1. 前言

最近準備搞一下RHCA LV V,外加2.9之后的ansible有較大變化于是練習下Do374的課程內容.
工作中有幾臺sftp的服務器,由于sftp的目錄權限比較特殊,有時候手工配置會出現一些報錯需要排查.
于是手寫了個ansibleplay來完成一鍵搭建及后續的用戶添加工作.

2. 思路

整個sftp配置主要分為以下步驟:

1. 安裝配置ssh服務,并開通防火墻(這部分工作在實現ansible之前其實已經完成了)
2. 根據用戶清創建用戶
3. 確認sftp的主目錄權限正常
4. 根據清單創建用戶的sftp主目錄和上傳目錄
5. 根據清單配置sshd主配置文件:/etc/ssh/sshd_config
6. 重置sshd服務

3. sftp搭建及用戶批量新增

3.1 配置文件內容

服務器清單文件:

變量	含義
name	用戶名
password	密碼
home_directory	sftp主目錄

users:
- name: ut_k8s_putpassword: "ut_k8s_put_123"home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_getpassword: "it_k8s_get_123"home_directory: "/ftp/pabc/it_k8s_get"
- name: ftp_k8spassword: "ftp_k8s_123"home_directory: "/ftp/public/ftp_k8s"

ansible playbook文件:
主要實現以下功能:

1. 根據用戶清單創建用戶
2. 創建/ftp目錄
3. 根據用戶清單創建用戶sftp主目錄
4. 根據用戶清單創建用戶sftp upload目錄
5. 配置sshd主配置文件sshd_config文件
6. 重置sshd服務,這個地方盡量使用reload,工作中發現如果用restart的話在某些會話沒有被釋放的情況下會造成sshd服務重啟卡主.

---
- name: Use block module to config sftp servicehosts: servercgather_facts: falsevars_files:- user_list.yamltasks:- name: user_addansible.builtin.user:name: "{{ item.name }}"comment: "{{ item.name }} to sftp"shell: /sbin/nologinpassword: "{{ item.password | password_hash('sha512') }}"create_home: yes with_items: "{{ users }}"- name: create sftp root directoryansible.builtin.file:path: /ftpstate: directoryowner: rootgroup: rootmode: '0755'- name: create sftp directoryansible.builtin.file:path: "{{ item.home_directory }}"state: directoryowner: rootgroup: "{{ item.name }}"mode: '1750'with_items: "{{ users }}"- name: Create upload directoryansible.builtin.file:path: "{{ item.home_directory }}/upload"state: directoryowner: "{{ item.name }}"group: "{{ item.name }}"mode: '1750'with_items: "{{ users }}"- name: replace sftp configansible.builtin.lineinfile:path: /etc/ssh/sshd_configregexp: '^Subsystem sftp'line: Subsystem sftp internal-sftp- name: Add configs into the sshd_config fileansible.builtin.blockinfile:path: /etc/ssh/sshd_configblock: |Match User {{ item.name }}chrootDirectory {{ item.home_directory }}X11Forwarding noAllowTcpForwarding noForceCommand internal-sftpmarker: "# {{ item.name }} config {mark}"with_items: "{{ users }}"- name: restart sshd serviceansible.builtin.systemd:state: reloadedname: sshd

3.2 執行測試

ansible-navigator run sftp.yaml -m stdout

3.3 登錄測試

嘗試sftp遠程登錄服務器并上傳文件.

sftp ut_k8s_put@serverc
cd upload/
put token.txt
bye

3.4 確認sftp服務器配置文件

確認sftp服務器上的配置文件和目錄使用情況.

用了block模塊的情況下后續刪除修改也會方便很多,每個用戶前后都有mark作為標記.

查看目錄結構
顯然我們剛才的文件也傳到了正確的位置

[root@serverc ~]# tree /ftp
/ftp
├── pabc
│   ├── it_k8s_get
│   │   └── upload
│   └── ut_k8s_put
│     └── upload
│         └── token.txt
└── public└── ftp_k8s└── upload8 directories, 1 file

4. 測試刪除用戶

user_del.yaml

users:
- name: ut_k8s_putpassword: "ut_k8s_put_123"home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_getpassword: "it_k8s_get_123"home_directory: "/ftp/pabc/it_k8s_get"

playbook

---
- name: remove sftp usershosts: servercgather_facts: falsevars_files:- user_del.yamltasks:- name: remove user configs from sshd_configansible.builtin.blockinfile:path: /etc/ssh/sshd_configbackup: yesstate: absentmarker: "# {{ item.name }} config {mark}"with_items: "{{ users }}"- name: remove user from systemansible.builtin.user:name: "{{ item.name }}"state: absentremove: yeswith_items: "{{ users }}"- name: restart sshd serviceansible.builtin.systemd:state: reloadedname: sshd

執行刪除

ansible-navigator run sftp_remove.yaml -m stdout

執行之后可以看到,清單文件中的2個用戶已經刪除,之前另外一個創建的用戶還是正常

嘗試用剩下的那個用戶再次連接
確認剩下的那個用戶并不受影響

至此使用ansible批量配置sftp增加或刪除用戶完成.