user模塊 可管理遠程主機上的 用戶,好比建立用戶、修改用戶、刪除用戶、爲用戶建立密鑰對等操做。html
append='yes'
,則從groups參數中增長用戶的屬組;若是 append='no'
,則用戶屬組只設置爲groups中的組,移除其餘全部屬組。state=absent
時使用,等價於 userdel --remove
布爾類型,默認值爲 false。state=absent
時使用,等價於 userdel --force
,布爾類型,默認值爲 false。/etc/shadow
文件中的的 第8列/etc/shadow
中密碼字符串不一致時更新用戶的密碼; 當設置爲on_create時,password參數的值與 /etc/shadow
中密碼字符串不一致時也不會更新用戶的密碼,但若是是新建立的用戶,則此參數即便爲on_create,也會更新用戶密碼。~/.ssh
目錄中生成名爲 id_rsa私鑰 和 id_rsa.pub公鑰,若是同名密鑰已經存在,則不作任何操做。generate_ssh_key=yes
時,指定生成的ssh key加密位數。generate_ssh_key=yes
時,使用此參數指定ssh私鑰的路徑及名稱,會在同路徑下生成以私鑰名開頭以 .pub
結尾對應公鑰。generate_ssh_key=yes
時,在建立證書時,使用此參數設置公鑰中的註釋信息。若是同名密鑰已經存在,則不作任何操做。當不指定此參數時,默認註釋信息爲"ansible-generated on $hostname」。generate_ssh_key=yes
時,在建立證書時,使用此參數設置私鑰密碼。若是同名密鑰已經存在,則不作任何操做。generate_ssh_key=yes
時,在建立證書時,使用此參數指定密鑰對的類型。默認值爲 rsa,若是同名密鑰已經存在,則不作任何操做。 下列英文文檔部分來自於 ansible-doc
,參數的修飾符號爲 "=" 或 "-" OPTIONS (= is mandatory):= 號開始的爲必須給出的參數python
name: 用於指定操做的 user,必須項算法
= name Name of the user to create, remove or modify. (Aliases: user) type: str
使用 ansible 在 note1 節點上增長 test 用戶shell
[root@note0 ~]# ansible note1 -m user -a "name=test" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1000, "home": "/home/test", "name": "test", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1000 } [root@note0 ~]#
驗證 用戶 是否 添加 成功,查看 note1 節點下的 /etc/passwd
文件bash
[root@note1 ~]# tail -1 /etc/passwd test:x:1000:1000::/home/test:/bin/bash
uid: 用於指定 user 的 UID,默認爲空app
- uid Optionally sets the `UID' of the user. [Default: (null)] type: int
使用 ansible 在 note1 節點上增長 testuid 用戶less
[root@note0 ~]# ansible note1 -m user -a "name=testuid uid=2000" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 2000, "home": "/home/testuid", "name": "testuid", "shell": "/bin/bash", "state": "present", "system": false, "uid": 2000 } [root@note0 ~]#
驗證 用戶 是否 添加 成功,查看 note1 節點下的 /etc/passwd
文件運維
[root@note1 ~]# tail -1 /etc/passwd testuid:x:2000:2000::/home/testuid:/bin/bash
state: 參數用於指定用戶是否存在於遠程主機中。 可選值有 present、absent: 默認值爲 present,表示用戶存在,至關於在遠程主機建立用戶; 當設置爲 absent 時表示用戶不存在,至關於在遠程主機刪除用戶。ssh
- state Whether the account should exist or not, taking action if the state is different from what is stated. (Choices: absent, present)[Default: present] type: str
使用 ansible 在 note1 節點上刪除 test 用戶測試
[root@note0 ~]# ansible note1 -m user -a "name=test state=absent" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "force": false, "name": "test", "remove": false, "state": "absent" } [root@note0 ~]#
驗證 用戶 是否 刪除 成功,查看 note1 節點下是否存在 test 用戶
[root@note1 ~]# id test id: test: no such user
remove: 參數在 state=absent
時使用,等價於 userdel --remove
布爾類型,默認值爲 false。
- remove This only affects `state=absent', it attempts to remove directories associated with the user. The behavior is the same as `userdel --remove', check the man page for details and support. [Default: False] type: bool
在 示例3.3.1 中咱們已經使用 ansible 在 note1 節點上刪除了 test 用戶,如今讓咱們查看test用戶home目錄是否存在。
[root@note1 ~]# cd /home #查看home目錄 [root@note1 home]# ll 總用量 0 drwx------ 2 1000 1000 59 7月 9 16:41 test drwx------ 2 testuid testuid 59 7月 9 17:01 testuid [root@note1 home]#
