Acest articol propune scripturi pentru automatizarea:
- instalării Raspbian pe Raspberry Pi printr-un script bash făcut acasă
- unei configurări și securizări minime a Raspbian prin Ansible cu un rol făcut acasă.
Instalarea Raspbian
Înainte de a începe ne plasăm într-un director de lucru, de exemplu ~/rpi
Introducem apoi microSD-ul (prin intermediul unui adaptor, de exemplu) pe postul nostru și localizăm calea microSD-ului
Instrumentele dmesg sau lsblk ajută la această localizare
## Dans ces exemples la microSD a été détectée sur sdd ce qui donne comme chemin /dev/sdd
## via dmesg
jls42@boo:~/rpi$ sudo dmesg |tail
[94655.145112] scsi host8: usb-storage 1-1.2:1.0
[94656.175566] scsi 8:0:0:0: Direct-Access Generic USB SD Reader 1.00 PQ: 0 ANSI: 0 CCS
[94656.176298] sd 8:0:0:0: Attached scsi generic sg4 type 0
[94656.177494] sd 8:0:0:0: [sdd] 62333952 512-byte logical blocks: (31.9 GB/29.7 GiB)
[94656.178010] sd 8:0:0:0: [sdd] Write Protect is off
[94656.178014] sd 8:0:0:0: [sdd] Mode Sense: 4b 00 00 08
[94656.178638] sd 8:0:0:0: [sdd] No Caching mode page found
[94656.178647] sd 8:0:0:0: [sdd] Assuming drive cache: write through
[94656.182648] sdd: sdd1 sdd2
[94656.185135] sd 8:0:0:0: [sdd] Attached SCSI removable disk
## ou via lsblk
jls42@boo:~/rpi$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
[...]
sdd 8:48 1 29,7G 0 disk
├─sdd1 8:49 1 43,9M 0 part
└─sdd2 8:50 1 1,7G 0 part
Apoi putem instala Raspbian pe microSD, de exemplu prin install_raspbian.sh
În timpul acestei instalări, va fi creat un punct de montaj /mnt/sdd
#!/bin/bash
# Ici on configure le chemin de la microSD
# et le point de montage nécessaire à la bonne exécution du script
msd_fs="/dev/sdd"
mountpoint="/mnt/sdd"
[ -d ${mountpoint} ] || mkdir ${mountpoint}
[ -b ${msd_fs} ] || { echo "${msd_fs} non disponible" ; exit 1 ;}
#raspbian_version="2018-06-27-raspbian-stretch-lite.zip"
raspbian_version=""
if [ -z ${raspbian_version} ]
then
raspbian_version=$(curl -s https://downloads.raspberrypi.org/raspbian_lite_latest | \
grep "raspbian_lite"| perl -nle 'print $1 if /.*href=".*images\/.*\/([0-9].*)"/')
if [ -e ${raspbian_version} ]
then
echo "La dernière image de Raspbian est déjà présente"
else
echo "Téléchargement de la dernière image de Raspbian"
curl -s -L https://downloads.raspberrypi.org/raspbian_lite_latest --output ${raspbian_version}
fi
fi
echo -e "Déploiement de ${raspbian_version} to ${msd_fs}"
time unzip -p ${raspbian_version} | sudo dd of=${msd_fs} bs=4M conv=fsync && \
echo -e "Montage de ${msd_fs}1 to ${mountpoint}" && \
sudo mount ${msd_fs}1 ${mountpoint} && \
echo -e "Activation du SSH sur Rasbpian" && \
sudo touch ${mountpoint}/ssh && \
echo -e "Vérification de l'activation SSH" && \
sudo ls -l ${mountpoint}/ssh && \
echo -e "Démontage ${msd_fs}1" && \
sudo umount ${mountpoint}
Îi dăm drepturi de execuție și îl executăm cu drepturi de root
chmod 700 install_raspbian.sh
sudo ./install_raspbian.sh
Ceea ce dă:
jls42@boo:~/rpi$ sudo ./install_raspbian.sh
Téléchargement de la dernière image de Raspbian
Déploiement de 2018-11-13-raspbian-stretch-lite.zip to /dev/sdd
0+28463 enregistrements lus
0+28463 enregistrements écrits
1866465280 bytes (1,9 GB, 1,7 GiB) copied, 102,911 s, 18,1 MB/s
real 1m42,923s
user 0m14,203s
sys 0m2,851s
Montage de /dev/sdd1 to /mnt/sdd
Activation du SSH sur Rasbpian
Vérification de l'activation SSH
-rwxr-xr-x 1 root root 0 déc. 8 22:45 /mnt/sdd/ssh
Démontage /dev/sdd1
În acest stadiu, cardul microSD este pregătit, îl putem introduce direct în Raspberry Pi.
Configurarea și securizarea Raspbian
Odată ce cardul microSD este introdus și Raspberry Pi este accesibil prin SSH, noi:
- recuperăm rolul ansible de inițializare
- pregătim playbook-ul ansible
- rulăm scriptul Ansible
Recuperarea rolului ansible ansible-rpi-init
Am dezvoltat un rol ansible pentru această automatizare, iată cum să-l recuperați:
git clone git@gitlab.com:jls42/ansible-rpi-init.git roles/ansible-rpi-init
Ceea ce dă:
jls42@boo:~/rpi$ git clone https://gitlab.com/jls42/ansible-rpi-init.git roles/ansible-rpi-init
Clonage dans 'roles/ansible-rpi-init'...
remote: Enumerating objects: 17, done.
remote: Counting objects: 100% (17/17), done.
remote: Compressing objects: 100% (9/9), done.
remote: Total 17 (delta 0), reused 0 (delta 0)
Dépaquetage des objets: 100% (17/17), fait.
