环境
- python >= 2.6 && <=2.7
- pip
- cherrypy 3.2.3
- salt-api-0.8.4.1
需要注意的是很多问题都是因为各个软件版本引起的
安装pip
wget https://bootstrap.pypa.io/get-pip.py
python get-pip.py
安装cherrypy
#不指定版本安装到3.6.0后面curl的时候会报 curl: (56) SSL read: errno -12263
pip install cherrypy==3.2.3
安装salt-api
#当前的版本是 0.8.4.1
pip install salt-api
配置自签名证书
cd /etc/pki/tls/certs
make testcert
#Enter pass phrase: 键入加密短语
#Verifying - Enter pass phrase: 确认加密短语
#/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0
#Enter pass phrase for /etc/pki/tls/private/localhost.key: 再次输入相同的加密短语
#Country Name (2 letter code) [XX]:CN
#State or Province Name (full name) []:Fujian
#Locality Name (eg, city) [Default City]:Fuzhou
#Organization Name (eg, company) [Default Company Ltd]:
#Organizational Unit Name (eg, section) []:
#Common Name (eg, your name or your server's hostname) []:
#Email Address []:
cd ../private/
openssl rsa -in localhost.key -out localhost_nopass.key
#Enter pass phrase for localhost.key: 输入之前的加密短语
添加用户
#生产环境请勿使用弱口令
useradd -M -s /sbin/nologin saltapi
passwd saltapi
配置salt-api
mkdir -p /etc/salt/master.d/
cd /etc/salt/master.d/
touch eauth.conf
touch api.conf
#vi eauth.conf
external_auth:
pam:
saltapi: #用户
- .* #该配置文件给予saltapi用户所有模块使用权限，出于安全考虑一般只给予特定模块使用权限
#vi api.conf
rest_cherrypy:
port: 8888
ssl_crt: /etc/pki/tls/certs/localhost.crt
ssl_key: /etc/pki/tls/private/localhost_nopass.key
将salt-api加入服务
#下载alt-api的启动脚本，,在页面https://github.com/saltstack/salt-api/releases下载salt-api的source code tar.gz,启动脚本在解压包的这个位置./pkg/rpm/salt-api
cp salt-api /etc/init.d/salt-api #拷贝至init.d
chmod +x salt-api #
service salt-api start #启动服务
chkconfig salt-api on #开机启动
service salt-master restart
service salt-api restart
验证服务
#获取token
curl -k https://192.168.181.15:8888/login -H "Accept: application/x-yaml" -d username='saltapi' -d password='password' -d eauth='pam'
return:
- eauth: pam expire: 1419027555.6693039 perms:
- .* start: 1418984355.669301 token: ea5fc2131c88c185698e181cc82db380b06068ad user:saltapi
调用test.ping
curl -k https://192.168.181.15:8888/ -H "Accept: application/x-yaml" -H "X-Auth-Token: ea5fc2131c88c185698e181cc82db380b06068ad" -d client='local' -d tgt='*' -d fun='test.ping'
