puppet系列之sudo模块

yxxs123 · 发表于 2018-8-3 07:32:17

　　需求：每台服务器上都创建dev组，专门给开发人员，给特定的开发人员建账号，并加入dev组；
　　运维人员也将创建各自的用户，并加入wheel组，通过sudo来对组里成员做权限设置。
　　架构如下：

http://blog.51cto.com/attachment/201304/210228339.jpg

　　manfests里面的文件内容如下：
　　

1,init.pp
class sudo {
case $::osfamily {
'RedHat': {
include "sudo::conf"
import 'sudoers.pp'
}
default: {
fail("$::osfamily not yet supported by the 'sudo' module!")
}
}
}
2,conf.pp
class sudo::conf {
package { "sudo":
ensure => present,
}
# Source the sudoers file from the Puppet Master
file { "/etc/sudoers":
ensure => present,
owner => 'root',
group => 'root',
mode => 0440,
source => "puppet:///modules/sudo/sudoers",
require => Package["sudo"],
}
# Source a new 'su' file for PAM (caution: this may be platform-specific)
file { "/etc/pam.d/su":
ensure => present,
owner => 'root',
group => 'root',
mode => 0644,
source => "puppet:///modules/sudo/pam_su_el6"
}
# Clear any config in sudoers.d
file { "/etc/sudoers.d":
ensure => directory,
owner => 'root',
group => 'root',
mode => '0750',
recurse => true,
purge => true,
require => Package["sudo"],
}
}
3,sudoers.pp
define sudo::sudoers (
$sudo_sudoers ,
$sudo_sysadmins ,
# $admins = split($sudo_sysadmins, ','),
# $sudoers = split($sudo_sudoers, ','),
)
{
user { [ $sudo_sysadmins ]:
ensure => present,
groups => ['wheel'],
require => Group['wheel'],
}
user { [ $sudo_sudoers ]:
ensure => present,
groups => ['dev'],
require => Group['dev'],
}
group { "wheel":
ensure => present,
}
group { "dev":
ensure => present,
}
}

　　

　　files目录文件内容如下：
　　

1,pam_su_el6
#%PAM-1.0
# This file is managed by Puppet.
#
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth required pam_wheel.so use_uid
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so
2,sudoers
## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
##
## This file must be edited with the 'visudo' command.
## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhap using
## wildcards for entire domains) or IP addresses instead.
# Host_Alias FILESERVERS = fs1, fs2
# Host_Alias MAILSERVERS = smtp, smtp2
## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem
## Command Aliases
## These are groups of related commands...
## Networking
#Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
## Installation and management of software
Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
## Services
#Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
## Updating the locate database
#Cmnd_Alias LOCATE = /usr/bin/updatedb
## Storage
Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
## Delegating permissions
#Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp
## Processes
#Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
## Drivers
#Cmnd_Alias DRIVERS = /sbin/modprobe
## Denied commands for dev
Cmnd_Alias DEV_DENIED = /bin/su, /usr/sbin/visudo, /bin/chgrp, /usr/sbin/adduser, /usr/sbin/useradd, /usr/sbin/usermod, /usr/sbin/userdel, /usr/sbin/passwd, /sbin/shutdown, /sbin/init, /sbin/reboot, /usr/bin/reboot
# Defaults specification
#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
# You have to run "ssh -t hostname sudo <cmd>".
#
Defaults requiretty
#
# Refuse to run if unable to disable echo on the tty. This setting should also be
# changed in order to be able to use sudo without a tty. See requiretty above.
#
Defaults !visiblepw
Defaults env_reset
Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
_XKB_CHARSET XAUTHORITY"
## Next comes the main part: which users can run what software on
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
## Allows members of the 'sys' group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL
## Allows members of the users group to mount and unmount the
## cdrom as root
# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom
## Allows members of the users group to shutdown this system
# %users localhost=/sbin/shutdown -h now
## Denied DEV_DENIED and STORAGE commands for dev group
%dev ALL=(ALL) ALL, !DEV_DENIED, !STORAGE

　　

　　使用方法如下：
　　

include sudo
sudo::sudoers { "example":
sudo_sysadmins => ['test-wheel-1','test-wheel-2'],
sudo_sudoers => ['test-sudo-1'],
}

　　

　　github地址如下：https://github.com/vTNT/puppet-sudo

账号		自动登录	找回密码
密码			立即注册

VMware vcenter+vSphere 6.5 U2共享

【跟谁学】韩宇极简英语课-技术人员不得不

用Zabbix通过JMX方式监控weblogic

winhex数据恢复教程（非常巨大，内容丰富）

Symantec Backup Exec 2015 2016/2012 BE20

NetScaler VPX部署之：NetScaler Gateway调

zabbix3.4.1安装部署+微信推送信息+大屏显

[经验分享] puppet系列之sudo模块

扫码加入运维网微信交流群