Cfengine自动化系统管理配置指南

需积分: 9 100 浏览量更新于2024-07-23 收藏 514KB PDF 举报

"cfengine配置手册" Cfengine是一款强大的自动化系统管理工具，与Chef等同类工具类似，用于简化和标准化IT基础设施的管理和维护。它通过定义和执行政策来确保系统的状态符合预期，这些政策涵盖了配置管理、软件部署、系统更新等多个方面。Cfengine的设计理念是提供一个灵活且可扩展的框架，让管理员能够集中控制大规模网络环境中的多台服务器和设备。在Cfengine v2.2.5这个版本中，主要的概念包括： 1. **Promise Theory**：Cfengine的核心是Promise Theory，这是一个理论模型，它描述了系统中各个组件如何通过承诺（promise）来相互协作，以达到期望的状态。每个承诺都定义了一个实体（如文件、服务或进程）的目标状态和实现该状态的行动。 2. **Policy Files**：Cfengine的策略文件（policy files）是用Cfengine语言编写的脚本，它们包含了对系统状态的描述和管理规则。这些文件可以定义主机的配置细节，例如文件权限、服务状态、包安装等，并指定何时和如何进行更改。 3. **Body Classes**：Body classes是Cfengine策略文件中的基本结构，用于组织和分类承诺。常见的body classes有`files`, `services`, `packages`, `commands`等，每个类别的body定义了特定类型的承诺。 4. **Promise Types**：Promise types指定了Cfengine处理系统状态的方式，如`edit`, `ensure`, `present`, `absent`等。例如，`edit`用于修改文件内容，`ensure`用于确保某个服务正在运行。 5. **Promise Resolution**：Cfengine会定期检查系统状态，并对比当前状态与策略文件中的承诺。如果发现不匹配，它会自动执行必要的动作来解决这些差异，即实现承诺。 6. **Policy Server**：Cfengine可以通过中央政策服务器分发和执行策略，这使得在分布式环境中保持一致性变得更加简单。政策服务器可以集中存储和管理策略，而客户端主机定期向服务器拉取并应用策略。 7. **Promise Feedback**：Cfengine提供了详细的反馈机制，报告承诺的执行结果，帮助管理员了解系统的变化和可能的问题。 8. **Version Control**：由于策略文件的重要性，它们通常被纳入版本控制系统，如Git，以跟踪更改历史和协同编辑。 9. **Flexibility and Customization**：Cfengine的灵活性在于它可以适应各种不同的系统管理需求。通过编写自定义的承诺和模块，管理员可以创建高度个性化的解决方案。 10. **Integration**：Cfengine可以与其他IT管理系统集成，如监控工具（Nagios）、日志分析（Logstash）等，实现更全面的自动化运维流程。 Cfengine是企业级系统管理的一个强大工具，通过其基于Promise Theory的模型，提供了高效、可靠的自动化解决方案，使IT管理员能更好地管理和维护复杂网络环境。理解并熟练运用Cfengine的配置手册对于提升IT运维效率至关重要。

14 Cfengine v2 Tutorial

/var/cfengine/bin/cfagent *.example.org

########

# END cfservd.conf

########

2.3.3 Where should I put the ﬁles?

Where should the ﬁles be located? To organize your ﬁles, you should think of three potential

locations, for diﬀerent purposes:

• A version controlled repository for authoring, testing and applying changes to the ﬁles.

Once a version is approved for release, these master ﬁles should be moved on to a

publishing area. e.g. ‘/usr/local/masterfiles/cfengine/inputs’ on ‘masterhost’.

• A centralized location, into which you publish your altered and tested conﬁgurations.

This is the ‘buﬀer’ location from which each client will download new and tested versions

of the master conﬁguration. e.g. ‘/usr/local/masterfiles/cfengine/inputs’ on

‘masterhost’. It acts as a buﬀer between the testing ground and the production location.

• The Work Directory. This is the production location. It is a location that is normally

chosen to be the private directory where cfagent expects to ﬁnd its conﬁguration ﬁles,

‘/var/cfengine/inputs’. Your ‘update.conf’ ﬁle has the job of copying from the

master location (second bullet) above to this location.

Modules and methods are normally kept in a separate directory than inputs ﬁles are

kept in, because they require a directory with special authorizations whe executing. This

is good practice As long as the ‘update.conf’ places the master versions in the correct

location (usually ‘/var/cfengine/modules’) on the local host, all will be okay.

You should not try to copy ﬁles directly from a version controlled repository, as you

might end up sending out an incomplete or partially tested version of the ﬁles to all your

hosts.