Crearea fișierului de inventar numit inventory
În acest exemplu de inventar, Raspberry Pi are ip-ul 192.168.1.190
[rpi1]
192.168.1.190 servername=rpi1
Generarea unui hash de parolă prin mkpasswd și păstrarea rezultatului pentru acțiunea următoare
## ici le mot de passe est 'osef'
jls42@boo:~$ mkpasswd --method=sha-512
Mot de passe :
$6$KRDQqQeZT$Bu439CILeJqHmwoxCwHXsgTJ5JEQjpZWfzCw6Deggfhip.DGScoCnUSBi.Hqnkh1OZUhTBaQees6GooW.PSLe.
Crearea unui playbook Ansible numit init_rpi.yml
---
- name: "Initialisation du Rapsberry Pi"
hosts: rpi1
remote_user: "pi"
roles:
- roles/ansible-rpi-init
vars:
rpi_password: "$6$KRDQqQeZT$Bu439CILeJqHmwoxCwHXsgTJ5JEQjpZWfzCw6Deggfhip.DGScoCnUSBi.Hqnkh1OZUhTBaQees6GooW.PSLe."
Generarea unei perechi de chei ssh dacă nu avem deja una
jls42@boo:~$ [ -f ~/.ssh/id_rsa.pub ] || ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jls42/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/jls42/.ssh/id_rsa.
Your public key has been saved in /home/jls42/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qHhedMjuI0LySVAp2mpFQMozuqBwI00FZo0oHX7rkYI jls42@boo
The key's randomart image is:
+---[RSA 2048]----+
|.=**. |
|*+=o. |
|+B+ . |
|+++o + o |
|Eo* + = S |
|*=o= = . |
|+=..+ o |
| +o.o. |
| ..... |
+----[SHA256]-----+
În acest stadiu fișierele următoare sunt prezente
jls42@boo:~/rpi$ tree
.
├── 2018-11-13-raspbian-stretch-lite.zip
├── init_rpi.yml
├── install_raspbian.sh
├── inventory
└── roles
└── ansible-rpi-init
├── defaults
│ └── main.yml
├── handlers
│ └── main.yml
├── LICENSE
├── meta
│ └── main.yml
├── README.md
├── tasks
│ └── main.yml
├── tests
│ ├── inventory
│ └── test.yml
└── vars
└── main.yml
8 directories, 13 files
Rularea Ansible cu playbook-ul init_rpi.yml
## Le mot de passe par défaut est : "raspberry"
export ANSIBLE_HOST_KEY_CHECKING=False
ansible-playbook -k -b -i inventory init_rpi.yml
Ceea ce dă
jls42@boo:~/rpi$ ansible-playbook -k -b -i inventory init_rpi.yml
SSH password:
PLAY [Initialisation du Rapsberry Pi] ******************************************************************************************************************************************************************************************************
TASK [Gathering Facts] *********************************************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:46:18 +0100 (0:00:00.050) 0:00:00.050 *****
ok: [192.168.1.190]
TASK [roles/ansible-rpi-init : Mise à jour raspbian] ***************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:46:22 +0100 (0:00:03.502) 0:00:03.553 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Configuration du nom] ***************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:53 +0100 (0:01:31.114) 0:01:34.667 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Ajoute le nom du serveur dans le fichier /etc/hosts] ********************************************************************************************************************************************************
Saturday 08 December 2018 23:47:55 +0100 (0:00:01.944) 0:01:36.612 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Ajoute la clef publique] ************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:56 +0100 (0:00:01.031) 0:01:37.643 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Mise à jour du mot de passe de l'utilisateur pi] ************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:57 +0100 (0:00:01.183) 0:01:38.826 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Redémarrage] ************************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:58 +0100 (0:00:01.249) 0:01:40.075 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Attente suite au redémarrage] *******************************************************************************************************************************************************************************
Saturday 08 December 2018 23:48:00 +0100 (0:00:01.714) 0:01:41.790 *****
ok: [192.168.1.190]
PLAY RECAP *********************************************************************************************************************************************************************************************************************************
192.168.1.190 : ok=8 changed=6 unreachable=0 failed=0
Saturday 08 December 2018 23:49:00 +0100 (0:01:00.451) 0:02:42.241 *****
===============================================================================
roles/ansible-rpi-init ------------------------------------------------ 158.69s
setup ------------------------------------------------------------------- 3.50s
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
total ----------------------------------------------------------------- 162.19s
Playbook run took 0 days, 0 hours, 2 minutes, 42 seconds
Și gata:
- parola de acces pentru utilizatorul “pi” a fost schimbată
- accesul este acum posibil fără parolă
- Raspberry Pi are numele indicat în servername (prin fișierul de inventar)
Verificare
Ne conectăm la Raspberry Pi pentru a confirma accesul corect fără parolă și numirea corectă
jls42@boo:~/rpi$ ssh pi@192.168.1.190
Linux rpi1 4.14.79-v7+ #1159 SMP Sun Nov 4 17:50:20 GMT 2018 armv7l
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Dec 8 22:47:59 2018 from 192.168.1.42
pi@rpi1:~ $
Bucură-te!
Acest document a fost tradus din versiunea fr în limba ro folosind modelul gpt-4o. Pentru mai multe informații despre procesul de traducere, consultați https://gitlab.com/jls42/ai-powered-markdown-translator.