使用 ansible playbook 更改 ssh 端口

Question

我想将客户端系统上的 ssh 服务器端口更改为自定义的 2202（在group_var/all 和roles/change-sshd-port/vars/main.yml 中定义的端口）。我的要求是当端口已经设置为自定义 2202 时也可以运行 playbook（然后 playbook 应该什么都不做）。 我已经根据解决方案使用了ansible角色：https://github.com/Forcepoint/fp-pta-ansible-change-sshd-port

第一次运行脚本时端口更改正常（完成后我可以在新端口上登录客户端节点）。
当我再次运行 playbook 时它失败了，因为它试图通过旧的 22 而不是新的端口 2202 执行一些任务

TASK [change-sshd-port : Confirm host connection works] ********************************************************************************************************************
fatal: [192.168.170.113]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.170.113 port 22: Connection refused", "unreachable": true}

当ansible_port 变量设置为roles/change-sshd-port/vars/main.yml 中的新端口时，我找不到它为何尝试使用端口22

---
# vars file for /home/me/ansible2/roles/change-sshd-port
ansible_port: 2202

角色任务roles/change-sshd-port/tasks/main.yml直到失败ping任务的部分是：

- name: Set configured port fact
  ansible.builtin.set_fact:
    configured_port: "{{ ansible_port }}"

- name: Check if we're using the inventory-provided SSH port
  ansible.builtin.wait_for:
    port: "{{ ansible_port }}"
    state: "started"
    host: "{{ ansible_host }}"
    connect_timeout: "5"
    timeout: "10"
  delegate_to: "localhost"
  ignore_errors: "yes"
  register: configured_ssh

- name: SSH port is configured properly
  ansible.builtin.debug:
    msg: "SSH port is configured properly"
  when: configured_ssh is defined and
        configured_ssh.state is defined and
        configured_ssh.state == "started"
  register: ssh_port_set

- name: Check if we're using the default SSH port
  ansible.builtin.wait_for:
    port: "22"
    state: "started"
    host: "{{ ansible_host }}"
    connect_timeout: "5"
    timeout: "10"
  delegate_to: "localhost"
  ignore_errors: "yes"
  register: default_ssh
  when: configured_ssh is defined and
        configured_ssh.state is undefined

- name: Set inventory ansible_port to default
  ansible.builtin.set_fact:
    ansible_port: "22"
  when: default_ssh is defined and
        "state" in default_ssh and
        default_ssh.state == "started"
  register: ssh_port_set

- name: Fail if SSH port was not auto-detected (unknown)
  ansible.builtin.fail:
    msg: "The SSH port is neither 22 or {{ ansible_port }}."
  when: ssh_port_set is undefined

- name: Confirm host connection works
  ansible.builtin.ping:

Answer 1

您的问题缺少很多细节（我们无法 根据您在 问题），所以我将不得不进行一些猜测。有 可能发生的几件事。

首先，如果您对剧本中的 ssh 端口不屑一顾， 您将需要禁用该剧的事实收集功能。经过 默认情况下，ansible 在目标主机上运行 setup 模块之前 在你的游戏中运行任务，这将使用任何端口 您已在库存中配置。如果 sshd 在不同的服务器上运行 端口超出预期，这将失败。

这是一个忽略你的端口的剧本 清点并成功连接到目标主机是否 sshd 在端口 22 或端口 2222 上运行（如果 sshd 将失败并出现错误 没有在这些端口上运行）：

- hosts: target
  gather_facts: false
  vars:
    desired_port: 2222
    default_port: 22
  tasks:
    - name: check if ssh is running on {{ desired_port }}
      delegate_to: localhost
      wait_for:
        port: "{{ desired_port }}"
        host: "{{ ansible_host }}"
        timeout: 10
      ignore_errors: true
      register: desired_port_check

    - name: check if ssh is running on {{ default_port }}
      delegate_to: localhost
      wait_for:
        port: "{{ default_port }}"
        host: "{{ ansible_host }}"
        timeout: 10
      ignore_errors: true
      register: default_port_check

    - fail:
        msg: "ssh is not running (or is running on an unknown port)"
      when: default_port_check is failed and desired_port_check is failed

    - when: default_port_check is success
      block:
        - debug:
            msg: "ssh is running on default port"

        - name: configure ansible to use port {{ default_port }}
          set_fact:
            ansible_port: "{{ default_port }}"

    - when: desired_port_check is success
      block:
        - debug:
            msg: "ssh is running on desired port"

        - name: configure ansible to use port {{ desired_port }}
          set_fact:
            ansible_port: "{{ desired_port }}"

    - name: run a command on the target host
      command: uptime
      register: uptime

    - debug:
        msg: "{{ uptime.stdout }}"