SSH 推送联系方法

SSH Push (ssh-push) is used in environments where Salt clients cannot reach the SUSE Multi-Linux Manager Server directly. In this environment, clients are located in a firewall-protected zone called a DMZ. No system within the DMZ is authorized to open a connection to the internal network where the SUSE Multi-Linux Manager Server is located.

SSH 推送仅打开从 SUSE Multi-Linux Manager 到客户端的隧道，但反向通道会直接禁用。这种方法可能并非适用于所有情况。因此，还可以使用 SSH 推送（利用隧道）这种联系方法。该方法还会打开反向隧道，因此您可以穿越所有防火墙进行通信，如果没有反向隧道，这些防火墙可能会阻止从客户端到服务器的连接。

如果无法在客户端上安装守护程序代理，也可以使用 SSH 推送。

The SSH Push method has serious limitations. It does not scale well, and consumes more Server resources and network bandwidth than the plain Salt method (default). The Push SSH method is not at all supported with large setups (1000 clients and more).

服务器使用 SSH 推送来定期联系客户端，以签入和执行安排的操作和事件。

在使用 SSH 推送方法管理的客户端上，目前不支持使用置备模式重新安装系统。

This image demonstrates the SSH Push process path. All items left of the Taskomatic block represent processes running on the SUSE Multi-Linux Manager client.

salt ssh contact taigon

To use SSH Push, you must have the SSH daemon running on the client, and reachable by the salt-api daemon running on the SUSE Multi-Linux Manager Server. Additionally, the required Python version will be deployed with the Salt Bundle on the client system.

在开始执行以下注册过程之前，请先在配置了 SSH 推送联系方法的情况下定义一个激活密钥。此方法要求与服务器建立 HTTPS 直接连接。

需要使用 Web UI 或 API 将这些客户端注册到 SUSE Multi-Linux Manager 服务器。请参见以下过程或示例。

过程：使用 SSH 推送注册客户端

  1. 在 SUSE Multi-Linux Manager Web UI 中，导航到系统  引导，然后填写相应的字段。

  2. 选择一个配置了 SSH 推送联系方法的激活密钥。有关激活密钥的详细信息，请参见 激活密钥。

  3. Check the Manage system completely via SSH checkbox.

  4. 单击 Bootstrap 开始注册。

  5. 导航到系统  概览，确认该系统已正确注册。

示例：通过 API 使用 SSH 推送方法

You can use the API to manage which contact method to use. This example Python code sets the contact method to ssh-push.

有效值为：

  • default (pull)

  • ssh-push

  • ssh-push-tunnel

client = xmlrpclib.Server(MLM_HOST + "/rpc/api", verbose=0)
key = client.auth.login(MLM_LOGIN, MLM_PASSWORD)
client.system.setDetails(key, 1000012345, {'contact_method' : 'ssh-push'})

1. 可用参数

如果您要配置通过 SSH 推送，可以修改注册系统时使用的参数，包括主机、激活密钥和口令。口令只能用于引导，不会保存在任何位置。所有将来的 SSH 会话均通过密钥/证书对获得授权。这些参数在系统  引导中配置。

您也可以配置在系统范围使用的持久性参数，包括配置 sudo 用户来以非特权用户而不是 root 身份访问系统。

Use mgrctl term before running steps inside the server container.
过程：配置非特权 SSH 访问

  1. Ensure you have the latest spacewalk-taskomatic and spacewalk-certs-tools packages installed on the SUSE Multi-Linux Manager Server.

  2. 在每个客户端系统上，创建相应的非特权用户。

  3. On each client system, edit the sudoers file:

    sudo visudo

  4. Grant sudo access to the user by adding this line at the end of the sudoers file. Replace <user> with the name of the user that is bootstrapping the client in the Web UI:

    <user>  ALL=NOPASSWD: /usr/bin/python3, /var/tmp/venv-salt-minion/bin/python

    This procedure grants root access without requiring a password, which is required for registering the client. When the client is successfully installed it runs with root privileges, so the access is no longer required. We recommend that you remove the line from the sudoers file after the client has been successfully installed.

  5. Inside the SUSE Multi-Linux Manager Server container, edit the /etc/rhn/rhn.conf configuration file, and add or amend this line to include the unprivileged username:

    ssh_push_sudo_user = <user>

  6. After changing this configuration parameter you must restart services such as salt-secrets-config.service, tomcat.service, and taskomatic.service. 为了涵盖所需的全部服务，最好以 root 身份重启 SUSE Multi-Linux Manager 服务器。在容器主机（在容器外部）上输入：

    mgradm restart

2. 操作的执行

The SSH Push feature uses taskomatic to execute scheduled actions using salt-ssh. The taskomatic job periodically checks for scheduled actions and executes them. The SSH Push feature executes a complete salt-ssh call based on the scheduled action.

By default, twenty Salt SSH actions can be executed at a time. You can increase the number of actions that can be executed in parallel, by adding these lines to your configuration file, and adjusting the value of parallel_threads upwards. We recommend you keep the number of parallel actions low, to avoid problems:

taskomatic.sshminion_action_executor.parallel_threads = <number>
org.quartz.threadPool.threadCount = <value of parallel_threads + 20>

这样可调整任何客户端上同时运行的操作数，以及 taskomatic 使用的工作器线程总数。如果需要在多个客户端上运行操作，则每个客户端上的操作始终按顺序执行。

If the clients are connected through a proxy, you need to adjust the MaxSessions settings on the proxy. In this case, set the number of parallel connections to be three times the total number of clients.

3. 未来的功能

SSH 推送目前尚不受支持某些功能。这些功能在 Salt SSH 客户端上不可用：

  • OpenSCAP 审计

  • 导致以下事件的信标：

    • Installing a package on a system using zypper does not invoke the package refresh.

    • 如果虚拟主机系统基于 Salt SSH，则虚拟主机功能（例如 Guest 主机）将无法正常工作。

更多信息：