三種注冊(cè)方式
Puppet注冊(cè)方式基本上有三種：手動(dòng)注冊(cè),自動(dòng)注冊(cè)和預(yù)簽名注冊(cè)
1.手動(dòng)注冊(cè)
手動(dòng)注冊(cè)是由Agent端先發(fā)起證書(shū)申請(qǐng)請(qǐng)求，然后由Puppet server端確認(rèn)證書(shū)方可注冊(cè)成功，這種注冊(cè)方式安全系數(shù)中等，逐一注冊(cè)（puppet cert --sign certname）在節(jié)點(diǎn)數(shù)量較大的情況下是比較麻煩的，效率也低，批量注冊(cè)(puppet cert --sign --all)效率很高，一次性便可注冊(cè)所有的Agent的請(qǐng)求，但是這種方式安全系數(shù)較低，因?yàn)殄e(cuò)誤的請(qǐng)求也會(huì)被注冊(cè)上。
2.自動(dòng)注冊(cè)
這種注冊(cè)方式簡(jiǎn)單來(lái)講是通過(guò)Puppet master端的ACL列表進(jìn)行控制的，安全系統(tǒng)較低，也就是說(shuō)符合預(yù)先定義的ACL列表中的所有節(jié)點(diǎn)請(qǐng)求不需要確認(rèn)都會(huì)被自動(dòng)注冊(cè)上，也就是說(shuō)你只需要知道ACL列表要求，其次能和PuppetMaster端通信便可輕易注冊(cè)成功。當(dāng)然，它的最大優(yōu)點(diǎn)就是效率非常高.
(1)查詢(xún)認(rèn)證情況
root@10.1.1.33:puppet# puppet cert --list --all
+ "agent.domain.com" (SHA256) 3F:8E:AE:B8:04:2B:51:9B:7A:B3:1E:86:C0:21:3E:81:D6:2A:55:A4:17:15:CA:5E:7A:8F:95:EC:D3:83:41:C0
+ "localhost" (SHA256) E4:F5:F3:A9:99:E9:4D:11:53:87:BE:47:95:4C:98:48:58:2D:3D:80:7E:9C:D9:C2:36:93:56:B2:EA:A0:F1:7B
+ "puppet.domain.com" (SHA256) 5A:E1:80:AA:76:B6:81:22:55:B7:28:4B:AB:7C:B9:87:A8:DD:7E:3A:31:DF:0C:5A:61:8F:4B:D2:16:A4:B6:BF (alt names: "DNS:puppet", "DNS:puppet.domain.com")
(2)在master上清除客戶(hù)端已經(jīng)agent注冊(cè)信息的證書(shū)
root@10.1.1.33:puppet# puppet cert --clean agent.domain.com
Notice: Revoked certificate with serial 7
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/ca/signed/agent.domain.com.pem'
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/certs/agent.domain.com.pem'
(3)在agent.domain.com端刪除注冊(cè)過(guò)的證書(shū)
root@10.1.1.33:puppet# puppet cert --clean agent.domain.com
Notice: Revoked certificate with serial 7
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/ca/signed/agent.domain.com.pem'
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/certs/agent.domain.com.pem'
(4)在Puppet master端編寫(xiě)ACL列表
root@10.1.1.33:puppet# cat autosign.conf
*.domain.com
root@10.1.1.33:puppet# /etc/init.d/puppetmaster restart
Stopping puppetmaster: [ OK ]
Starting puppetmaster: [ OK ]
(5)客戶(hù)端申請(qǐng)注冊(cè)證書(shū).
root@10.1.1.34:ssl# puppet agent --test
Info: Creating a new SSL key for agent.domain.com
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for agent.domain.com
Info: Certificate Request fingerprint (SHA256): FD:70:31:87:C6:44:EC:8D:18:0D:F5:10:E3:CE:5B:DC:EA:31:BD:BC:8C:C7:B2:80:F7:7E:2C:F2:4E:FB:12:90
Info: Caching certificate for agent.domain.com
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for ca
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for agent.domain.com
Info: Applying configuration version '1418292313'
Notice: /Stage[main]/Test/File[/tmp/agent.txt]/ensure: defined content as '{md5}fc3ff98e8c6a0d3087d515c0473f8677'
Notice: Finished catalog run in 0.13 seconds
(6)服務(wù)端查看證書(shū).
