试连通性
[[email protected] ~]# salt-ssh * test.ping Permission denied for host node1, do you want to deploy the salt-ssh key? (password required): [Y/n] y Password for[email protected]: node1: True 免密登录 [[email protected] ~]# ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /root/.ssh/id_rsa. Your public key has been saved in /root/.ssh/id_rsa.pub. The key fingerprint is: SHA256:fcHhZ3Jmo6curhWhbeiZHn53glIbSjEoYSAtCrKfMUA[email protected] The keys randomart image is: +---[RSA 3072]----+ oE.. . =.. o o . ++ . . . . = B o o . . o= . X . . + . So= o . o ..+oo o .=o.+. ooo=.o . +=.o.o +----[SHA256]-----+ [[email protected] ~]# ssh-copy-id[email protected] /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: /root/.ssh/id_rsa.pub /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys[email protected]s password: Number of key(s) added: 1 Now try logging into the machine, with: ssh[email protected] and check to make sure that only the key(s) you wanted were added. [[email protected] ~]# salt-ssh * test.ping node1: True 通过salt-ssh初始化系统安装salt-minion [[email protected] ~]# cd /srv/salt/base/init/salt-minion/ [[email protected] salt-minion]# vim main.sls 0644 - template: jinja - require: - pkg: salt-minion salt-minion.service: service.running: - enable: true - reload: true - watch: - file: /etc/salt/minion [[email protected] ~]# vim /srv/salt/base/init/salt-minion/files/minion.j2 ...... #master: salt master: {{ pillar[master_ip] }} # Set http proxy information for the minion when doing requests ...... [[email protected] ~]# cat /srv/pillar/base/salt-minion.sls master_ip: 192.168.172.142 [[email protected] ~]# cat /srv/pillar/base/top.sls base: *: - salt-minion [[email protected] ~]# salt-ssh node1 state.sls init.salt-minion.main //安装完成后删除密钥 [[email protected] ~]# rm -f .ssh/authorized_keys [[email protected] ~]# salt-key -L Accepted Keys: Denied Keys: Unaccepted Keys: 192.168.172.142 192.168.172.143 Rejected Keys
