是否可以为 Windows ec2 实例创建加密的 ebs 启动卷？

此 AWS 示例显示如何复制未加密的引导卷，创建加密的引导卷： aws ec2 copy-image -r us-east-1 -s ami-60b6c60a --encrypted --kmsKeyID arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef

但是，当我使用Microsoft Windows Server 2012 R2 Base - ami-c8a9baa2作为源尝试此操作时aws ec2 copy-image --source-region us-east-1 --source-image-id ami-c8a9baa2 --name 'W12R2_Base_encrypted' --description 'Microsoft Windows Server 2012 R2 Base - ami-c8a9baa2 (encrypted)' --encrypted，我收到错误：“调用 CopyImage 操作时发生客户端错误 (InvalidRequest)：无法复制具有 EC2 BillingProduct 代码的图像到另一个 AWS 账户。 ”

使用chef-icinga2 食谱的最新提交，我无法让pnp4nagios在 ubuntu 14.04 上使用icinga2 。

我在我的包装食谱中设置了pnp=true并且icinga2::server_pnp配方成功运行。

属性/default.rb

默认['icinga2']['版本'] = '2.4.4-1'
默认['icinga2']['classic_ui']['enable'] = true
默认['icinga2']['classic_ui']['version'] = '2.4.4-1'
默认['icinga2']['pnp'] = true

服务都在运行，可以成功重启。

root@icinga2-host:~# 服务 icinga2 状态
 * icinga2 正在运行
root@icinga2-host:~# service apache2 status
 * apache2 正在运行
root@icinga2-host:~# 服务 rrdcached 状态
rrdcached (7867) 正在运行。
root@icinga2-host:~# 服务 npcd 状态
 * 检查 Nagios Performance C Daemon (PNP4Nagios) npcd 的状态 [ OK ]

perfdata 已启用

root@icinga2-host:# icinga2 功能启用 perfdata
root@icinga2-host:# icinga2 功能列表
禁用功能：api gelf 石墨 icingastatus livestatus opentsdb syslog
启用的功能： checker command compatlog debuglog ido-mysql mainlog notification perfdata statusdata

存在以下配置文件：

root@icinga2-host:~# ls -la /etc/pnp4nagios/
总计 120
drwxr-xr-x 5 nagios nagios 4096 3 月 29 日 14:28。
drwxr-xr-x 99 根根 4096 Mar 29 14:28 ..
-rw-r--r-- 1 nagios nagios 29383 Mar 29 14:28 background.pdf
drwxr-xr-x 2 nagios nagios 4096 3 月 29 日 14:28 check_commands
drwxr-xr-x 2 nagios nagios 4096 3 月 29 日 14:28 config.d
-rw-r--r-- 1 nagios nagios 9570 3 月 29 日 14:28 config_local.php
-rw-r--r-- 1 nagios nagios 9558 3 月 29 日 14:28 config.php
-rw-r--r-- 1 nagios nagios 9570 3 月 29 日 14:28 config.php.0.6.24
-rw-r--r-- 1 nagios nagios 1350 3 月 29 日 14:28 misccommands.cfg-sample
-rw-r--r-- 1 nagios nagios 1682 Mar 29 14:28 nagios.cfg-sample
-rw-r--r-- 1 nagios nagios 4186 3 月 29 日 14:28 npcd.cfg
drwxr-xr-x 2 nagios nagios 4096 3 月 29 日 14:28 页
-rw-r--r-- 1 nagios nagios 522 3 月 29 日 14:28 pnp4nagios_release
-rw-r--r-- 1 nagios nagios 2523 Mar 29 14:28 process_perfdata.cfg
-rw-r--r-- 1 nagios nagios 676 3 月 29 日 14:28 rra.cfg
-rw-r--r-- 1 nagios nagios 651 3 月 29 日 14:28 rra.cfg-sample

我在以下位置看到重复出现的错误“RRDs::create ERROR you must define at least one Round Robin Archive ” /var/log/pnp4nagios/perfdata.log：