root@10.1.1.33:puppet# puppet cert --list --all
+ "agent.domain.com" (SHA256) FE:04:96:32:46:A4:54:BF:A9:4F:20:CA:EF:7E:F7:C6:A6:88:34:4A:D9:7E:50:54:FA:C0:10:29:87:F9:1C:6E
+ "client.domain.com" (SHA256) E3:B4:46:90:DF:85:37:77:48:BB:F9:FD:9F:13:DE:52:2F:00:1C:71:A3:BC:C2:E2:A5:34:4F:01:DB:27:02:F5
+ "localhost" (SHA256) E4:F5:F3:A9:99:E9:4D:11:53:87:BE:47:95:4C:98:48:58:2D:3D:80:7E:9C:D9:C2:36:93:56:B2:EA:A0:F1:7B
+ "puppet.domain.com" (SHA256) 5A:E1:80:AA:76:B6:81:22:55:B7:28:4B:AB:7C:B9:87:A8:DD:7E:3A:31:DF:0C:5A:61:8F:4B:D2:16:A4:B6:BF (alt names: "DNS:puppet", "DNS:puppet.domain.com")
3.預(yù)簽名認(rèn)證
預(yù)簽名注冊(cè)是在agent端未提出申請(qǐng)的情況下，預(yù)先在puppet master端生成agent端的證書(shū)，然后復(fù)制到節(jié)點(diǎn)對(duì)應(yīng)的目錄下即可注冊(cè)成功，這種方式安全系數(shù)最高，但是操作麻煩，需要提前預(yù)知所有節(jié)點(diǎn)服務(wù)器的certname名稱(chēng)，其次需要將生成的證書(shū)逐步copy到所有節(jié)點(diǎn)上去。不過(guò)，如果你的系統(tǒng)中安裝了kickstart或者cobbler這樣的自動(dòng)化工具，倒是可以將證書(shū)部分轉(zhuǎn)換成腳本集成到統(tǒng)一自動(dòng)化部署中.注：生產(chǎn)環(huán)境中建議此方式進(jìn)行注冊(cè)，既安全又可靠.
(1)查詢(xún)認(rèn)證情況
root@10.1.1.33:puppet# puppet cert --list --all
+ "agent.domain.com" (SHA256) 3F:8E:AE:B8:04:2B:51:9B:7A:B3:1E:86:C0:21:3E:81:D6:2A:55:A4:17:15:CA:5E:7A:8F:95:EC:D3:83:41:C0
+ "localhost" (SHA256) E4:F5:F3:A9:99:E9:4D:11:53:87:BE:47:95:4C:98:48:58:2D:3D:80:7E:9C:D9:C2:36:93:56:B2:EA:A0:F1:7B
+ "puppet.domain.com" (SHA256) 5A:E1:80:AA:76:B6:81:22:55:B7:28:4B:AB:7C:B9:87:A8:DD:7E:3A:31:DF:0C:5A:61:8F:4B:D2:16:A4:B6:BF (alt names: "DNS:puppet", "DNS:puppet.domain.com")
(2)在master上清除客戶(hù)端已經(jīng)agent注冊(cè)信息的證書(shū)
root@10.1.1.33:puppet# puppet cert --clean agent.domain.com
Notice: Revoked certificate with serial 7
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/ca/signed/agent.domain.com.pem'
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/certs/agent.domain.com.pem'
(3)在agent.domain.com端刪除注冊(cè)過(guò)的證書(shū)
root@10.1.1.33:puppet# puppet cert --clean agent.domain.com
Notice: Revoked certificate with serial 7
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/ca/signed/agent.domain.com.pem'
Notice: Removing file Puppet::SSL::Certificate agent.domain.com at '/var/lib/puppet/ssl/certs/agent.domain.com.pem'
(4)puppet server端預(yù)先生成agent證書(shū)
puppetca --generate agent.domain.com
(5)agent節(jié)點(diǎn)生成目錄結(jié)構(gòu)
puppet agent --test
(6)puppet master端copy證書(shū)到agent.domain.com上
root@10.1.1.33:puppet#scp /var/lib/puppet/ssl/private_keys/agent.domain.com.pem agent.domain.com:/var/lib/puppet/ssl/private_keys/
root@10.1.1.33:puppet#scp /var/lib/puppet/ssl/certs/agent.domain.com.pem agent.domain.com:/var/lib/puppet/ssl/certs/
root@10.1.1.33:puppet#scp /var/lib/puppet/ssl/certs/ca.pem agent.domain.com:/var/lib/puppet/ssl/certs/ca.pem
常用命令
1.puppet master
puppet master 默認(rèn)是以Ruby內(nèi)建的WEBRick在后臺(tái)運(yùn)行的守護(hù)進(jìn)程,同樣也可以采用最常用的Web服務(wù)器apache和nginx替換WEBRick以提升性能.puppet master主要功能是編譯配置文件,文件,模版,節(jié)點(diǎn)的自定義插件.
root@10.1.1.33:nodes# puppet master --help
puppet master [-D|--daemonize|--no-daemonize] [-d|--debug] [-h|--help]
[-l|--logdest syslog|FILE>|console] [-v|--verbose] [-V|--version]
[--compile NODE-NAME>]
* --daemonize: #-D發(fā)送到后臺(tái)守護(hù)進(jìn)程,默認(rèn)選項(xiàng)
* --no-daemonize: #不發(fā)送到后臺(tái)守護(hù)進(jìn)程
* --debug: #完整調(diào)試
* --help: #輸出幫助
* --logdest: #日志發(fā)送方式,默認(rèn)是syslog
* --verbose: #顯示詳細(xì)信息
* --version: #打印puppet版本
* --compile: #以JSON的方式輸出編譯的catalog
使用--getconfig輸出默認(rèn)配置文件
root@10.1.1.33:puppet# puppet master --genconfig > puppet.conf
puppet不啟用后臺(tái)守護(hù)進(jìn)程的方式運(yùn)行.
