Ansible_常用模块
阅读原文时间:2023年07月09日阅读:3

一、Ansible常用模块

1、ansible常用模块command、shell、raw的区别:

  • command模块不是调用的shell的指令,所以没有bash的环境变量
  • shell模块调用的/bin/sh指令执行
  • raw很多地方和shell类似,更多的地方建议使用shellcommand模块
    • 但是如果是使用老版本python,需要用到raw,又或者是客户端是路由器,因为没有安装python模块,那就需要使用raw模块了

二、Ansible常用模块使用详解

1、ping模块

1️⃣:ping模块用于检查指定节点机器是否连通,用法很简单,不涉及参数,主机如果在线,则回复pong

  • 实例:

    [root@localhost ~]# ansible all -m ping
    192.168.121.81 | SUCCESS => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false,
    "ping": "pong"
    }

2、user模块

①:user模块常用参数

create_home :【 yes | no 】
说明:默认创建帐户或主目录不存在时将为用户创建主目录;除非选择 no
group
说明:设置用户主要组
groups
说明:设置用户附加组;当设置为空字符串时' ',该用户将从主要组之外的所有组中删除
home
说明:设置用户的家目录
name
说明:要创建,删除或修改的用户的名称
password
说明:将用户密码设置为此加密值;要在Linux系统上创建禁用的帐户,请将其设置为'!'或'*'
remove :【 yes | no 】
说明:当 state=asbent 时,删除与用户关联的目录;相当于:userdel --remove
shell
说明:设置用户的登陆的shell;如果不希望登陆可以设置 /sbin/nologin
state :【 present | absent 】
说明:设置未present声明创建该用户;设置absent声明删除该用户
system :【 yes | no 】
说明:当 state=present 时,将其设置为 yes 会使该用户成为系统帐户
uid
说明:指明用户的UID

②:在受控机上添加一个系统用户,用户名为zhangsanUID为888,设置登陆的shell为/sbin/nologin,无家目录

  • 实例:

    [root@localhost ~]# ansible 192.168.121.81 -m user -a 'name=zhangsan uid=888 system=yes shell=/sbin/nologin create_home=no state=present'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "comment": "",
    "create_home": false,
    "group": 888,
    "home": "/home/zhangsan",
    "name": "zhangsan",
    "shell": "/sbin/nologin",
    "state": "present",
    "system": true,
    "uid": 888
    }

    //查看受控主机上是否存在zhangsan 用户
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'id zhangsan'
    192.168.121.81 | CHANGED | rc=0 >>
    uid=888(zhangsan) gid=888(zhangsan) groups=888(zhangsan)

    //删除受管主机上的zhangsan用户
    [root@localhost ~]# ansible 192.168.121.81 -m user -a 'name=zhangsan state=absent'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "force": false,
    "name": "zhangsan",
    "remove": false,
    "state": "absent"
    }

    //查看受控主机上是否存在zhangsanzhangsan用户
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'id zhangsan'
    192.168.121.81 | FAILED | rc=1 >>
    id: ‘zhangsan’: no such usernon-zero return code

    //更改zhangsan用户的UID为1000
    [root@localhost ~]# ansible 192.168.121.81 -m user -a 'name=zhangsan uid=1000'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "append": false,
    "changed": true,
    "comment": "",
    "group": 888,
    "home": "/home/zhangsan",
    "move_home": false,
    "name": "zhangsan",
    "shell": "/sbin/nologin",
    "state": "present",
    "uid": 1000
    }  

3、group模块

①:group模块常用参数

name
说明:指定组的名称
state : 【 present | absent 】
说明:设置present声明创建该组;设置absent声明删除该组
system : 【 yes | no 】
说明:如果yes,则表示创建的组是系统组
gid
说明:声明组的GID

②:在受控机上添加一个系统组,其GID为800,组名为zhangsan

  • 实例:

    [root@localhost ~]# ansible 192.168.121.81 -m group -a 'name=zhangsan system=yes gid=800 state=present'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "gid": 800,
    "name": "zhangsan",
    "state": "present",
    "system": true
    }