2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/3tw-icinga2-berkshelf/_HOST_.rrd DS:1:GAUGE:8460:U:U DS:2 :GAUGE:8460:U:U --start=1459261782 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_runtime.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_rows.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_errors.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_invalid.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_skipped.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_update.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7963] [0] RRDs::create /var/rrdtool/cache/.pnp-internal/runtime_create.rrd DS:1:GAUGE:8460:U:U --start= 1459261728 --step=60
2016-03-29 14:29:18 [7963] [0] RRDs::create ERROR 你必须定义至少一个循环存档
2016-03-29 14:29:18 [7962] [0] RRDs::create /var/rrdtool/cache/3tw-icinga2-berkshelf/ping6.rrd DS:1:GAUGE:8460:U:U DS:2 :GAUGE:8460:U:U --start=1459261721 --step=60
2016-03-29 14:29:18 [7962] [0] RRDs::create ERROR 您必须定义至少一个循环存档
2016-03-29 14:29:18 [7962] [0] RRDs::create /var/rrdtool/cache/3tw-icinga2-berkshelf/http.rrd DS:1:GAUGE:8460:U:U DS:2 :GAUGE:8460:U:U --start=1459261725 --step=60
2016-03-29 14:29:18 [7962] [0] RRDs::create ERROR 您必须定义至少一个循环存档
2016-03-29 14:29:18 [7962] [0] RRDs::create /var/rrdtool/cache/3tw-icinga2-berkshelf/icinga.rrd DS:1:GAUGE:8460:U:U DS:2 :GAUGE:8460:U:U DS:3:GAUGE:8460:U:U DS:4:GAUGE:8460:U:U DS:5:GAUGE:8460:U:U DS:6:GAUGE:8460:U :U DS:7:GAUGE:8460:U:U DS:8:GAUGE:8460:U:U DS:9:GAUGE:8460:U:U DS:10:GAUGE:8460:U:U DS:11:仪表：8460：U：U DS：12：仪表：8460：U：U DS：13：仪表：8460：U：U DS：14：仪表：8460：U：U DS：15：仪表：8460：U： U DS:16:GAUGE:8460:U:U DS:17:GAUGE:8460:U:U DS:18:GAUGE:8460:U:U DS:19:GAUGE:8460:U:U DS:20:GAUGE :8460:U:U DS:21:GAUGE:8460:U:U DS:22:GAUGE:8460:U:U DS:23:GAUGE:8460:U:U DS:24:GAUGE:8460:U:U DS:25:GAUGE:8460:U:U DS:26:GAUGE:8460:U:U DS:27:GAUGE:8460:U:U DS:28:GAUGE:8460:U:U DS:29:GAUGE: 8460:U:U DS:30:GAUGE:8460:U:U DS:31:GAUGE:8460:U:U DS:32:GAUGE:8460:U:U DS:33:GAUGE:8460:U:U DS :34:GAUGE:8460:U:U DS:35:GAUGE:8460:U:U DS:36:GAUGE:8460:U:U DS:37:GAUGE:8460:U:U DS:38:GAUGE:8460:U:U DS:39:GAUGE:8460:U:U --start=1459261725 --step=60
2016-03-29 14:29:18 [7962] [0] RRDs::create ERROR 您必须定义至少一个循环存档
2016-03-29 14:29:18 [7962] [0] RRDs::create /var/rrdtool/cache/3tw-icinga2-berkshelf/load.rrd DS:1:GAUGE:8460:U:U DS:2 :GAUGE:8460:U:U DS:3:GAUGE:8460:U:U --start=1459261728 --step=60

/var/spool/icinga2/perfdata文件夹是空的。

我只在缓存文件夹中看到 xml 文件：

root@icinga2-host:~# ls -la /var/rrdtool/cache/icinga2-host/
共 88 个
drwxrwxr-x 2 nagios nagios 4096 3 月 29 日 14:46。
drwxr-xr-x 4 nagios nagios 4096 3 月 29 日 14:29 ..
-rw-rw-r-- 1 nagios nagios 2630 Mar 29 14:46 apt.xml
-rw-rw-r-- 1 nagios nagios 1971 年 3 月 29 日 14:44 disk__.xml
-rw-rw-r-- 1 nagios nagios 4980 Mar 29 14:46 disk.xml
-rw-rw-r-- 1 nagios nagios 2577 Mar 29 14:45 _HOST_.xml
-rw-rw-r-- 1 nagios nagios 2588 Mar 29 14:46 http.xml
-rw-rw-r-- 1 nagios nagios 27973 Mar 29 14:46 icinga.xml
-rw-rw-r-- 1 nagios nagios 3300 3 月 29 日 14:45 load.xml
-rw-rw-r-- 1 nagios nagios 2649 Mar 29 14:46 ping4.xml
-rw-rw-r-- 1 nagios nagios 2649 Mar 29 14:45 ping6.xml
-rw-rw-r-- 1 nagios nagios 1948 年 3 月 29 日 14:44 procs.xml
-rw-rw-r-- 1 nagios nagios 1974 年 3 月 29 日 14:46 ssh.xml
-rw-rw-r-- 1 nagios nagios 1950 年 3 月 29 日 14:46 swap.xml
-rw-rw-r-- 1 nagios nagios 1934 年 3 月 29 日 14:46 users.xml

我尝试使用verify_pnp_config工具，但找不到要传递给它的正确配置文件，所以我总是得到相同的错误（我尝试过 process_perfdata.cfg、rra.cfg 和 npcd.cfg）：

root@icinga2-host:/usr/local/pnp4nagios# wget http://verify.pnp4nagios.org/verify_pnp_config
root@icinga2-host:/usr/local/pnp4nagios# perl verify_pnp_config --mode npcdmod --config=/etc/pnp4nagios/npcd.cfg --pnpcfg=/etc/pnp4nagios/
[信息] ========== 启动环境检查 ============
[INFO] 我的版本是：verify_pnp_config-0.6.25-R.40
[INFO] 启动选项：verify_pnp_config --mode npcdmod --config=/etc/pnp4nagios/npcd.cfg --pnpcfg=/etc/pnp4nagios/
[信息] 读取 /etc/pnp4nagios/npcd.cfg
[INFO] 读取 /etc/pnp4nagios/npcd.cfg 时无法确定产品
[CRIT] /etc/pnp4nagios/npcd.cfg 看起来不像一个有效的配置文件

有人知道我应该从这里去哪里吗？谢谢！

aws ec2 实例上可用的 yum 存储库只有旧版本的libmemcached：v 1.0.8。

谁能告诉我如何在 aws ec2 实例上安装更新的版本，如 1.0.18？

我可以添加哪个外部 yum 存储库来安装更新的版本，即使它不受支持？

EC2：yum 信息 libmemcached

Using username "ec2-user".
Authenticating with public key "imported-openssh-key"