# Example update.conf

control:

master_cfinput = ( /usr/local/masterfiles/cfengine/inputs )

workdir = ( /var/cfengine )

copy:

# Copy from bullet 2 to bullet 3

$(master_cfinput) dest=$(workdir)/inputs

r=inf

mode=700

type=binary

exclude=*.lst

exclude=*~

exclude=#*

server=$(policyhost)

trustkey=true

Chapter 2: Getting started 15

$(master_modules) dest=$(workdir)/modules

r=inf

mode=700

type=binary

exclude=*.lst

exclude=*~

exclude=#*

server=$(policyhost)

trustkey=true

2.4 Optional features in cfagent

Cfagent doesn’t do anything unless you ask it to. When you run a cfagent program it

generates no output unless it ﬁnds something it believes to be wrong. It does not carry out

any actions unless they are declared in the action sequence.

If you like, though, you can make cfagent positively chatty. Cfagent can be run with a

number of command line options (see the reference manual). If you run the program with

the ‘-v’ or ‘--verbose’ options, it will supply you cheerily with a resume of what it is doing.

Certain warning messages also get printed in verbose mode, so it is a useful debugging tool.

You can ask cfagent to check lots of things – the timezone for instance, or the domain

name. In order for it to check these things, it needs some information from you. All of the

switches and options which change the way in which cfagent behaves get speciﬁed either

on the command line or in the control: section of the control ﬁle. Some special control

variables are used for this purpose. Here is a short example:

control:

domain = ( example.org )

netmask = ( 255.255.255.0 )

timezone = ( MET CET )

mountpattern = ( /mydomain/mountpoint )

actionsequence =

(

checktimezone # check time zone

netconfig # includes check netmask

resolve # includes domain

mountinfo # look for mounted disks under mountpattern

)

To get verbose output you must run cfagent with the appropriate command line option

‘--verbose’ or ‘-v’.

Notice that setting values has a special kind of syntax: a variable name, an equals sign

and a value in parentheses. This tells you that the quantity of the left hand side assumes

the value on the right hand side. There are lots of questions you might ask at this point.

The answers to these will be covered as we go along and in the next chapter.

Before leaving this brief advertisement for control parameters, it is worth noting the

deﬁnition of mountpattern above. This declares a directory in which cfagent expects to

16 Cfengine v2 Tutorial

ﬁnd mounted disks. It will be explained in detail later, for now notice that this deﬁnition

looks rather stupid and inﬂexible. It would be much better if we could use some kind of

variables to deﬁne where to look for mounted ﬁlesystems. And of course you can...

Having brieﬂy scraped the surface of what cfagent can do, turn to the example and

take a look at what a complete program can look like, (see the reference manual). If you

understand it, you might like to skip through the rest of the manual until you ﬁnd what you

are looking for. If it looks mysterious, then the next chapter should answer some questions

in more depth.

2.5 Invoking cfagent

Cfagent may be invoked in a number of ways. Here are some examples:

host% cfagent

host% cfagent --file myfile

host% cfagent -f myfile -v -n

host% cfagent --help

The ﬁrst of these (the default command, with no arguments) causes cfagent to look for a

ﬁle called ‘cfagent.conf’ in the directory pointed to by the environment variables CFINPUTS

or ‘/var/cfengine/inputs’ by default, and execute it silently. The second command reads

the ﬁle ‘myfile’ and works silently. The third works in verbose mode and the -n option

means that no actions should actually be carried out, only warnings should be printed. The

ﬁnal example causes cfagent to print out a list of its command line options.

The complete list of options is listed in the summary at the beginning of this manual,

or you can see it by giving the -h option, (see the reference manual).

In addition to running cfagent with a ﬁlename, you can also treat cfagent ﬁles as scripts

by starting your cfagent program with the standard shell line:

#!/usr/local/sbin/cfagent -f

# My config script

Here we assume that you have installed cfengine under the directory ‘/usr/local/sbin’.

By adding a header like this to the ﬁrst line of your program and making the ﬁle executable

with the chmod shell command, you can execute the program just by typing its name—i.e.

without mentioning cfengine explicitly at all.

As a novice to cfengine, it is advisable to check all programs with the -n option before

trusting them to your system, at least until you are familiar with the behaviour of cfengine.

This ‘safe’ option allows you to see what cfengine wants to do, without actually committing

yourself to doing it.

Chapter 2: Getting started 17

2.6 Running cfengine permanently, monitoring and

restarting cfexecd

Once you are happy using cfengine, you will want it to run least once per hour on your

systems. This is easily achieved by adding the following line to the root crontab ﬁle of each

system:

0,30 * * * * /usr/local/sbin/cfexecd -F

This is enough to ensure that cfengine will get run. Any output generated by this job,

will be stored in ‘/var/cfengine/outputs’. In addition, if you add the following to the ﬁle

‘cfagent.conf’, the system administrator will be emailed a summary of any output:

control:

smtpserver = ( mailhub.example.org ) # site MTA which can talk smtp

sysadm = ( mark@example.org ) # mail address of sysadm

Fill in suitable values for these variables. An alternative, or additional way to run cfengine,

is to run the ‘cfexecd’ program is daemon mode (without the ‘-F’) option. In this mode, the

daemon lives in the background and sleeps, activating only in accordance with a scheduling

policy. The default policy is to run once every hour (equivalent to Min00_05). Here is

how you would modify ‘cfagent.conf’ in order to make the daemon execute cfagent every

half-hour:

control:

# When should cfexecd in daemon mode wake up the agent?

schedule = ( Min00_05 Min30_35 )

Note that the time speciﬁcations are the basic cfengine time classes, See Section 5.3

[Building ﬂexible time classes], page 60. Although one of these methods should suﬃce,

no harm will arise from running both cron and the cfexecd side-by-side. Cfagents locking

mechanisms ensure that no contention will occur.

