ansible自動化管理windows系統實戰

時間 2021-01-19

標籤 html python ios git github shell bootstrap windows 服務器 app 欄目測試自動化简体版

原文原文鏈接

1、簡述

一、說明
平常系統自動化運維過程當中不免會有windows系列服務器,就開源軟件來講目前大多的對windows批量管理兼容性不太好;不像Linux系統便捷,但現實中確實有些業務須要跑在windows上;搜索查找折騰一番後,發現python開發的ansible(已經被redhat收購)有比較好的解決方案,經過一番折騰,整理出來,以備忘交流;html

二、實驗環境
服務器端:
CentOS7.4_x64 自帶python 2.7.5 ip:172.16.3.167
源碼安裝ansiblepython

被管理windows端:
win7sp1_x32 須要powershell 3.0+ ip:172.16.3.188 並開啓winrm服務開啓防火牆規則ios

三、實驗目標
能經過ansible 的各模塊對windows進行傳輸文件,管理帳號,執行腳本等批量自動化管理工做;git

2、ansible配置

一、簡介
Ansible 從1.7+版本開始支持Windows，但管理機必須爲Linux系統，遠程主機的通訊方式也由Linux下的SSH變爲PowerShell，管理機須要安裝Python的pywinrm模塊，但PowerShell需3.0+版本且Management Framework 3.0+版本，實測Windows 7 SP1和Windows Server 2008 R2及以上版本系統經簡單配置可正常與Ansible通訊。
二、環境準備
如下配置在CentOS7.4_x64下
安裝pip及相關依賴github

下載pip
#wget https://bootstrap.pypa.io/get-pip.py
#python get-pip.py
安裝依賴
#pip install pywinrm paramiko PyYAML Jinja2 httplib2 six

三、源碼安裝ansibleshell

# git clone git://github.com/ansible/ansible.git --recursive
#cd ./ansible
#source ./hacking/env-setup

運行了env-setup腳本,就意味着Ansible基於源碼運行起來了.默認的inventory文件是 /etc/ansible/hosts
cat /etc/ansible/hosts
注:能夠把這步添加到開機自啓中;bootstrap

[win7]
172.16.3.188 ansible_ssh_user="virtual" ansible_ssh_pass="myself." ansible_ssh_port=5985 ansible_connection="winrm" ansible_winrm_server_cert_validation=ignore

注意上信息在一行;以空格隔開,[win7] 是這臺主機的標題;下面的是ip和鏈接信息等;
以上ansible管理端已經配置好,被管理端win7尚未配置,相對來講稍稍麻煩點windows

3、被管理端win7配置

一、環境簡介
和Linux稍有區別，被管理端系統若是是Windows系列時;需預先有如下配置：
安裝Framework 3.0+ (有可能須要下載)
配置powershell策略爲remotesigned (須要修改)
升級PowerShell至3.0+(win7默認是2.0)
設置Windows遠端管理，英文全稱WS-Management（WinRM）服務器

二、環境配置
a、升級或安裝Framework 4.5
若是Framework版不知足請至微軟官方下載
b、修改powershell策略爲remotesigned
如圖:
app

c、升級PowerShell至3.0
保存如下腳本爲upgrade_to_ps3.ps1

# Powershell script to upgrade a PowerShell 2.0 system to PowerShell 3.0 
# based on http://occasionalutility.blogspot.com/2013/11/everyday-powershell-part-7-powershell.html 
# some Ansible modules that may use Powershell 3 features, so systems may need 
# to be upgraded.  This may be used by a sample playbook.  Refer to the windows 
# documentation on docs.ansible.com for details. 
# - hosts: windows 
#   tasks: 
#     - script: upgrade_to_ps3.ps1 

# Get version of OS 

# 6.0 is 2008 
# 6.1 is 2008 R2 
# 6.2 is 2012 
# 6.3 is 2012 R2 

 if ($PSVersionTable.psversion.Major -ge 3) 
 { 
     write-host "Powershell 3 Installed already; You don't need this" 
    Exit 
} 

 $powershellpath = "C:\powershell" 

function download-file 
 { 
     param ([string]$path, [string]$local) 
     $client = new-object system.net.WebClient 
    $client.Headers.Add("user-agent", "PowerShell") 
    $client.downloadfile($path, $local) 
 } 

 if (!(test-path $powershellpath)) 
{ 
    New-Item -ItemType directory -Path $powershellpath 
} 

# .NET Framework 4.0 is necessary. 

 #if (($PSVersionTable.CLRVersion.Major) -lt 2) 
 #{ 
#    $DownloadUrl = "http://download.microsoft.com/download/B/A/4/BA4A7E71-2906-4B2D-A0E1-80CF16844F5F/dotNetFx45_Full_x86_x64.exe" 
#    $FileName = $DownLoadUrl.Split('/')[-1] 
#    download-file $downloadurl "$powershellpath\$filename" 
#    ."$powershellpath\$filename" /quiet /norestart 
#} 

 #You may need to reboot after the .NET install if so just run the script again. 

