本文章提供脚本来自动化：
- 通过自制bash脚本在Raspberry Pi上安装Raspbian
- 使用Ansible通过自制角色对Raspbian进行最小配置及安全化。
安装Raspbian
开始之前我们进入一个工作目录，比如 ~/rpi
然后插入microSD卡（可能需要通过转接器）到计算机中并定位microSD卡的路径
dmesg 及 lsblk 工具有助于定位此路径
## Dans ces exemples la microSD a été détectée sur sdd ce qui donne comme chemin /dev/sdd
## via dmesg
jls42@boo:~/rpi$ sudo dmesg |tail
[94655.145112] scsi host8: usb-storage 1-1.2:1.0
[94656.175566] scsi 8:0:0:0: Direct-Access Generic USB SD Reader 1.00 PQ: 0 ANSI: 0 CCS
[94656.176298] sd 8:0:0:0: Attached scsi generic sg4 type 0
[94656.177494] sd 8:0:0:0: [sdd] 62333952 512-byte logical blocks: (31.9 GB/29.7 GiB)
[94656.178010] sd 8:0:0:0: [sdd] Write Protect is off
[94656.178014] sd 8:0:0:0: [sdd] Mode Sense: 4b 00 00 08
[94656.178638] sd 8:0:0:0: [sdd] No Caching mode page found
[94656.178647] sd 8:0:0:0: [sdd] Assuming drive cache: write through
[94656.182648] sdd: sdd1 sdd2
[94656.185135] sd 8:0:0:0: [sdd] Attached SCSI removable disk
## ou via lsblk
jls42@boo:~/rpi$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
[...]
sdd 8:48 1 29,7G 0 disk
├─sdd1 8:49 1 43,9M 0 part
└─sdd2 8:50 1 1,7G 0 part
然后我们可以比如通过install_raspbian.sh脚本在microSD卡上安装Raspbian
在这次安装中，一个挂载点将被创建 /mnt/sdd
#!/bin/bash
# Ici on configure le chemin de la microSD
# et le point de montage nécessaire à la bonne exécution du script
msd_fs="/dev/sdd"
mountpoint="/mnt/sdd"
[ -d ${mountpoint} ] || mkdir ${mountpoint}
[ -b ${msd_fs} ] || { echo "${msd_fs} non disponible" ; exit 1 ;}
#raspbian_version="2018-06-27-raspbian-stretch-lite.zip"
raspbian_version=""
if [ -z ${raspbian_version} ]
then
raspbian_version=$(curl -s https://downloads.raspberrypi.org/raspbian_lite_latest | \
grep "raspbian_lite"| perl -nle 'print $1 if /.*href=".*images\/.*\/([0-9].*)"/')
if [ -e ${raspbian_version} ]
then
echo "La dernière image de Raspbian est déjà présente"
else
echo "Téléchargement de la dernière image de Raspbian"
curl -s -L https://downloads.raspberrypi.org/raspbian_lite_latest --output ${raspbian_version}
fi
fi
echo -e "Déploiement de ${raspbian_version} to ${msd_fs}"
time unzip -p ${raspbian_version} | sudo dd of=${msd_fs} bs=4M conv=fsync && \
echo -e "Montage de ${msd_fs}1 to ${mountpoint}" && \
sudo mount ${msd_fs}1 ${mountpoint} && \
echo -e "Activation du SSH sur Rasbpian" && \
sudo touch ${mountpoint}/ssh && \
echo -e "Vérification de l'activation SSH" && \
sudo ls -l ${mountpoint}/ssh && \
echo -e "Démontage ${msd_fs}1" && \
sudo umount ${mountpoint}
我们给它执行权限然后以root权限执行它
chmod 700 install_raspbian.sh
sudo ./install_raspbian.sh
这给出：
jls42@boo:~/rpi$ sudo ./install_raspbian.sh
Téléchargement de la dernière image de Raspbian
Déploiement de 2018-11-13-raspbian-stretch-lite.zip to /dev/sdd
0+28463 enregistrements lus
0+28463 enregistrements écrits
1866465280 bytes (1,9 GB, 1,7 GiB) copied, 102,911 s, 18,1 MB/s
real 1m42,923s
user 0m14,203s
sys 0m2,851s
Montage de /dev/sdd1 to /mnt/sdd
Activation du SSH sur Rasbpian
Vérification de l'activation SSH
-rwxr-xr-x 1 root root 0 déc. 8 22:45 /mnt/sdd/ssh
Démontage /dev/sdd1
在此阶段microSD卡已经准备好，我们可以直接将它插入到Raspberry Pi中。
配置和安全化Raspbian
一旦microSD卡插入并且Raspberry Pi可以通过SSH访问，我们：
- 获取ansible的初始化角色
- 准备ansible的剧本
- 执行Ansible脚本
获取ansible角色 ansible-rpi-init
我开发了一个ansible角色来自动化这个过程，以下是如何获取它：
git clone git@gitlab.com:jls42/ansible-rpi-init.git roles/ansible-rpi-init
这将给出：
jls42@boo:~/rpi$ git clone https://gitlab.com/jls42/ansible-rpi-init.git roles/ansible-rpi-init
Clonage dans 'roles/ansible-rpi-init'...
remote: Enumerating objects: 17, done.
remote: Counting objects: 100% (17/17), done.
remote: Compressing objects: 100% (9/9), done.
remote: Total 17 (delta 0), reused 0 (delta 0)
Dépaquetage des objets: 100% (17/17), fait.
