[Do374]Ansible一键搭建sftp实现用户批量增删

1. 前言

最近准备搞一下RHCA LV V,外加2.9之后的ansible有较大变化于是练习下Do374的课程内容.
工作中有几台sftp的服务器,由于sftp的目录权限比较特殊,有时候手工配置会出现一些报错需要排查.
于是手写了个ansibleplay来完成一键搭建及后续的用户添加工作.

2. 思路

整个sftp配置主要分为以下步骤:

1. 安装配置ssh服务,并开通防火墙(这部分工作在实现ansible之前其实已经完成了)
2. 根据用户清创建用户
3. 确认sftp的主目录权限正常
4. 根据清单创建用户的sftp主目录和上传目录
5. 根据清单配置sshd主配置文件:/etc/ssh/sshd_config
6. 重置sshd服务

3. sftp搭建及用户批量新增

3.1 配置文件内容

服务器清单文件:

users:
- name: ut_k8s_put
  password: "ut_k8s_put_123"
  home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_get
  password: "it_k8s_get_123"
  home_directory: "/ftp/pabc/it_k8s_get"
- name: ftp_k8s
  password: "ftp_k8s_123"
  home_directory: "/ftp/public/ftp_k8s"

ansible playbook文件:
主要实现以下功能:

1. 根据用户清单创建用户
2. 创建/ftp目录
3. 根据用户清单创建用户sftp主目录
4. 根据用户清单创建用户sftp upload目录
5. 配置sshd主配置文件sshd_config文件
6. 重置sshd服务,这个地方尽量使用reload,工作中发现如果用restart的话在某些会话没有被释放的情况下会造成sshd服务重启卡主.

---
- name: Use block module to config sftp service
  hosts: serverc
  gather_facts: false
  vars_files:
  - user_list.yaml
  tasks:
  - name: user_add
    ansible.builtin.user:
      name: "{{ item.name }}"
      comment: "{{ item.name }} to sftp"
      shell: /sbin/nologin
      password: "{{ item.password | password_hash('sha512') }}"
      create_home: yes 
    with_items: "{{ users }}"
  - name: create sftp root directory
    ansible.builtin.file:
      path: /ftp
      state: directory
      owner: root
      group: root
      mode: '0755'
  - name: create sftp directory
    ansible.builtin.file:
      path: "{{ item.home_directory }}"
      state: directory
      owner: root
      group: "{{ item.name }}"
      mode: '1750'
    with_items: "{{ users }}"
  - name: Create upload directory
    ansible.builtin.file:
      path: "{{ item.home_directory }}/upload"
      state: directory
      owner: "{{ item.name }}"
      group: "{{ item.name }}"
      mode: '1750'
    with_items: "{{ users }}"
  - name: replace sftp config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      regexp: '^Subsystem sftp'
      line: Subsystem sftp internal-sftp
  - name: Add configs into the sshd_config file
    ansible.builtin.blockinfile:
      path: /etc/ssh/sshd_config
      block: |
        Match User {{ item.name }}
          chrootDirectory {{ item.home_directory }}
          X11Forwarding no
          AllowTcpForwarding no
          ForceCommand internal-sftp
          
      marker: "# {{ item.name }} config {mark}"
    with_items: "{{ users }}"
  - name: restart sshd service
    ansible.builtin.systemd:
      state: reloaded
      name: sshd

3.2 执行测试

ansible-navigator run sftp.yaml -m stdout

3.3 登录测试

尝试sftp远程登录服务器并上传文件.

sftp ut_k8s_put@serverc
cd upload/
put token.txt
bye

3.4 确认sftp服务器配置文件

确认sftp服务器上的配置文件和目录使用情况.

用了block模块的情况下后续删除修改也会方便很多,每个用户前后都有mark作为标记.

查看目录结构
显然我们刚才的文件也传到了正确的位置

[root@serverc ~]# tree /ftp
/ftp
├── pabc
│   ├── it_k8s_get
│   │   └── upload
│   └── ut_k8s_put
│     └── upload
│         └── token.txt
└── public
    └── ftp_k8s
        └── upload

8 directories, 1 file

4. 测试删除用户

user_del.yaml

users:
- name: ut_k8s_put
  password: "ut_k8s_put_123"
  home_directory: "/ftp/pabc/ut_k8s_put"
- name: it_k8s_get
  password: "it_k8s_get_123"
  home_directory: "/ftp/pabc/it_k8s_get"

playbook

---
- name: remove sftp users
  hosts: serverc
  gather_facts: false
  vars_files:
  - user_del.yaml
  tasks:
  - name: remove user configs from sshd_config
    ansible.builtin.blockinfile:
      path: /etc/ssh/sshd_config
      backup: yes
      state: absent
      marker: "# {{ item.name }} config {mark}"
    with_items: "{{ users }}"
  - name: remove user from system
    ansible.builtin.user:
      name: "{{ item.name }}"
      state: absent
      remove: yes
    with_items: "{{ users }}"
  - name: restart sshd service
    ansible.builtin.systemd:
      state: reloaded
      name: sshd

执行删除

ansible-navigator run sftp_remove.yaml -m stdout

执行之后可以看到,清单文件中的2个用户已经删除,之前另外一个创建的用户还是正常

尝试用剩下的那个用户再次连接
确认剩下的那个用户并不受影响

至此使用ansible批量配置sftp增加或删除用户完成.