1. 前言

最近准备搞一下RHCA LV V,外加2.9之后的ansible有较大变化于是练习下Do374的课程内容.
工作中有几台sftp的服务器,由于sftp的目录权限比较特殊,有时候手工配置会出现一些报错需要排查.
于是手写了个ansibleplay来完成一键搭建及后续的用户添加工作.

2. 思路

整个sftp配置主要分为以下步骤:

1. 安装配置ssh服务,并开通防火墙(这部分工作在实现ansible之前其实已经完成了)
2. 根据用户清创建用户
3. 确认sftp的主目录权限正常
4. 根据清单创建用户的sftp主目录和上传目录
5. 根据清单配置sshd主配置文件:/etc/ssh/sshd_config
6. 重置sshd服务

3. sftp搭建及用户批量新增

3.1 配置文件内容

服务器清单文件:

变量	含义
name	用户名
password	密码
home_directory	sftp主目录

users:
- name: ut_k8s_putpassword: "ut_k8s_put_123"home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_getpassword: "it_k8s_get_123"home_directory: "/ftp/pabc/it_k8s_get"
- name: ftp_k8spassword: "ftp_k8s_123"home_directory: "/ftp/public/ftp_k8s"

ansible playbook文件:
主要实现以下功能:

1. 根据用户清单创建用户
2. 创建/ftp目录
3. 根据用户清单创建用户sftp主目录
4. 根据用户清单创建用户sftp upload目录
5. 配置sshd主配置文件sshd_config文件
6. 重置sshd服务,这个地方尽量使用reload,工作中发现如果用restart的话在某些会话没有被释放的情况下会造成sshd服务重启卡主.

---
- name: Use block module to config sftp servicehosts: servercgather_facts: falsevars_files:- user_list.yamltasks:- name: user_addansible.builtin.user:name: "{{ item.name }}"comment: "{{ item.name }} to sftp"shell: /sbin/nologinpassword: "{{ item.password | password_hash('sha512') }}"create_home: yes with_items: "{{ users }}"- name: create sftp root directoryansible.builtin.file:path: /ftpstate: directoryowner: rootgroup: rootmode: '0755'- name: create sftp directoryansible.builtin.file:path: "{{ item.home_directory }}"state: directoryowner: rootgroup: "{{ item.name }}"mode: '1750'with_items: "{{ users }}"- name: Create upload directoryansible.builtin.file:path: "{{ item.home_directory }}/upload"state: directoryowner: "{{ item.name }}"group: "{{ item.name }}"mode: '1750'with_items: "{{ users }}"- name: replace sftp configansible.builtin.lineinfile:path: /etc/ssh/sshd_configregexp: '^Subsystem sftp'line: Subsystem sftp internal-sftp- name: Add configs into the sshd_config fileansible.builtin.blockinfile:path: /etc/ssh/sshd_configblock: |Match User {{ item.name }}chrootDirectory {{ item.home_directory }}X11Forwarding noAllowTcpForwarding noForceCommand internal-sftpmarker: "# {{ item.name }} config {mark}"with_items: "{{ users }}"- name: restart sshd serviceansible.builtin.systemd:state: reloadedname: sshd

3.2 执行测试

ansible-navigator run sftp.yaml -m stdout

3.3 登录测试

尝试sftp远程登录服务器并上传文件.

sftp ut_k8s_put@serverc
cd upload/
put token.txt
bye

3.4 确认sftp服务器配置文件

确认sftp服务器上的配置文件和目录使用情况.

用了block模块的情况下后续删除修改也会方便很多,每个用户前后都有mark作为标记.

查看目录结构
显然我们刚才的文件也传到了正确的位置

[root@serverc ~]# tree /ftp
/ftp
├── pabc
│   ├── it_k8s_get
│   │   └── upload
│   └── ut_k8s_put
│     └── upload
│         └── token.txt
└── public└── ftp_k8s└── upload8 directories, 1 file

4. 测试删除用户

user_del.yaml

users:
- name: ut_k8s_putpassword: "ut_k8s_put_123"home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_getpassword: "it_k8s_get_123"home_directory: "/ftp/pabc/it_k8s_get"

playbook

---
- name: remove sftp usershosts: servercgather_facts: falsevars_files:- user_del.yamltasks:- name: remove user configs from sshd_configansible.builtin.blockinfile:path: /etc/ssh/sshd_configbackup: yesstate: absentmarker: "# {{ item.name }} config {mark}"with_items: "{{ users }}"- name: remove user from systemansible.builtin.user:name: "{{ item.name }}"state: absentremove: yeswith_items: "{{ users }}"- name: restart sshd serviceansible.builtin.systemd:state: reloadedname: sshd

执行删除

ansible-navigator run sftp_remove.yaml -m stdout

执行之后可以看到,清单文件中的2个用户已经删除,之前另外一个创建的用户还是正常

尝试用剩下的那个用户再次连接
确认剩下的那个用户并不受影响

至此使用ansible批量配置sftp增加或删除用户完成.