咱們能夠看到,經過state=absent刪除的用戶home目錄還存在,下面咱們來演示一下完全刪除一個用戶。
使用 ansible 在 note1 節點上刪除 testuid 用戶
[root@note0 ~]# ansible note1 -m user -a "name=testuid state=absent remove=yes" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "force": false, "name": "testuid", "remove": true, "state": "absent" } [root@note0 ~]#
下面咱們來驗證一下,用戶及home目錄是否完全刪除
#查看testuid用戶是否存在 [root@note1 home]# id testuid id: testuid: no such user #查看home目錄 [root@note1 home]# ll 總用量 0 drwx------ 2 1000 1000 59 7月 9 16:41 test [root@note1 home]#
group: 參數用於指定用戶 主組。默認值爲空,建立的用戶組名跟用戶名一致。
- group Optionally sets the user's primary group (takes a group name). [Default: (null)] type: str
使用 ansible 在 note1 節點上 建立test 用戶,並指定主組爲 testgrp
#首先建立使用ansible建立testgrp組 [root@note0 ~]# ansible note1 -m group -a "name=testgrp state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "gid": 1000, "name": "testgrp", "state": "present", "system": false } #使用ansible建立test用戶 [root@note0 ~]# ansible note1 -m user -a "name=test group=testgrp state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1000, "home": "/home/test", "name": "test", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1000 } [root@note0 ~]#
驗證 用戶 是否 建立 成功
[root@note1 home]# id test uid=1000(test) gid=1000(testgrp) 組=1000(testgrp)
groups: 參數用於指定用戶屬組,能夠在建立用戶時指定用戶屬組,也能夠管理已經存在的用戶屬組。
groups爲列表類型,多個參數以逗號分隔,例如 groups='grp,mygrp'
;默認值 爲 空 ,也能夠設置空字符串 groups='',groups=`null` ,groups=`~` ,將用戶從其餘屬組 移除。
append: 跟groups參數一塊兒使用管理用戶屬組。布爾類型,默認爲false,若是 append='yes'
,則從groups參數中增長用戶的屬組;若是 append='no'
,則用戶屬組只設置爲groups中的組,移除其餘全部屬組。
- groups List of groups user will be added to. When set to an empty string `''', `null', or `~', the user is removed from all groups except the primary group. (`~' means `null' in YAML) Before Ansible 2.3, the only input format allowed was a comma separated string. [Default: (null)] type: list - append If `yes', add the user to the groups specified in `groups'. If `no', user will only be added to the groups specified in `groups', removing them from all other groups. [Default: False] type: bool
先使用 ansible 在 note1 節點上建立 mygrp1,mygrp2,mygrp3 測試組
#首先建立使用建立測試組 [root@note0 ~]# ansible note1 -m group -a "name=mygrp1 gid=2001 state=present" [root@note0 ~]# ansible note1 -m group -a "name=mygrp2 gid=2002 state=present" [root@note0 ~]# ansible note1 -m group -a "name=mygrp3 gid=2003 state=present" #測試組建立成功 [root@note1 home]# cat /etc/group mygrp1:x:2001: mygrp2:x:2002: mygrp3:x:2003:
建立用戶 testuser,並指定屬組爲 mygrp1 mygrp2
[root@note0 ~]# ansible note1 -m user -a "name=testuser groups=mygrp1,mygrp2 state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1001, "groups": "mygrp1,mygrp2", "home": "/home/testuser", "name": "testuser", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1001 } [root@note0 ~]#
驗證用戶 testuser的屬組爲mygrp1,mygrp2
[root@note1 home]# id testuser uid=1001(testuser) gid=1001(testuser) 組=1001(testuser),2001(mygrp1),2002(mygrp2)
將testuser的屬組變動爲mygrp1,mygrp2,mygrp3
