python-----Bastion Host前戲paramiko模組

標籤：指令碼   sel   pcl   ssh   /tmp   sftp   fga   elf   upload   

Bastion Host前戲

開發Bastion Host之前，先來學習Python的paramiko模組，該模組機遇SSH用於串連遠程伺服器並執行相關操作

SSHClient

用於串連遠程伺服器並執行基本命令

基於使用者名稱密碼串連：

import paramiko  # 建立SSH對象ssh = paramiko.SSHClient()# 允許串連不在know_hosts檔案中的主機ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())# 串連伺服器ssh.connect(hostname=‘c1.salt.com‘, port=22, username=‘wupeiqi‘, password=‘123‘)  # 執行命令stdin, stdout, stderr = ssh.exec_command(‘df‘)# 擷取命令結果result = stdout.read()  # 關閉串連ssh.close()

View Code

import paramikotransport = paramiko.Transport((‘hostname‘, 22))transport.connect(username=‘wupeiqi‘, password=‘123‘)ssh = paramiko.SSHClient()ssh._transport = transportstdin, stdout, stderr = ssh.exec_command(‘df‘)print stdout.read()transport.close()

SSHClient 封裝 Transport

基於公開金鑰密鑰串連：

import paramiko private_key = paramiko.RSAKey.from_private_key_file(‘/home/auto/.ssh/id_rsa‘) # 建立SSH對象ssh = paramiko.SSHClient()# 允許串連不在know_hosts檔案中的主機ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())# 串連伺服器ssh.connect(hostname=‘c1.salt.com‘, port=22, username=‘wupeiqi‘, key=private_key) # 執行命令stdin, stdout, stderr = ssh.exec_command(‘df‘)# 擷取命令結果result = stdout.read() # 關閉串連ssh.close()

View Code

import paramikoprivate_key = paramiko.RSAKey.from_private_key_file(‘/home/auto/.ssh/id_rsa‘)transport = paramiko.Transport((‘hostname‘, 22))transport.connect(username=‘wupeiqi‘, pkey=private_key)ssh = paramiko.SSHClient()ssh._transport = transportstdin, stdout, stderr = ssh.exec_command(‘df‘)transport.close()SSHClient 封裝 Transport

SSHClient 封裝 Transport

import paramikofrom io import StringIOkey_str = """-----BEGIN RSA PRIVATE KEY-----MIIEpQIBAAKCAQEAq7gLsqYArAFco02/55IgNg0r7NXOtEM3qXpb/dabJ5Uyky/8NEHhFiQ7deHIRIuTW5Zb0kD6h6EBbVlUMBmwJrC2oSzySLU1w+ZNfH0PE6W6fansH80whhuc/YgP+fjiO+VR/gFcqib8Rll5UfYzf5H8uuOnDeIXGCVgyHQSmt8if1+e7hn1MVO1Lrm9Fco8ABI7dyv8/ZEwoSfh2C9rGYgA58LT1FkBRkOePbHD43xNfAYCtfLvz6LErMnwdOW4sNMEWWAWv1fsTB35PAm5CazfKzmam9n5IQXhmUNcNvmaZtvPc4f4g59mdsaWNtNaY96UjOfx83Om86gmdkKcnwIDAQABAoIBAQCnDBGFJuv8aA7AZkBLe+GN815JtOyye7lIS1n2I7En3oImoUWNaJEYwwJ8+LmjxMwDCtAkR0XwbvY+c+nsKPEtkjb3sAu6I148RmwWsGncSRqUaJrljOypaW9dS+GO4Ujjz3/lw1lrxSUhIqVc0E7kyRW8kP3QCaNBwArYteHreZFFp6XmtKMtXaEA3saJYILxaaXlYkoRi4k8S2/K8aw3ZMR4tDCOfB4o47JaeiA/e185RK3A+mLn9xTDhTdZqTQpv17/YRPcgmwzzu30fhVXQT/SuI0sO+bzCO4YGoEwoBX718AWhdLJFoFq1B7k2ZEzXTAtjEXQEWm601ndU/jhAasdfasdasdfasdfa3eraszxqwefasdfadasdffsFIfAsjQb4HdkmHuCOeJrJOd+CYvdEeqJJNnF6AbHyYHIECkj0Qq1kEfLOEsqzd5nDbtkKBte6M1trbjlHtJ2Yb8w6o/q/6Sbj7wf/cW3LIYEdeVCjScozVcQ9R83ea05J+QOAr4nAoGBAMaqUzLJfLNWZ5Qosmir2oHStFlZpxspax/ln7DlWLW4wPB4YJalSVovF2Buo8hr8X65lnPiE41M+G0Z7icEXiFyDBFDCtzx0x/RmaBokLathrFtI81UCx4gQPLaSVNMlvQA539GsubSrO4LpHRNGg/weZ6EqQOXvHvkUkm2bDDJAoGATytFNxen6GtC0ZT3SRQMWYfasdf3xbtuykmnluiofasd2sfmjnljkt7khghmghdasSDFGQfgaFoKfaawoYeHC2XasVUsVviBn8kPSLSVBPX4JUfQmA6h8HsajeVahxN1U9e0nYJ0sYDQFUMTS2t8RT57+WK/0ONwTWHdu+KnaJECgYEAid/ta8LQC3p82iNAZkpWlGDSD2yb/8rH8NQg9tjEryFwrbMtfX9qn+8srx06B796U3OjifstjJQNmVI0qNlsJpQK8fPwVxRxbJS/pMbNICrf3sUa4sZgDOFfkeuSlgACh4cVIozDXlR59Z8Y3CoiW0uObEgvMDIfenAj98pl3ZkCgYEAj/UCSni0dwX4pnKNPm6LUgiS7QvIgM3H9piyt8aipQuzBi5LUKWwDlQC4Zb73nHgdREtQYYXTu7p27Bl0Gizz1sW2eSgxFU8eTh+ucfVwOXKAXKU5SeI+MbuBfUYQ4if2N/BXn47+/ecf3A4KgB37Le5SbLDddwCNxGlBzbpBa0=-----END RSA PRIVATE KEY-----"""private_key = paramiko.RSAKey(file_obj=StringIO(key_str))transport = paramiko.Transport((‘10.0.1.40‘, 22))transport.connect(username=‘wupeiqi‘, pkey=private_key)ssh = paramiko.SSHClient()ssh._transport = transportstdin, stdout, stderr = ssh.exec_command(‘df‘)result = stdout.read()transport.close()print(result)基於私密金鑰字串進行串連

