CentOS Linux release 7.9.2009 (Core) 默认的OpenSSH版本是OpenSSH_7.4p1，YUM提供的最新版本也是 OpenSSH_7.4p1，对OpenSSH升级，须采用编译部署的方式。
[root@ansible-centos7-shanghai-area0 roles]# vim update_openssh.yaml
---
- name: OpenSSH_7.4p1版本升级至OpenSSH_8.5p1版本
hosts: open
user: root
gather_facts: false
roles:
- openssh_update
[root@ansible-centos7-shanghai-area0 roles]# vim openssh_update/vars/main.yaml
open_ssh_package: openssh-8.4p1.tar.gz
open_ssl_package: openssl-1.1.1g.tar.gz
[root@ansible-centos7-shanghai-area0 roles]# cat openssh_update/tasks/main.yaml
---
- import_tasks: install.yaml
[root@ansible-centos7-shanghai-area0 roles]# cat openssh_update/tasks/install.yaml
---
- name:部署 telnet、xinetd服务
yum:
name: ['telnet','telnet-server','xinetd']
state: present
- name: 启动telnet、xinetd服务并配置开机启动
service:
name: "{{ item }}"
state: started
enabled: yes
loop:
- xinetd
- telnet.socket
- name: 对/etc/securetty文件进行备份
shell:
cmd: cp -rf /etc/securetty /etc/securetty.bak$(date +%Y%m%d)
- name: 在/etc/securetty文件中添加其他终端设备
blockinfile:
dest: /etc/securetty
block: "pts/0\npts/1\npts/2\npts/3\npts/4"
- name: 重启xinetd服务
service:
name: xinetd
state: restarted
notify: # 需要确保telnet成功运行才能进行后面的升级工作，否则升级失败，telnet没没有运行，无法远程连接服务器
- telnet 服务运行中，即将进行升级
[root@ansible-centos7-shanghai-area0 roles]# cat openssh_update/handlers/main.yaml
---
- name: 部署编译环境
yum:
name: ['gcc','gcc-c++','glibc','make','autoconf','openssl','openssl-devel','pcre-devel','pam-devel']
state: present
listen: telnet 服务运行中，即将进行升级
- name: 部署软件包pam，zlib
shell:
cmd: yum -y install pam* zlib*
listen: telnet 服务运行中，即将进行升级
- name: 将openssh、openssl解压到/opt目录
unarchive:
src: "{{ item }}"
dest: /opt/
loop:
- "{{ open_ssh_package }}"
- "{{ open_ssl_package }}"
listen: telnet 服务运行中，即将进行升级
- name: 备份openssl文件
shell:
cmd: mv /usr/bin/openssl /usr/bin/openssl_bak;mv /usr/include/openssl /usr/include/openssl_bak
listen: telnet 服务运行中，即将进行升级
- name: 编译安装openssl
shell:
cmd: ./config shared --prefix=/usr/local/ssl && make && make install
chdir: /opt/openssl-1.1.1k
listen: telnet 服务运行中，即将进行升级
- name: 设置openssl指令的软链接
shell:
cmd: 'ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl;ln -s /usr/local/ssl/include/openssl /usr/include/openssl'
listen: telnet 服务运行中，即将进行升级
- name: 加载openssl模块
shell:
cmd: echo "/usr/local/ssl/lib" >> /etc/ld.so.conf;/sbin/ldconfig
listen: telnet 服务运行中，即将进行升级
- name: 备份/etc/ssh、/etc/pam.d/sshd.pam
shell:
cmd: mv /etc/ssh /etc/ssh.$(date +%Y%m%d);cp -rf /etc/pam.d/sshd.pam /etc/pam.d/sshd.pam.$(date +%Y%m%d) || echo "ansible_ens33['ipv4']['address']上暂无这个文件。"
listen: telnet 服务运行中，即将进行升级
- name: 编译安装openssh
shell:
cmd: ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-openssl-includes=/usr/local/ssl/include --with-ssl-dir=/usr/local/ssl --with-zlib --with-md5-passwords --with-pam && make && make install
chdir: /opt/openssh-8.5p1
listen: telnet 服务运行中，即将进行升级
- name: 替换新的sshd_config
shell:
cmd: cp -rf /opt/openssh-8.5p1/sshd_config /etc/ssh/sshd_config
listen: telnet 服务运行中，即将进行升级
- name: override default of no subsystems
lineinfile:
dest: /etc/ssh/sshd_config
regexp: .*Subsystem.*sftp-server
line: Subsystem sftp /usr/libexec/openssh/sftp-server
listen: telnet 服务运行中，即将进行升级
- name: 关闭DNS解析
lineinfile:
dest: /etc/ssh/sshd_config
regexp: .*UseDNS
line: UseDNS no
listen: telnet 服务运行中，即将进行升级
- name: 允许root远程登录
lineinfile:
dest: /etc/ssh/sshd_config
regexp: .*PermitRootLogin
line: PermitRootLogin yes
listen: telnet 服务运行中，即将进行升级
- name: 添加banner路径
lineinfile:
dest: /etc/ssh/sshd_config
insertafter: ^#Banner none
line: Banner /etc/sshbanner
listen: telnet 服务运行中，即将进行升级
- name: 复制sshd.init和sshd.pam
shell:
cmd: cp -a contrib/redhat/sshd.init /etc/init.d/sshd;cp -a contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
chdir: /opt/openssh-8.5p1
listen: telnet 服务运行中，即将进行升级
- name: 将sshd添加到chkconfig进行管理
shell:
cmd: chmod +x /etc/init.d/sshd;chkconfig --add sshd;chkconfig sshd on;systemctl enable sshd
listen: telnet 服务运行中，即将进行升级
- name: 备份sshd.service并重启sshd服务
shell:
cmd: mv /usr/lib/systemd/system/sshd.service /opt/;mv /usr/lib/systemd/system/sshd.socket /opt/;systemctl daemon-reload;service sshd restart
listen: telnet 服务运行中，即将进行升级
- name: 检查版本，确认是否升级成功
shell:
cmd: ssh -V;openssl version
register: check
listen: telnet 服务运行中，即将进行升级
- name: 查询更新后的版本信息
debug:
var: check
verbosity: 0
listen: telnet 服务运行中，即将进行升级
[root@ansible-centos7-shanghai-area0 roles]# ls
openssh_update update_openssh.yaml
[root@ansible-centos7-shanghai-area0 roles]# ansible-playbook --syntax-check update_openssh.yaml # 检查yaml语法
playbook: update_openssh.yaml
[root@ansible-centos7-shanghai-area0 roles]# ansible-playbook -i /etc/ansible/hosts -e hosts=192.168.122.102 /etc/ansible/roles/update_openssh.yaml # 运行
[WARNING]: Found variable using reserved name: hosts
PLAY [OpenSSH_7.4p1版本升级至OpenSSH_8.5p1版本] *******************************************************************************************************************************************************************************************************
TASK [openssh_update : 部署 telnet、xinetd服务] *****************************************************************************************************************************************************************************************************
changed: [192.168.122.102]