       __|  __|_  )
       _|  (     /   Amazon Linux AMI
      ___|\___|___|

https://aws.amazon.com/amazon-linux-ami/2015.09-release-notes/
No packages needed for security; 1 packages available
Run "sudo yum update" to apply all updates.
[ec2-user@ip-xxx-xxx-xxx-xxx ~]$ yum info libmemcached
Loaded plugins: priorities, update-motd, upgrade-helper
Available Packages
Name        : libmemcached
Arch        : x86_64
Version     : 1.0.8
Release     : 2.6.amzn1
Size        : 246 k
Repo        : amzn-main/2015.09
Summary     : Client library and command line tools for memcached server
URL         : http://libmemcached.org/
License     : BSD
Description : libmemcached is a C/C++ client library and tools for the memcached server
            : (http://memcached.org/). It has been designed to be light on memory
            : usage, and provide full access to server side methods.
            :
            : It also implements several command line tools:
            :
            : memcapable  Checking a Memcached server capibilities and compatibility
            : memcat      Copy the value of a key to standard output
            : memcp       Copy data to a server
            : memdump     Dumping your server
            : memerror    Translate an error code to a string
            : memexist    Check for the existance of a key
            : memflush    Flush the contents of your servers
            : memparse    Parse an option string
            : memping     Test to see if a server is available.
            : memrm       Remove a key(s) from the server
            : memslap     Generate testing loads on a memcached cluster
            : memstat     Dump the stats of your servers to standard output
            : memtouch    Touches a key

EC2：猫 /etc/yum.repos.d/amzn-main.repo

[ec2-user@ip-xxx-xxx-xxx-xxx~]$ cat /etc/yum.repos.d/amzn-main.repo
[amzn-main]
name=amzn-main-Base
mirrorlist=http://repo.$awsregion.$awsdomain/$releasever/main/mirror.list
mirror_expire=300
metadata_expire=300
priority=10
failovermethod=priority
fastestmirror_enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-ga
enabled=1
retries=5
timeout=10
report_instanceid=yes

[amzn-main-debuginfo]
name=amzn-main-debuginfo
mirrorlist=http://repo.$awsregion.$awsdomain/$releasever/main/debuginfo/mirror.list
mirror_expire=300
metadata_expire=300
priority=10
failovermethod=priority
fastestmirror_enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-ga
enabled=0
retries=5
timeout=10
report_instanceid=yes

谢谢！

我们正在运行开源 chef-server 11.1.3（我们正在测试 chef-server-core 12.2.0-1）。我可以将 11.1.3 服务器环境中的客户端节点升级到chef-client 12.5.1吗？

有什么会阻止我在我的食谱中使用新的自定义资源模型吗？

谢谢！

我正在尝试在具有基于 Chef 11.10.4 的客户端的 Ubuntu 14.04 系统上的厨师食谱中执行数据库数据加载。我在 ruby​​ 块中进行数据加载，以下是日志中错误的相关部分：

Mixlib::ShellOut::CommandTimeout

命令在 600 秒后超时：

命令超出了允许的执行时间，被 TERM 信号杀死。

[2015-10-06T01:24:00+00:00] 错误：ruby_block[Load Dataset]（chef-virtuoso::load line 178）有一个错误：Mixlib::ShellOut::CommandTimeout：命令在 600 秒后超时：

shell_out!任何人都知道如何将红宝石块中的默认 CommandTimeout 增加到 3600 ？

这是配方中失败的红宝石块：

::Chef::Recipe.send(:include, Chef::Mixin::ShellOut)

ruby_block "Load Dataset" do
  block do
    shell_out!(DATA_LOAD_COMMAND)
  end
end

我正在寻找一种使用CloudFront进行蓝/绿部署的方法。

有没有人有一个很好的解决方案来从一个 CloudFront 分配迁移到另一个，或者每个人真的只是创建他们的分配然后再也不碰它了吗？

我的 CloudFront 分配由一个用于静态内容（javascript 等）的 S3源和一个指向 AWS ELB 的自定义源组成。

CloudFront 没有变化

在正常情况下，我们根本不会对 CloudFront 分配进行任何更改。我们通过更改 S3 中静态内容文件的名称来对 S3 源中的静态内容进行版本控制，并对弹性负载均衡器 (ELB) 下的 EC2 实例进行滚动部署。但是，有时我们需要对 CloudFront 分配本身进行测试和更改，或者对我们的环境进行足够大的更改，我们需要在新环境中指向新的 ELB。

两个 CloudFront 分配

我尝试的第一个选项是拥有两个单独的 CloudFront Web Distributions，一个用于我当前的环境或 A 环境，一个用于我的新环境或 B 环境。我尝试使用 Route53加权路由策略，为我的 www.domain.com Route53 记录添加了两条记录，一条指向权重为 1 的 CloudFront 分配 A，另一条指向权重为 0 的 CloudFront 分配 B。计划是在我想从分配 A 移动到分配 B 时更改权重。但是，一次只有一个 CloudFront 分配可以注册 www.domain.com备用域名 (CNAME)，否则您会收到以下错误：

com.amazonaws.services.cloudfront.model.CNAMEAlreadyExistsException: One or more of the CNAMEs you provided are already associated with a different resource. (Service: AmazonCloudFront; Status Code: 409; Error Code: CNAMEAlreadyExists; Request ID: ef84a5f0-44e7-11e5-9315-0ba167bb108a)

一个 CloudFront 分配

第二种选择是保留一个 CloudFront Web 分配。我有 S3 和自定义源指向我的 A 和 B 环境，然后当我想从一个环境移动到另一个环境时，我更新 CloudFront缓存行为以指向另一个源。这非常混乱，因为这些更新需要 15 到 60 分钟，无法看到更新的进度，并且根据您的更改的性质，您可能需要使用CloudFront 失效来跟进，这样您就不会提供缓存的内容来自旧环境和新内容。

谢谢你的建议！

Logstash 版本 1.5.0.1

我正在尝试使用 logstash s3 输入插件来下载 cloudfront 日志和cloudfront 编解码器插件来过滤流。

我使用bin/plugin install logstash-codec-cloudfront.

