服务器
192.168.48.81 # client
192.168.48.82 # bastion
192.168.48.83 # private
password方式
192.168.48.81
groupadd -g 501 ansible
useradd -u 501 -g 501 ansible
passwd ansible # @ansible
192.168.48.82
groupadd -g 501 ansible
useradd -u 501 -g 501 ansible
passwd ansible # @ansible
groupadd -g 502 bastion
useradd -u 502 -g 502 bastion
passwd bastion # @bastion
192.168.48.83
groupadd -g 502 bastion
useradd -u 502 -g 502 bastion
passwd bastion # @bastion
192.168.48.81 -> 192.168.48.83
ssh -o ProxyCommand='ssh -W %h:%p ansible@192.168.48.82' bastion@192.168.48.83
ansible@192.168.48.82's password:
bastion@192.168.48.83's password:
Last login: Fri Jan 23 10:59:07 2015 from 192.168.48.82
......
sshkey方式
192.168.48.81
su - ansible -c "ssh-keygen -b 2048 -t rsa -f ~/.ssh/ansible.pem -q -N ''"
# /home/ansible/.ssh
ansible.pem ansible.pem.pub
192.168.48.82
su - bastion -c "ssh-keygen -b 2048 -t rsa -f ~/.ssh/bastion82.pem -q -N ''"
# /home/bastion/.ssh/
bastion82.pem bastion82.pem.pub
192.168.48.81 -> 192.168.48.82 sshkey
su - ansible
ssh-copy-id -i .ssh/ansible.pem.pub '-o StrictHostKeyChecking=no 192.168.48.82'
# 测试
ssh -i .ssh/ansible.pem 192.168.48.82
192.168.48.82 -> 192.168.48.83 sshkey
su - bastion
ssh-copy-id -i .ssh/bastion82.pem.pub '-o StrictHostKeyChecking=no 192.168.48.83'
# 测试
ssh -i .ssh/bastion82.pem 192.168.48.83
ssh.config方式
192.168.48.81
mkdir -p /etc/ansible/keys
cp ansible.pem, ansible.pem.pub, bastion82.pem, bastion82.pem.pub -> /etc/ansible/keys
192.168.48.81 remove /home/ansible/.ssh/{ansible.pem, ansible.pem.pub}
192.168.48.82 remove /home/ansible/.ssh/{ansible.pem, ansible.pem.pub}, /home/bastion/.ssh/{bastion82.pem, bastion82.pem.pub}
192.168.48.83 remove /home/bastion/.ssh/{bastion82.pem, bastion82.pem.pub}
# /etc/ansible/ssh.config
Host bastion-82
User ansible
Hostname 192.168.48.82
IdentityFile /etc/ansible/keys/ansible.pem
Host server-83
User bastion
Hostname 192.168.48.83
IdentityFile /etc/ansible/keys/bastion82.pem
ProxyCommand ssh -q -A -x -i /etc/ansible/keys/ansible.pem -l ansible bastion-82 -W %h:%p
[root@bjyh-48-81 ~]# ssh -F /etc/ansible/ssh.config bastion-82
Last login: Fri Jan 23 17:06:32 2015 from 192.168.48.81
[ansible@bjyh-48-82 ~]$
[root@bjyh-48-81 ~]# ssh -F /etc/ansible/ssh.config server-83
Last login: Fri Jan 23 17:08:41 2015 from 192.168.48.82
[bastion@bjyh-48-83 ~]$