[root@note0 ~]# ansible note1 -m user -a "name=testuser groups='mygrp1,mygrp2,mygrp3' state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "append": false, "changed": true, "comment": "", "group": 1001, "groups": "mygrp1,mygrp2,mygrp3", "home": "/home/testuser", "move_home": false, "name": "testuser", "shell": "/bin/bash", "state": "present", "uid": 1001 } [root@note0 ~]#
驗證用戶testuser的屬組是否爲mygrp1,mygrp2,mygrp3
[root@note1 home]# id testuser uid=1001(testuser) gid=1001(testuser) 組=1001(testuser),2001(mygrp1),2002(mygrp2),2003(mygrp3)
先將testuser用戶屬組還原爲mygrp1,mygrp2 再增長屬組mygrp3
#使用append=yes時,只將要添加的屬組填入groups參數中便可。 [root@note0 ~]# ansible note1 -m user -a "name=testuser groups='mygrp3' append=yes state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "append": true, "changed": true, "comment": "", "group": 1001, "groups": "mygrp3", "home": "/home/testuser", "move_home": false, "name": "testuser", "shell": "/bin/bash", "state": "present", "uid": 1001 } [root@note0 ~]#
驗證用戶testuser的屬組是否爲mygrp1,mygrp2,mygrp3
[root@note1 home]# id testuser uid=1001(testuser) gid=1001(testuser) 組=1001(testuser),2001(mygrp1),2002(mygrp2),2003(mygrp3)
將testuser的屬組變動爲mygrp1
[root@note0 ~]# ansible note1 -m user -a "name=testuser groups='mygrp1' state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "append": false, "changed": true, "comment": "", "group": 1001, "groups": "mygrp1", "home": "/home/testuser", "move_home": false, "name": "testuser", "shell": "/bin/bash", "state": "present", "uid": 1001 } [root@note0 ~]#
驗證用戶testuser的屬組是否爲mygrp1
[root@note1 home]# id testuser uid=1001(testuser) gid=1001(testuser) 組=1001(testuser),2001(mygrp1)
先將testuser用戶屬組還原爲mygrp1,mygrp2,mygrp3 再變動用戶testuser屬組爲mygrp3
#使用append=no時,用戶的屬組只設置爲groups參數中的組 [root@note0 ~]# ansible note1 -m user -a "name=testuser groups='mygrp1' append='no' state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "append": false, "changed": true, "comment": "", "group": 1001, "groups": "mygrp1", "home": "/home/testuser", "move_home": false, "name": "testuser", "shell": "/bin/bash", "state": "present", "uid": 1001 } [root@note0 ~]#
驗證用戶testuser的屬組是否爲mygrp1
[root@note1 home]# id testuser uid=1001(testuser) gid=1001(testuser) 組=1001(testuser),2001(mygrp1)
passwd: 參數用於指定用戶密碼,可是這個密碼不能是明文密碼,而是一個對明文密碼加密後的字符串,至關於 /etc/shadow
文件中的密碼字段,是一個對明文密碼進行哈希後的字符串,能夠使用命令生成明文密碼對應的加密字符串。
- password Optionally set the user's password to this crypted value. On macOS systems, this value has to be cleartext. Beware of security issues. To create a disabled account on Linux systems, set this to `'!'' or `'*''. See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-crypted-passwords-for-the-user-module for details on various ways to generate these password values. [Default: (null)] type: str
要生成md5算法的密碼,使用openssl便可。
openssl passwd -1 '123456' openssl passwd -1 -salt 'abcdefg' '123456'
但 openssl passwd
不支持生成sha-256和sha-512算法的密碼。使用python命令生成sha-512算法
python -c 'import crypt,getpass;pw="123456";print(crypt.crypt(pw))'
如今就方便多了,直接將結果賦值給變量便可。
[root@note0 ~]# a=$(python -c 'import crypt,getpass;pw="123456";print(crypt.crypt(pw))') [root@note0 ~]# echo $a $6$uKhnBg5A4/jC8KaU$scXof3ZwtYWl/6ckD4GFOpsQa8eDu6RDbHdlFcRLd/2cDv5xYe8hzw5ekYCV5L2gLBBSfZ.Uc166nz6TLchlp.
