免密码配置

这里我们就引入了密钥的概念。管理机和被管理机通信使用密钥代替密码，这样就提高了安全性。具体操作步骤如下：

步骤一：在管理机器生成公钥

[root@localhost ~]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:IrRLAe0wt1pDfZjbzI16ss79M6Hp/O/7aLSXyGQtcBo root@localhost.localdomain
The key's randomart image is:
+---[RSA 2048]----+
|  .. . o         |
|  o.+ + .        |
|   *o. * o       |
|   .=o. = E .    |
|   o+...S  = .   |
|  .. oo.. o = .  |
|    .  + o * + . |
|     ..oo o =.o  |
|     .o.+oo*=+.  |
+----[SHA256]-----+
[root@localhost ~]#

步骤二：把公钥复制到被管理机器

[root@localhost ~]# ssh-copy-id root@192.168.233.167
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.233.167's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@192.168.233.167'"
and check to make sure that only the key(s) you wanted were added.

输入被管理机器密码即可。

聪明的同学可能马上就想到了，一台机器这样复制还行，被管理的机器少则几十台，多则几百几千台。一个一个的复制岂不是要累死了。几百几千台当然不可能这样操作了。我们用个小工具sshpass，写个小脚本来完成这个重复的工作。

其实前面在/etc/ansible/hosts配置user和password的时候，ansible就是调用sshpass来自动输入ssh密码的。

sshpas需要单独安装，首先要下载：http://sourceforge.net/projects/sshpass/

安装sshpass会用到gcc，所以要先安装gcc

[root@localhost ~]# yum install gcc -y

[root@localhost ~]# tar -xvf sshpass-1.06.tar.gz

[root@localhost ~]# cd sshpass-1.06/

[root@localhost ~]# ./configure

[root@localhost ~]# make && make install

接下来写脚本copysk.sh。

#!/bin/bash
#
password=123456
for ip in $(cat ip)
do
sshpass -p ${password} ssh-copy-id root@${ip}
done

脚本文件copysk.sh和ip文件在同一目录下。然后执行脚本即可

[root@localhost ~]# bash copysk.sh

如果不知道如何写脚本，这上面的复制修改password的值，再把ip文件中的IP改为你的IP即可。

密钥已经配置好了，管理机上的清单文件也要改一下。

打开清单文件如下：

[root@localhost ~]# vi /etc/ansible/hosts
192.168.1.1
192.168.1.2

把IP后面的ansible_ssh_user 和 ansible_ssh_pass删除，只保留前面的IP就行了。