root@10.1.1.33:puppet master --no-daemonize --verbose
2.puppet agent
puppet agent 在每個(gè)節(jié)點(diǎn)以守護(hù)進(jìn)程方式運(yùn)行,通常每30分鐘向master請(qǐng)求一次,以確認(rèn)新的信息并詢(xún)問(wèn)是否有變更.然后負(fù)責(zé)運(yùn)行編譯好的catalog代碼
root@10.1.1.34:tmp# puppet agent --help
puppet agent [--certname NAME>] [-D|--daemonize|--no-daemonize]
[-d|--debug] [--detailed-exitcodes] [--digest DIGEST>] [--disable [MESSAGE]] [--enable]
[--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|FILE>|console]
[--masterport PORT>] [--no-client] [--noop] [-o|--onetime] [-t|--test]
[-v|--verbose] [-V|--version] [-w|--waitforcert SECONDS>]
使用"--noop"參數(shù),puppet運(yùn)行catelog,但不執(zhí)行配置
root@10.1.1.34:tmp# puppet agent --noop
3.puppet apply
puppet apply 是puppet運(yùn)行命令,主要在檢測(cè)manifests時(shí)或在沒(méi)有網(wǎng)絡(luò)連接的情況下使用.不同于puppet agent,puppet apply在運(yùn)行時(shí)不會(huì)連接master
root@10.1.1.34:tmp# puppet apply --help
puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
[-e|--execute] [--detailed-exitcodes] [-L|--loadclasses]
[-l|--logdest syslog|eventlog|FILE>|console] [--noop]
[--catalog catalog>] [--write-catalog-summary] file>
(1) 將輸出信息輸出到日志文件
root@10.1.1.33:manifests# puppet apply -l /tmp/init.pp init.pp
root@10.1.1.33:manifests# cat /tmp/init.pp
Fri Dec 12 16:17:46 +0800 2014 Puppet (notice): Compiled catalog for puppet.domain.com in environment production in 0.04 seconds
Fri Dec 12 16:17:47 +0800 2014 Puppet (notice): Finished catalog run in 0.04 seconds
4.puppet cert
它用于管理本地證書(shū),查看未簽名證書(shū),簽署證書(shū),廢除證書(shū),清除證書(shū).
puppet cert action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
[--digest digest>] [host>]
常用操作:
clean #清除證書(shū)
fingerprint #打印證書(shū)指紋
generate #生成客戶(hù)端證書(shū)
list #查看認(rèn)證客戶(hù)端列表
print #打印主機(jī)證書(shū)的全文信息
revoke #廢除已認(rèn)證的主機(jī)
sign #簽署認(rèn)證
verify #驗(yàn)證本地指定的認(rèn)證
命令參數(shù):
--all #執(zhí)行所有操作,包括'sign','clean', 'list', and 'fingerprint'
--digest #設(shè)置證書(shū)指紋加密的方式
--debug #啟用完整調(diào)試模式|
--verbose #顯示詳細(xì)信息
--version #顯示版本
(1)查看請(qǐng)求認(rèn)證的客戶(hù)端列表
root@10.1.1.33:nodes# puppet cert list
(2)為主機(jī)agent.domin.com簽署驗(yàn)證
root@10.1.1.33:nodes# puppet cert sign agent.domain.com
(3)列出所有簽名和未簽名的證書(shū)
root@10.1.1.33:nodes# puppet cert list --all
+ "agent.domain.com" (SHA256) 3C:82:6A:E2:9B:8B:8F:8A:ED:C9:83:EB:64:47:6C:91:E5:8E:86:A6:B3:D7:1D:E5:4E:39:4D:04:5A:21:C5:86 #符號(hào)+表示已經(jīng)簽署過(guò)認(rèn)證
"client.domain.com" (SHA256) E3:B4:46:90:DF:85:37:77:48:BB:F9:FD:9F:13:DE:52:2F:00:1C:71:A3:BC:C2:E2:A5:34:4F:01:DB:27:02:F5
(4)給所有未簽署認(rèn)證的請(qǐng)求頒發(fā)認(rèn)證:
root@10.1.1.33:nodes# puppet cert sign --all
(5)查看所有已簽署認(rèn)證的客戶(hù)端列表
root@10.1.1.33:nodes# puppet cert list --all
+ "agent.domain.com" (SHA256) 3C:82:6A:E2:9B:8B:8F:8A:ED:C9:83:EB:64:47:6C:91:E5:8E:86:A6:B3:D7:1D:E5:4E:39:4D:04:5A:21:C5:86
5.puppet kick
它用于連接到agent客戶(hù)端主動(dòng)運(yùn)行puppet agent --test命令.類(lèi)似主動(dòng)觸發(fā)配置
