SSH批量部署服务

SSH批量部署服务

1.1在NFS上作为中心分发服务器将私钥分发到其他服务器上

1.1.1NFS部署

 [root@nfs-server ~]# useradd zhurui
 [root@nfs-server ~]# echo 123456|passwd --stdin zhurui
 Changing password for user zhurui.
 passwd: all authentication tokens updated successfully.
 创建密码对:
 [root@nfs-server ~]# su - zhurui     ##切换到zhurui用户下，以后批量分发都在当前用户下，安全考虑
 [zhurui@nfs-server ~]$ ssh-keygen -t dsa ##ssh-keygen是生成秘钥的工具，-t参数指建立秘钥的类型，这里建立dsa类型秘钥(还有一种类型的秘钥为RSA，两者加密算法有区别)
 Generating public/private dsa key pair.
 Enter file in which to save the key (/home/zhurui/.ssh/id_dsa):
 Created directory '/home/zhurui/.ssh'.
 Enter passphrase (empty for no passphrase):
 Enter same passphrase again:
 Your identification has been saved in /home/zhurui/.ssh/id_dsa.
 Your public key has been saved in /home/zhurui/.ssh/id_dsa.pub.
 The key fingerprint is:
 6f:65:c4:a6:fb:32:45:0c:85:c3:bc:87:8f:a4:ae:bc zhurui@nfs-server
 The key's randomart image is:
 +--[ DSA 1024]----+
 |         o o.    |
 |          *.     |
 |           *+    |
 |          +++    |
 |        So.=o    |
 |        ...+o    |
 |       .  +.     |
 |     .  ..o.     |
 |      Eo   o.    |
 +-----------------+
 [zhurui@nfs-server ~]$
 [zhurui@nfs-server ~]$ ls -l .ssh/
 total 8
 -rw-------. 1 zhurui zhurui 672 Mar  5 04:23 id_dsa   ##私钥
 -rw-r--r--. 1 zhurui zhurui 607 Mar  5 04:23 id_dsa.pub  ##公钥
 将公钥分发给web-lamp01服务器
 [zhurui@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub zhurui@192.168.1.12  ##将公钥分发给1.12服务器
 The authenticity of host '192.168.1.12 (192.168.1.12)' can't be established.
 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
 Are you sure you want to continue connecting (yes/no)? yes
 Warning: Permanently added '192.168.1.12' (RSA) to the list of known hosts.
 Nasty PTR record "192.168.1.12" is set up for 192.168.1.12, ignoring
 zhurui@192.168.1.12's password:
 Permission denied, please try again.
 zhurui@192.168.1.12's password:
 Now try logging into the machine, with "ssh 'zhurui@192.168.1.12'", and check in:

   .ssh/authorized_keys

 to make sure we haven't added extra keys that you weren't expecting.

 [zhurui@nfs-server ~]$ 

1.1.2 web-lnmp02客户端分发部署

 [zhurui@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub zhurui@192.168.1.13  ##将公钥分发到1.13服务器
 The authenticity of host '192.168.1.13 (192.168.1.13)' can't be established.
 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
 Are you sure you want to continue connecting (yes/no)? yes
 Warning: Permanently added '192.168.1.13' (RSA) to the list of known hosts.
 Nasty PTR record "192.168.1.13" is set up for 192.168.1.13, ignoring
 zhurui@192.168.1.13's password:
 Now try logging into the machine, with "ssh 'zhurui@192.168.1.13'", and check in:

   .ssh/authorized_keys

 to make sure we haven't added extra keys that you weren't expecting.

