设置大批量服务器使用key登录验证方式实践方案

密钥生成

# cat add_user_sshkey.sh
#!/bin/env bash

if [ ! $# -eq 1 ]
then
    echo -e "Usages: $0 username"
    exit 1
fi

username=$1
rm -f ${username} ${username}.pub
ssh-keygen -t rsa -N '' -C ${username}@kaixin-inc.com -f ${username}>useradd.log
rsa_hash=`grep ${username} useradd.log |grep -v Your|awk '{print $1}'`
echo "${username} `date +%Y.%m.%d\ %H:%M:%S` ${rsa_hash}" >>useradd.list
rm -f useradd.log
if [ -f authorized_keys ]
then
    sed -i "/${username}/d" authorized_keys
fi
cat ${username}.pub>>authorized_keys
rm -f ${username}_sshkey_file.tar.gz
tar -zcf ${username}_sshkey_file.tar.gz ${username}*
mkdir -p sshkey_file
mv ${username}_sshkey_file.tar.gz sshkey_file
rm -f ${username}_sshkey_file.tar.gz
rm -f ${username} ${username}.pub
[root@linux-node9 ~]# ls -al sshkey_file/
total 12
drwxr-xr-x   2 root root   73 Feb 21 08:19 .
dr-xr-x---. 12 root root 4096 Feb 21 08:31 ..
-rw-r--r--   1 root root 1749 Feb 21 08:14 xxx_sshkey_file.tar.gz
-rw-r--r--   1 root root 1753 Feb 21 08:19 yyy_sshkey_file.tar.gz

将生成后的sshkey发送给用户即可

密钥推送

[root@linux-node9 ~]# yum install -y ansible
[root@linux-node9 ~]# cat rsync_sshkey_file.yml
---
- hosts: all
  remote_user: root
  tasks:
  - name: copy authorized_keys to remote tmp dir
    copy: src=/root/authorized_keys dest=/tmp/authorized_keys owner=root group=root mode=0600

  - name: del user key on remote host
    shell: cat /tmp/authorized_keys|while read line;do sed -i "#$line#d" /tmp/authorized_keys;done

  - name: add user key to remote host authorized_keys
    shell: cat /tmp/authorized_keys >>~/.ssh/authorized_keys

  - name: del tmp authorized_keys
    file: path=/tmp/authorized_keys state=absent
[root@linux-node9 ~]# ansible-playbook rsync_sshkey_file.yml

PLAY [all] *******************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************
ok: [127.0.0.1]

TASK [copy authorized_keys to remote tmp dir] ********************************************************************************************************************************
changed: [127.0.0.1]

TASK [del user key on remote host] *******************************************************************************************************************************************
changed: [127.0.0.1]

TASK [add user key to remote host authorized_keys] ***************************************************************************************************************************
changed: [127.0.0.1]

TASK [del tmp authorized_keys] ***********************************************************************************************************************************************
changed: [127.0.0.1]

PLAY RECAP *******************************************************************************************************************************************************************
127.0.0.1                  : ok=5    changed=4    unreachable=0    failed=0

1、管理主机通过ansible分发密钥对，前提条件管理主机到所有被管理主机已经建立ssh互信关系，这块可以在服务器申请或者初始化初期就完成

FQA

1、如何控制密钥分发的主机组，用户可能没有权限登录所有主机？
解答：结合CDMB或者其他权限系统，生成临时的密钥分发组，ansible-playbook指定组进行密钥分发
2、非ansible管理的ssh互信关系会被破坏,如何解决？
解答：在playbook做处理，先删除要添加的key，在追加，防止重复添加

======================================================
希望各位朋友支持一下