集群ssh登陆自动化配置

情景描述

当需要进行集群配置时，如hadoop集群，mongodb集群等等，都需要使用ssh建立安全连接；使用ssh进行登陆之前，首先每台机器要生成一个密钥对,即公钥和私钥；例如A要登陆到B，首先需要把A的公钥添加到B的登陆授权文件中，通常是 ~/.ssh/authorized_keys中，这样A才能登陆到B，反过来如果B要登陆到A，同样也需要将B的公钥添加到A的登陆授权文件中；

手动操作

1.生成密钥对

ssh-keygen -t rsa

2. 拷贝公钥到远程服务器

ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host

3.最后登陆到远程服务器，无需密码

ssh user@remote-host

经过以上步骤实现了A免密码登录B，如果B要登陆A同样还需要拷贝公钥，如果一个集群中有好几十台服务器，手动操作就显得非常繁琐；就需要进行批处理解决集群中的任意两台机器之间的相互免密码登录；

批处理方式

思路：首先录入集群中每台服务器的ip，用户名，密码；然后登陆到每台机器，生成密钥对；拷贝远程脚本到各个服务器上，登陆到远程服务器上，并执行ssh-copy-id，两两相互拷贝公钥到对方授权文件中；最后删除远程服务器上的远程脚本；执行脚本主要依赖于expect，需要事先确保每一台机器都有安装expect；

远程脚本，主要实现了拷贝公钥到远程服务器
ssh-id-cp.sh

#!/bin/bash

# param: host, passwd

function ssh_id_auto_copy(){
    expect << EOF
        spawn ssh-copy-id -i $HOME/.ssh/id_rsa.pub $1
        expect {
            "*yes/no" { send "yes\r"; exp_continue }
            "*assword" { send "$2\r" }
        }
        expect eof
EOF
}

ssh_id_auto_copy $1 $2

批处理脚本scatter-aware.sh

#!/bin/bash

###
# Note: Before running this script, please ensure you have installed 'expect' on each system
###
# check expect command
if ! type "expect" > /dev/null; then
    echo "please intall expect on each matchine in this cluster"
    echo "run: sudo apt-get install expect"
    exit 1
fi

# params: user, host, passwd
function ssh_auto_keygen(){
    expect << EOF
    spawn ssh $1@$2 "ssh-keygen -t rsa"
    expect {
        "yes/no"        { send "yes\r"; exp_continue }
        "*assword" { send "$3\r" ; exp_continue }
        "save the key" { send "\r" ; exp_continue }
        "Overwrite" { send "y\r" ; exp_continue }
        "no passphrase" { send "\r" ; exp_continue }
        "again" { send "\r" ; }
    }
    expect eof;
EOF
}


if [ $( id -u ) -ne 0 ]; then
    echo "Permission denied."
    exit 1
fi


flag="y";
i=0;
while [ $flag != "n" ]
do
    read -p "Enter host:" hosts[$i]
    read -p "Enter ${hosts[$i]}'s user:" users[$i]
    read -p "Enter ${hosts[$i]}'s passwd:" passwds[$i]
    let i++
    read -p "Continue(y/n)" flag
    while [ $flag != "n" ] && [ $flag != "y" ]
    do
        read -p "Continue(y/n)" flag
    done
done

length=$i;

# copy remote script
for (( i=0; i<$length; i++ ))
do
    ssh_auto_keygen ${users[$i]} ${hosts[$i]} ${passwds[$i]}
    expect << EOF
    spawn scp ssh-id-cp.sh ${users[$i]}@${hosts[$i]}:$HOME
    expect {
        "*assword" { send "${passwds[$i]}\r";}
    }
    expect eof;
EOF
done

# copy ssh identify
for (( i=0; i<$length; i++ ))
do
    for (( j=0; j<$length; j++))
    do
        if [ $i -eq $j ]; then
            continue
        fi
        expect << EOF
        spawn ssh ${users[$i]}@${hosts[$i]} "bash $HOME/ssh-id-cp.sh ${hosts[$j]} ${passwds[$j]}"
        expect {
            "*yes/no" { send "yes\r"; exp_continue }
            "*assword" { send "${passwds[$i]}\r" }
        }
        expect eof;
EOF
    done
done

# Clean
for (( i=0; i<$length; i++))
do
    expect << EOF
    spawn ssh ${users[$i]}@${hosts[$i]} "rm -f $HOME/ssh-id-cp.sh"
    expect {
        "*yes/no" { send "yes\r"; exp_continue }
        "*assword" { send "${passwds[$i]}\r" }
    }
    expect eof;
EOF
done

echo "done"

以上仅仅在Ubuntu上实用，脚本写的仓促简陋，欢迎大家补充；

代码位置：