 [zhurui@nfs-server ~]$ 

1.1.3 rsync-backup客户端分发部署

 [zhurui@nfs-server ~]$ ssh-copy-id -i .ssh/id_dsa.pub zhurui@192.168.1.17
 The authenticity of host '192.168.1.17 (192.168.1.17)' can't be established.
 RSA key fingerprint is d6:e6:e6:2a:c7:df:99:51:bb:f4:90:29:16:df:c4:a5.
 Are you sure you want to continue connecting (yes/no)? yes
 Warning: Permanently added '192.168.1.17' (RSA) to the list of known hosts.
 zhurui@192.168.1.17's password:
 Now try logging into the machine, with "ssh 'zhurui@192.168.1.17'", and check in:

   .ssh/authorized_keys

 to make sure we haven't added extra keys that you weren't expecting.

 [zhurui@nfs-server ~]$ 

2.1在NFS上测试

2.1.1 通过ssh命令在当前机器上查看web-lamp01的IP地址

 [zhurui@nfs-server ~]$ ssh -P22 zhurui@192.168.1.12 /sbin/ifconfig eth0
 eth0      Link encap:Ethernet  HWaddr 00:0C:29:49:CE:B3
           inet addr:192.168.1.12  Bcast:192.168.1.255  Mask:255.255.255.0
           inet6 addr: fe80::20c:29ff:fe49:ceb3/64 Scope:Link
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:7701 errors:0 dropped:0 overruns:0 frame:0
           TX packets:4795 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:4806676 (4.5 MiB)  TX bytes:484902 (473.5 KiB)
 注：在命令执行过程中，跳过输入密码的步骤
 接着分发文件测试：
 [zhurui@nfs-server ~]$ cp /etc/hosts
 hosts        hosts.allow  hosts.deny
 [zhurui@nfs-server ~]$ cp /etc/hosts .
 [zhurui@nfs-server ~]$ ll
 [zhurui@nfs-server ~]$ scp -P22 hosts zhurui@192.168.1.12:~ ##将当前目录下hosts文件分发到1.12家目录下
 hosts                                          100%  243     0.2KB/s   00:00
 [zhurui@nfs-server ~]$ 

 检查1.12上zhurui家目录下有无hosts文件
 [root@lamp01 zhurui]# cat /home/zhurui/hosts
 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
 192.168.1.11 nfs-server
 192.168.1.17 backup
 192.168.1.12 lamp01
 192.168.1.13 lnmp02
 [root@lamp01 zhurui]#
 通过脚本分发：
 [zhurui@nfs-server ~]$ sh fenfa.sh
 hosts                                          100%  257     0.3KB/s   00:00
 hosts                                          100%  257     0.3KB/s   00:00
 hosts                                          100%  257     0.3KB/s   00:00
   

批量管理脚本：

 #!/bin/sh
 . /etc/init.d/functions
 if [ $# -ne 1 ]
    then
     echo "USAGE:$0 USAGE|COMMAND"
     exit 1
 fi
 for n in 12 13 17
 do
   ssh -p22 zhurui@192.168.1.$n $1
 done

 ~         

批量分发脚本：

 #!/bin/sh
 . /etc/init.d/functions

 for n in 12 13 17
 do
   scp -P22 $1 zhurui@192.168.1.$n:~ &>/dev/null
   if [ $? -eq 0 ]
     then
       action "fenfa $1 ok" /bin/true
     else
       action "fenfa $1 ok" /bin/false
   fi
 done

 ~     

利用分发脚本分发hosts文件

 [zhurui@nfs-server ~]$ sh fenfa.sh hosts
 fenfa hosts ok                                             [  OK  ]
 fenfa hosts ok                                             [  OK  ]
 fenfa hosts ok                                             [  OK  ]
 [zhurui@nfs-server ~]$ 

优化后的分发脚本

 #!/bin/sh
 . /etc/init.d/functions
 if [ $# -ne 1 ]
    then
     echo "USAGE:$0 {FILENAME|DIRNAME}"
     exit 1
 fi
 for n in 12 13 17
 do
   scp -P22 -r $1 zhurui@192.168.1.$n:~ &>/dev/null
   if [ $? -eq 0 ]
     then
       action "fenfa $1 ok" /bin/true
     else
       action "fenfa $1 ok" /bin/false
   fi
 done