【30分で動かすシリーズ】FabricでOpenSSL祭に対応してみる

記事タイトルとURLをコピーする

先日、OpenSSLに脆弱性が見つかり対応する必要がありました。
対応すると言っても一言でいえばOpenSSLを更新すれば良いのですが、対象のサーバが何十台、何百台あると大変です。 
いわゆる刺身タンポポな作業になります。
人生は有限です。機械に任せられるところは任せてさっさとビールでも飲みたいものです。
「機械に任せて」の部分をFabricでやってみます。 
FablicLogo

 

Fabricとは

公式サイトはこちらになります。
公式サイトを開くとすぐ動作例が書かれています。 
一言で雑に言いますと「すげぇSSH」です。

 

今回の想定

複数台のサーバのOpenSSLを更新する、とします。
対象のサーバには手動でsshできる環境があるとします。
「複数台のサーバそれぞれにsshログインしてOpenSSLを更新して、サーバを再起動させる」 を手動で行うところをFabricを使って自動化しましょうという内容になります。

Fabricのインストール

FabricはPythonで動きます。Pythonが動く環境でしたら下記を実行するだけでFabricが動くようになります。

pip install fabric

 

タスクを書く

OpenSSLを更新するために「yum -y update openssl」して終わったら再起動する内容です。

$ vi opensslup.py
#coding:utf-8
from fabric.api import env, run, sudo
from fabric.contrib.console import confirm

env.use_ssh_config = True

def yum_update_openssl():
    sudo('yum -y update openssl',user='root', pty=True)
    sudo('reboot', user='root', pty=True)

env.use_ssh_config」は対象にsshするときに~/.ssh/configを見に行くようにするためです。
これを書いておくと手動でsshするときの設定を利用でき、Fabricを実行するための設定を書かなくてよいという利点があります。

 

動かしてみる

今回の対象はRedhat Enterprise Linuxを使ってみます。
テストとしてAWSから提供されているRHEL6.5のAMIから2台ラウンチしておきます。
それが「RHEL-Test-A」および「RHEL-Test-B」になります。ターミナルで「ssh RHEL-Test-A」とすると接続できる感じです。