我得到以下信息：错误：对象：#Version：1.0 不是此包装器的合法参数，因为它不响应“读取”。

这是来自 /var/logs/logstash/logstash.log 的完整错误消息

 {:timestamp=>"2015-08-05T13:35:20.809000-0400", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n  Plugin: <LogStash::Inputs::S3 bucket=>\"[BUCKETNAME]\", prefix=>\"cloudfront/\", region=>\"us-east-1\", type=>\"cloudfront\", secret_access_key=>\"[SECRETKEY]/1\", access_key_id=>\"[KEYID]\", sincedb_path=>\"/opt/logstash_input/s3/cloudfront/sincedb\", backup_to_dir=>\"/opt/logstash_input/s3/cloudfront/backup\", temporary_directory=>\"/var/lib/logstash/logstash\">\n  Error: Object: #Version: 1.0\n is not a legal argument to this wrapper, cause it doesn't respond to \"read\".", :level=>:error}

我的 logstash 配置文件：/etc/logstash/conf.d/cloudfront.conf

input {
  s3 {
    bucket => "[BUCKETNAME]"
    delete => false
    interval => 60 # seconds
    prefix => "cloudfront/"
    region => "us-east-1"
    type => "cloudfront"
    codec => "cloudfront"
    secret_access_key => "[SECRETKEY]"
    access_key_id => "[KEYID]"
    sincedb_path => "/opt/logstash_input/s3/cloudfront/sincedb"
    backup_to_dir => "/opt/logstash_input/s3/cloudfront/backup"
    use_ssl => true
  }
}

我正在成功使用类似的 s3 输入流将我的 cloudtrail 日志记录到基于stackoverflow 帖子中的答案的 logstash 中。

来自 s3 的 CloudFront 日志文件（我只包含文件中的标头）：

 #Version: 1.0
 #Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken x-forwarded-for ssl-protocol ssl-cipher x-edge-response-result-type

根据 cloudfront 插件 github repo cloudfront_spec.rb 和官方 AWS CloudFront Access Logs文档中的第 26-29 行，标头看起来基本上是正确的格式。

有任何想法吗？谢谢！

[2015 年 9 月 9 日更新]

根据这篇文章，我尝试使用gzip_lines编解码器插件，安装bin/plugin install logstash-codec-gzip_lines并使用过滤器解析文件，不幸的是我得到了完全相同的错误。看起来这是日志文件的第一个字符的问题#。

作为记录，这是新的尝试，包括由于四个新字段而解析云端日志文件的更新模式：

/etc/logstash/conf.d/cloudfront.conf

input {
  s3 {
    bucket => "[BUCKETNAME]"
    delete => false
    interval => 60 # seconds
    prefix => "cloudfront/"
    region => "us-east-1"
    type => "cloudfront"
    codec => "gzip_lines"
    secret_access_key => "[SECRETKEY]"
    access_key_id => "[KEYID]"
    sincedb_path => "/opt/logstash_input/s3/cloudfront/sincedb"
    backup_to_dir => "/opt/logstash_input/s3/cloudfront/backup"
    use_ssl => true
  }
}
filter {
    grok {
    type => "cloudfront"
    pattern => "%{DATE_EU:date}\t%{TIME:time}\t%{WORD:x_edge_location}\t(?:%{NUMBER:sc_bytes}|-)\t%{IPORHOST:c_ip}\t%{WORD:cs_method}\t%{HOSTNAME:cs_host}\t%{NOTSPACE:cs_uri_stem}\t%{NUMBER:sc_status}\t%{GREEDYDATA:referrer}\t%{GREEDYDATA:User_Agent}\t%{GREEDYDATA:cs_uri_stem}\t%{GREEDYDATA:cookies}\t%{WORD:x_edge_result_type}\t%{NOTSPACE:x_edge_request_id}\t%{HOSTNAME:x_host_header}\t%{URIPROTO:cs_protocol}\t%{INT:cs_bytes}\t%{GREEDYDATA:time_taken}\t%{GREEDYDATA:x_forwarded_for}\t%{GREEDYDATA:ssl_protocol}\t%{GREEDYDATA:ssl_cipher}\t%{GREEDYDATA:x_edge_response_result_type}"
  }

mutate {
    type => "cloudfront"
        add_field => [ "listener_timestamp", "%{date} %{time}" ]
    }

date {
      type => "cloudfront"
      match => [ "listener_timestamp", "yy-MM-dd HH:mm:ss" ]
    }

}

几个月来，我一直在成功使用 mongodb 食谱创建用户帐户，但最近发生了一些变化，我不知道它是什么。默认配方完成且没有错误，并且成功安装了 mongodb 服务器，但是 user_management 配方失败并出现错误NameError: uninitialized constant Mongo::MongoClient。

这是在具有 chef 版本 11.10 和 Berkshelf 版本 3.2.0 的 AWS Opsworks 环境中。

伯克斯文件

source "https://supermarket.chef.io"
cookbook 'mongodb', '~> 0.16.1', github: 'edelight/chef-mongodb'

这是我在层中使用的自定义 json 的 mongodb 部分：

"mongodb": {
    "dbconfig_file": "/etc/mongod.conf",
    "sysconfig_file": "/etc/default/mongod",
    "default_init_name": "mongod",
    "instance_name": "mongod",
    "admin": {
        "username": "admin",
        "password": "xxxxx"
    },
    "config": {
        "auth": true,
        "bind_ip": "0.0.0.0",
        "port": "27017",
        "logpath": "/var/log/mongo/mongod.log",
        "dbpath": "/var/lib/mongo"
    },
    "authentication": {
        "username": "admin",
        "password": "xxxxx"
    },
    "users": [
        {
            "username": "mongodb-dba1",
            "password": "xxxxx",
            "roles": [
                "root"
            ],
            "database": "admin"
        },
        {
            "username": "mongodb-rw1",
            "password": "xxxxx",
            "roles": [
                "readWrite"
            ],
            "database": "apis_cache"
        },
        {
            "username": "mongodb-r1",
            "password": "xxxxx",
            "roles": [
                "read"
            ],
            "database": "apis_cache"
        },
        {
            "username": "admin",
            "password": "xxxxx",
            "roles": [
                "userAdminAnyDatabase",
                "dbAdminAnyDatabase"
            ],
            "database": "admin"
        }
    ]
},

