标签：The   常用   角色   gid   用户   false   检测   lin   分析   

使用roles一键优化企业架构

环境

流程分析

1.安装ansible
2.优化ansible
3.推送公钥
4.开启防火墙
5.开启80 443 873 nfs等端口和服务白名单
6.关闭selinux
7.创建同一的用户

推送公钥脚本

#推送过后，使用172.16.1.网段， 跳板机可以直接连接，10.0.0.网段第一次的连接只需要输入yes
#使用该脚本可以向新克隆的虚拟机推送该公钥

vim /root/jb.sh	    
#!/bin/bash 
pass=‘1‘
        ip=‘172.16.1.‘
        ip2=‘10.0.0.‘
	    [ -f /root/.ssh/id_rsa ] ||         ssh-keygen -t rsa -P "" -f /root/.ssh/id_rsa

        for i in  5 6 7 8 9 31 41 51 52 53 54 61 71 81;
        do
        sshpass -p $pass ssh-copy-id -i /root/.ssh/id_rsa.pub -o stricthostkeychecking=no root@${ip}${i}
        
        sshpass -p $pass ssh-copy-id -i /root/.ssh/id_rsa.pub -o stricthostkeychecking=no root@${ip2}${i}
        
        done
	    chmod 600 /root/jb.sh

1.安装absible
[root@m01 ~]# yum install -y ansible
2.优化ansible
[root@m01 ~]#  vim /etc/ansible/ansible.cfg		#改为
host_key_checking = False
3.创建密钥对
[root@m01 ~]# ssh-keygen
4.推送公钥
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.5
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.6
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.7
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.8
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.9
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.31
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.41
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.51
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.52
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.53
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.54
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.61
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.71
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.81

#或者使用脚本推送公钥
sh jb.sh

5.编辑主机清单
[root@m01 ~]# vim /etc/ansible/hosts
[web_group]
web01 ansible_ssh_host=172.16.1.7 asible_ssh_user=root ansible_ssh_port=22
web02 ansible_ssh_host=172.16.1.8 asible_ssh_user=root ansible_ssh_port=22
web03 ansible_ssh_host=172.16.1.9 asible_ssh_user=root ansible_ssh_port=22

[db_group]
db01 ansible_ssh_host=172.16.1.51 asible_ssh_user=root ansible_ssh_port=22
db02 ansible_ssh_host=172.16.1.52 asible_ssh_user=root ansible_ssh_port=22
db03 ansible_ssh_host=172.16.1.53 asible_ssh_user=root ansible_ssh_port=22
db04 ansible_ssh_host=172.16.1.54 asible_ssh_user=root ansible_ssh_port=22

[nfs_group]
nfs ansible_ssh_host=172.16.1.31 asible_ssh_user=root ansible_ssh_port=22

[redis_group]
redis ansible_ssh_host=172.16.1.81 asible_ssh_user=root ansible_ssh_port=22

[lb_group]
lb01 ansible_ssh_host=172.16.1.5 asible_ssh_user=root ansible_ssh_port=22
lb02 ansible_ssh_host=172.16.1.6 asible_ssh_user=root ansible_ssh_port=22

[backup_group]
backup ansible_ssh_host=172.16.1.41 asible_ssh_user=root ansible_ssh_port=22

[zabbix_group]
zabbix ansible_ssh_host=172.16.1.71 asible_ssh_user=root ansible_ssh_port=22

[m01_group]
m01 ansible_ssh_host=172.16.1.61 asible_ssh_user=root ansible_ssh_port=22

6.仪式（检测）
[root@m01 ~]# ansible ‘*‘ -m ping

ansible优化

1.下载
[root@m01 ~]#  yum install -y ansible
2.优化
[root@m01 ~]#  vim /etc/ansible/ansible.cfg		#改为
host_key_checking = False

使用ansible-galaxy创建角色目录

[root@m01 ansible]# ansible-galaxy init base

编辑tasks目录

1.打开防火墙
[root@m01 base]# vim tasks/firewalld.yml 
- name: start firewalld
  service:
    name: firewalld
    state: started
    enabled: yes
2.打开常用端口
[root@m01 base]# vim tasks/port.yml 
- name: Open Port
  firewalld:
    port: "{{ item }}"
    state: enabled
    permanent: no
  loop:
    - "{{ port }}"

- name: Open nfs
  firewalld:
    service: nfs
    state: enabled
    permanent: no
3.关闭selinux
[root@m01 base]# vim tasks/selinux.yml 
- name: stop selinux
  selinux:
    state: disabled
4.创建"www"用户
[root@m01 base]# vim tasks/user_group.yml 
- name: panduan "{{ ww_w }}"
  shell: ‘id {{ ww_w }}‘
  ignore_errors: yes
  register: id_www

- name: Create {{ ww_w }} Group
  group:
    name: "{{ ww_w }}"
    gid: "{{ uid_gid }}"
    state: present
  when: id_www.rc != 0

- name: Create {{ ww_w }} User
  user:
    name: "{{ ww_w }}"
    uid: "{{ uid_gid }}"
    group: "{{ ww_w }}"
    shell: /sbin/nologin
    create_home: false
  when: id_www.rc != 0
5.编辑main.yml
[root@m01 base]# vim tasks/main.yml 
- include: firewalld.yml
- include: port.yml
- include: selinux.yml
- include: user_group.yml
6.编辑变量文件
[root@m01 base]# vim vars/main.yml 

编辑vars目录

port:
  - "22/tcp"
  - "23/tcp"
  - "80/tcp"
  - "443/tcp"
  - "873/tcp"
  - "3306/tcp"
  - "9000/tcp"
  - "6379/tcp"
  - "8080/tcp"
ww_w: www
uid_gid: 666

编辑入口文件

[root@m01 roles]# vim site.yml 
- hosts: all
  roles:
    - { role: base }

执行

[root@m01 roles]# ansible-playbook site.yml

base

标签：The   常用   角色   gid   用户   false   检测   lin   分析   

原文地址：https://www.cnblogs.com/syy1757528181/p/13166101.html