何をしているかを出力するようにしていますので、がんばっている感が分かります。

$ fab -H RHEL-Test-A,RHEL-Test-B -f ./opensslup.py yum_update_openssl
[RHEL-Test-A] Executing task 'yum_update_openssl'
[RHEL-Test-A] sudo: yum -y update openssl
[RHEL-Test-A] out: Loaded plugins: amazon-id, rhui-lb, security
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-client-config-server-6                                                                                        | 2.9 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-client-config-server-6/primary_db                                                                             | 3.4 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases                                                                                          | 3.7 kB     00:00
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db               34% [================                                ]  0.0 B/s | 9.1 MB     --:-- ETA
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db               69% [=================================               ]  15 MB/s |  18 MB     00:00 ETA
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db                                                                               |  26 MB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases-optional                                                                                 | 3.5 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-releases-optional/primary_db                                                                      | 2.7 MB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-rh-common                                                                                         | 2.9 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-rh-common/primary_db                                                                              |  14 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-rhscl                                                                                             | 3.1 kB     00:00
[RHEL-Test-A] out:
[RHEL-Test-A] out: rhui-REGION-rhel-server-rhscl/primary_db                                                                                  | 577 kB     00:00
[RHEL-Test-A] out: Setting up Update Process
[RHEL-Test-A] out: Resolving Dependencies
[RHEL-Test-A] out: --> Running transaction check
[RHEL-Test-A] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.7 will be updated
[RHEL-Test-A] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.14 will be an update
[RHEL-Test-A] out: --> Finished Dependency Resolution
[RHEL-Test-A] out:
[RHEL-Test-A] out: Dependencies Resolved
[RHEL-Test-A] out:
[RHEL-Test-A] out: =================================================================================================================================================
[RHEL-Test-A] out:  Package                  Arch                    Version                                Repository                                         Size
[RHEL-Test-A] out: =================================================================================================================================================
[RHEL-Test-A] out: Updating:
[RHEL-Test-A] out:  openssl                  x86_64                  1.0.1e-16.el6_5.14                     rhui-REGION-rhel-server-releases                  1.5 M
[RHEL-Test-A] out:
[RHEL-Test-A] out: Transaction Summary
[RHEL-Test-A] out: =================================================================================================================================================
[RHEL-Test-A] out: Upgrade       1 Package(s)
[RHEL-Test-A] out:
[RHEL-Test-A] out: Total download size: 1.5 M
[RHEL-Test-A] out: Downloading Packages:
[RHEL-Test-A] out:
[RHEL-Test-A] out: openssl-1.0.1e-16.el6_5.14.x86_64.rpm                                                                                     | 1.5 MB     00:00
[RHEL-Test-A] out: Running rpm_check_debug
[RHEL-Test-A] out: Running Transaction Test
[RHEL-Test-A] out: Transaction Test Succeeded
[RHEL-Test-A] out: Running Transaction
[RHEL-Test-A] out:
[RHEL-Test-A] out:   Updating   : openssl-1.0.1e-16.el6_5.14.x86_64 [######################################################################################## ] 1/2
[RHEL-Test-A] out:   Updating   : openssl-1.0.1e-16.el6_5.14.x86_64                                                                                             1/2
[RHEL-Test-A] out:
[RHEL-Test-A] out:   Cleanup    : openssl-1.0.1e-16.el6_5.7.x86_64                                                                                              2/2
[RHEL-Test-A] out:
[RHEL-Test-A] out:   Verifying  : openssl-1.0.1e-16.el6_5.14.x86_64                                                                                             1/2
[RHEL-Test-A] out:
[RHEL-Test-A] out:   Verifying  : openssl-1.0.1e-16.el6_5.7.x86_64                                                                                              2/2
[RHEL-Test-A] out:
[RHEL-Test-A] out: Updated:
[RHEL-Test-A] out:   openssl.x86_64 0:1.0.1e-16.el6_5.14
[RHEL-Test-A] out:
[RHEL-Test-A] out: Complete!
[RHEL-Test-A] out:

[RHEL-Test-A] sudo: reboot
[RHEL-Test-A] out:
[RHEL-Test-A] out:
[RHEL-Test-A] out: Broadcast message from ec2-user@ip-10-0-30-222
[RHEL-Test-A] out:
[RHEL-Test-A] out:  (/dev/pts/0) at 0:12 ...
[RHEL-Test-A] out:
[RHEL-Test-A] out:
[RHEL-Test-A] out:
[RHEL-Test-A] out:
[RHEL-Test-A] out: The system is going down for reboot NOW!
[RHEL-Test-A] out:
[RHEL-Test-A] out:

[RHEL-Test-B] Executing task 'yum_update_openssl'
[RHEL-Test-B] sudo: yum -y update openssl
[RHEL-Test-B] out: Loaded plugins: amazon-id, rhui-lb, security
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-client-config-server-6                                                                                        | 2.9 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-client-config-server-6/primary_db                                                                             | 3.4 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases                                                                                          | 3.7 kB     00:00
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db               20% [=========-                                      ]  0.0 B/s | 5.5 MB     --:-- ETA
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db               44% [=====================                           ]  11 MB/s |  12 MB     00:01 ETA
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db               69% [=================================               ]  11 MB/s |  18 MB     00:00 ETA
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db               94% [=============================================   ]  12 MB/s |  25 MB     00:00 ETA
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db                                                                               |  26 MB     00:01
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases-optional                                                                                 | 3.5 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-releases-optional/primary_db                                                                      | 2.7 MB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-rh-common                                                                                         | 2.9 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-rh-common/primary_db                                                                              |  14 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-rhscl                                                                                             | 3.1 kB     00:00
[RHEL-Test-B] out:
[RHEL-Test-B] out: rhui-REGION-rhel-server-rhscl/primary_db                                                                                  | 577 kB     00:00
[RHEL-Test-B] out: Setting up Update Process
[RHEL-Test-B] out: Resolving Dependencies
[RHEL-Test-B] out: --> Running transaction check
[RHEL-Test-B] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.7 will be updated
[RHEL-Test-B] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.14 will be an update
[RHEL-Test-B] out: --> Finished Dependency Resolution
[RHEL-Test-B] out:
[RHEL-Test-B] out: Dependencies Resolved
[RHEL-Test-B] out:
[RHEL-Test-B] out: =================================================================================================================================================
[RHEL-Test-B] out:  Package                  Arch                    Version                                Repository                                         Size
[RHEL-Test-B] out: =================================================================================================================================================
[RHEL-Test-B] out: Updating:
[RHEL-Test-B] out:  openssl                  x86_64                  1.0.1e-16.el6_5.14                     rhui-REGION-rhel-server-releases                  1.5 M
[RHEL-Test-B] out:
[RHEL-Test-B] out: Transaction Summary
[RHEL-Test-B] out: =================================================================================================================================================
[RHEL-Test-B] out: Upgrade       1 Package(s)
[RHEL-Test-B] out:
[RHEL-Test-B] out: Total download size: 1.5 M
[RHEL-Test-B] out: Downloading Packages:
[RHEL-Test-B] out:
[RHEL-Test-B] out: openssl-1.0.1e-16.el6_5.14.x86_64.rpm                                                                                     | 1.5 MB     00:00
[RHEL-Test-B] out: Running rpm_check_debug
[RHEL-Test-B] out: Running Transaction Test
[RHEL-Test-B] out: Transaction Test Succeeded
[RHEL-Test-B] out: Running Transaction
[RHEL-Test-B] out:
[RHEL-Test-B] out:   Updating   : openssl-1.0.1e-16.el6_5.14.x86_64 [######################################################################################## ] 1/2
[RHEL-Test-B] out:   Updating   : openssl-1.0.1e-16.el6_5.14.x86_64                                                                                             1/2
[RHEL-Test-B] out:
[RHEL-Test-B] out:   Cleanup    : openssl-1.0.1e-16.el6_5.7.x86_64                                                                                              2/2
[RHEL-Test-B] out:
[RHEL-Test-B] out:   Verifying  : openssl-1.0.1e-16.el6_5.14.x86_64                                                                                             1/2
[RHEL-Test-B] out:
[RHEL-Test-B] out:   Verifying  : openssl-1.0.1e-16.el6_5.7.x86_64                                                                                              2/2
[RHEL-Test-B] out:
[RHEL-Test-B] out: Updated:
[RHEL-Test-B] out:   openssl.x86_64 0:1.0.1e-16.el6_5.14
[RHEL-Test-B] out:
[RHEL-Test-B] out: Complete!
[RHEL-Test-B] out:

[RHEL-Test-B] sudo: reboot
[RHEL-Test-B] out:
[RHEL-Test-B] out:
[RHEL-Test-B] out: Broadcast message from ec2-user@ip-10-0-40-40
[RHEL-Test-B] out:
[RHEL-Test-B] out:  (/dev/pts/0) at 0:12 ...
[RHEL-Test-B] out:
[RHEL-Test-B] out:
[RHEL-Test-B] out:
[RHEL-Test-B] out:
[RHEL-Test-B] out: The system is going down for reboot NOW!
[RHEL-Test-B] out:
[RHEL-Test-B] out:


Done.
Disconnecting from ec2-user@54.199.21X.XXX... done.
Disconnecting from ec2-user@54.199.22X.XXX... done.


対象2台はt1.microでラウンチして実行時間は1分ほどでした。手動でやるとどのくらいかかるでしょうね。早くビールが飲めますね。

 

まとめ

「自動化」と言いますと最近ではChefで!という流れがありますが、こういうツールもあるよというご紹介でした。(今更ではあります)
「これって自動化できないかな?」と考えながら作業するのは大事、同じことを3回やるようになったら自動化を検討しましょう。2回でもいいです。
当然、タスクの内容はいろいろ書けます。「これってどうやれば?」と思ったらググれば出てきます。
何か自動化したいなぁと思ったときFabricを思い出していただけると幸いです。