 # If the Operating System is above 6.2, then you already have PowerShell Version > 3 
 if ([Environment]::OSVersion.Version.Major -gt 6) 
 { 
     write-host "OS is new; upgrade not needed." 
    Exit 
} 

 $osminor = [environment]::OSVersion.Version.Minor 

$architecture = $ENV:PROCESSOR_ARCHITECTURE 

 if ($architecture -eq "AMD64") 
 { 
     $architecture = "x64" 
 }   
 else 
 { 
     $architecture = "x86"  
}  

if ($osminor -eq 1) 
 { 
     $DownloadUrl = "http://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.1-KB2506143-" + $architecture + ".msu" 
} 
elseif ($osminor -eq 0) 
 { 
     $DownloadUrl = "http://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.0-KB2506146-" + $architecture + ".msu" 
} 
 else 
 { 
    # Nothing to do; In theory this point will never be reached. 
     Exit 
} 

$FileName = $DownLoadUrl.Split('/')[-1] 
download-file $downloadurl "$powershellpath\$filename" 

Start-Process -FilePath "$powershellpath\$filename" -ArgumentList /quiet

腳原本源於github upgrade_to_ps3.ps1

右擊-->以管理員運行稍等幾分鐘(具體時間看下載的速度,只要任務管理器中有powershell就說明還在下載安裝),系統會自動重啓升級安裝powershell到3.0
如圖:

重啓後查看powershell信息

d、設置Windows遠端管理（WS-Management，WinRM）服務
winrm 服務默認都是未啓用的狀態;注意如下操做在cmd中執行,而非powershell中
對winrm服務進行基礎配置：

winrm quickconfig
C:\Users\san02>winrm quickconfig
已在此計算機上運行 WinRM 服務。
WinRM 沒有設置成爲了管理此計算機而容許對其進行遠程訪問。
必須進行如下更改:
在 HTTP://* 上建立 WinRM 偵聽程序接受 WS-Man 對此機器上任意 IP 的請求。
啓用 WinRM 防火牆異常。
執行這些更改嗎[y/n]? y
WinRM 已經進行了更新，以用於遠程管理。
在 HTTP://* 上建立 WinRM 偵聽程序接受 WS-Man 對此機器上任意 IP 的請求。
WinRM 防火牆異常已啓用。

查看winrm service listener
winrm e winrm/config/listener
C:\Users\san02>winrm e winrm/config/listener
Listener
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = 127.0.0.1, 172.16.3.137, ::1, fe80::100:7f:fffe%13, fe80::5efe
:172.16.3.137%12, fe80::4865:97de:bb1f:877%11

配置auth 爲true(默認爲false)
winrm set winrm/config/service/auth @{Basic="true"}C:\Users\san02>winrm set winrm/config/service/auth @{Basic="true"}
Auth
    Basic = true
    Kerberos = true
    Negotiate = true
    Certificate = false
    CredSSP = false
    CbtHardeningLevel = Relaxed

配置容許非加密方式
winrm set winrm/config/service @{AllowUnencrypted="true"}
C:\Users\san02>winrm set winrm/config/service @{AllowUnencrypted="true"}
Service
    RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;
;;WD)
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = true
    Auth
        Basic = true
        ......如下省略.......

至此被管理端win7的環境配置完成!

4、測試Ansible管理windows

一、查看鏈接狀態

[root@localhost ~]# ansible win7 -m win_ping
172.16.3.188 | SUCCESS => {
    "attempts": 1, 
    "changed": false, 
    "failed": false, 
    "ping": "pong"
}

二、獲取Windows Facts

[root@localhost ~]# ansible win7 -m   setup
172.16.3.188 | SUCCESS => {
    "ansible_facts": {
        "ansible_architecture": "32-bit", 
        "ansible_bios_date": "12/01/2006", 
        "ansible_bios_version": "VirtualBox", 
        "ansible_date_time": {
            "date": "2018-01-24", 
            "day": "24", 
            "epoch": "1516816620.86637", 
            "hour": "17", 
            "iso8601": "2018-01-24T09:57:00Z", 
            "iso8601_basic": "20180124T175700861308", 
            "iso8601_basic_short": "20180124T175700", 
            "iso8601_micro": "2018-01-24T09:57:00.861308Z", 
            "minute": "57", 
            "month": "01", 
            "second": "00", 
    ......如下省略.......