这是我执行 mongodb::user_management 配方时的 opsworks 日志。

[2015-04-14T13:33:31+00:00] INFO: Processing chef_gem[mongo] action install (mongodb::user_management line 1)
[2015-04-14T13:33:32+00:00] WARN: Cloning resource attributes for mongodb_user[admin] from prior resource (CHEF-3694)
[2015-04-14T13:33:32+00:00] WARN: Previous mongodb_user[admin]: /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb:14:in `block in from_file'
[2015-04-14T13:33:32+00:00] WARN: Current  mongodb_user[admin]: /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb:14:in `block in from_file'
[2015-04-14T13:33:32+00:00] INFO: Processing template[/etc/hosts] action create (opsworks_stack_state_sync::hosts line 3)
[2015-04-14T13:33:32+00:00] INFO: Processing template[/etc/motd.opsworks-static] action create (opsworks_stack_state_sync::motd line 1)
[2015-04-14T13:33:32+00:00] INFO: Processing chef_gem[mongo] action install (mongodb::user_management line 1)
[2015-04-14T13:33:32+00:00] INFO: Processing mongodb_user[admin] action add (mongodb::user_management line 14)

================================================================================
Error executing action `add` on resource 'mongodb_user[admin]'
================================================================================

NameError
---------
uninitialized constant Mongo::MongoClient

Cookbook Trace:
---------------
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:62:in `retrieve_db'
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:9:in `add_user'
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:71:in `block in class_from_file'

Resource Declaration:
---------------------
# In /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb

14:   mongodb_user user['username'] do
15:     password user['password']
16:     roles user['roles']
17:     database user['database']
18:     connection node['mongodb']
19:     action :add
20:   end
21: end


Compiled Resource:
------------------
# Declared in /var/lib/aws/opsworks/cache.stage2/cookbooks/mongod/recipes/user_management.rb:14:in `block in from_file'

mongodb_user("admin") do
action [:add]
retries 0
retry_delay 2
cookbook_name "mongodb"
recipe_name "user_management"
password "xxxxx"
roles ["userAdminAnyDatabase", "dbAdminAnyDatabase"]
database "admin"
connection {"client_roles"=>[], "cluster_name"=>nil, "shard_name"=>"default", "replica_arbiter_only"=>false, "replica_build_indexes"=>true, "replica_hidden"=>false, "replica_slave_delay"=>0, "replica_priority"=>1, "replica_tags"=>{}, "replica_votes"=>1, "auto_configure"=>{"replicaset"=>true, "sharding"=>true}, "configserver_url"=>nil, "root_group"=>"root", "user"=>"mongodb", "group"=>"mongodb", "init_dir"=>"/etc/init/", "init_script_template"=>"debian-mongodb.upstart.erb", "sysconfig_file"=>"/etc/default/mongod", "sysconfig_file_template"=>"mongodb.sysconfig.erb", "dbconfig_file_template"=>"mongodb.conf.erb", "dbconfig_file"=>"/etc/mongod.conf", "package_name"=>"mongodb", "package_version"=>nil, "default_init_name"=>"mongod", "instance_name"=>"mongod", "install_method"=>"distro", "is_replicaset"=>nil, "is_shard"=>nil, "is_configserver"=>nil, "reload_action"=>"restart", "apt_repo"=>"ubuntu-upstart", "template_cookbook"=>"mongodb", "key_file_content"=>nil, "ruby_gems"=>{"mongo"=>nil, "bson_ext"=>nil}, "config"=>{"port"=>"27017", "bind_ip"=>"0.0.0.0", "logpath"=>"/var/log/mongo/mongod.log", "logappend"=>true, "fork"=>false, "dbpath"=>"/var/lib/mongo", "nojournal"=>false, "rest"=>false, "smallfiles"=>false, "oplogSize"=>nil, "replSet"=>nil, "auth"=>true}, "mms_agent"=>{"api_key"=>nil, "package_url"=>"https://mms.mongodb.com/download/agent/%{agent_type}/mongodb-mms-%{agent_type}-agent", "monitoring"=>{"version"=>"2.2.0.70-1", "mmsApiKey"=>nil, "mmsBaseUrl"=>"https://mms.mongodb.com", "configCollectionsEnabled"=>true, "configDatabasesEnabled"=>true, "throttlePassesShardChunkCounts"=>10, "throttlePassesDbstats"=>20, "throttlePassesOplog"=>10, "disableProfileDataCollection"=>false, "disableGetLogsDataCollection"=>false, "disableLocksAndRecordStatsDataCollection"=>false, "enableMunin"=>true, "useSslForAllConnections"=>false, "sslRequireValidServerCertificates"=>false}, "backup"=>{"version"=>"2.1.0.106-1", "mmsApiKey"=>nil, "mothership"=>"api-backup.mongodb.com", "https"=>true, "sslRequireValidServerCertificates"=>false}, "user"=>"mongodb-mms-agent", "group"=>"mongodb-mms-agent"}, "sysconfig"=>{"DAEMON"=>"/usr/bin/$NAME", "DAEMON_USER"=>"mongodb", "DAEMON_OPTS"=>"--config /etc/mongod.conf", "CONFIGFILE"=>"/etc/mongod.conf", "ENABLE_MONGODB"=>"yes", "DAEMONUSER"=>"mongodb", "ENABLE_MONGOD"=>"yes", "ENABLE_MONGO"=>"yes"}, "ulimit"=>{"fsize"=>"unlimited", "cpu"=>"unlimited", "as"=>"unlimited", "nofile"=>64000, "rss"=>"unlimited", "nproc"=>32000}, "admin"=>{"username"=>"admin", "password"=>"xxxxx", "roles"=>["userAdminAnyDatabase", "dbAdminAnyDatabase"], "database"=>"admin"}, "users"=>[{"username"=>"mongodb-dba1", "password"=>"xxxxx", "roles"=>["root"], "database"=>"admin"}, {"username"=>"mongodb-rw1", "password"=>"xxxxx", "roles"=>["readWrite"], "database"=>"apis_cache"}, {"username"=>"mongodb-r1", "password"=>"xxxxx", "roles"=>["read"], "database"=>"apis_cache"}, {"username"=>"admin", "password"=>"xxxxx", "roles"=>["userAdminAnyDatabase", "dbAdminAnyDatabase"], "database"=>"admin"}], "save-state"=>"false", "restore-state"=>"false", "monit"=>"true", "pid_file"=>"/var/lib/mongo/mongod.lock", "start_command"=>"/usr/bin/env service mongod start", "stop_command"=>"/usr/bin/env service mongod stop", "authentication"=>{"username"=>"admin", "password"=>"xxxxx"}}
username "admin"
end

