SSH批量部署服务

SSH批量部署服务

在NFS上作为中心分发服务器将私钥分发到其他服务器上

NFS部署

 

 1 [root@nfs-server ~]# useradd luoahong
 2 [root@nfs-server ~]# echo 123456|passwd --stdin luoahong
 3 Changing password for user luoahong.
 4 passwd: all authentication tokens updated successfully.
 5 创建密码对:
 6 [root@nfs-server ~]# su - luoahong     ##切换到luoahong用户下，以后批量分发都在当前用户下，安全考虑
 7 [luoahong@nfs-server ~]$ ssh-keygen -t dsa ##ssh-keygen是生成秘钥的工具，-t参数指建立秘钥的类型，这里建立dsa类型秘钥(还有一种类型的秘钥为RSA，两者加密算法有区别)
 8 Generating public/private dsa key pair.
 9 Enter file in which to save the key (/home/luoahong/.ssh/id_dsa): 
10 Created directory '/home/luoahong/.ssh'.
11 Enter passphrase (empty for no passphrase): 
12 Enter same passphrase again: 
13 Your identification has been saved in /home/luoahong/.ssh/id_dsa.
14 Your public key has been saved in /home/luoahong/.ssh/id_dsa.pub.
15 The key fingerprint is:
16 6f:65:c4:a6:fb:32:45:0c:85:c3:bc:87:8f:a4:ae:bc luoahong@nfs-server
17 The key's randomart image is:
18 +--[ DSA 1024]----+
19 |         o o.    |
20 |          *.     |
21 |           *+    |
22 |          +++    |
23 |        So.=o    |
24 |        ...+o    |
25 |       .  +.     |
26 |     .  ..o.     |
27 |      Eo   o.    |
28 +-----------------+
29 [luoahong@nfs-server ~]$ 
30 [luoahong@nfs-server ~]$ ls -l .ssh/
31 total 8
32 -rw-------. 1 luoahong luoahong 672 Mar  5 04:23 id_dsa   ##私钥
33 -rw-r--r--. 1 luoahong luoahong 607 Mar  5 04:23 id_dsa.pub  ##公钥
34 将公钥分发给web-lamp01服务器
35 [luoahong@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub luoahong@10.241.58.12  ##将公钥分发给1.12服务器
36 The authenticity of host '10.241.58.12 (10.241.58.12)' can't be established.
37 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
38 Are you sure you want to continue connecting (yes/no)? yes
39 Warning: Permanently added '10.241.58.12' (RSA) to the list of known hosts.
40 Nasty PTR record "10.241.58.12" is set up for 10.241.58.12, ignoring
41 luoahong@10.241.58.12's password: 
42 Permission denied, please try again.
43 luoahong@10.241.58.12's password: 
44 Now try logging into the machine, with "ssh 'luoahong@10.241.58.12'", and check in:
45 
46   .ssh/authorized_keys
47 
48 to make sure we haven't added extra keys that you weren't expecting.
49 
50 [luoahong@nfs-server ~]$ 

 

web-lnmp02客户端分发部署

 1 [luoahong@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub luoahong@10.241.58.13  ##将公钥分发到1.13服务器
 2 The authenticity of host '10.241.58.13 (10.241.58.13)' can't be established.
 3 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
 4 Are you sure you want to continue connecting (yes/no)? yes
 5 Warning: Permanently added '10.241.58.13' (RSA) to the list of known hosts.
 6 Nasty PTR record "10.241.58.13" is set up for 10.241.58.13, ignoring
 7 luoahong@10.241.58.13's password: 
 8 Now try logging into the machine, with "ssh 'luoahong@10.241.58.13'", and check in:
 9 
10   .ssh/authorized_keys
11 
12 to make sure we haven't added extra keys that you weren't expecting.
13 
14 [luoahong@nfs-server ~]$ 

 rsync-backup客户端分发部署

 

 1 [luoahong@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub luoahong@10.241.58.17
 2 The authenticity of host '10.241.58.17 (10.241.58.17)' can't be established.
 3 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
 4 Are you sure you want to continue connecting (yes/no)? yes
 5 Warning: Permanently added '10.241.58.17' (RSA) to the list of known hosts.
 6 luoahong@10.241.58.17's password: 
 7 Now try logging into the machine, with "ssh 'luoahong@10.241.58.17'", and check in:
 8 
 9   .ssh/authorized_keys
10 
11 to make sure we haven't added extra keys that you weren't expecting.
12 
13 [luoahong@nfs-server ~]$ 

