Upgrade to Pro — share decks privately, control downloads, hide ads and more …

時代が求めたSTNSと僕

 時代が求めたSTNSと僕

第5回ペパボテックカンファレンス〜インフラエンジニア大特集〜

Kazuhiko Yamashita

May 14, 2016
Tweet

More Decks by Kazuhiko Yamashita

Other Decks in Technology

Transcript

  1. ΞʔΩςΫνϟ STNS http(1104) process libnss-stns libpam-stns query-wrapper key-wrapper /user/name/pyama {

    name:pyama, id: 1000, dir:/home/pyama … } αʔόɾΫϥΠΞϯτؒ͸httpΛར༻ͨ͠ JSONܗࣜͷΠϯλʔϑΣʔε ͞Βʹ೚ҙͷwrapperΛར༻Մೳ
  2. stns.conf(αʔό) port = 1104 include = "/etc/stns/conf.d/*" # ϕʔγοΫೝূΛαϙʔτ user

    = "basic_user" password = "basic_password" [users.example] id = 1001 group_id = 1001 keys = ["ssh-rsa XXXXX…"] [groups.example] id = 1001 users = ["example"] [sudoers.example] password = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" hash_type = "sha256"
  3. σϓϩΠϢʔβʔͷ؅ཧ [users.deploy] id = 1000 group_id = 1000 link_users =

    [“foo","bar"] [users.foo] keys = ["ssh-rsa aaa”] [users.bar] keys = ["ssh-rsa bbb"] deployϢʔβʔͰSSHϩάΠϯ͢Δࡍʹɺlink_usersͰ ࢦఆͨ͠Ϣʔβʔͷެ։伴Λར༻͢Δ͜ͱ͕ग़དྷΔ →authorized_keysʹॻ͔ͳͯ͘ྑ্͍ʹɺ ɹ୭͕σϓϩΠग़དྷΔͷ͔Ұ໨ྎવ
  4. ૊৫ߏ଄Λදݱ͢Δ [groups.tech] users = ["antipop"] link_groups = [“tech-1"] [groups.tech-1] users

    = ["pyama"] pyama͸tech-1ʹॴଐ͢ΔtechͷϢʔβʔͰ͋Δɻ ۩ମతͳར༻γʔϯ͸sshd_configͷAllowGroupsɺ sudoersͳͲɺάϧʔϓͰ؅ཧ͢Δ৔߹ʹศརɻ
  5. sudoύεϫʔυΛ؅ཧ͢Δ $ sudo ls [sudo] password for pyama: <pyamaύεϫʔυ> nice_guy.txt

    /etc/sudoersͷઃఆʹґଘ͢Δ͕ɺҰൠతʹ͸ sudo࣮ߦͨ͠ϢʔβʔͷύεϫʔυΛٻΊΒΕΔ
  6. sudoύεϫʔυΛ؅ཧ͢Δ [sudoers.example] password = "f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2" hash_type = "sha256" /etc/stns/stns.conf /etc/pam.d/sudo

    auth sufficient libpam_stns.so sudo example ݸผʹϢʔβʔ͝ͱʹύεϫʔυΛ؅ཧ͢ΔखؒΛল͖ɺ ෆਖ਼ΞΫηε࣌ʹsudo͞ΕΔ͜ͱΛ๷͙ (rootύεϫʔυͷ౪ௌରࡦʹ΋)
  7. libnss_stns.conf(ΫϥΠΞϯτ) api_end_point = ["http://<server-master>:1104", "http://<server-slave>:1104"] user = "basic_user" password =

    "basic_password" wrapper_path = "/usr/local/bin/stns-query-wrapper" chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper" ssl_verify = true
  8. wrapper_path STNSͰ͸ΠϯλʔϑΣʔεͷϑΥʔϚοτ͑͞߹ͬ ͍ͯΕ͹೚ҙͷόοΫΤϯυΛ࢖༻Մೳɻ $ /usr/local/bin/stns-query-wrapper /user/name/pyama { "pyama": { "id":

    10301, "password": "", "hash_type": "", "group_id": 2000, "directory": "", "shell": "", "gecos": "", "keys": [ "ssh-rsa xxx" ], "link_users": null } }
  9. όοΫΤϯυʹRailsAPIΛར༻͢Δྫ process libnss-stns libpam-stns query-wrapper key-wrapper /user/name/pyama { name:pyama, id:

    1000, dir:/home/pyama … } Linuxϓϩηεͱͷ΍ΓऔΓ͸STNSΛར༻͠ɺ Ϣʔβʔ৘ใ͸RailsͰ؅ཧ͢Δ ΋͸΍GoݴޠΛར༻͢Δඞཁ΋ͳ͍
  10. ੑೳධՁ ςετσʔλΛ1000݅౤ೖ require "toml" users = Hash.new { |h,k| h[k]

    = Hash.new(&h.default_proc) } (1..1000).each do |n| users[:users]["user_#{n}"]["id"] = n users[:users]["user_#{n}"]["group_id"] = n end puts TOML::Generator.new(users).body $ ab -k -c 100 -n 100000 http://localhost:11104/user/name/user_1 abΛར༻͠ɺಉ࣌઀ଓ100Ͱ10ສΞΫηε Total transferred: 36600000 bytes HTML transferred: 19000000 bytes Requests per second: 11543.13 [#/sec] (mean) Time per request: 8.663 [ms] (mean) Time per request: 0.087 [ms] (mean, across all concurrent requests) Transfer rate: 4125.77 [Kbytes/sec] received
  11. GitHub FlowͰϢʔβʔ؅ཧ thor Λར༻͠Github(GHE)͔Β Ϣʔβʔ৘ใɺάϧʔϓ৘ใ ެ։伴৘ใΛੜ੒͢Δ [users.pyama] id = 1000

    group_id =1000 keys = ["ssh-rsa xxx”] [groups.muu-developer] id = 1000 bundle exec thor build
  12. ֎෦APIར༻ wrapper-cmd = [“original-command.rb”] STNS stns-module /user/name/pyama { name:pyama, id:

    1000, dir:/home/pyama … } original-command.rb run { name:pyama, id: 1000, dir:/home/pyama … } STNSʹϢʔβʔ৘ใΛొ࿥͢Δඞཁ͕ͳ͘ͳΓɺ ֎෦γεςϜͱͷ࿈ܞ͕ߋʹՃ଎