[2015-04-14T13:33:32+00:00] INFO: Running queued delayed notifications before re-raising exception
[2015-04-14T13:33:32+00:00] ERROR: Running exception handlers
[2015-04-14T13:33:32+00:00] ERROR: Exception handlers complete
[2015-04-14T13:33:32+00:00] FATAL: Stacktrace dumped to /var/lib/aws/opsworks/cache.stage2/chef-stacktrace.out
[2015-04-14T13:33:32+00:00] ERROR: mongodb_user[admin] (mongodb::user_management line 14) had an error: NameError: uninitialized constant Mongo::MongoClient
[2015-04-14T13:33:32+00:00] FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully (exit code 1)

更新：

我在最新提交的 chef.io cookbook 更新为“悲观地允许 1.X mongo gem”时遇到了同样的错误：

伯克斯文件

source "https://supermarket.chef.io"
cookbook 'mongodb', git: 'https://github.com/bellpeterm/chef-mongodb.git', ref: '45cdb7177a5f6e9b59dea2ec8e057321114e8a3c'

Opsworks 日志：

[2015-04-14T19:19:07+00:00] INFO: Processing chef_gem[mongo] action install (mongodb::mongo_gem line 20)
[2015-04-14T19:19:07+00:00] INFO: Installing chef-gem mongo ~> 1.12
[2015-04-14T19:19:16+00:00] INFO: Successfully installed bson-1.12.1
Successfully installed mongo-1.12.1
2 gems installed

[2015-04-14T19:19:16+00:00] INFO: Processing chef_gem[bson_ext] action install (mongodb::mongo_gem line 20)
[2015-04-14T19:19:19+00:00] INFO: Installing chef-gem bson_ext = 1.12.1
[2015-04-14T19:19:24+00:00] INFO: Building native extensions.  This could take a while...
Successfully installed bson_ext-1.12.1
1 gem installed

[2015-04-14T19:19:24+00:00] WARN: Cloning resource attributes for mongodb_user[admin] from prior resource (CHEF-3694)
[2015-04-14T19:19:24+00:00] WARN: Previous mongodb_user[admin]: /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb:14:in `block in from_file'
[2015-04-14T19:19:24+00:00] WARN: Current  mongodb_user[admin]: /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb:14:in `block in from_file'
[2015-04-14T19:19:24+00:00] INFO: Processing template[/etc/hosts] action create (opsworks_stack_state_sync::hosts line 3)
[2015-04-14T19:19:24+00:00] INFO: Processing template[/etc/motd.opsworks-static] action create (opsworks_stack_state_sync::motd line 1)
[2015-04-14T19:19:24+00:00] INFO: Processing package[gcc] action nothing (mongodb::mongo_gem line 3)
[2015-04-14T19:19:24+00:00] INFO: Processing package[libsasl2-dev] action nothing (mongodb::mongo_gem line 15)
[2015-04-14T19:19:24+00:00] INFO: Processing chef_gem[mongo] action install (mongodb::mongo_gem line 20)
[2015-04-14T19:19:24+00:00] INFO: Processing chef_gem[bson_ext] action install (mongodb::mongo_gem line 20)
[2015-04-14T19:19:24+00:00] INFO: Processing mongodb_user[admin] action add (mongodb::user_management line 14)

================================================================================
Error executing action `add` on resource 'mongodb_user[admin]'
================================================================================


NameError
---------
uninitialized constant Mongo::MongoClient


Cookbook Trace:
---------------
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:62:in `retrieve_db'
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:9:in `add_user'
/var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/providers/user.rb:71:in `block in class_from_file'


Resource Declaration:
---------------------
# In /var/lib/aws/opsworks/cache.stage2/cookbooks/mongodb/recipes/user_management.rb

14:   mongodb_user user['username'] do
15:     password user['password']
16:     roles user['roles']
17:     database user['database']
18:     connection node['mongodb']
19:     action :add
20:   end
21: end

谢谢你的帮助！

我在 python 2.7 弹性豆茎环境中工作。

我正在尝试使用 .ebextensions .config 文件中的sources键将 tgz 存档复制到我的应用程序根目录中的目录 -- /opt/python/current/app/utility。我这样做是因为此文件夹中的文件太大而无法包含在我的 github 存储库中。

但是，似乎在将 ondeck 符号链接创建到当前捆绑目录之前执行了源键，因此/opt/python/ondeck/app在使用源命令时我无法引用，因为它创建了文件夹，然后在尝试创建 ondeck 符号时出现 beanstalk 错误关联。