    //查看受控主机上是否存在zhangsan组
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'grep zhangsan /etc/group'
    192.168.121.81 | CHANGED | rc=0 >>
    zhangsan❌800:

    //删除收控主机上的zhangsan组
    [root@localhost ~]# ansible 192.168.121.81 -m group -a 'name=zhangsan state=absent'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "name": "zhangsan",
    "state": "absent"
    }

    //查看受控主机上是否存在zhangsan 组
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'grep zhangsan /etc/group'
    192.168.121.81 | FAILED | rc=1 >>
    non-zero return code

    //更改受控主机zhangsan组的GID为1000
    [root@localhost ~]# ansible 192.168.121.81 -m group -a 'name=zhangsan gid=1000'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "gid": 1000,
    "name": "zhangsan",
    "state": "present",
    "system": false
    }

4、yum模块

1️⃣:yum模块用于在指定节点机器上通过yum管理软件

2️⃣:yum模块常用参数

name:安装的软件包名
state : 【 present | installed | latest | absent | removed 】
present: 安装软件
installed: 安装软件
latest: 安装软件
absent: 卸载软件
removed: 卸载软件

  • 示例:在受控主机上使用yum模块安装httpd服务

    • [root@localhost ~]# ansible 192.168.121.81 -m yum -a 'name=httpd state=present'
      192.168.121.81 | CHANGED => {
      "ansible_facts": {
      "discovered_interpreter_python": "/usr/libexec/platform-python"
      },
      "changed": true,
      "msg": "",
      "rc": 0,
      "results": [
      "Installed: apr-1.6.3-9.el8.x86_64",
      "Installed: centos-logos-httpd-80.5-2.el8.noarch",
      "Installed: apr-util-1.6.1-6.el8.x86_64",
      "Installed: apr-util-bdb-1.6.1-6.el8.x86_64",
      "Installed: httpd-2.4.37-21.module_el8.2.0+382+15b0afa8.x86_64",
      "Installed: httpd-filesystem-2.4.37-21.module_el8.2.0+382+15b0afa8.noarch",
      "Installed: mod_http2-1.11.3-3.module_el8.2.0+307+4d18d695.x86_64",
      "Installed: httpd-tools-2.4.37-21.module_el8.2.0+382+15b0afa8.x86_64",
      "Installed: apr-util-openssl-1.6.1-6.el8.x86_64",
      "Installed: mailcap-2.1.48-3.el8.noarch"
      ]
      }

      //启动httpd服务
      [root@localhost ~]# ansible 192.168.121.81 -m command -a 'systemctl start httpd'
      192.168.121.81 | CHANGED | rc=0 >>

      //查看httpd服务端口
      [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'ps -ef | grep httpd'
      192.168.121.81 | CHANGED | rc=0 >>
      root 20991 1 0 18:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
      apache 20992 20991 0 18:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
      apache 20993 20991 0 18:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
      apache 20994 20991 0 18:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
      apache 20996 20991 0 18:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND
      root 21573 21572 0 18:59 pts/1 00:00:00 /bin/sh -c ps -ef | grep httpd
      root 21575 21573 0 18:59 pts/1 00:00:00 grep httpd

      //查看是否安装httpd服务
      [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'rpm -qa | grep httpd'
      192.168.121.81 | CHANGED | rc=0 >>
      httpd-filesystem-2.4.37-21.module_el8.2.0+382+15b0afa8.noarch
      centos-logos-httpd-80.5-2.el8.noarch
      httpd-2.4.37-21.module_el8.2.0+382+15b0afa8.x86_64
      httpd-tools-2.4.37-21.module_el8.2.0+382+15b0afa8.x86_64

5、command模块

1️⃣:command模块用于在远程主机上执行命令,ansible默认就是使用command模块

2️⃣:command模块有一个缺陷就是不能使用管道符和重定向功能

  • 实例:

    //查看 /tmp下文件
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'ls /tmp'
    192.168.121.81 | CHANGED | rc=0 >>
    ansible_command_payload_bgh98niw
    ks-script-rz2t819q
    systemd-private-27d81652d04247e0aabf5ca3135190a7-httpd.service-34NQn0
    vmware-root_987-4257200413