三、遠程執行命令
遠程執行命令分爲遠程執行windows 原生自有命令經過raw 模塊,如:"ipconfig "
遠程執行ansible的win_command模塊也能夠執行命令,即ansible的擴展命令如"whoami"
默認是亂碼,須要修改winrm模塊文件

sed -i "s#tdout_buffer.append(stdout)#tdout_buffer.append(stdout.decode('gbk').encode('utf-8'))#g" /usr/lib/python2.7/site-packages/winrm/protocol.py
sed -i "s#stderr_buffer.append(stderr)#stderr_buffer.append(stderr.decode('gbk').encode('utf-8'))#g" /usr/lib/python2.7/site-packages/winrm/protocol.py

a、獲取ip地址
[root@localhost ~]# ansible win7 -m raw -a "ipconfig"
172.16.3.188 | SUCCESS | rc=0 >>
Windows IP Configuration
Ethernet adapter 本地鏈接:

   Connection-specific DNS Suffix  . : 
   Link-local IPv6 Address . . . . . : fe80::c55d:90f1:8d60:5d97%11
   IPv4 Address. . . . . . . . . . . : 172.16.3.188
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::daae:90ff:fe02:9d81%11
                                       172.16.3.1
         .....省略.....

b、win_command模塊遠程獲取身份
[root@localhost ansible]# ansible win7 -m win_command -a "whoami"
172.16.3.188 | SUCCESS | rc=0 >>
virtual_san\virtual

c、移動文件
[root@localhost ansible]# ansible win7 -m raw -a "cmd /c 'move /y d:\issue c:\issue'"
172.16.3.188 | SUCCESS | rc=0 >>
        1 file(s) moved

d、建立文件夾
[root@localhost ansible]# ansible win7 -m raw -a "mkdir d:\\tst"
172.16.3.188 | SUCCESS | rc=0 >>
    Directory: D:\
Mode                LastWriteTime     Length Name                              
----                -------------     ------ ----                              
d----         2018/1/25     16:44            tst   

e、刪除文件或目錄
[root@localhost ansible]# ansible win7 -m win_file -a "path=D:\1.txt state=absent"
172.16.3.188 | SUCCESS => {
    "attempts": 1, 
    "changed": true, 
    "failed": false
}

f、結束某程序
先經過 tasklist獲取運行程序信息
[root@localhost ansible]# ansible win7 -m raw -a "taskkill /F /IM QQ.exe /T" 
172.16.3.188 | SUCCESS | rc=0 >>
SUCCESS: The process with PID 3504 (child process of PID 2328) has been terminated

四、文件傳輸到win7被管理端
把/etc/issue文件複製到當前目錄(也能夠直接/etc/issue)再傳送到目標主機D盤下(能夠修改文件名)

[root@localhost ~]# ansible win7 -m  win_copy -a "src=issue dest=D:\issue"
172.16.3.188 | SUCCESS => {
    "attempts": 1, 
    "changed": true, 
    "checksum": "5c76e3b565c91e21bee303f15c728c71e6b39540", 
    "dest": "D:\\issue", 
    "failed": false, 
    "operation": "file_copy", 
    "original_basename": "issue", 
    "size": 23, 
    "src": "issue"
}

五、添加用戶

[root@localhost ansible]# ansible win7 -m win_user -a "name=san2 passwd=123.c0m groups=Administrators"
172.16.3.188 | SUCCESS => {
    "account_disabled": false, 
    "account_locked": false, 
    "attempts": 1, 
    "changed": true, 
    "description": "", 
    "failed": false, 
    "fullname": "san2", 
    "groups": [
        {
            "name": "Administrators", 
            "path": "WinNT://WORKGROUP/VIRTUAL_SAN/Administrators"
        }
    ], 
    "name": "san2", 
    "password_expired": true, 
    "password_never_expires": false, 
    "path": "WinNT://WORKGROUP/VIRTUAL_SAN/san2", 
    "sid": "S-1-5-21-2708087092-4192450616-382865091-1004", 
    "state": "present", 
    "user_cannot_change_password": false
}

經過以上的實踐我得知,要想經過ansible批量管理windows,前提是windows上要基於powershell配置好winrm服務;而後ansible經過模塊和winrm服務遠程指管理;這裏只是簡單的列舉了向個經常使用管理模塊;更多好用的模塊請參考官方windows可用模塊,包括自動配置等;