Puppet–SSH自动化管理

meikkiie

　　创建ssh模块相应的目录和文件




[iyunv@master ~]# mkdir -p /etc/puppet/modules/ssh/{manifests,templetes,files}

　　前面sudo模块的时候，所有相关的设置都是在init.pp文件中，但再SSH模块中我们尝试着将配置分为init.pp，install.pp，config.pp，service.pp，params.pp。


　　创建配置相应文件



[iyunv@master ~]# touch /etc/puppet/modules/ssh/manifests/{install.pp,config.pp,service.pp}

　　配置params.pp文件，该文件主要是配置模块的参数



[iyunv@master ~]# vim /etc/puppet/modules/ssh/manifests/params.pp
class ssh::params {
case $operatingsystem {
Solaris: {
$ssh_package_name ='openssh'
$ssh_service_config='/etc/ssh/sshd_config'
$ssh_service_name='sshd'
}

/(Ubuntu|Debian)/: {
$ssh_package_name='openssh-server'
$ssh_service_config='/etc/ssh/sshd_config'
$ssh_service_name='sshd'
}

/(RedHat|CentOS|Fedora)/: {
$ssh_package_name='openssh-server'
$ssh_service_config='/etc/ssh/sshd_config'
$ssh_service_name='sshd'
}
}
}

　　编辑ssh模块的init.pp文件



[iyunv@master ~]# vim /etc/puppet/modules/ssh/manifests/init.pp

class ssh{
include ssh::params,ssh::install,ssh::config,ssh::service
}

　　编辑install.pp



[iyunv@master ~]# vim /etc/puppet/modules/ssh/manifests/install.pp
class ssh::install {
package {"$ssh::params::ssh_package_name":
ensure=>installed,
}
}

　　编辑config.pp



[iyunv@master ~]# vim /etc/puppet/modules/ssh/manifests/config.pp
class ssh::config{
file { $ssh::params::ssh_service_config:
ensure=>present,
owner=>'root',
group=>'root',
mode=>0600,
source=>"puppet://$puppetserver/modules/ssh/sshd_config",
require=>Class["ssh::install"],
notify=>Class["ssh::service"],
}
}

　　Notify在这里是发出通知到对应的类，即如果ssh:config改变了，就notify通知ssh::service类。


　　编辑service.pp



[iyunv@master ~]# vim /etc/puppet/modules/ssh/manifests/service.pp

class ssh::service{
service{ $ssh::params::ssh_service_name:
ensure=>running,
hasstatus=>true,
hasrestart=>true,
enable=>true,
require=>Class["ssh::config"],
}
}

　　设置hasstatus告诉puppet该服务支持status命令，即类似service sshd status


　　设置hasrestart告诉puppet该服务支持restart命令，即类似service sshd restart


　　复制默认的sshd_config文件到模块的files目录下



[iyunv@master ~]# cp /etc/ssh/sshd_config   /etc/puppet/modules/ssh/files/

　　Ssh模块设置完成，下面是将该模块应用到节点上


　　编辑nodes.pp



[iyunv@master ~]# vim /etc/puppet/manifests/nodes.pp

class base {
include sudo,ssh
}

node 'client1.centos' {
include base
}

node 'client2.centos' {
include  base
}

　　到节点上验证配置是否正确



[iyunv@client1 ~]# puppetd   --server  master.puppet --test
notice: Ignoring --listen on onetime run
info: Caching catalog for client1.centos
info: Applying configuration version '1330052716'
--- /etc/ssh/sshd_config        2011-12-08 04:25:10.000000000 +0800
+++ /tmp/puppet-file20120224-27947-1eierk0-0    2012-02-24 11:06:15.203891553 +0800
@@ -1,3 +1,4 @@
+# puppet auto configuration
#      $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file.  See
info: FileBucket adding {md5}853a26a0f4b8a7fc8529e45ed57fe67b
info: /Stage[main]/Ssh::Config/File[/etc/ssh/sshd_config]: Filebucketed /etc/ssh/sshd_config to puppet with sum 853a26a0f4b8a7fc8529e45ed57fe67b
notice: /Stage[main]/Ssh::Config/File[/etc/ssh/sshd_config]/content: content changed '{md5}853a26a0f4b8a7fc8529e45ed57fe67b' to '{md5}4a860a0861932b44d8af13e64d953b39'
info: /Stage[main]/Ssh::Config/File[/etc/ssh/sshd_config]: Scheduling refresh of Service[sshd]
notice: /Stage[main]/Ssh::Service/Service[sshd]: Triggered 'refresh' from 1 events
notice: Finished catalog run in 0.81 seconds