    //在root目录下创建test文件
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'touch /root/test'
    192.168.121.81 | CHANGED | rc=0 >>
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'ls /root'
    192.168.121.81 | CHANGED | rc=0 >>
    anaconda-ks.cfg
    test

6、shell模块

①:shell模块用于在受控机上执行受控机上的脚本,亦可直接在受控机上执行命令(一般当命名使用,脚本就用script模块)

②:shell模块可能使用的参数

chdir
说明:运行命令之前,先切换到该目录
removes
说明:文件名(如果文件名不存在)将不会删除指定的文件
stdin
说明:将命令的 stdin 直接设置为指定值

③:shell模块亦支持管道与重定向

  • 实例:

    //查看受控主机上的脚本文件
    [root@localhost ~]# ls
    anaconda-ks.cfg test.sh
    [root@localhost ~]# chmod a+x test.sh
    [root@localhost ~]# ll test.sh
    -rwxr-xr-x. 1 root root 27 Aug 27 19:12 test.sh

    //在控制节点上执行受控主机上的脚本文件
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a '/root/test.sh'
    192.168.121.81 | CHANGED | rc=0 >>
    Thu Aug 27 19:15:20 CST 2020/root/test.sh: line 1: !/bin/bash: No such file or directory

    //使用shell执行管道符
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'cat /etc/group | grep root'
    192.168.121.81 | CHANGED | rc=0 >>
    root❌0:

    //使用shell执行重定向
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a '/root/test.sh > /tmp/dir.txt'
    192.168.121.81 | CHANGED | rc=0 >>
    /root/test.sh: line 1: !/bin/bash: No such file or directory
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'cat /tmp/dir.txt'
    192.168.121.81 | CHANGED | rc=0 >>
    Thu Aug 27 19:19:04 CST 2020

7、raw模块

1️⃣:raw模块用于在远程主机上执行命令,其支持管道符与重定向(除此之外,可以使用raw模块在其他不能安装服务:(例如路由器)上安装服务)

  • 实例

    //使用管道符
    [root@localhost ~]# ansible 192.168.121.81 -m raw -a 'cat /etc/group |grep root'
    192.168.121.81 | CHANGED | rc=0 >>
    root❌0:

    //使用重定向
    [root@localhost ~]# ansible 192.168.121.81 -m raw -a 'echo "hellow word" > /root/test.txt'
    192.168.121.81 | CHANGED | rc=0 >>
    [root@localhost ~]# ansible 192.168.121.81 -m raw -a 'cat /root/test.txt'
    192.168.121.81 | CHANGED | rc=0 >>
    hellow word

8、script模块

①:script模块用于在受管主机上执行控制节点上的脚本

②:script模块常用参数

chdir
说明:运行脚本之前,先切换到远程节点上的此目录
creates
说明:远程节点上的文件名(如果已存在)将不会运行此步骤
removes
说明:远程节点上的文件名(如果文件名不存在)将不会运行

  • 实例:

    //查看控制节点上的脚本文件
    [root@localhost ~]# ls
    anaconda-ks.cfg test.sh

    //执行控制节点上的脚本文件
    [root@localhost ~]# ansible 192.168.121.81 -m script -a '/root/test.sh > /root/dir.txt'
    192.168.121.81 | CHANGED => {
    "changed": true,
    "rc": 0,
    "stderr": "Shared connection to 192.168.121.81 closed.\r\n",
    "stderr_lines": [
    "Shared connection to 192.168.121.81 closed."
    ],
    "stdout": "",
    "stdout_lines": []
    }
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'cat /root/dir.txt'
    192.168.121.81 | CHANGED | rc=0 >>
    This is test file.sh

9、service模块

1️⃣:service模块用于管理受控机上的服务

2️⃣:service模块常用参数列表

state : 【 started | stopped | restarted | reloaded 】
started 启动服务
stopped 停止服务
restarted 重新启动
reloaded 重现加载

enabled : 【 yes | no 】
yes 开机自启
no 不启用开机自启
设置服务是否开机自启

  • 实例:

    //查看受控主机上的httpd服务是否启动
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'systemctl status httpd'
    192.168.121.81 | FAILED | rc=3 >>
    ● httpd.service - The Apache HTTP Server
    Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
    Active: inactive (dead)
    Docs: man:httpd.service(8)

    Aug 27 18:58:10 localhost.localdomain systemd[1]: Starting The Apache HTTP Server…
    Aug 27 18:58:10 localhost.localdomain httpd[20991]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
    Aug 27 18:58:10 localhost.localdomain systemd[1]: Started The Apache HTTP Server.
    Aug 27 18:58:10 localhost.localdomain httpd[20991]: Server configured, listening on: port 80
    Aug 27 19:31:21 localhost.localdomain systemd[1]: Stopping The Apache HTTP Server…
    Aug 27 19:31:22 localhost.localdomain systemd[1]: Stopped The Apache HTTP Server.non-zero return code

    //使用sevice模块启动httpd服务
    [root@localhost ~]# ansible 192.168.121.81 -m service -a 'name=httpd state=started'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "name": "httpd",
    "state": "started",
    "status": {
    "ActiveEnterTimestampMonotonic": "0",
    "ActiveExitTimestampMonotonic": "0",
    …………

    //查看受控主机httpd服务状态
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'systemctl status httpd'
    192.168.121.81 | CHANGED | rc=0 >>
    ● httpd.service - The Apache HTTP Server
    Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
    Active: active (running) since Thu 2020-08-27 19:37:22 CST; 1min 33s ago
    Docs: man:httpd.service(8)
    Main PID: 23488 (httpd)
    Status: "Running, listening on: port 80"
    Tasks: 213 (limit: 11340)
    Memory: 27.3M
    CGroup: /system.slice/httpd.service
    ├─23488 /usr/sbin/httpd -DFOREGROUND
    ├─23489 /usr/sbin/httpd -DFOREGROUND
    ├─23490 /usr/sbin/httpd -DFOREGROUND
    ├─23491 /usr/sbin/httpd -DFOREGROUND
    └─23492 /usr/sbin/httpd -DFOREGROUND

    Aug 27 19:37:22 localhost.localdomain systemd[1]: Starting The Apache HTTP Server…
    Aug 27 19:37:22 localhost.localdomain httpd[23488]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
    Aug 27 19:37:22 localhost.localdomain systemd[1]: Started The Apache HTTP Server.
    Aug 27 19:37:23 localhost.localdomain httpd[23488]: Server configured, listening on: port 80

    //设置受控主机httpd服务开机自启
    [root@localhost ~]# ansible 192.168.121.81 -m service -a 'name=httpd enabled=yes'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "enabled": true,
    "name": "httpd",
    "status": {
    "ActiveEnterTimestamp": "Thu 2020-08-27 19:37:22 CST",
    "ActiveEnterTimestampMonotonic": "18191160572",
    ………….

    //查看受控主机上httpd服务开机自启状态
    [root@localhost ~]# ansible 192.168.121.81 -m command -a 'systemctl is-enabled httpd'
    192.168.121.81 | CHANGED | rc=0 >>
    enabled

    //停止受控主机上的httpd服务
    [root@localhost ~]# ansible 192.168.121.81 -m service -a 'name=httpd state=stopped'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "name": "httpd",
    "state": "stopped",
    "status": {
    "ActiveEnterTimestamp": "Thu 2020-08-27 19:37:22 CST",
    "ActiveEnterTimestampMonotonic": "18191160572",

10、copy模块

1️⃣:copy模块用于复制文件至远程受控机

2️⃣:copy模块常用参数

src
说明:复制到远程服务器的文件的本地路径;可以是绝对的也可以是相对的
dest
说明:文件应复制到的远程主机的绝对路径
backup : 【 yes | no 】
说明:创建一个包含时间戳信息的备份文件,以便在不正确地破坏文件的情况下将其找回
force : 【 yes | no 】
说明:如果为yes,则当内容与源文件不同时,将替换远程文件;如果为no,则仅在目标不存在的情况下才传输文件

