环境说明： 原理图：
一、 时间同步,并写入crontab 15 1 * * * /usr/sbin/ntpdate pool.ntp.org; hwclock -w >/dev/null 2>&1 二、 修改主机名,并写入/etc/hosts文件 192.168.0.12 puppetmaster.info.com 192.168.0.64 client1.info.com 三、 安装ruby [iyunv@puppetmaster ~]# yum install ruby ruby-libs ruby-rdoc -y [iyunv@puppetmaster ~]# ruby --version ruby 1.8.5 (2006-08-25) [i386-linux] 四、 安装facter [iyunv@puppetmaster src]# wget http://downloads.puppetlabs.com/facter/facter-1.6.8.tar.gz [iyunv@puppetmaster src]# tar xzvf facter-1.6.8.tar.gz [iyunv@puppetmaster src]# cd facter-1.6.8 [iyunv@puppetmaster facter-1.6.8]# ruby install.rb [iyunv@puppetmaster puppet-2.7.14]# ruby install.rb 五、 安装puppet [iyunv@puppetmaster src]# wget http://downloads.puppetlabs.com/puppet/puppet-2.7.14.tar.gz [iyunv@puppetmaster src]# tar xzvf puppet-2.7.14.tar.gz [iyunv@puppetmaster src]# cd puppet-2.7.14 六、 复制配置文件 [iyunv@puppetmaster puppet-2.7.14]# cp conf/redhat/fileserver.conf /etc/puppet/ [iyunv@puppetmaster puppet-2.7.14]# cp conf/redhat/puppet.conf /etc/puppet/ [iyunv@puppetmaster puppet-2.7.14]# cp conf/redhat/server.init /etc/init.d/puppetmaster 七、 设置puppetmaster 服务开机启动 [iyunv@puppetmaster puppet-2.7.14]# ls -l /etc/init.d/puppetmaster -rwxr-xr-x 1 root root 3936 Sep 3 12:13 /etc/init.d/puppetmaster [iyunv@puppetmaster puppet-2.7.14]# [iyunv@puppetmaster puppet-2.7.14]# chkconfig --add puppetmaster [iyunv@puppetmaster puppet-2.7.14]# chkconfig --level 35 puppetmaster on 八、 创建puppet帐号 [iyunv@puppetmaster puppet-2.7.14]# puppetmasterd --mkusers [iyunv@puppetmaster puppet-2.7.14]# ls -l /etc/puppet/ total 16 -rw-r--r-- 1 root root 2552 Sep 3 12:11 auth.conf -rwxr-xr-x 1 root root 381 Sep 3 12:13 fileserver.conf drwxr-xr-x 2 root root 4096 Sep 3 12:17 manifests -rwxr-xr-x 1 root root 853 Sep 3 12:13 puppet.conf [iyunv@puppetmaster puppet-2.7.14]# id puppet uid=1002(puppet) gid=1002(puppet) groups=1002(puppet) [iyunv@puppetmaster puppet]# cat /etc/passwd |grep puppet puppet:x:1002:1002::/home/puppet:/bin/bash [iyunv@puppetmaster puppet]# ls -l /var/lib/puppet/ total 36 drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 bucket drwxr-xr-x 2 root root 4096 Sep 3 12:17 facts drwxr-xr-x 2 root root 4096 Sep 3 12:17 lib drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 reports drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 rrd drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 server_data drwxrwx--x 8 puppet root 4096 Sep 3 12:26 ssl drwxr-xr-t 2 root root 4096 Sep 3 12:17 state drwxr-x--- 2 puppet puppet 4096 Sep 3 12:17 yaml [iyunv@puppetmaster puppet]# netstat -Tanlp | grep 8140 tcp 0 0 0.0.0.0:8140 0.0.0.0:* LISTEN 4556/ruby 客户端： [iyunv@client1 puppet-2.7.14]# cp conf/redhat/client.init /etc/init.d/puppet [iyunv@client1 puppet-2.7.14]# chkconfig --level 35 puppet on [iyunv@client1 puppet-2.7.14]# puppetd --mkusers Could not prepare for execution: Got 1 failure(s) while initializing: change from absent to present failed: Could not create user puppet: Execution of '/usr/sbin/useradd -g puppet -M puppet' returned 3: useradd: invalid numeric argument 'puppet' [iyunv@client1 puppet-2.7.14]# groupadd puppet;useradd -g puppet -M puppet [iyunv@client1 puppet-2.7.14]# service puppet start Starting puppet: [ OK ] [iyunv@client1 puppet-2.7.14]# telnet puppetmaster.info.com 8140 Trying 192.168.0.12... Connected to puppetmaster.info.com (192.168.0.12). Escape character is '^]'. [iyunv@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com warning: peer certificate won't be verified in this SSL session info: Caching certificate