puppet一键安装脚本（二）

mil

测试解析与puppetmaster端口是否畅通

[iyunv@puppet puppet-2.7.14]# telnet server.viong.com 8140
Trying 192.168.50.55...
Connected to server.viong.com.
Escape character is '^]'.
Connection closed by foreign host
[iyunv@client1 puppet-2.7.14]# puppetd --test --server server.viong.com

info: Creating a new SSL key for client1.viong.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for ca
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
info: Creating a new SSL certificate request for client1.viong.com
info: Certificate Request fingerprint (md5): 6F:6A:45:D9:14:28:D1:5B:05:3B:4F:0B:9A:51:D1:71
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled
# puppetd --test --server server.viong.com命令是指puppetd 从 server.viong.com去读取
puppet配置文件. 第一次连接,双方会进行ssl证书的验证,这是一个新的客户端,在服务器端那里还没有被认证,因此需要在服务器端进行证书认证

以下这步批准证书是在服务端操作

查看当然待批准证书列表
[iyunv@server ~]# puppetca list
client1.viong.com (B0:85:72:E6:7D:63:EA:CC:BD:0C:E4:F1:70:89:24:70)
批准当前证书
[iyunv@server ~]# puppetca -s client1.viong.com
notice: Signed certificate request for client1.viong.com
notice: Removing file Puppet::SSL::CertificateRequest client1.viong.com at
'/var/lib/puppet/ssl/ca/requests/client1.viong.com.pem'
查看验证签名,注意前面的+号，说明已经签名
[iyunv@server ~]# puppetca -a --list
+ server.viong.com (43:33:D3:A0:26:C4:E9:89:66:A6:DC:54:20:90:E9:4D) (alt names:
DNS:puppet, DNS:puppet.viong.com, DNS:server.viong.com)
--------------------------------------------------------------------------------------------------
如果要批准全部证书
puppetca -s -a
也可以在puppetmaster端的puppet.conf加入这行：
autosign = true
服务端就自动签证书
--------------------------------------------------------------------------------------------------
回到客户端操作，从服务端取回已批准的证书
[iyunv@client1 puppet-2.7.14]# puppetd --test --server server.viong.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for client1.viong.com
info: Caching certificate_revocation_list for ca
info: Caching catalog for client1.viong.com
info: Applying configuration version '1338897814'
info: Creating state file /var/lib/puppet/state/state.yaml
notice: Finished catalog run in 0.02 seconds

验证证书是否正确
服务端：
[iyunv@server ~]# md5sum /var/lib/puppet/ssl/ca/signed/client1.viong.com.pem
8529a6f2d42c1b492c016fe870b744b6 /var/lib/puppet/ssl/ca/signed/client1.viong.com.pem
客户端：
[iyunv@client1 puppet-2.7.14]# md5sum /var/lib/puppet/ssl/certs/client1.viong.com.pem
8529a6f2d42c1b492c016fe870b744b6 /var/lib/puppet/ssl/certs/client1.viong.com.pem
------------------------------------------------------------------------------------------------
出现修改主机名问题引起无法认证，需要重新申请证书，操作以下两个步骤：
服务端：
[iyunv@server ca]# rm -rf /var/lib/puppet/ssl/ca/signed/client1.viong.com.pem
客户端：
[iyunv@client1 puppet-2.7.14]# rm -rf /var/lib/puppet/ssl/
------------------------------------------------------------------------------------------------
功能测试
服务端：
建立pp文件测试
puppet的第一个执行的代码是在/etc/puppet/manifest/site.pp
因此这个文件必须存在,而且其他的代码也要通过代码来调用.
[backcolor=white !important]

[backcolor=white !important][size=1em]1

[size=1em][backcolor=white !important][size=1em]node default { file { "/tmp/puppettest1.txt": content => "hello,first puppet manifest"; } }

上面的代码对默认连入的puppet客户端执行一个操作,在/tmp目录生成一个viong.txt文件,内容是good,test pass! 并自动回车换行
初次创建pp文件，需要重启puppetmaster
[iyunv@server ~]# service puppetmaster restart   
停止 puppetmaster：                                        [确定]
启动 puppetmaster：                                        [确定]
客户端：
[iyunv@client1 puppet-2.7.14]# puppetd --test --server server.viong.com
info: Caching catalog for client1.viong.com
info: Applying configuration version '1338897814'
notice: /Stage[main]//Node[default]/File[/tmp/viong.txt]/ensure: defined content as '{md5}9a3f5438e1d35a72d853974203de4254'
notice: Finished catalog run in 0.03 seconds

客户端查看下就可以知道是否成功了

lakers009

或許俄们并不一定会冇以後，但是俄会珍惜现在。