  • 实例:

    //查看控制节点文件
    [root@localhost ~]# ls
    anaconda-ks.cfg test.sh

    //复制文件
    [root@localhost ~]# ansible 192.168.121.81 -m copy -a 'src=/root/test.sh dest=/root'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "checksum": "6754b4785dbeace09c90e9ce4a2560d4e386efab",
    "dest": "/root/test.sh",
    "gid": 0,
    "group": "root",
    "md5sum": "b51ea9009c046cd325621fa7065782f0",
    "mode": "0644",
    "owner": "root",
    "secontext": "system_u:object_r:admin_home_t:s0",
    "size": 41,
    "src": "/root/.ansible/tmp/ansible-tmp-1598558057.5922036-5111-245228725024513/source",
    "state": "file",
    "uid": 0
    }

    //查看受管主机上是否存在改文件
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'ls /root'
    192.168.121.81 | CHANGED | rc=0 >>
    anaconda-ks.cfg
    test.sh  

11、template模块

1️⃣:template模块用于生成一个模板,并可将其传输至远程主机上(主要用于创建模板)

2️⃣:template模块常用参数

src
说明:本地模板的路径;这可以是相对或绝对路径
dest
说明:将模板呈现到远程计算机上的位置
backup : 【 yes | no 】
说明:创建一个包含时间戳信息的备份文件,以便在不正确地破坏文件的情况下将其找回
force : 【 yes | no 】
说明:设置yes为时,如果内容不同于源文件,则替换远程文件;设置为时 no,仅在目标不存在的情况下才传输文件

  • 实例:

    [root@localhost ~]# ansible 192.168.121.81 -m template -a 'src=/etc/yum.repos.d/CentOS-Base.repo dest=/etc/yum.repos.d'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "checksum": "4966466ad015ef3d2a3cc0b8252d43efbdcf2c94",
    "dest": "/etc/yum.repos.d/CentOS-Base.repo",
    "gid": 0,
    "group": "root",
    "md5sum": "d06fb7d5709727828bcaba7457ea673e",
    "mode": "0644",
    "owner": "root",
    "secontext": "system_u:object_r:system_conf_t:s0",
    "size": 2595,
    "src": "/root/.ansible/tmp/ansible-tmp-1598559298.4569452-5352-77842158483794/source",
    "state": "file",
    "uid": 0
    }

    //查看受控主机上是否存在该文件
    [root@localhost ~]# ansible 192.168.121.81 -m shell -a 'ls /etc/yum.repos.d'
    192.168.121.81 | CHANGED | rc=0 >>
    CentOS-Base.repo
    redhat.repo   

12、firewalld模块

1️⃣:firewalld模块常用参数

firewalld模块实现放行某个端口的权限:
permanent :【 yes | no 】
说明:此配置应处于正在运行的firewalld配置中,还是应在重新启动后持续存在;此外需要注意的是:如果设置为no,则假定为yes,永久启用;设置为yes,则假定为no,临时启用
port
说明:要添加到防火墙d或从防火墙删除的端口或端口范围的名称;对于端口范围,格式必须为 port/protocol 或 port-port/protocol;例如: 80/tcp
rich_rule
说明:富规则,用于添加到防火墙或从防火墙中删除
service
说明:要添加到防火墙或从防火墙删除的服务的名称
source
说明:您要添加到防火墙或从防火墙删除的源ip网络
state :【 present |enabled | absent | disabled 】
说明:对于端口:此端口应接受(enabled)还是拒绝(disabled)连接;状态present和absent只能在区域级别的操作中使用

  • 实例:

  • //查看受控主机上得防火墙是否启用
    [root@ansible ~]# ansible 192.168.121.81 -m shell -a 'systemctl is-active firewalld'
    192.168.121.81 | CHANGED | rc=0 >>
    active