The other components of cfengine can be started by cfagent itself:

processes:

"cfenvd" restart "/usr/local/sbin/cfenvd"

"cfservd" restart "/usr/local/sbin/cfservd"

Note that, to start cfexecd by cfengine, one must do this

processes:

"bin/cfexecd$" restart "/usr/local/sbin/cfexecd"

It’s important to use as speciﬁc a regular expression as possible in match statements (the

path to the program and the regular expression metacharacter $ meaning "end of line", in

this example) because bare strings can often match unexpected processes. For instance,

using cfexecd by itself will also match a process spawned by cfagent -F, which shows up

as /var/cfagent/bin/cfagent -Dfrom_cfexecd in the process table!

18 Cfengine v2 Tutorial

2.7 CFINPUTS environment variable

Whenever cfengine looks for a ﬁle it asks a question: is the ﬁlename an absolute name (that

is a name which begins from ‘/’ like /usr/file), is it a ﬁle in the directory in which you

invoke cfengine or is it a ﬁle which should be searched for in a special place?

If you use an absolute ﬁlename either on the command line using -f or in the import

section of your program (a name which begins with a slash ’/’), then cfengine trusts the

name of the ﬁle you have given and treats it literally. If you specify the name of the ﬁle as

simple ‘.’ or ‘-’ then cfengine reads its input from the standard input.

If you run cfengine without arguments (so that the default ﬁlename is ‘cfagent.conf’)

or you specify a ﬁle without a leading slash in the import section, then the value of the

environment variable CFINPUTS is prepended to the start of the ﬁle name. This allows you

to keep your conﬁguration in a standard place, pointed to by CFINPUTS. For example:

host# setenv CFINPUTS /usr/local/masterfiles/cfengine/inputs

host# cfagent -f myfile

In this example, cfengine tries to open ‘myfile’. in the directory ‘/usr/local/masterfiles/cfengine/inputs’.

If no value is set for CFINPUTS, then the default location is the trusted cfengine directory

‘/var/cfengine/inputs’.

2.8 What to aim for

If you are a beginner to cfengine, you might not be certain exactly how you want to use it.

Here are some hints from Dr. Daystrom about how to get things working quickly.

• Run cfengine from cron every hour on all your systems. Be sure to label long tasks, or

tasks which do not need to be performed often by a time class which prevents it from

being executed all the time, See Chapter 5 [Using cfengine as a front-end for cron],

page 59.

Running cfengine from cron means that it will be run in parallel on your systems.

Cfengine on one host does not have to wait for cfengine on another host to complete.

• Set up cfservd on all your systems so that cfengine can be executed remotely, so that

you can immediately “push" changes to all your hosts with cfrun. Think carefully

about whom you wish to give permission to run cfengine from the net, See Section 6.3

[Conﬁguring cfservd], page 68. Set up you ‘cfservd.conf’ ﬁle accordingly. You can

also use this daemon to grant access rights for remote ﬁle copying.

Cfrun polls all your hosts serially and gives you a concatenated indexed list of problems

on all hosts. The disadvantage with cfrun is that each host has to wait its turn.

• Don’t forget to add cfservd to the system startup scripts, or to ‘inittab’ so that it

starts when you boot your system.

• Add all your hosts to the ‘cfrun.hosts’ ﬁle. It does not matter that some may

be master servers and others clients. The locking mechanisms will protect you from

silliness, See Section 6.2.5 [Deadlocks and runaway loops], page 67. Cfengine will work

it out. Cfrun allows you to remotely execute cfengine on groups of hosts which satisfy

a list of cfengine classes.

剩余109页未读，继续阅读

apaul030515

粉丝: 0
资源: 2

Cfengine自动化系统管理配置指南

wx494社区门诊管理系统小程序-php+vue+uniapp.zip（可运行源码+sql文件+文档）

HTML+CSS+JS+JQ+Bootstrap的家具风格趋势展示响应式网页.7z

高分项目，基于Python+OpenCV的实时疲劳驾驶检测系统，内含源码+演示视频+部署教程

ansible使用手册

Ansible-中文手册

pdsh 使用手册指南

ansible自动化运维手册

puppet最经典中文手册资料

assible集成tar包安装 内附安装手册

CFengine 3中文手册：系统自动化与策略配置详解

最新资源

assible集成tar包安装内附安装手册