Translated from 日本語 • View original Hello. This is Komiya from the platform.
Continuing from the previous article, I apologize for the Chef article.
data_bags to prepare user management.
For the time being, I wrote here before, but I think it would be better if the relevant information was gathered, so I will partially repost it.
data_bags is something that can be managed such as data search with LDAP-like functions.
If you use chef-server, you can communicate with the server to retrieve data and reflect it.
Since this is Chef-solo, we will prepare data in a local file and reflect it.
Reference:
If you have a large number of users and frequently add and change accounts, it would be a good idea to use data_bags to manage the enablement and disabling as shown in the link below.
How to use chef-data-bag
[shell]# cd ; cd chef-repo/data_bags # mkdir users; cd users # vi xxx-op.json // xxx-op.json { "id" : "xxx-op", "groups": [ "xxx-op","wheel" ], "uid": 1000, "username" : "xxx-op", "home" : "/home/xxx-op", "shell" : "/bin/bash", "password" : "$1$ Ka.Mw69U$TT5HRfSe7xxxxx" }
# vi yyy-op.json // yyy-op.json { "id" : "yyy-op", "groups": [ "yyy-op","wheel" ], "uid": 500, "username" : "yyy-op", "home" : "/home/yyy-op", "shell" : "/bin/bash", "password" : "$1$Ka. Mw69U$TT5HRfSe78Pxxxxx" }
# vi dev.json // dev.json { "id" : "dev", "groups": [ "dev","wheel" ], "uid": 501, "username" : "dev", "home" : "\/home\/dev", "shell" : "\/bin\/bash", "password" : "$1$S/q25RbR$ oO7pCoAjBWxxxxx" }[/shell]
Create a password with the following command
[shell]# openssl passwd -1[/shell]
[shell]# knife solo data bag show users[/shell] Make sure the data is displayed
- Encrypt the user definition in MySQL
*Defining passwords in plain text in JSON files for nodes and roles is not secure, and it is not smart to record them for each node.
So let's use databags that can be encrypted using keys
It seems that encryption cannot be used with only knife-solo, but if you _bag gem install knife-solo_data\, you will be able to use it.
[shell]# openssl rand -base64 512 | tr -d '\r\n' > /etc/chef/encrypted_data_bag_secret # chmod 400 encrypted_data_bag_secret # cd /root/chef-repo # knife solo data bag create mysqlusers root --secret-file ./ encrypted_data_bag_secret The editor will open, enter the following { "id": "root", "user": "root", "pass": "xxxxxxx", "host": "localhost", "privileges": "all" }
# knife solo data bag create mysqlusers repl --secret-file ./encrypted_data_bag_secret The editor will open, enter the following { "id": "repl", "user": "repl", "pass":"xxxxxxx", "host":"172.20.28.%", " privileges": ["\\:replication slave", "\\:replication client"] }
# knife solo data bag create mysqlusers xxx_admin --secret-file ./encrypted_data_bag_secret The editor will open, enter the following { "id": "xxx_admin", "user": "xxx_admin", "pass": "xxxxxxx", "host": "172.20.28.%" "privileges": "all" }
# knife solo data bag create mysqlusers zabbix --secret-file ./encrypted_data_bag_secret The editor will open, enter the following { "id": "zabbix", "user": "zabbix", "pass": "xxxxxxx", "host": "localhost", "privileges": "all" }
Confirm # knife solo data bag show mysqlusers # knife solo data bag show mysqlusers repl --secret-file ./encrypted_data_bag_secret # knife solo data bag show mysqlusers root --secret-file . /encrypted_data_bag_secret # knife solo data bag show mysqlusers xxx_admin --secret-file ./encrypted_data_bag_secret # knife solo data bag show mysqlusers zabbix --secret-file . /encrypted_data_bag_secret[/shell] data is displayed
Other commands can be found below.
[shell]# knife solo data bag --help[/shell]
It seems that it is possible to pass the key for databags to the client host in a bootstrap file with chef-server,
Perhaps because of knife-solo_data_bag, it seemed that there was no need to specify the bootstrap file when using knife solo cook hostname.
I don't really know how to do it on the vagrant side.
Next, I will take out the data registered in data_bags from the recipe. data_bag('users') to get a list of IDs of user data objects placed in the data_bags/users directory.
