sshkey + sudo

1. 生成sshkey

ssh-keygen -f root.pem -N '' -C 'root@local'
ssh-keygen -f ansible.pem -N '' -C 'ansible@local'
ssh-keygen -f app.pem -N '' -C 'app@local'

2. 用户ansible

useradd ansible
mkdir -p /home/ansible/.ssh && chmod 700 /home/ansible/.ssh

cat > /home/ansible/.ssh/authorized_keys <<EOF
ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ansible@local
EOF

chmod 600 /home/ansible/.ssh/authorized_keys
chown -R ansible:ansible /home/ansible/.ssh

3. 用户app

useradd app
mkdir -p /home/app/.ssh && chmod 700 /home/app/.ssh

cat > /home/app/.ssh/authorized_keys <<EOF
ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx app@local
EOF

chmod 600 /home/app/.ssh/authorized_keys
chown -R app:app /home/app/.ssh

4. 部署目录

mkdir -p /opt/app && chown -R app:app /opt/app

5 变更ssh端口29922 （略）

6. sudo

gpasswd -a ansible wheel
usermod -a -G wheel app
chmod 744 /usr/bin/su

# 禁止切换root
Cmnd_Alias DISABLE_SU = /usr/bin/su, /bin/bash

7. 登录

ssh -i root.pem root@srv-001 -p 29922
ssh -i ansible.pem ansible@srv-001 -p 29922
ssh -i app.pem app@srv-001 -p 29922