TASK [openssh_update : 启动telnet、xinetd服务并配置开机启动] *********************************************************************************************************************************************************************************************
changed: [192.168.122.102] => (item=xinetd)
changed: [192.168.122.102] => (item=telnet.socket)
TASK [openssh_update : 对/etc/securetty文件进行备份] **************************************************************************************************************************************************************************************************
changed: [192.168.122.102]
TASK [openssh_update : 在/etc/securetty文件中添加其他终端设备] *******************************************************************************************************************************************************************************************
changed: [192.168.122.102]
TASK [openssh_update : 重启xinetd服务] **********************************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 部署编译环境] ***************************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 部署软件包pam，zlib] ***********************************************************************************************************************************************************************************************
[WARNING]: Consider using the yum module rather than running 'yum'. If you need to use command because yum is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this
message.
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 将openssh、openssl解压到/opt目录] ****************************************************************************************************************************************************************************
changed: [192.168.122.102] => (item=openssh-8.5p1.tar.gz)
changed: [192.168.122.102] => (item=openssl-1.1.1k.tar.gz)
RUNNING HANDLER [openssh_update : 备份openssl文件] **********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 编译安装openssl] **********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 设置openssl指令的软链接] ******************************************************************************************************************************************************************************************
[WARNING]: Consider using the file module with state=link rather than running 'ln'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg
to get rid of this message.
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 加载openssl模块] **********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 备份/etc/ssh、/etc/pam.d/sshd.pam] ***************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 编译安装openssh] **********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 替换新的sshd_config] ******************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : override default of no subsystems] ************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 关闭DNS解析] **************************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 允许root远程登录] ***********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 添加banner路径] ***********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 复制sshd.init和sshd.pam] *************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 将sshd添加到chkconfig进行管理] ***************************************************************************************************************************************************************************************
[WARNING]: Consider using the file module with mode rather than running 'chmod'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to
get rid of this message.
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 备份sshd.service并重启sshd服务] **********************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 检查版本，确认是否升级成功] ********************************************************************************************************************************************************************************************
changed: [192.168.122.102]
RUNNING HANDLER [openssh_update : 查询更新后的版本信息] **************************************************************************************************************************************************************************************************
ok: [192.168.122.102] => {
"check": {
"changed": true,
"cmd": "ssh -V;openssl version",
"delta": "0:00:00.043766",
"end": "2021-04-16 12:10:53.211888",
"failed": false,
"rc": 0,
"start": "2021-04-16 12:10:53.168122",
"stderr": "OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021",
"stderr_lines": [
"OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021"
],
"stdout": "OpenSSL 1.1.1k 25 Mar 2021",
"stdout_lines": [
"OpenSSL 1.1.1k 25 Mar 2021"
]
}
}
PLAY RECAP **********************************************************************************************************************************************************************************************************************************
192.168.122.102 : ok=24 changed=23 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[root@ansible-centos7-shanghai-area0 roles]# IDC 升级应用
[root@devops-centos7-shanghai-area1 roles]# cat /root/scripts/ssh-keygen_copy.sh
#!/bin/bash
host=$(cat /root/host)
for i in $host
do
/usr/bin/expect <<-EOF
spawn ssh-copy-id root@$i
expect "connecting"
send "yes\n"
expect "password"
send "111111\n"
expect eof
EOF
done # 通过expect 交互下发滚动密钥
[root@devops-centos7-shanghai-area1 roles]# tree
.