for ca warning: peer certificate won't be verified in this SSL session warning: peer certificate won't be verified in this SSL session info: Creating a new SSL certificate request for client1.info.com info: Certificate Request fingerprint (md5): 07:C9:D4:43:3C:3E:D6:D1:0A:B1:8B:71:DB:6B:9D:FE warning: peer certificate won't be verified in this SSL session warning: peer certificate won't be verified in this SSL session warning: peer certificate won't be verified in this SSL session Exiting; no certificate found and waitforcert is disabled 以下这步批准证书是在服务端操作 查看当前待批准证书列表 [iyunv@puppetmaster ~]# puppetca -l client1.info.com (07:C9:D4:43:3C:3E:D6:D1:0A:B1:8B:71:DB:6B:9D:FE) 批准当前证书 [iyunv@puppetmaster ~]# puppetca -s client1.info.com notice: Signed certificate request for client1.info.com notice: Removing file Puppet::SSL::CertificateRequest client1.info.com at '/var/lib/puppet/ssl/ca/requests/client1.info.com.pem' 查看验证签名,注意前面的+号，说明已经签名 [iyunv@puppetmaster ~]# puppetca -a --list + client1.info.com (03:BE:50:AE:72:1A:39:79:17:F4:E5:74:FD:CC:BC:8C) + puppetmaster.info.com (97:34:BF:26:A6:0E:E9:9C:DB:76:D3:53:D0:56:60:83) (alt names: DNS:puppet, DNS:puppet.info.com, DNS:puppetmaster.info.com) 如果要批准全部证书 puppetca -s -a 也可以在puppetmaster端的puppet.conf加入这行： autosign = true 服务端就自动签证书 回到客户端操作，从服务端取回已批准的证书 [iyunv@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com warning: peer certificate won't be verified in this SSL session info: Caching certificate for client1.info.com info: Caching certificate_revocation_list for ca info: Caching catalog for client1.info.com info: Applying configuration version '1378188531 验证证书是否正确 服务端: [iyunv@puppetmaster ~]# md5sum /var/lib/puppet/ssl/ca/signed/client1.info.com.pem 27a295f39a6b4a6c7ceb74c9c3a5084c /var/lib/puppet/ssl/ca/signed/client1.info.com.pem 客户端: [iyunv@client1 puppet-2.7.14]# md5sum /etc/puppet/ssl/certs/client1.info.com.pem 27a295f39a6b4a6c7ceb74c9c3a5084c /etc/puppet/ssl/certs/client1.info.com.pem 出现修改主机名问题引起无法认证，需要重新申请证书，操作以下两个步骤： 服务端： [iyunv@puppetmaster ~]# rm /var/lib/puppet/ssl/ca/signed/client1.info.com.pem -rf 客户端： [iyunv@client1 puppet-2.7.14]# rm /etc/puppet/ssl/certs/ -rf 功能测试 服务端： [iyunv@puppetmaster ~]# vim /etc/puppet/manifests/site.pp node default { file {"/tmp/viong.txt": content=>"good,test pass!\nHello World!\n";} } [iyunv@puppetmaster ~]# service puppetmaster restart Stopping puppetmaster: [ OK ] Starting puppetmaster: [ OK ] 客户端： [iyunv@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com info: Caching catalog for client1.info.com info: Applying configuration version '1378190404' notice: /Stage[main]//Node[default]/File[/tmp/viong.txt]/ensure: defined content as '{md5}4750aa5be82dae5db286a5859700dd51' notice: Finished catalog run in 0.03 seconds 如果报错 [iyunv@client1 puppet-2.7.14]# puppetd --test --server puppetmaster.info.com err: Could not retrieve catalog from remote server: Error 400 on SERVER: Could not parse for environment production: Syntax error at end of file; expected '}' at /etc/puppet/manifests/site.pp:4 on node client1.info.com warning: Not using cache on failed catalog err: Could not retrieve catalog; skipping run 可能是/etc/puppet/manifests/site.pp 这个文件书写格式有问题。 在客户端查看: [iyunv@client1 puppet-2.7.14]# ls -l /tmp/viong.txt -rw-r--r-- 1 root root 29 Sep 3 14:50 /tmp/viong.txt [iyunv@client1 puppet-2.7.14]# cat /tmp/viong.txt good,test pass!
运维网声明
1、欢迎大家加入本站运维交流群:群②:261659950 群⑤:202807635 群⑦870801961 群⑧679858003运维网
QQ群⑧：
窥视卡
雷达卡
发表于 2015-9-16 11:08:54
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