    //查看受控主机是否启用800端口
    [root@ansible ~]# ansible 192.168.121.81 -m shell -a 'firewall-cmd --list-all'
    192.168.121.81 | CHANGED | rc=0 >>
    public (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth0
    sources:
    services: cockpit dhcpv6-client ssh
    ports: //800端口还没有放行
    protocols:
    masquerade: no
    forward-ports:
    source-ports:
    icmp-blocks:
    rich rules:

    //放行受控主机上800端口
    [root@ansible ~]# ansible 192.168.121.81 -m firewalld -a 'port=800/tcp state=enabled permanent=no'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "msg": "Non-permanent operation, Changed port 800/tcp to enabled"
    }

    //再次查看受控主机上800端口是否放行
    [root@ansible ~]# ansible 192.168.121.81 -m shell -a 'firewall-cmd --list-all'
    192.168.121.81 | CHANGED | rc=0 >>
    public (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth0
    sources:
    services: cockpit dhcpv6-client ssh
    ports: 800/tcp //800端口已经放行
    protocols:
    masquerade: no
    forward-ports:
    source-ports:
    icmp-blocks:
    rich rules:   

    //关闭800端口放行
    [root@ansible ~]# ansible 192.168.121.81 -m firewalld -a 'port=800/tcp state=disabled permanent=no' //permanent必须为yes,否则在开机自启后任然启用800端口放行
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "msg": "Non-permanent operation, Changed port 800/tcp to disabled"
    }

    //查看800端口是否放行
    [root@ansible ~]# ansible 192.168.121.81 -m shell -a 'firewall-cmd --list-all'
    192.168.121.81 | CHANGED | rc=0 >>
    public (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth0
    sources:
    services: cockpit dhcpv6-client ssh
    ports: //800端口已经取消放行
    protocols:
    masquerade: no
    forward-ports:
    source-ports:
    icmp-blocks:
    rich rules:

13、selinux模块

1️⃣:selinux模块常用参数:

policy
说明:如果state不是disabled,则需要使用要使用的SELinux策略的名称(例如)targeted
state : 【 enforcing | premissive | disabled 】
说明:
disabled #关闭selinux
permissive #临时关闭selinux
enforcing #强制执行selinux

例子:

  • name: Enable SELinux
    selinux:
    policy: targeted
    state: enforcing

  • name: Put SELinux in permissive mode, logging actions that would be blocked.
    selinux:
    policy: targeted
    state: permissive

  • name: Disable SELinux
    selinux:
    state: disabled

  • 实例:

    //查看受管主机的selinux状态
    [root@ansible ~]# ansible all -m shell -a 'getenforce'
    192.168.121.81 | CHANGED | rc=0 >>
    Enforcing

    //设置selinux为disabled
    [root@ansible ~]# ansible all -m selinux -a 'state=disabled'
    [WARNING]: SELinux state temporarily changed from 'enforcing' to 'permissive'. State change will take effect next reboot.
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "configfile": "/etc/selinux/config",
    "msg": "Config SELinux state changed from 'enforcing' to 'disabled'",
    "policy": "targeted",
    "reboot_required": true,
    "state": "disabled"
    }
    //忽略警告

    //查看selinux状态
    [root@ansible ~]# ansible all -m shell -a 'getenforce'
    192.168.121.81 | CHANGED | rc=0 >>
    Permissive

14、seport模块

1️⃣:seport模块管理网络端口类型定义(在selinux添加/删除允许开放的端口)

2️⃣:seport常用模块:

ports
说明:端口或端口范围 ;例如:1000-2000 ;200-500,7777(逗号分隔)
proto :【 tcp | udp 】
说明:指定端口的协议 ;例如:proto=tcp;proto=udp
reload :【 yes | no 】
说明:提交后重新加载SELinux策略
setype
说明:指定端口的selinux类型 ;例如:http服务:setype=http_port_t
state :【 present | absent 】
说明:指定端口的状态:
present #添加允许开放该端口
absent #删除/关闭该端口

  • 实例:

