2、自动化运维之SaltStack远程执行详解
SaltStack远程执行详解
●目标(Targeting)
●模块(Module)
●返回(Returnners)
混合模式-C 选项
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184448002-160243564.png)
主机名设置参照:
redis-node1-redis03-idc04-soa.example.com(电商)
1.1模块介绍
[root@linux-node1 salt]# salt '*' service.available sshd
linux-node1.zhurui.com:
True
linux-node2.zhurui.com:
True
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184449002-2094337051.png)
服务重载:
[root@linux-node1 salt]# salt '*' service.reload httpd
linux-node2.zhurui.com:
True
linux-node1.zhurui.com:
True
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184449346-169161752.png)
服务状态:
[root@linux-node1 salt]# salt '*' service.status httpd
linux-node1.zhurui.com:
True
linux-node2.zhurui.com:
True
[root@linux-node1 salt]#
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184449752-1397689594.png)
1.2network模块介绍
1.2.1返回tcp状态
[root@linux-node1 salt]# salt '*' network.active_tcp
linux-node2.zhurui.com:
----------
0:
----------
local_addr:
0.0.0.0
local_port:
2049
remote_addr:
0.0.0.0
remote_port:
0
1:
----------
local_addr:
0.0.0.0
local_port:
35682
remote_addr:
0.0.0.0
remote_port:
0
10:
----------
local_addr:
192.168.0.16
local_port:
48670
remote_addr:
192.168.0.15
remote_port:
4506
2:
----------
local_addr:
0.0.0.0
local_port:
875
remote_addr:
0.0.0.0
remote_port:
0
3:
----------
local_addr:
0.0.0.0
local_port:
111
remote_addr:
0.0.0.0
remote_port:
0
4:
----------
local_addr:
0.0.0.0
local_port:
51349
remote_addr:
0.0.0.0
remote_port:
0
5:
----------
local_addr:
0.0.0.0
local_port:
22
remote_addr:
0.0.0.0
remote_port:
0
6:
----------
local_addr:
0.0.0.0
local_port:
55993
remote_addr:
0.0.0.0
remote_port:
0
7:
----------
local_addr:
0.0.0.0
local_port:
58267
remote_addr:
0.0.0.0
remote_port:
0
8:
----------
local_addr:
192.168.0.16
local_port:
22
remote_addr:
192.168.0.101
remote_port:
49285
9:
----------
local_addr:
192.168.0.16
local_port:
59181
remote_addr:
192.168.0.15
remote_port:
4505
linux-node1.zhurui.com:
----------
0:
----------
local_addr:
0.0.0.0
local_port:
58975
remote_addr:
0.0.0.0
remote_port:
0
1:
----------
local_addr:
0.0.0.0
local_port:
49856
remote_addr:
0.0.0.0
remote_port:
0
10:
----------
local_addr:
0.0.0.0
local_port:
4505
remote_addr:
0.0.0.0
remote_port:
0
11:
----------
local_addr:
0.0.0.0
local_port:
4506
remote_addr:
0.0.0.0
remote_port:
0
12:
----------
local_addr:
192.168.0.15
local_port:
4505
remote_addr:
192.168.0.15
remote_port:
51071
13:
----------
local_addr:
192.168.0.15
local_port:
4506
remote_addr:
192.168.0.16
remote_port:
48670
14:
----------
local_addr:
192.168.0.15
local_port:
4506
remote_addr:
192.168.0.15
remote_port:
33972
15:
----------
local_addr:
192.168.0.15
local_port:
22
remote_addr:
192.168.0.101
remote_port:
49268
16:
----------
local_addr:
192.168.0.15
local_port:
33972
remote_addr:
192.168.0.15
remote_port:
4506
17:
----------
local_addr:
192.168.0.15
local_port:
4505
remote_addr:
192.168.0.16
remote_port:
59181
18:
----------
local_addr:
127.0.0.1
local_port:
45016
remote_addr:
127.0.0.1
remote_port:
4506
19:
----------
local_addr:
192.168.0.15
local_port:
51071
remote_addr:
192.168.0.15
remote_port:
4505
2:
----------
local_addr:
0.0.0.0
local_port:
2049
remote_addr:
0.0.0.0
remote_port:
0
3:
----------
local_addr:
0.0.0.0
local_port:
44356
remote_addr:
0.0.0.0
remote_port:
0
4:
----------
local_addr:
0.0.0.0
local_port:
40808
remote_addr:
0.0.0.0
remote_port:
0
5:
----------
local_addr:
0.0.0.0
local_port:
11211
remote_addr:
0.0.0.0
remote_port:
0
1.2.1在master设置规则允许特定用户,可使用的特定方法
[root@linux-node1 salt]# vim /etc/salt/master
245 client_acl:
246 zhurui1:
247 - test.ping
248 - network.
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184450815-522868501.png)
[root@linux-node1 salt]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
[root@linux-node1 salt]# useradd zhurui1 ##创建用户,并且设置密码
[root@linux-node1 salt]# echo '123456'|passwd --stdin zhurui1
Changing password for user zhurui.
passwd: all authentication tokens updated successfully.
[root@linux-node1 salt]#
[root@linux-node1 home]# chmod 777 /var/log/salt/master
[root@linux-node1 home]# su - zhurui1
[zhurui1@linux-node1 ~]$ salt '*' test.ping
linux-node2.zhurui.com:
True
linux-node1.zhurui.com:
True
[zhurui1@linux-node1 ~]$
截图如下:
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184451065-11622325.png)
运行其他模块跟方法会报错,没有权限
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184451393-1921694196.png)
1.2.2 指定特定主机,在特定用户下允许的操作
client_acl:
zhurui1:
- test.ping
- network.*
user01:
- linux-node1*:
- test.ping
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184456674-404019550.png)
[root@linux-node1 home]# /etc/init.d/salt-master restart
Stopping salt-master daemon: [ OK ]
Starting salt-master daemon: [ OK ]
[root@linux-node1 home]# su - user01
[user01@linux-node1 ~]$ salt '*' test.ping
Failed to authenticate! This is most likely because this user is not permitted to execute commands, but there is a small possibility that a disk error occurred (check disk/inode usage).
[user01@linux-node1 ~]$ salt 'linux-node1*' test.ping
linux-node1.zhurui.com:
True
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184456955-2015054760.png)
1.2.3 指定黑名单,禁止特定用户的操作
开启如下行:
![](https://images2015.cnblogs.com/blog/854573/201703/854573-20170325184457283-1771537158.png)
########## 今天的苦逼是为了不这样一直苦逼下去!##########