Geek Answers Handbook

Chef: disconnect server with root ssh privilege?

When we provide new linux servers, we

  • create a new user with sudo rights and ...
  • block root from ssh access

And then we move on to setting up the system using the new user account. Of course, we do it this way because our logs are full of hostile ssh root login attempts.

But now we are trying to use a chef (a chef with a solo knife and a librarian chef) to create servers. When we create a recipe that blocks ssh from root, we cannot run the recipes again.

I saw this: How to start a firewall client for a chef with a non-root user? but it seems that the “root” is hardcoded everywhere, and the decision made will require forking all the main cookbooks.

Any ideas on how to create a restartable chef setup that includes disabling root ssh access?

+4
source share
2 answers

This is not uncommon for boot servers using an account other than root. As @StephenKing noted, the knife supports this. The following is my usual procedure:

ssh-copy-id me@hostname
knife bootstrap hostname --ssh-user me --sudo --run-list role[desired_server_role]

However, this answer assumes that you are using a chef server (highly recommended) ....

, . , sudo "kno solo prepare" :

SSH ~/.ssh/config , -F. (-p), (-i) (-P). sudo , .

"knot solo bootstrap", , .

$ knife solo bootstrap -h 
knife solo bootstrap [USER@]HOSTNAME [JSON] (options)
        --no-berkshelf               Skip berks install
        --bootstrap-version VERSION  The version of Chef to install
    -N, --node-name NAME             The Chef node name for your new node
        --server-url URL             Chef Server URL
        --chef-zero-port PORT        Port to start chef-zero on
    -k, --key KEY                    API Client Key
        --[no-]color                 Use colored output, defaults to false on Windows, true otherwise
    -c, --config CONFIG              The configuration file to use
        --defaults                   Accept default values for all questions
    -d, --disable-editing            Do not open EDITOR, just accept the data as is
    -e, --editor EDITOR              Set the editor to use for interactive commands
    -E, --environment ENVIRONMENT    The Chef environment for your node
        --format FORMAT              Which format to use for output
        --[no-]host-key-verify       Verify host key, enabled by default.
    -i, --identity-file FILE         The ssh identity file
    -j JSON_ATTRIBS,                 A JSON string to be added to node config (if it does not exist)
        --json-attributes
        --no-librarian               Skip librarian-chef install
    -z, --local-mode                 Point knife commands at local repository instead of server
    -u, --user USER                  API Client Username
        --omnibus-options "OPTIONS"  Pass options to the install.sh script
        --omnibus-url URL            URL to download install.sh from
        --omnibus-version VERSION    Deprecated. Replaced with --bootstrap-version.
        --prerelease                 Install the pre-release Chef version
        --print-after                Show the data after a destructive operation
    -r, --run-list RUN_LIST          Comma separated list of roles/recipes to put to node config (if it does not exist)
    -F CONFIG_FILE,                  Alternate location for ssh config file
        --ssh-config-file
        --ssh-identity FILE          Deprecated. Replaced with --identity-file.
    -P, --ssh-password PASSWORD      The ssh password
    -p, --ssh-port PORT              The ssh port
    -x, --ssh-user USERNAME          The ssh username
    -s, --startup-script FILE        The startup script on the remote server containing variable definitions
        --sudo-command SUDO_COMMAND  The command to use instead of sudo for admin privileges
        --sync-only                  Only sync the cookbook - do not run Chef
    -V, --verbose                    More verbose output. Use twice for max verbosity
    -v, --version                    Show chef version
    -W, --why-run                    Enable whyrun mode
    -y, --yes                        Say yes to all prompts for confirmation
    -h, --help                       Show this message

, ( -).

, , chef-. , -.

Update

:

+2

sudo (knife bootstrap , , sudo chef-client).

+1

More articles:


All Articles