    //查看受控主机上是否开放777端口
    [root@ansible ~]# ansible all -m shell -a 'semanage port -l | grep http'
    192.168.121.81 | CHANGED | rc=0 >>
    http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
    http_cache_port_t udp 3130
    http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
    pegasus_http_port_t tcp 5988
    pegasus_https_port_t tcp 5989
    //semanage命令需要安装额外的安装包才能使用该命令,我这是提前安装好了的

    //使用seport模块允许开放777端口
    [root@ansible ~]# ansible all -m seport -a 'ports=777 proto=tcp setype=http_port_t state=present'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "ports": [
    "777"
    ],
    "proto": "tcp",
    "setype": "http_port_t",
    "state": "present"
    }

    //查看受控主机上是否开放777端口
    [root@ansible ~]# ansible all -m shell -a 'semanage port -l | grep http'
    192.168.121.81 | CHANGED | rc=0 >>
    http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
    http_cache_port_t udp 3130
    http_port_t tcp 777, 80, 81, 443, 488, 8008, 8009, 8443, 9000
    pegasus_http_port_t tcp 5988
    pegasus_https_port_t tcp 5989

    //关闭777端口
    [root@ansible ~]# ansible all -m seport -a 'ports=777 proto=tcp setype=http_port_t state=absent'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "ports": [
    "777"
    ],
    "proto": "tcp",
    "setype": "http_port_t",
    "state": "absent"
    }

    //查看777端口是否删除
    [root@ansible ~]# ansible all -m shell -a 'semanage port -l | grep http'
    192.168.121.81 | CHANGED | rc=0 >>
    http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
    http_cache_port_t udp 3130
    http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
    pegasus_http_port_t tcp 5988
    pegasus_https_port_t tcp 5989

15、mount模块

1️⃣:mount模块用来挂载目录,也可以用来挂载镜像文件

2️⃣:mount常用的参数:

src
说明:选择所要安装文件的路径;当状态设置为present或mounted,必须使用该参数
path
说明:挂载的路径;例如 path=/mnt/files
fstype
说明:挂载文件系统类型;当状态为present或mounted,必须使用该参数
state :【 mounted | unmounted | remounted | present | absent 】
说明:
mounted:如果是mounted,将在fstab中主动安装设备并进行适当配置;如果没有安装点,则将创建安装点
如果是unmounted,则无需更改fstab即可卸载设备
remounted指定要在挂载本身上强制刷新时重新安装设备
present仅指定要在fstab中配置设备,并且不触发或不需要安装
absent指定将设备安装项从fstab中删除,还将卸载设备并删除安装点
opts
说明:以什么方式挂载;例如:ro,rw

  • 实例:

    //查看/dev/sr0是否已经挂载
    [root@ansible ~]# ansible all -m shell -a 'df -h'
    192.168.121.81 | CHANGED | rc=0 >>
    Filesystem Size Used Avail Use% Mounted on
    devtmpfs 887M 0 887M 0% /dev
    tmpfs 904M 0 904M 0% /dev/shm
    tmpfs 904M 8.6M 895M 1% /run
    tmpfs 904M 0 904M 0% /sys/fs/cgroup
    /dev/mapper/rhel-root 50G 1.7G 49G 4% /
    /dev/mapper/rhel-home 27G 225M 27G 1% /home
    /dev/nvme0n1p1 1014M 173M 842M 17% /boot
    tmpfs 181M 0 181M 0% /run/user/0

    //挂载/dev/s/sr0到/mnt
    [root@ansible ~]# ansible all -m mount -a 'src=/dev/sr0 path=/mnt fstype=iso9660 state=mounted'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "dump": "0",
    "fstab": "/etc/fstab",
    "fstype": "iso9660",
    "name": "/mnt",
    "opts": "defaults",
    "passno": "0",
    "src": "/dev/sr0"
    }