例如,ansible建立用戶並指定密碼:
[root@note0 ~]# a=$(python -c 'import crypt,getpass;pw="123456";print(crypt.crypt(pw))') [root@note0 ~]# ansible note1 -m user -a 'name=testpass password="$a" update_password=always' [WARNING]: The input password appears not to have been hashed. The 'password' argument must be encrypted for this module to work properly. 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1005, "home": "/home/testpass", "name": "testpass", "password": "NOT_LOGGING_PASSWORD", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1005 } [root@note0 ~]#
登陸驗證
[root@note0 ~]# ssh testpass@note1 testpass@note1's password: Last login: Thu Jul 11 00:12:57 2019 from note0 [testpass@note1 ~]$ who am i testpass pts/1 2019-07-11 00:13 (note0) [testpass@note1 ~]$
expires: 參數用於指定用戶過時時間,至關於設置 /etc/shadow
文件中的的 第8列 ,好比,你想要設置用戶的過時日期爲2019年07月10日,那麼你首先要獲取2019年07月10日的 unix 時間戳,使用命令 date -d 20190710 +%s
獲取到的時間戳爲1562688000,因此,當設置 expires=1562688000
時,表示用戶的過時時間爲2019年07月10日0點0分,設置成功後,查看遠程主機的 /etc/shadow
文件,對應用戶的第8列的值將變成18086(表示1970年1月1日到2019年07月10日的天數,unix 時間戳的值會自動轉換爲天數,咱們不用手動的進行換算),當前ansible版本此參數支持在GNU/Linux, FreeBSD, and DragonFlyBSD 系統中使用。
設置一個過時時間爲20190710的用戶testexprie
[root@note0 ~]# ansible note1 -m user -a "name=testexpire expires=1562688000 comment='expires date is 20190710' state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "expires date is 20190710", "create_home": true, "group": 1003, "home": "/home/testexpire", "name": "testexpire", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1003 } [root@note0 ~]#
在note1上驗證testexprie用戶
[root@note1 home]# cat /etc/shadow testexpire:!!:18086:0:99999:7::18086:
登陸失敗,提示帳號過時
[root@note0 ~]# ssh testexpire@note1 testexpire@note1's password: Your account has expired; please contact your system administrator Connection closed by 176.16.128.1
home: 參數用於指定用戶home目錄,值爲路徑
- home Optionally set the user's home directory. [Default: (null)] type: path - create_home Unless set to `no', a home directory will be made for the user when the account is created or if the home directory does not exist. Changed from `createhome' to `create_home' in Ansible 2.5. (Aliases: createhome)[Default: True] type: bool - move_home If set to `yes' when used with `home: ', attempt to move the user's old home directory to the specified directory if it isn't there already and the old home exists. [Default: False] type: bool
[root@note0 ~]# ansible note1 -m user -a "name=testhome home=/home/testdir state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1004, "home": "/home/testdir", "name": "testhome", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1004 } [root@note0 ~]#
驗證testhome用戶的home目錄
# 首先登陸note1節點,su到testhome用戶 [root@note1 ~]# su - testhome # cd 到主目錄 [testhome@note1 ~]$ cd ~ # 執行pwd [testhome@note1 ~]$ pwd /home/testdir [testhome@note1 ~]$
move_home: 若是設置爲yes,結合home= 使用,臨時遷移用戶家目錄到特定目錄
- move_home If set to `yes' when used with `home: ', attempt to move the user's old home directory to the specified directory if it isn't there already and the old home exists. [Default: False] type: bool
首先建立testmove用戶,而後在testmove用戶home目錄下建立test_move_home.txt文件