 

2.1在NFS上测试

2.1.1 通过ssh命令在当前机器上查看web-lamp01的IP地址

 

 1 [luoahong@nfs-server ~]$ ssh -P22 luoahong@10.241.58.12 /sbin/ifconfig eth0
 2 eth0      Link encap:Ethernet  HWaddr 00:0C:29:49:CE:B3  
 3           inet addr:10.241.58.12  Bcast:10.241.58.255  Mask:255.255.255.0
 4           inet6 addr: fe80::20c:29ff:fe49:ceb3/64 Scope:Link
 5           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 6           RX packets:7701 errors:0 dropped:0 overruns:0 frame:0
 7           TX packets:4795 errors:0 dropped:0 overruns:0 carrier:0
 8           collisions:0 txqueuelen:1000 
 9           RX bytes:4806676 (4.5 MiB)  TX bytes:484902 (473.5 KiB)
10 注：在命令执行过程中，跳过输入密码的步骤
11 接着分发文件测试：
12 [luoahong@nfs-server ~]$ cp /etc/hosts
13 hosts        hosts.allow  hosts.deny   
14 [luoahong@nfs-server ~]$ cp /etc/hosts .
15 [luoahong@nfs-server ~]$ ll
16 [luoahong@nfs-server ~]$ scp -P22 hosts luoahong@10.241.58.12:~ ##将当前目录下hosts文件分发到1.12家目录下
17 hosts                                          100%  243     0.2KB/s   00:00    
18 [luoahong@nfs-server ~]$ 
19 
20 检查1.12上luoahong家目录下有无hosts文件
21 [root@lamp01 luoahong]# cat /home/luoahong/hosts 
22 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4 
23 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
24 10.241.58.11 nfs-server
25 10.241.58.17 backup
26 10.241.58.12 lamp01
27 10.241.58.13 lnmp02
28 [root@lamp01 luoahong]# 
29 通过脚本分发：
30 [luoahong@nfs-server ~]$ sh fenfa.sh
31 hosts                                          100%  257     0.3KB/s   00:00    
32 hosts                                          100%  257     0.3KB/s   00:00    
33 hosts                                          100%  257     0.3KB/s   00:00  
34   

 

批量管理脚本：

 1 #!/bin/sh
 2 . /etc/init.d/functions
 3 if [ $# -ne 1 ]
 4    then
 5     echo "USAGE:$0 USAGE|COMMAND"
 6     exit 1
 7 fi
 8 for n in 12 13 17
 9 do
10   ssh -p22 luoahong@10.241.58.$n $1
11 done
12 
13 ~         

 

批量分发脚本：

 

 1 #!/bin/sh
 2 . /etc/init.d/functions
 3 
 4 for n in 12 13 17
 5 do
 6   scp -P22 $1 luoahong@10.241.58.$n:~ &>/dev/null
 7   if [ $? -eq 0 ]
 8     then
 9       action "fenfa $1 ok" /bin/true
10     else
11       action "fenfa $1 ok" /bin/false
12   fi
13 done
14 
15 ~     

 

利用分发脚本分发hosts文件

 

1 [luoahong@nfs-server ~]$ sh fenfa.sh hosts
2 fenfa hosts ok                                             [  OK  ]
3 fenfa hosts ok                                             [  OK  ]
4 fenfa hosts ok                                             [  OK  ]
5 [luoahong@nfs-server ~]$ 

 

优化后的分发脚本

 

 1 #!/bin/sh
 2 . /etc/init.d/functions
 3 if [ $# -ne 1 ]
 4    then
 5     echo "USAGE:$0 {FILENAME|DIRNAME}"
 6     exit 1
 7 fi
 8 for n in 12 13 17
 9 do
10   scp -P22 -r $1 luoahong@10.241.58.$n:~ &>/dev/null
11   if [ $? -eq 0 ]
12     then
13       action "fenfa $1 ok" /bin/true
14     else
15       action "fenfa $1 ok" /bin/false
16   fi
17 done