    //查看是否挂载
    [root@ansible ~]# ansible all -m shell -a 'df -h'
    192.168.121.81 | CHANGED | rc=0 >>
    Filesystem Size Used Avail Use% Mounted on
    devtmpfs 887M 0 887M 0% /dev
    tmpfs 904M 0 904M 0% /dev/shm
    tmpfs 904M 8.6M 895M 1% /run
    tmpfs 904M 0 904M 0% /sys/fs/cgroup
    /dev/mapper/rhel-root 50G 1.7G 49G 4% /
    /dev/mapper/rhel-home 27G 225M 27G 1% /home
    /dev/nvme0n1p1 1014M 173M 842M 17% /boot
    tmpfs 181M 0 181M 0% /run/user/0
    /dev/sr0 7.4G 7.4G 0 100% /mnt

    //卸载
    [root@ansible ~]# ansible all -m mount -a 'src=/dev/sr0 path=/mnt state=unmounted'
    192.168.121.81 | CHANGED => {
    "ansible_facts": {
    "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "dump": "0",
    "fstab": "/etc/fstab",
    "name": "/mnt",
    "opts": "defaults",
    "passno": "0",
    "src": "/dev/sr0"
    }

    //查看是否卸载成功
    [root@ansible ~]# ansible all -m shell -a 'df -h'
    192.168.121.81 | CHANGED | rc=0 >>
    Filesystem Size Used Avail Use% Mounted on
    devtmpfs 887M 0 887M 0% /dev
    tmpfs 904M 0 904M 0% /dev/shm
    tmpfs 904M 8.6M 895M 1% /run
    tmpfs 904M 0 904M 0% /sys/fs/cgroup
    /dev/mapper/rhel-root 50G 1.7G 49G 4% /
    /dev/mapper/rhel-home 27G 225M 27G 1% /home
    /dev/nvme0n1p1 1014M 173M 842M 17% /boot
    tmpfs 181M 0 181M 0% /run/user/0

    //查看/etc/fstab文件是否删除信息
    [root@ansible ~]# ansible all -m shell -a 'cat /etc/fstab'
    192.168.121.81 | CHANGED | rc=0 >>

    /etc/fstab

    Created by anaconda on Wed Aug 26 03:25:38 2020

    Accessible filesystems, by reference, are maintained under '/dev/disk/'.

    See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.

    After editing this file, run 'systemctl daemon-reload' to update systemd

    units generated from this file.

    /dev/mapper/rhel-root / xfs defaults 0 0
    UUID=234365dc-2262-452e-9cbb-a6acfde04385 /boot xfs defaults 0 0
    /dev/mapper/rhel-home /home xfs defaults 0 0
    /dev/mapper/rhel-swap swap swap defaults 0 0
    /dev/sr0 /mnt iso9660 defaults 0 0

16、yum_repository模块

1️⃣:yum_repository模块是用来添加或删除YUM仓库的

2️⃣:yum_repository模块常用的参数:

name
说明:唯一的存储库ID。也就是配置文件中“[ ]”中括号中写的内容;名称必须唯一name参数是必须设置的;仅当状态设置为present或时,才需要此参数absent
description
说明:人类可读的字符串,描述存储库;也就是配置文件中name=描述的字符串;仅在state设置为present时才需要此参数
baseurl
说明:yum存储库“ repodata”目录所在目录的URL;它也可以是多个URL的列表;说白了就是给仓库的地址;如果需要的参数状态设置为present
enbaled :【 yes | no 】
说明:yum是否使用此存储库
yes 代表启用
no 代表不启用
pgpcheck :【 yes | no 】
说明:yum是否应该对软件包执行GPG签名检查;可选boolean值:
yes 如果设置启用签名检查:则需要写入gpgkey=URL
no 不启用签名检查
file
说明:不带 .repo 扩展名的文件名,用于保存存储库。默认为name的值。
如果设置里name参数,name改变的是文件中[ ] 中中括号中的值;而file改变的是文件名的名称
如果设置了name参数,但不给值,name就使用DEFAULT作为仓库的名称;file任然是改变文件名的名称
state :【 present | absent 】
说明:repo 文件的状态(是否创建)

3️⃣:演示实例:

//查看playbook

[root@localhost ~]# cat playbook.yml

手机扫一扫

移动阅读更方便

阿里云服务器
腾讯云服务器
七牛云服务器

你可能感兴趣的文章