├── openssh_update
│ ├── files
│ │ ├── openssh-8.5p1.tar.gz
│ │ └── openssl-1.1.1k.tar.gz
│ ├── handlers
│ │ └── main.yaml
│ ├── tasks
│ │ ├── install.yaml
│ │ └── main.yaml
│ └── vars
│ └── main.yaml
└── update_openssh.yaml
5 directories, 7 files
[root@devops-centos7-shanghai-area1 roles]# ansible-playbook update_openssh.yaml # update_openssh.yaml 中指定主机分组即可
PLAY [OpenSSH_7.4p1版本升级至OpenSSH_8.5p1版本] ******************************************************************************************************************************************************************************************************
TASK [openssh_update : 安装telnet、xinetd] ****************************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
TASK [openssh_update : 启动telnet、xinetd,并设置开机启动] ********************************************************************************************************************************************************************************************
changed: [172.17.1.11] => (item=xinetd)
changed: [172.17.1.12] => (item=xinetd)
changed: [172.17.1.11] => (item=telnet.socket)
changed: [172.17.1.12] => (item=telnet.socket)
TASK [openssh_update : 备份/etc/securetty文件] *************************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
TASK [openssh_update : 在/etc/securetty文件添加其他终端设备] ******************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
TASK [openssh_update : 重启xinetd服务] *********************************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 部署编译环境] **************************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 部署软件包pam，zlib] *******************************************************************************************************************************************************************************************
[WARNING]: Consider using the yum module rather than running 'yum'. If you need to use command because yum is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of
this message.
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 将openssh、openssl解压到/opt目录] *******************************************************************************************************************************************************************************
changed: [172.17.1.12] => (item=openssh-8.5p1.tar.gz)
changed: [172.17.1.11] => (item=openssh-8.5p1.tar.gz)
changed: [172.17.1.12] => (item=openssl-1.1.1k.tar.gz)
changed: [172.17.1.11] => (item=openssl-1.1.1k.tar.gz)
RUNNING HANDLER [openssh_update : 备份openssl文件] *********************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 编译安装openssl] *********************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 设置openssl指令的软链接] *****************************************************************************************************************************************************************************************
[WARNING]: Consider using the file module with state=link rather than running 'ln'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg
to get rid of this message.
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 加载openssl模块] *********************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 备份/etc/ssh、/etc/pam.d/sshd.pam] **************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 编译安装openssh] *********************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 替换新的sshd_config] *****************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : override default of no subsystems] ***********************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 关闭DNS解析] *************************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 允许root远程登录] **********************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 添加banner路径] **********************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 复制sshd.init和sshd.pam] ************************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 将sshd添加到chkconfig进行管理] ***********************************************************************************************************************************************************************************
[WARNING]: Consider using the file module with mode rather than running 'chmod'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to
get rid of this message.
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 备份sshd.service并重启sshd服务] *********************************************************************************************************************************************************************************
changed: [172.17.1.11]
changed: [172.17.1.12]
RUNNING HANDLER [openssh_update : 检查版本，确认是否升级成功] *******************************************************************************************************************************************************************************************
changed: [172.17.1.12]
changed: [172.17.1.11]
RUNNING HANDLER [openssh_update : 查询更新后的版本信息] **********************************************************************************************************************************************************************************************
ok: [172.17.1.11] => {
"check": {
"changed": true,
"cmd": "ssh -V;openssl version",
"delta": "0:00:00.010642",
"end": "2021-04-19 14:38:47.334222",
"failed": false,
"rc": 0,
"start": "2021-04-19 14:38:47.323580",
"stderr": "OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021",
"stderr_lines": [
"OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021"
],
"stdout": "OpenSSL 1.1.1k 25 Mar 2021",
"stdout_lines": [
"OpenSSL 1.1.1k 25 Mar 2021"
]
}
}
ok: [172.17.1.12] => {
"check": {
"changed": true,
"cmd": "ssh -V;openssl version",
"delta": "0:00:00.015121",
"end": "2021-04-19 14:38:47.290111",
"failed": false,
"rc": 0,
"start": "2021-04-19 14:38:47.274990",
"stderr": "OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021",
"stderr_lines": [
"OpenSSH_8.5p1, OpenSSL 1.1.1k 25 Mar 2021"
],
"stdout": "OpenSSL 1.1.1k 25 Mar 2021",
"stdout_lines": [
"OpenSSL 1.1.1k 25 Mar 2021"
]
}
}
PLAY RECAP *********************************************************************************************************************************************************************************************************************************
172.17.1.11 : ok=24 changed=23 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
172.17.1.12 : ok=24 changed=23 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0