.ebextensions/utility.config以下是我尝试过的文件的副本：

sources:
  /opt/python/ondeck/app/utility: http://[bucket].s3.amazonaws.com/utility.tgz

以上成功复制到/opt/python/ondec/app/utility，但随后beantalk错误，因为它无法从/opt/python/bundle/x->/opt/python/ondeck创建符号链接。

sources:
  utility: http://[bucket].s3.amazonaws.com/utility.tgz

上面将文件夹复制到 /utility，与 /etc 并行。

环境：aws opsworks chef 11.10 和 ubuntu 14.04。

我正在使用厨师配方更新/etc/dhcp/dhclient.confaws opsworks ec2 节点上的文件，以便将我的自定义 dns 搜索后缀添加到/etc/resolv.conf文件中的搜索行。

file.insert_line_if_no_match仅当更新文件时，如何让我的配方重新启动节点？ 我显然不希望每次运行配方时都重新启动节点。

在我下面的代码片段中，值node['opsworks']['stack']['name']类似于a.dev.mydomain.com.

ruby_block "add custom dns domain search suffix" do
  block do
    file = Chef::Util::FileEdit.new("/etc/dhcp/dhclient.conf")
    file.insert_line_if_no_match("/append domain-search/", "append domain-search \"#{node['opsworks']['stack']['name']}\";")
    file.write_file
  end
end

上面的代码片段将最后一行添加到/etc/dhcp/dhclient.conf：

# Configuration file for /sbin/dhclient, which is included in Debian's
#       dhcp3-client package.
#
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
send host-name = gethostname();
request subnet-mask, broadcast-address, time-offset, routers,
        domain-name, domain-name-servers, domain-search, host-name,
        dhcp6.name-servers, dhcp6.domain-search,
        netbios-name-servers, netbios-scope, interface-mtu,
        rfc3442-classless-static-routes, ntp-servers,
        dhcp6.fqdn, dhcp6.sntp-servers;
append domain-search "a.dev.mydomain.com";

重启后/etc/dhcp/dhclient.conf修改如下：

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 172.16.0.23
search ec2.internal a.dev.mydomain.com

注意：我认为尝试在文件更新后使用类似 a 的设置来实施设置风险太大sudo dhclient -r; sudo dhclient，但我很想知道是否有人在不重新启动的情况下获得了这种类型的更新。

在 AWS Opsworks 中运行的 Chef 11.10.4 环境。

我不知道如何使用节点属性传递下面的“each do”块变量“lyr”的值node['aws-tag'][#{lyr}]？

下面的代码块适用于第 02-06 行，但不适用于第 07-14 行。

[01] include_recipe "aws"
[02] unless node['aws-tag']['tags'].empty? || node['aws-tag']['tags'].nil?
[03]    aws_resource_tag node['ec2']['instance_id'] do
[04]        tags(node['aws-tag']['tags'])
[05]        action :update
[06]    end
[07]    node['opsworks']['instance']['layers'].each do |lyr|
[08]        unless node['aws-tag'][#{lyr}].empty? || node['aws-tag'][#{lyr}].nil?
[09]            aws_resource_tag node['ec2']['instance_id'] do
[10]                tags(node['aws-tag'][#{lyr}])
[11]                action :update
[12]            end
[13]        end
[14]    end
[15] end

以下是 chef-shell 的结果，显示了上面代码中引用的属性值：

厨师>节点['opsworks']['instance']['layers'] => [“mongodb”]

chef > node['aws-tag'] => {"tags"=>{"application"=>"app1", "environment"=>"dev"}, "mongodb"=>{"service"=>" mongodb"}}

注意：我正在修改chef-aws-tag食谱以使用标签标记所有 ec2 实例，node['aws-tag']['tags']此外还标记每个 ec2 实例 opsworks 层特定标签，这些标签包含在按层传递给 opsworks 的自定义 json 中，在这种情况下node['aws-tag']['mongodb']or的内容node['aws-tag']['LAYER']，一般来说。

如果我运行上面的代码，我会得到一个配方编译错误：“unexpected keyword_do_block, expecting ']'”——请参阅下面的 opsworks 的详细错误消息：

================================================================================
Recipe Compile Error in /var/lib/aws/opsworks/cache.stage2/cookbooks/chef-aws-tag/recipes/ec2.rb
================================================================================


SyntaxError
-----------
/var/lib/aws/opsworks/cache.stage2/cookbooks/chef-aws-tag/recipes/ec2.rb:9: syntax error, unexpected keyword_do_block, expecting ']'
/var/lib/aws/opsworks/cache.stage2/cookbooks/chef-aws-tag/recipes/ec2.rb:12: syntax error, unexpected keyword_end, expecting ']'


Cookbook Trace:
---------------
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/mixin/from_file.rb:30:in `instance_eval'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/mixin/from_file.rb:30:in `from_file'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/cookbook_version.rb:237:in `load_recipe'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context.rb:151:in `load_recipe'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context/cookbook_compiler.rb:139:in `block in compile_recipes'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context/cookbook_compiler.rb:137:in `each'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context/cookbook_compiler.rb:137:in `compile_recipes'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context/cookbook_compiler.rb:74:in `compile'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/run_context.rb:86:in `load'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/policy_builder/expand_node_object.rb:75:in `setup_run_context'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/client.rb:252:in `setup_run_context'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/client.rb:413:in `do_run'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/client.rb:200:in `block in run'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/client.rb:194:in `fork'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/client.rb:194:in `run'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/application.rb:215:in `run_chef_client'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/application/client.rb:314:in `block in run_application'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/application/client.rb:306:in `loop'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/application/client.rb:306:in `run_application'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/application.rb:66:in `run'
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/bin/chef-client:26:in `<top (required)>'
/opt/aws/opsworks/current/bin/chef-client:16:in `load'
/opt/aws/opsworks/current/bin/chef-client:16:in `<main>'