You can retrieve objects with the ID specified in data_bag_item('users', id) from the Data Bag.
Reference:
[[chef] data bag usage] (http://tech.blog.piyo.org/2012/06/19/chef-data-bag%E6%B4%BB%E7%94%A8%E6%B3%95/)
Automate user creation with Chef's Data Bag
・Write a login_users recipe
[shell]cd site-cookbooks/login_users/recipes # vi default.rb data_ids = data_bag('users')
data_ids.each do |id| u = data_bag_item('users', id) user u['username'] do home u['home'] shell u['shell'] uid u['uid'] password u['password'] end end
group 'wheel' do group_name 'wheel' members ['root', 'xxx-op', 'yyy-op', 'dev'] action :modify end
cookbook_file '/home/dev/.bash_profile' do source 'home/dev/.bash_profile' owner 'dev' group 'dev' mode 0644 end[/shell] I couldn't specify a subgroup with a user resource, so I used a group resource.
[shell]echo "umask 002" >> /home/dev/.bash_profile tail /home/dev/.bash_profile mkdir -p /root/chef-repo/site-cookbooks/login_users/files/default/home/dev cp -p /home/dev/. bash_profile /root/chef-repo/site-cookbooks/login_users/files/default/home/dev/[/shell]
・Create a user for mysql
Note
Install MySQL in ChefGet started todayManagemysql users and databases in Chef chefManage JSON data you don't want to be exposed in ChefRecord of using DataBags to encrypt data Handling MySQL passwords in Chef
I thought I'd try to get the mysql/database cookbook from opscode, but
It didn't work and it was quite difficult to identify errors in recipes that I didn't write myself, so I decided to bash.
Here is what I tried to use→ mysql_database_user resource manual
The recipe is as follows
[shell]# vi site-cookbooks/mysqld/recipes/mysql-users.rb #include_recipe "openssl" #include_recipe 'database::mysql'
#mysql_connection_info = {:host => "localhost", # :username => 'root', # #:password => node['mysql']['server_root_password']} # :password => ''}
#mysql_database "xxx_db" do # connection mysql_connection_info # action :create #end
odbadm_data = Chef::EncryptedDataBagItem.load("mysqlusers","odb_admin") root_data = Chef::EncryptedDataBagItem.load("mysqlusers","root") repl_data = Chef:: EncryptedDataBagItem.load("mysqlusers","repl") myuser_o = odbadm_data["user"] mypass_o =odbadm_data["pass"] myuser_ro = root_data["user"] mypass_ro =root_data[" pass"] myuser_re = repl_data["user"] mypass_re =repl_data["pass"] #mysql_database_user "#{user}" do # connection mysql_connection_info # password "#{password}" # database_name "*" # host "[#{host}, %, localhost]" # privileges [:all] # action [:create, :grant] #end # mysqlconn = "mysql -u root" script "create_msql_odbadm" do not_if "ls /root/ .path_to_file" #not_if "#{mysqlconn} -p #{mypass_ro} -e 'select count(*) from mysql.user where user=\'repl\';'" interpreter "bash" user "root" code <-EOL #{mysqlconn} < EOF grant all privileges on *.* to #{myuser_o}@'%' identified by "#{mypass_o}"; grant all privileges on *.* to #{myuser_o}@'10.0.0.%' identified by "#{mypass_o}"; grant all privileges on *.* to #{myuser_o}@'localhost' identified by "#{mypass_o}"; grant all privileges on *.* to #{myuser_ro}@'10.0.0.%' identified by "#{mypass_ro}"; grant all privileges on *.* to #{myuser_ro}@'localhost' identified by "#{mypass_ro}"; grant replication slave, replication client on *.* to #{myuser_re}@'10.0.0.%' identified by "#{mypass_re}"; grant replication slave, replication client on *.* to #{myuser_re}@'localhost' identified by "#{mypass_re}"; drop database test; delete from mysql.user where password=''; flush privileges; EOF EOL end
script "create_pfile" do not_if 'ls /root/.path_to_filed' interpreter "bash" user "root" code <-EOL echo="" "#{mypass_ro}"=""> /root/.path_to_file chown 400 /root/.path_to_file EOL end[/shell]
That's all for now. Thank you for watching.
Next time it's a webserver recipe. </-EOL>