#建立testmove用戶。 [root@note0 ~]# ansible note1 -m user -a "name=testmove state=present" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1006, "home": "/home/testmove", "name": "testmove", "shell": "/bin/bash", "state": "present", "system": false, "uid": 1006 } #使用ansible的file模塊在testmove用戶home目錄下建立test_move_home.txt文件 [root@note0 ~]# ansible note1 -m file -a "path=/home/testmove/test_move_home.txt state=touch" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "dest": "/home/testmove/test_move_home.txt", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "size": 0, "state": "file", "uid": 0 } #在note1節點上,查看/home/testmove下是否存在test_move_home.txt [root@note1 ~]# cd /home/testmove [root@note1 testmove]# ll 總用量 0 -rw-r--r-- 1 root root 0 7月 11 06:22 test_move_home.txt [root@note1 testmove]#
使用ansible的move_home參數遷移用戶home目錄
#遷移testmove用戶的home目錄至/tmp/testmove_new [root@note0 ~]# ansible note1 -m user -a "user=testmove move_home=yes home=/tmp/testmove_new/" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "append": false, "changed": true, "comment": "", "group": 1006, "home": "/tmp/testmove_new/", "move_home": true, "name": "testmove", "shell": "/bin/bash", "state": "present", "uid": 1006 } [root@note0 ~]#
驗證遷移的新home目錄下是否存在test_move_home.txt文件
[root@note1 testmove]# cd /tmp/testmove_new/ [root@note1 testmove_new]# ll 總用量 0 -rw-r--r-- 1 root root 0 7月 11 06:22 test_move_home.txt [root@note1 testmove_new]#
generate_ssh_key: 參數用於指定是否生成ssh密鑰對,布爾類型,默認爲false。當設置爲yes時,爲用戶生成 ssh 密鑰對,默認在 ~/.ssh
目錄中生成名爲 id_rsa私鑰 和 id_rsa.pub公鑰,若是同名密鑰已經存在,則不作任何操做。
- generate_ssh_key Whether to generate a SSH key for the user in question. This will *not* overwrite an existing SSH key unless used with `force=yes'. [Default: False] type: bool version_added: 0.9
使用ansible建立testssh用戶,並生成ssh_key。
[root@note0 ~]# ansible note1 -m user -a "name=testssh state=present generate_ssh_key=yes" 176.16.128.1 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": true, "comment": "", "create_home": true, "group": 1007, "home": "/home/testssh", "name": "testssh", "shell": "/bin/bash", "ssh_fingerprint": "2048 07:18:48:ea:f1:dc:95:22:75:fc:b5:5e:80:25:a7:1f ansible-generated on note1 (RSA)", "ssh_key_file": "/home/testssh/.ssh/id_rsa", "ssh_public_key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIrQCOP11FK/s50vpOm/z+hXEmet+oEdWqGbyQD0JdN0AJrS/MzHZF3v+sjMf4SoDL7PafPYnFY4iVEtNOuBK8uvQgziVXVRxPs7h9Yy+ZdFw8qFjeiC74pKl+0Mqq49I9TD1GMbOQRd0K7nTycymCAX0MW5lQz7q44f3qa4+4y8C63xxi/4H9x3lJ+JsjDDIzKo4i69CnqU3Bn+0HzfxYi9j63HtcdLF8OwVfyF73lK6xd+vK68AaxRfPIOEj4KJXU3iMdiM5zVvMZgjEKyaGKPJD/uQl35MV2oazmFHTHWrKgA5AXwJEMKJYJzF6a8Z6SrmSnvxp6TpnMmbXAjev ansible-generated on note1", "state": "present", "system": false, "uid": 1007 } [root@note0 ~]#
驗證note1節點下的ssh_key文件
[root@note1 ~]# cd /home/testssh/.ssh [root@note1 .ssh]# ll 總用量 8 -rw------- 1 testssh testssh 1679 7月 11 06:39 id_rsa -rw-r--r-- 1 testssh testssh 408 7月 11 06:39 id_rsa.pub [root@note1 .ssh]# cat id_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIrQCOP11FK/s50vpOm/z+hXEmet+oEdWqGbyQD0JdN0AJrS/MzHZF3v+sjMf4SoDL7PafPYnFY4iVEtNOuBK8uvQgziVXVRxPs7h9Yy+ZdFw8qFjeiC74pKl+0Mqq49I9TD1GMbOQRd0K7nTycymCAX0MW5lQz7q44f3qa4+4y8C63xxi/4H9x3lJ+JsjDDIzKo4i69CnqU3Bn+0HzfxYi9j63HtcdLF8OwVfyF73lK6xd+vK68AaxRfPIOEj4KJXU3iMdiM5zVvMZgjEKyaGKPJD/uQl35MV2oazmFHTHWrKgA5AXwJEMKJYJzF6a8Z6SrmSnvxp6TpnMmbXAjev ansible-generated on note1 [root@note1 .ssh]#
ansible的user模塊經常使用參數就介紹到這裏,不作過多贅述了。歡迎指點交流。