基於私密金鑰字串進行串連

SFTPClient

用於串連遠程伺服器並執行上傳下載

基於使用者名稱密碼上傳下載

import paramiko transport = paramiko.Transport((‘hostname‘,22))transport.connect(username=‘wupeiqi‘,password=‘123‘) sftp = paramiko.SFTPClient.from_transport(transport)# 將location.py 上傳至伺服器 /tmp/test.pysftp.put(‘/tmp/location.py‘, ‘/tmp/test.py‘)# 將remove_path 下載到本地 local_pathsftp.get(‘remove_path‘, ‘local_path‘) transport.close()

View Code

基於公開金鑰密鑰上傳下載

import paramiko private_key = paramiko.RSAKey.from_private_key_file(‘/home/auto/.ssh/id_rsa‘) transport = paramiko.Transport((‘hostname‘, 22))transport.connect(username=‘wupeiqi‘, pkey=private_key ) sftp = paramiko.SFTPClient.from_transport(transport)# 將location.py 上傳至伺服器 /tmp/test.pysftp.put(‘/tmp/location.py‘, ‘/tmp/test.py‘)# 將remove_path 下載到本地 local_pathsftp.get(‘remove_path‘, ‘local_path‘) transport.close()

View Code

#!/usr/bin/env python# -*- coding:utf-8 -*-import paramikoimport uuidclass Haproxy(object):    def __init__(self):        self.host = ‘172.16.103.191‘        self.port = 22        self.username = ‘wupeiqi‘        self.pwd = ‘123‘        self.__k = None    def create_file(self):        file_name = str(uuid.uuid4())        with open(file_name,‘w‘) as f:            f.write(‘sb‘)        return file_name    def run(self):        self.connect()        self.upload()        self.rename()        self.close()    def connect(self):        transport = paramiko.Transport((self.host,self.port))        transport.connect(username=self.username,password=self.pwd)        self.__transport = transport    def close(self):        self.__transport.close()    def upload(self):        # 串連，上傳        file_name = self.create_file()        sftp = paramiko.SFTPClient.from_transport(self.__transport)        # 將location.py 上傳至伺服器 /tmp/test.py        sftp.put(file_name, ‘/home/wupeiqi/tttttttttttt.py‘)    def rename(self):        ssh = paramiko.SSHClient()        ssh._transport = self.__transport        # 執行命令        stdin, stdout, stderr = ssh.exec_command(‘mv /home/wupeiqi/tttttttttttt.py /home/wupeiqi/ooooooooo.py‘)        # 擷取命令結果        result = stdout.read()ha = Haproxy()ha.run()Demo

DemoBastion Host的實現 

 

Bastion Host執行流程：

1. 管理員為使用者在伺服器上建立帳號（將公開金鑰放置伺服器，或者使用使用者名稱密碼）
2. 使用者登陸Bastion Host，輸入Bastion Host使用者名稱密碼，現實目前使用者管理的伺服器列表
3. 使用者選擇伺服器，並自動登陸
4. 執行操作並同時將使用者操作記錄

註：配置.brashrc實現ssh登陸後自動執行指令碼，如：/usr/bin/python /home/wupeiqi/menu.py

實現過程

步驟一，實現使用者登陸

 

python-----Bastion Host前戲paramiko模組