使用密码方式认证

修改配置文件

  1. sed -i 's/.*\(host_key_checking\)/\1/' /etc/ansible/ansible.cfg
  2. # 去掉配置文件中的注释
  3. #host_key_checking = False
  4. host_key_checking = False

密码格式：

  1. [root@uat-ansible-server01 ~]# cat /etc/ansible/hosts 
  2. [uat]
  3. 10.182.220.83 ansible_ssh_port=22 ansible_ssh_user=chroot ansible_ssh_pass="!QAZ2wsx" ansible_become_pass="!Q2w3e4r"
  4. 10.182.220.84 ansible_ssh_port=22 ansible_ssh_user=chroot ansible_ssh_pass="!QAZ2wsx" ansible_become_pass="!Q2w3e4r"
  5. 10.182.220.85 ansible_ssh_port=22 ansible_ssh_user=chroot ansible_ssh_pass="!QAZ2wsx" ansible_become_pass="!Q2w3e4r"
  6. 10.182.220.86 ansible_ssh_port=22 ansible_ssh_user=chroot ansible_ssh_pass="!QAZ2wsx" ansible_become_pass="!Q2w3e4r"
  7. #10.182.220.[81:250] ansible_ssh_port=22 ansible_ssh_user=chroot ansible_ssh_pass="!QAZ2wsx" ansible_become_pass="!Q2w3e4r"
  8. [root@uat-ansible-server01 ~]#

ansible添加host主机列表

  1. [root@uat-ansible-server01 ansible]# vim  /etc/ansible/hosts 
  3. [uat]
  4. 10.182.220.83

ansible ssh认证 批量分发认证

  1. [root@uat-ansible-server01 ansible]# 
  2. [root@uat-ansible-server01 ansible]# ssh-keygen 
  3. Generating public/private rsa key pair.
  4. Enter file in which to save the key (/root/.ssh/id_rsa): 
  5. Enter passphrase (empty for no passphrase): 
  6. Enter same passphrase again: 
  7. Your identification has been saved in /root/.ssh/id_rsa
  8. Your public key has been saved in /root/.ssh/id_rsa.pub
  9. The key fingerprint is:
  10. SHA256:SHzGqdG+Px/+rLfoTvPha61ToV89fRei+XuneyaSzMA root@uat-ansible-server01.novalocal
  11. The key's randomart image is:
  12. +---[RSA 3072]----+
  13. |                 |
  14. |     . o .       |
  15. |      + *        |
  16. |     . B     . o |
  17. |      o S.  o o =|
  18. |         .Eo . .B|
  19. |        .  +=.oo=|
  20. |         ..o=O=+=|
  21. |          .=BB&@.|
  22. +----[SHA256]-----+
  23. [root@uat-ansible-server01 ansible]#
  1. [root@uat-ansible-server01 ~]# 
  2. [root@uat-ansible-server01 ~]# vim  /etc/ansible/hosts 
  3. [root@uat-ansible-server01 ~]# 
  4. [root@uat-ansible-server01 ~]# ansible all -m authorized_key -a "user=root key='{{ lookup('file','/root/.ssh/id_rsa.pub')}}' path='/root/.ssh/authorized_keys' manage_dir=no" --ask-pass -c paramiko
  5. SSH password: 
  7. paramiko: The authenticity of host '10.182.220.84' can't be established.
  8. The ssh-rsa key fingerprint is 6d96e2e5e6f35970ef8b3be9bdfdaf2f.
  9. Are you sure you want to continue connecting (yes/no)?
  11. [WARNING]: Platform linux on host 10.182.220.84 is using the discovered Python interpreter at /usr/bin/python, but future installation of another
  12. Python interpreter could change this. See https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information.
  13. 10.182.220.84 | CHANGED => {
  14.     "ansible_facts": {
  15.         "discovered_interpreter_python": "/usr/bin/python"
  16.     }, 
  17.     "changed": true, 
  18.     "comment": null, 
  19.     "exclusive": false, 
  20.     "follow": false, 
  21.     "gid": 0, 
  22.     "group": "root", 
  23.     "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDh88TFqncVmoT3zRbTXbAkAjvhfzAA4eZeUbOmq4fMn3tT+/uiE2Uy5w/jRfjD/mO5V+inWghL4D8CB7oTkL66VdH/e32bktG42/BkxNBcQoOVr2Y1KNjdXIgLUsazB/AzVqIhypsFDYbyippkdVDP9EVbPW0nFoOGyg53vuEMa/u8F5k3/0sWn5XlN3XC3yqAgkY9rJczztecATE02C1nWeo1Mz2I/Kb7aYvmqsaCl63Y2hxgpGyM503D3gZDnX5BLj9SycyyTAlCP/8Hn7fPAjx1HE5RbOTHcaBQn/h5wQiLYRwrMKjSNxJ7PcG3PF0w+KKXjhxdaDqiUBR4qWYKpgsTb2JvWRst8MNldBvibMaLBME13mY1OPAXW8InOg5BX8Qe/aYKshdByZJfCvQbR1s7rRQXsdpCHHUxe4iUnRoC/pH8p+27rXkqn3RiogkDSVINZwiaNLtGCxZAhpZs6IVz2NYKElH2mMVPSGakj8jrmn8KObVYqrs6h1BYQtU= root@uat-ansible-server01.novalocal", 
  24.     "key_options": null, 
  25.     "keyfile": "/root/.ssh/authorized_keys", 
  26.     "manage_dir": false, 
  27.     "mode": "0600", 
  28.     "owner": "root", 
  29.     "path": "/root/.ssh/authorized_keys", 
  30.     "size": 589, 
  31.     "state": "file", 
  32.     "uid": 0, 
  33.     "user": "root", 
  34.     "validate_certs": true
  35. }
  36. [root@uat-ansible-server01 ~]#

