先日、OpenSSLに脆弱性が見つかり対応する必要がありました。
対応すると言っても一言でいえばOpenSSLを更新すれば良いのですが、対象のサーバが何十台、何百台あると大変です。
いわゆる刺身タンポポな作業になります。
人生は有限です。機械に任せられるところは任せてさっさとビールでも飲みたいものです。
「機械に任せて」の部分をFabricでやってみます。
Fabricとは
公式サイトはこちらになります。
公式サイトを開くとすぐ動作例が書かれています。
一言で雑に言いますと「すげぇSSH」です。
今回の想定
複数台のサーバのOpenSSLを更新する、とします。
対象のサーバには手動でsshできる環境があるとします。
「複数台のサーバそれぞれにsshログインしてOpenSSLを更新して、サーバを再起動させる」 を手動で行うところをFabricを使って自動化しましょうという内容になります。
Fabricのインストール
FabricはPythonで動きます。Pythonが動く環境でしたら下記を実行するだけでFabricが動くようになります。
pip install fabric
タスクを書く
OpenSSLを更新するために「yum -y update openssl」して終わったら再起動する内容です。
$ vi opensslup.py #coding:utf-8 from fabric.api import env, run, sudo from fabric.contrib.console import confirm env.use_ssh_config = True def yum_update_openssl(): sudo('yum -y update openssl',user='root', pty=True) sudo('reboot', user='root', pty=True)
「env.use_ssh_config」は対象にsshするときに~/.ssh/configを見に行くようにするためです。
これを書いておくと手動でsshするときの設定を利用でき、Fabricを実行するための設定を書かなくてよいという利点があります。
動かしてみる
今回の対象はRedhat Enterprise Linuxを使ってみます。
テストとしてAWSから提供されているRHEL6.5のAMIから2台ラウンチしておきます。
それが「RHEL-Test-A」および「RHEL-Test-B」になります。ターミナルで「ssh RHEL-Test-A」とすると接続できる感じです。
何をしているかを出力するようにしていますので、がんばっている感が分かります。
$ fab -H RHEL-Test-A,RHEL-Test-B -f ./opensslup.py yum_update_openssl [RHEL-Test-A] Executing task 'yum_update_openssl' [RHEL-Test-A] sudo: yum -y update openssl [RHEL-Test-A] out: Loaded plugins: amazon-id, rhui-lb, security [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-client-config-server-6 | 2.9 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-client-config-server-6/primary_db | 3.4 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-releases | 3.7 kB 00:00 [RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db 34% [================ ] 0.0 B/s | 9.1 MB --:-- ETA [RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db 69% [================================= ] 15 MB/s | 18 MB 00:00 ETA [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-releases/primary_db | 26 MB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-releases-optional | 3.5 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-releases-optional/primary_db | 2.7 MB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-rh-common | 2.9 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-rh-common/primary_db | 14 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-rhscl | 3.1 kB 00:00 [RHEL-Test-A] out: [RHEL-Test-A] out: rhui-REGION-rhel-server-rhscl/primary_db | 577 kB 00:00 [RHEL-Test-A] out: Setting up Update Process [RHEL-Test-A] out: Resolving Dependencies [RHEL-Test-A] out: --> Running transaction check [RHEL-Test-A] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.7 will be updated [RHEL-Test-A] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.14 will be an update [RHEL-Test-A] out: --> Finished Dependency Resolution [RHEL-Test-A] out: [RHEL-Test-A] out: Dependencies Resolved [RHEL-Test-A] out: [RHEL-Test-A] out: ================================================================================================================================================= [RHEL-Test-A] out: Package Arch Version Repository Size [RHEL-Test-A] out: ================================================================================================================================================= [RHEL-Test-A] out: Updating: [RHEL-Test-A] out: openssl x86_64 1.0.1e-16.el6_5.14 rhui-REGION-rhel-server-releases 1.5 M [RHEL-Test-A] out: [RHEL-Test-A] out: Transaction Summary [RHEL-Test-A] out: ================================================================================================================================================= [RHEL-Test-A] out: Upgrade 1 Package(s) [RHEL-Test-A] out: [RHEL-Test-A] out: Total download size: 1.5 M [RHEL-Test-A] out: Downloading Packages: [RHEL-Test-A] out: [RHEL-Test-A] out: openssl-1.0.1e-16.el6_5.14.x86_64.rpm | 1.5 MB 00:00 [RHEL-Test-A] out: Running rpm_check_debug [RHEL-Test-A] out: Running Transaction Test [RHEL-Test-A] out: Transaction Test Succeeded [RHEL-Test-A] out: Running Transaction [RHEL-Test-A] out: [RHEL-Test-A] out: Updating : openssl-1.0.1e-16.el6_5.14.x86_64 [######################################################################################## ] 1/2 [RHEL-Test-A] out: Updating : openssl-1.0.1e-16.el6_5.14.x86_64 1/2 [RHEL-Test-A] out: [RHEL-Test-A] out: Cleanup : openssl-1.0.1e-16.el6_5.7.x86_64 2/2 [RHEL-Test-A] out: [RHEL-Test-A] out: Verifying : openssl-1.0.1e-16.el6_5.14.x86_64 1/2 [RHEL-Test-A] out: [RHEL-Test-A] out: Verifying : openssl-1.0.1e-16.el6_5.7.x86_64 2/2 [RHEL-Test-A] out: [RHEL-Test-A] out: Updated: [RHEL-Test-A] out: openssl.x86_64 0:1.0.1e-16.el6_5.14 [RHEL-Test-A] out: [RHEL-Test-A] out: Complete! [RHEL-Test-A] out: [RHEL-Test-A] sudo: reboot [RHEL-Test-A] out: [RHEL-Test-A] out: [RHEL-Test-A] out: Broadcast message from ec2-user@ip-10-0-30-222 [RHEL-Test-A] out: [RHEL-Test-A] out: (/dev/pts/0) at 0:12 ... [RHEL-Test-A] out: [RHEL-Test-A] out: [RHEL-Test-A] out: [RHEL-Test-A] out: [RHEL-Test-A] out: The system is going down for reboot NOW! [RHEL-Test-A] out: [RHEL-Test-A] out: [RHEL-Test-B] Executing task 'yum_update_openssl' [RHEL-Test-B] sudo: yum -y update openssl [RHEL-Test-B] out: Loaded plugins: amazon-id, rhui-lb, security [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-client-config-server-6 | 2.9 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-client-config-server-6/primary_db | 3.4 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-releases | 3.7 kB 00:00 [RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db 20% [=========- ] 0.0 B/s | 5.5 MB --:-- ETA [RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db 44% [===================== ] 11 MB/s | 12 MB 00:01 ETA [RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db 69% [================================= ] 11 MB/s | 18 MB 00:00 ETA [RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db 94% [============================================= ] 12 MB/s | 25 MB 00:00 ETA [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-releases/primary_db | 26 MB 00:01 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-releases-optional | 3.5 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-releases-optional/primary_db | 2.7 MB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-rh-common | 2.9 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-rh-common/primary_db | 14 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-rhscl | 3.1 kB 00:00 [RHEL-Test-B] out: [RHEL-Test-B] out: rhui-REGION-rhel-server-rhscl/primary_db | 577 kB 00:00 [RHEL-Test-B] out: Setting up Update Process [RHEL-Test-B] out: Resolving Dependencies [RHEL-Test-B] out: --> Running transaction check [RHEL-Test-B] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.7 will be updated [RHEL-Test-B] out: ---> Package openssl.x86_64 0:1.0.1e-16.el6_5.14 will be an update [RHEL-Test-B] out: --> Finished Dependency Resolution [RHEL-Test-B] out: [RHEL-Test-B] out: Dependencies Resolved [RHEL-Test-B] out: [RHEL-Test-B] out: ================================================================================================================================================= [RHEL-Test-B] out: Package Arch Version Repository Size [RHEL-Test-B] out: ================================================================================================================================================= [RHEL-Test-B] out: Updating: [RHEL-Test-B] out: openssl x86_64 1.0.1e-16.el6_5.14 rhui-REGION-rhel-server-releases 1.5 M [RHEL-Test-B] out: [RHEL-Test-B] out: Transaction Summary [RHEL-Test-B] out: ================================================================================================================================================= [RHEL-Test-B] out: Upgrade 1 Package(s) [RHEL-Test-B] out: [RHEL-Test-B] out: Total download size: 1.5 M [RHEL-Test-B] out: Downloading Packages: [RHEL-Test-B] out: [RHEL-Test-B] out: openssl-1.0.1e-16.el6_5.14.x86_64.rpm | 1.5 MB 00:00 [RHEL-Test-B] out: Running rpm_check_debug [RHEL-Test-B] out: Running Transaction Test [RHEL-Test-B] out: Transaction Test Succeeded [RHEL-Test-B] out: Running Transaction [RHEL-Test-B] out: [RHEL-Test-B] out: Updating : openssl-1.0.1e-16.el6_5.14.x86_64 [######################################################################################## ] 1/2 [RHEL-Test-B] out: Updating : openssl-1.0.1e-16.el6_5.14.x86_64 1/2 [RHEL-Test-B] out: [RHEL-Test-B] out: Cleanup : openssl-1.0.1e-16.el6_5.7.x86_64 2/2 [RHEL-Test-B] out: [RHEL-Test-B] out: Verifying : openssl-1.0.1e-16.el6_5.14.x86_64 1/2 [RHEL-Test-B] out: [RHEL-Test-B] out: Verifying : openssl-1.0.1e-16.el6_5.7.x86_64 2/2 [RHEL-Test-B] out: [RHEL-Test-B] out: Updated: [RHEL-Test-B] out: openssl.x86_64 0:1.0.1e-16.el6_5.14 [RHEL-Test-B] out: [RHEL-Test-B] out: Complete! [RHEL-Test-B] out: [RHEL-Test-B] sudo: reboot [RHEL-Test-B] out: [RHEL-Test-B] out: [RHEL-Test-B] out: Broadcast message from ec2-user@ip-10-0-40-40 [RHEL-Test-B] out: [RHEL-Test-B] out: (/dev/pts/0) at 0:12 ... [RHEL-Test-B] out: [RHEL-Test-B] out: [RHEL-Test-B] out: [RHEL-Test-B] out: [RHEL-Test-B] out: The system is going down for reboot NOW! [RHEL-Test-B] out: [RHEL-Test-B] out: Done. Disconnecting from ec2-user@54.199.21X.XXX... done. Disconnecting from ec2-user@54.199.22X.XXX... done.
対象2台はt1.microでラウンチして実行時間は1分ほどでした。手動でやるとどのくらいかかるでしょうね。早くビールが飲めますね。
まとめ
「自動化」と言いますと最近ではChefで!という流れがありますが、こういうツールもあるよというご紹介でした。(今更ではあります)
「これって自動化できないかな?」と考えながら作業するのは大事、同じことを3回やるようになったら自動化を検討しましょう。2回でもいいです。
当然、タスクの内容はいろいろ書けます。「これってどうやれば?」と思ったらググれば出てきます。
何か自動化したいなぁと思ったときFabricを思い出していただけると幸いです。