创建一个名为inventory的清单文件
在这个例子的清单文件中，Raspberry Pi的IP地址是 192.168.1.190
[rpi1]
192.168.1.190 servername=rpi1
通过mkpasswd生成一个密码哈希，并保存结果用于下一步操作
## ici le mot de passe est 'osef'
jls42@boo:~$ mkpasswd --method=sha-512
Mot de passe :
$6$KRDQqQeZT$Bu439CILeJqHmwoxCwHXsgTJ5JEQjpZWfzCw6Deggfhip.DGScoCnUSBi.Hqnkh1OZUhTBaQees6GooW.PSLe.
创建一个名为init_rpi.yml的Ansible剧本
---
- name: "Initialisation du Rapsberry Pi"
hosts: rpi1
remote_user: "pi"
roles:
- roles/ansible-rpi-init
vars:
rpi_password: "$6$KRDQqQeZT$Bu439CILeJqHmwoxCwHXsgTJ5JEQjpZWfzCw6Deggfhip.DGScoCnUSBi.Hqnkh1OZUhTBaQees6GooW.PSLe."
生成一个ssh密钥对，如果还没有的话
jls42@boo:~$ [ -f ~/.ssh/id_rsa.pub ] || ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jls42/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/jls42/.ssh/id_rsa.
Your public key has been saved in /home/jls42/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qHhedMjuI0LySVAp2mpFQMozuqBwI00FZo0oHX7rkYI jls42@boo
The key's randomart image is:
+---[RSA 2048]----+
|.=**. |
|*+=o. |
|+B+ . |
|+++o + o |
|Eo* + = S |
|*=o= = . |
|+=..+ o |
| +o.o. |
| ..... |
+----[SHA256]-----+
在这个阶段以下文件应出现
jls42@boo:~/rpi$ tree
.
├── 2018-11-13-raspbian-stretch-lite.zip
├── init_rpi.yml
├── install_raspbian.sh
├── inventory
└── roles
└── ansible-rpi-init
├── defaults
│ └── main.yml
├── handlers
│ └── main.yml
├── LICENSE
├── meta
│ └── main.yml
├── README.md
├── tasks
│ └── main.yml
├── tests
│ ├── inventory
│ └── test.yml
└── vars
└── main.yml
8 directories, 13 files
使用init_rpi.yml剧本启动Ansible
## Le mot de passe par défaut est : "raspberry"
export ANSIBLE_HOST_KEY_CHECKING=False
ansible-playbook -k -b -i inventory init_rpi.yml
这将给出
jls42@boo:~/rpi$ ansible-playbook -k -b -i inventory init_rpi.yml
SSH password:
PLAY [Initialisation du Rapsberry Pi] ******************************************************************************************************************************************************************************************************
TASK [Gathering Facts] *********************************************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:46:18 +0100 (0:00:00.050) 0:00:00.050 *****
ok: [192.168.1.190]
TASK [roles/ansible-rpi-init : Mise à jour raspbian] ***************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:46:22 +0100 (0:00:03.502) 0:00:03.553 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Configuration du nom] ***************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:53 +0100 (0:01:31.114) 0:01:34.667 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Ajoute le nom du serveur dans le fichier /etc/hosts] ********************************************************************************************************************************************************
Saturday 08 December 2018 23:47:55 +0100 (0:00:01.944) 0:01:36.612 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Ajoute la clef publique] ************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:56 +0100 (0:00:01.031) 0:01:37.643 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Mise à jour du mot de passe de l'utilisateur pi] ************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:57 +0100 (0:00:01.183) 0:01:38.826 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Redémarrage] ************************************************************************************************************************************************************************************************
Saturday 08 December 2018 23:47:58 +0100 (0:00:01.249) 0:01:40.075 *****
changed: [192.168.1.190]
TASK [roles/ansible-rpi-init : Attente suite au redémarrage] *******************************************************************************************************************************************************************************
Saturday 08 December 2018 23:48:00 +0100 (0:00:01.714) 0:01:41.790 *****
ok: [192.168.1.190]
PLAY RECAP *********************************************************************************************************************************************************************************************************************************
192.168.1.190 : ok=8 changed=6 unreachable=0 failed=0
Saturday 08 December 2018 23:49:00 +0100 (0:01:00.451) 0:02:42.241 *****
===============================================================================
roles/ansible-rpi-init ------------------------------------------------ 158.69s
setup ------------------------------------------------------------------- 3.50s
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
total ----------------------------------------------------------------- 162.19s
Playbook run took 0 days, 0 hours, 2 minutes, 42 seconds
瞧：
- “pi”用户的访问密码已更改
- 现在可以无密码访问
- Raspberry Pi具有清单文件中指定的servername（通过清单文件）
验证
我们连接到Raspberry Pi以确认能够正确无密码访问和正确命名
jls42@boo:~/rpi$ ssh pi@192.168.1.190
Linux rpi1 4.14.79-v7+ #1159 SMP Sun Nov 4 17:50:20 GMT 2018 armv7l
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Dec 8 22:47:59 2018 from 192.168.1.42
pi@rpi1:~ $
尽情享用！
此文档已由gpt-4-1106-preview模型从博客的法文版本翻译而来。