ansible查看主机列表清单

  1. [root@uat-ansible-server01 ~]# ansible all --list-host
  2.   hosts (1):
  3.     10.182.220.84
  4. [root@uat-ansible-server01 ~]#

ansible 连通性测试

  1. [root@uat-ansible-server01 ~]# ansible 10.182.220.84 -m ping
  2. 10.182.220.84 | SUCCESS => {
  3.     "ansible_facts": {
  4.         "discovered_interpreter_python": "/usr/bin/python"
  5.     }, 
  6.     "changed": false, 
  7.     "ping": "pong"
  8. }
  9. [root@uat-ansible-server01 ~]# 
  10. [root@uat-ansible-server01 ~]#

常用模块示例

列出ansible所支持的模块 ansible -doc -l
[root@uat-ansible-server01 ~]# ansible-doc -l |wc -l
3387
[root@uat-ansible-server01 ~]#

查看模块帮助
ansible-doc -s fetch

调用模块 ansible all -m ping

调用模块传入模块参数
ansible 10.182.220.84 -m fetch -a “src=/etc/fstab det=/tmp/ansible/“

fetch 模块

查看帮助

  1. [root@uat-ansible-server01 ~]# ansible-doc -s fetch
  2. - name: Fetch files from remote nodes
  3.   fetch:
  4.       dest:                  # (required) A directory to save the file into. For example, if the `dest' directory is `/backup' a `src' file named
  5.                                `/etc/profile' on host `host.example.com', would be saved into
  6.                                `/backup/host.example.com/etc/profile'. The host name is based on the inventory name.
  7.       fail_on_missing:       # When set to `yes', the task will fail if the remote file cannot be read for any reason. Prior to Ansible 2.5, setting
  8.                                this would only fail if the source file was missing. The default was changed to `yes'
  9.                                in Ansible 2.5.
  10.       flat:                  # Allows you to override the default behavior of appending hostname/path/to/file to the destination. If `dest' ends with
  11.                                '/', it will use the basename of the source file, similar to the copy module. This can
  12.                                be useful if working with a single host, or if retrieving files that are uniquely named
  13.                                per host. If using multiple hosts with the same filename, the file will be overwritten
  14.                                for each host.
  15.       src:                   # (required) The file on the remote system to fetch. This `must' be a file, not a directory. Recursive fetching may be
  16.                                supported in a later release.
  17.       validate_checksum:     # Verify that the source and destination checksums match after the files are fetched.
  18. [root@uat-ansible-server01 ~]#

拷贝远端机器文件到指定目录
如本地机器目录不存在自动新建目录

  1. [root@uat-ansible-server01 ~]# ansible uat -m fetch -a "src=/etc/fstab dest=/tmp/fstab" 
  2. 10.182.220.84 | CHANGED => {
  3.     "changed": true, 
  4.     "checksum": "5261d6f27b6648b9db485626014f69ae0bc11ebd", 
  5.     "dest": "/tmp/fstab/10.182.220.84/etc/fstab", 
  6.     "md5sum": "6c097bb53e1e7e71d595798975a23bdc", 
  7.     "remote_checksum": "5261d6f27b6648b9db485626014f69ae0bc11ebd", 
  8.     "remote_md5sum": null
  9. }
  10. [root@uat-ansible-server01 ~]# ll -l /tmp/fstab/
  11. total 4
  12. drwxr-xr-x 3 root root 4096 Jul  8 22:51 10.182.220.84
  13. [root@uat-ansible-server01 ~]#

