ansible 访问内网服务器

ssh
https://medium.com/@paulskarseth/ansible-bastion-host-proxycommand-e6946c945d30#.rauzlfv0z
http://blog.scottlowe.org/2015/12/24/running-ansible-through-ssh-bastion-host
https://10mi2.wordpress.com/2015/01/14/using-ssh-through-a-bastion-host-transparently/
https://gagor.pl/2016/04/use-bastion-host-with-ansible
http://www.cweye.net/2015/07/17/ansible-jumper.html
http://my.oschina.net/foreverich/blog/657075

sudo
http://tech-sketch.jp/2016/06/ssh_sudo_su.html

案例
有A B两个数据中心，每个数据中心仅１台服务器(jumphost)有公网ip，其他服务器均为内网地址。

控制机
1 conctrol 生成带password的key

ssh-keygen -f a.pem -N '@ansible'
ssh-keygen -f b.pem -N '@ansible'

2 A jumphost & targethost

useradd ansible

su - ansible -c 'mkdir .ssh'
su - ansible -c 'curl http://install.local/a.pem.pub -O .ssh/authorized_keys'
su - ansible -c 'chmod 600 .ssh/authorized_keys'
su - ansible -c 'chmod 700 .ssh'

3 B jumphost & targethost

useradd ansible

su - ansible -c 'mkdir .ssh'
su - ansible -c 'curl http://install.local/b.pem.pub -O .ssh/authorized_keys'
su - ansible -c 'chmod 600 .ssh/authorized_keys'
su - ansible -c 'chmod 700 .ssh'

4 control ssh_config

# A
Host 69.xx.xx.xx
    User ansible
    Port 29922
    #IdentityFile keys/dc.pem
    ControlMaster auto
    ControlPath keys/ansible-%r@%h:%p
    ControlPersist 15m
    ForwardAgent yes 
    StrictHostKeyChecking no

Host 10.150.1.*
    User ansible
    Port 29922
    #IdentityFile keys/dc.pem
    ProxyCommand ssh -p 29922 %r@69.xx.xx.xx -W %h:%p
    ForwardAgent yes
    StrictHostKeyChecking no

# B
Host 173.xx.xx.xx
    User ansible
    Port 29922
    #IdentityFile keys/dc.pem
    ControlMaster auto
    ControlPath keys/ansible-%r@%h:%p
    ControlPersist 15m
    ForwardAgent yes 
    StrictHostKeyChecking no

Host 10.160.1.*
    User ansible
    Port 29922
    #IdentityFile keys/la.pem
    ProxyCommand ssh -p 29922 %r@173.xx.xx.xx -W %h:%p                                                                                                                               
    ForwardAgent yes
    StrictHostKeyChecking no

5 control login

# 私钥加入内存，用于ssh agent forward
#ssh-agent bash
ssh-add keys/a.pem
Enter passphrase for keys/a.pem:

ssh-add keys/b.pem
Enter passphrase for keys/b.pem:

# 分别登录A B跳板机和内网主机
ssh -F ssh_config 69.xx.xx.xx
ssh -F ssh_config 10.150.1.35

ssh -F ssh_config 173.xx.xx.xx
ssh -F ssh_config 10.160.1.35

# 删除内存私匙
ssh-add -D

6 jumphost & targethost sudo

cat > /etc/sudoers.d/ansible << _EOF_
Defaults:ansible,%operator    !requiretty

Cmnd_Alias SU = /bin/su*
Cmnd_Alias SUDO = /usr/bin/vim /etc/sudoers*, /bin/vi /etc/sudoers*, /bin/su*, /usr/sbin/visudo
Cmnd_Alias ACCOUNT = /usr/sbin/adduser*, /usr/sbin/useradd*, /usr/sbin/groupadd*, /usr/sbin/userdel*
Cmnd_Alias SHELLS = /bin/sh, /bin/ksh, /bin/bash, /bin/zsh, /bin/csh, /bin/tcsh, /usr/bin/login

ansible ALL = (ALL) NOPASSWD: ALL, !SU
%operator ALL = (ALL) NOPASSWD: ALL, !SHELLS, !SU, !SUDO, !ACCOUNT
_EOF_

chmod 440 /etc/sudoers.d/ansible
groupadd operator

/etc/pam.d/su
#auth           required        pam_wheel.so use_uid
->
auth           required        pam_wheel.so use_uid

/etc/ssh/sshd_config
PermitRootLogin no
RSAAuthentication yes
PubkeyAuthentication yes
PasswordAuthentication yes

7 jumphost & targethost user (ansible控制)

1 建立用户
useradd ken

加入operator组
usermod -G operator ken

用户.ssh/authorized_keys写入用户公匙
ken.gem -> .ssh/authorized_keys

2 用户使用私匙登录
local> ssh-add ken.gem
local> ssh -p 29922 -A ken@69.xx.xx.xx
69> ssh -p 29922 -A ken@10.150.1.xx

3 删除用户

登录自动启动ssh-agent

cat > /etc/profile.d/ssh-agent.sh << EOF
#!/bin/bash

if [ ! -S ~/.ssh/ssh_auth_sock ]; then
  eval \`ssh-agent\`
  ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi

export SSH_AUTH_SOCK=~/.ssh/ssh_auth_sock
EOF

手动执行ssh-add加入sshkey，只要不重启sshkey一直存在内存中

登录自动加载带密码的sshkey　密码输入没有解决

echo "echo '@ansible'" > /opt/ansible/keys/.passphrase && chmod 700 /opt/ansible/keys/.passphrase

ssh-add -l | grep 'The agent has no identities' && cat /opt/ansible/keys/{dc.pem,la.pem} | SSH_ASKPASS=/opt/ansible/keys/.passphrase ssh-add -

ssh-add 将私匙加入内存，公匙分别加入堡垒机及内网机，加入代理转发，可以登录任意服务器
ssh -p 29922 ansible@192.168.1.22 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no 
-o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes

ssh -p 29922 ansible@192.168.1.23 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no 
-o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes 
-o ProxyCommand='ssh -p 29922 %r@192.168.1.22 -W %h:%p'

ssh -p 22 ansible@192.168.1.24 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no 
-o ControlMaster=auto -o ControlPersist=5m -o ControlPath=/tmp/ansible-%r@%h:%p -o ForwardAgent=yes 
-o ProxyCommand='ssh -p 29922 %r@192.168.1.22 -W %h:%p'