copy模块

拷贝文件
copy模块是将本机文件拷贝到远端主机上

  1.  #!/bin/bash
  2.  echo `date` > /tmp/ansible_test.txt
  3.  然后把该脚本分发到各个机器上
  4.  ansible testhost -m copy -a "src=/tmp/test.sh dest=/tmp/test.sh mode=0755"
  5.  最后是批量执行该shell脚本
  6.  ansible testhost -m shell -a "/tmp/test.sh"
  1. src参数    用于指定需要copy的文件或目录
  2. dest参数    用于指定文件将被拷贝到远程主机的哪个目录
  3. content参数    当不使用src指定拷贝的文件时，可以使用content直接指定文件内容，src与content两个参数必有其一，否则会报错。
  4. force参数    当远程主机的目标路径中已经存在同名文件，并且与ansible主机中的文件内容不同时，是否强制覆盖，可选值有yes和no,果 状认值为yes,表示覆盖，如果设置为no，则不会执行覆盖拷贝操作，远程主机中的文件保持不变。
  5. backup参数    当远程主机的目标路径中已经存在同名文件，并且与ansible主机中的文件内容不同时，是否对远程主机的文件进行备份，可选值有yes和no,当设i为yes时，会先备份远程主机中的文件，然后再将ansible主机中的文件拷贝到远程主机。
  6. owner参数    指定文件拷贝到远程主机后的属主，但是远程主机上必须有对应的用户，否则会报错。
  7. group参数    指定文件拷贝到远程主机后的属组，但是远程主机.上必须有对应的组，否则会报错。
  8. mode参数    指定文件拷贝到远程主机后的权限，如果你想将权限设置为"rw-r–r--",则可以使用mode =0644表示，如果你想要在user对应的权限位上添加执行权限，则可以使用mode: =u+ x表示
  1. [root@uat-ansible-server01 tmp]# cd fstab/
  2. [root@uat-ansible-server01 fstab]# 
  3. [root@uat-ansible-server01 fstab]# ll
  4. total 4
  5. drwxr-xr-x 3 root root 4096 Jul  8 22:51 10.182.220.84
  6. [root@uat-ansible-server01 fstab]# mv 10.182.220.84/ 10.182.220.84-83
  7. [root@uat-ansible-server01 fstab]# 
  8. [root@uat-ansible-server01 fstab]# ansible uat -m copy -a "src=/tmp/fstab dest=/tmp"
  9. 10.182.220.84 | SUCCESS => {
  10.     "ansible_facts": {
  11.         "discovered_interpreter_python": "/usr/bin/python"
  12.     }, 
  13.     "changed": false, 
  14.     "dest": "/tmp/fstab/10.182.220.84-83/etc", 
  15.     "gid": 0, 
  16.     "group": "root", 
  17.     "mode": "0755", 
  18.     "owner": "root", 
  19.     "path": "/tmp/fstab/10.182.220.84-83/etc", 
  20.     "size": 4096, 
  21.     "state": "directory", 
  22.     "uid": 0
  23. }
  24. [root@uat-ansible-server01 fstab]# ansible uat -m command -a "ls -l /tmp/"
  25. 10.182.220.84 | CHANGED | rc=0 >>
  26. total 28
  27. drwx------ 2 root root 4096 Jul  8 22:57 ansible_command_payload_RVKEDj
  28. drwxr-xr-x 3 root root 4096 Jul  8 22:57 fstab
  29. drwxr-xr-x 2 root root 4096 Jun 26 11:44 hsperfdata_root
  30. drwx------ 3 root root 4096 Jul  8 00:43 systemd-private-c565ae5029b443f898b504016830d233-chronyd.service-QM5ODg
  31. drwx------ 3 root root 4096 Jun 26 11:50 systemd-private-c565ae5029b443f898b504016830d233-httpd.service-21rpPF
  32. drwx------ 3 root root 4096 Jul  8 09:21 systemd-private-c565ae5029b443f898b504016830d233-mariadb.service-540HdZ
  33. drwx------ 3 root root 4096 Jun 26 11:50 systemd-private-c565ae5029b443f898b504016830d233-rh-php72-php-fpm.service-kQ9eub
  34. prw-r--r-- 1 root root    0 Jul  8 22:57 wrapper-1375-1-in
  35. prw-r--r-- 1 root root    0 Jul  8 22:57 wrapper-1375-1-out
  36. [root@uat-ansible-server01 fstab]# ansible uat -m command -a "ls -l /tmp/fstab"
  37. 10.182.220.84 | CHANGED | rc=0 >>
  38. total 4
  39. drwxr-xr-x 3 root root 4096 Jul  8 22:57 10.182.220.84-83
  40. [root@uat-ansible-server01 fstab]#
  1. [root@ansible-server-prod ansible]# tree 
  2. .
  3. ├── 1.txt
  4. ├── ansible.cfg
  5. ├── hosts
  6. ├── hosts.bak
  7. └── roles
  8.     └── metribeat
  9.         ├── defaults
  10.         │   └── main.yml
  11.         ├── files
  12.         ├── handlers
  13.         │   └── main.yml
  14.         ├── meta
  15.         │   └── main.yml
  16.         ├── README.md
  17.         ├── tasks
  18.         │   └── main.yml
  19.         ├── templates
  20.         ├── tests
  21.         │   ├── inventory
  22.         │   └── test.yml
  23.         └── vars
  24.             └── main.yml
  26. 10 directories, 12 files
  27. [root@ansible-server-prod ansible]# cat hosts
  28. [zyxf]
  29. 10.82.100.[94:217] ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='!Q2w3e4r'
  30. [root@ansible-server-prod ansible]#

普通用户登录 指定hosts文件执行

  1. 10.82.100.[80:240] ansible_ssh_port=22 ansible_ssh_user=mauser ansible_ssh_pass='1qaz@WSX' ansible_become_pass='!Q2w3e4r'