Relevant File Content:
----------------------
/opt/aws/opsworks/releases/20141010064749_328/vendor/bundle/ruby/2.0.0/gems/chef-11.10.4/lib/chef/mixin/from_file.rb:

23: 
24:        # Loads a given ruby file, and runs instance_eval against it in the context of the current
25:        # object.
26:        #
27:        # Raises an IOError if the file cannot be found, or is not readable.
28:        def from_file(filename)
29:          if File.exists?(filename) && File.readable?(filename)
30>>           self.instance_eval(IO.read(filename), filename, 1)
31:          else
32:            raise IOError, "Cannot open or read #{filename}!"
33:          end
34:        end
35: 
36:        # Loads a given ruby file, and runs class_eval against it in the context of the current
37:        # object.
38:        #
39:        # Raises an IOError if the file cannot be found, or is not readable.



[2014-10-28T17:43:22+00:00] ERROR: Running exception handlers
[2014-10-28T17:43:22+00:00] ERROR: Exception handlers complete
[2014-10-28T17:43:22+00:00] FATAL: Stacktrace dumped to /var/lib/aws/opsworks/cache.stage2/chef-stacktrace.out
[2014-10-28T17:43:22+00:00] ERROR: /var/lib/aws/opsworks/cache.stage2/cookbooks/chef-aws-tag/recipes/ec2.rb:9: syntax error, unexpected keyword_do_block, expecting ']'
/var/lib/aws/opsworks/cache.stage2/cookbooks/chef-aws-tag/recipes/ec2.rb:12: syntax error, unexpected keyword_end, expecting ']'
[2014-10-28T17:43:22+00:00] FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully (exit code 1)

我想在 aws opsworks ec2 服务器上使用chef-shell会话，这样我就可以测试一些我想包含在自定义配方中的环境和实例特定代码。例如，我想查看node[:opsworks][:instance][:layers] 或 node[:opsworks][:instance][:public_dns_name] 等实例属性的输出以及我传递的数据使用自定义 json到 opsworks 堆栈。

我可以启动 chef-shell，我只是不知道如何使用它来访问 opsworks 属性。

如果我 ssh 进入 opsworks ec2 实例，我可以访问像 node['ec2']['instance_id'] 这样的属性，但没有像 node['opsworks']['instance']['layers'] 这样的 opsworks 特定属性

root@mongodb1:/opt/aws/opsworks/current/bin# ./chef-shell
loading configuration: none (standalone session)
Session type: standalone
Loading......done.

This is the chef-shell.
 Chef Version: 11.10.4
 http://www.opscode.com/chef
 http://docs.opscode.com/

run `help' for help, `exit' or ^D to quit.

Ohai2u [email protected]!
chef > attributes_mode
chef:attributes > node['ec2']['instance_id']
 => "i-c1a98f2c"
chef:attributes > node['opsworks']['instance']['layers']
NoMethodError: undefined method `[]' for nil:NilClass
        from (irb#1):4
chef:attributes >

5 月，AWS 引入了标记弹性 beanstalk 环境的功能。 当我们使用“eb start”创建弹性 beanstalk 环境时，我们无法弄清楚如何标记它。

我们使用“eb 命令行界面”来创建我们的环境。使用这种机制，您可以通过命令行或使用.elasticbeanstalk/optionsettings 传递配置参数。environment_name文件。有人知道如何使用选项设置文件标记环境吗？

如果没有，是否有人知道在创建环境后标记环境的方法？

有谁知道如何从源代码创建一个包含 isql 的 virtuoso-opensource 7.1 ubuntu deb 包？

如果我make install从源执行 avirtuoso-t并isql安装到/usr/local/virtuoso-opensource/bin文件夹，但是，如果我dpkg-buildpackage在同一源上执行 a，它只会安装/usr/bin/virtuoso-t但isql不包括在内。

安装 7.1（包括 isql）

 apt-get install -y bison libtool flex gperf autoconf gawk make libssl-dev wget unzip
 wget --no-check-certificate -q https://github.com/openlink/virtuoso-opensource/archive/develop/7.zip -O virtuoso-opensource.zip
 unzip -q virtuoso-opensource.zip
 cd virtuoso-opensource
 ./autogen
 ./configure
 make
 sudo make install

结果是一个bin带有virtuoso-t, isql,isqlw等的目录：

/usr/local/virtuoso-opensource/bin/:
total 13544
-rw-r--r-- 1       95 Sep  8 12:06 backup.sql
-rwxr-xr-x 1    31840 Jun 18 15:39 inifile
-rwxr-xr-x 1   518984 Jun 18 15:39 isql
-rwxr-xr-x 1   649128 Jun 18 15:39 isqlw
-rwxr-xr-x 1   439856 Jun 18 15:39 virt_mail
-rwxr-xr-x 1 12214992 Jun 18 15:39 virtuoso-t

7.1的打包安装（里面没有isql）

但是，如果我从与上述相同的源构建一个 deb 包并安装它，我只会得到/usr/bin/virtuoso-t而不是isql,isqlw等。

 apt-get install -y bison libtool flex gperf autoconf gawk make libssl-dev wget unzip
 apt-get install -y build-essential debhelper autotools-dev automake net-tools m4 libreadline-dev openssl
 wget --no-check-certificate -q https://github.com/openlink/virtuoso-opensource/archive/develop/7.zip -O virtuoso-opensource.zip
 unzip -q virtuoso-opensource.zip
 cd virtuoso-opensource
 dpkg-buildpackage -us -uc -rfakeroot
 cd ..
 dpkg -i virtuoso-opensource_7.1_amd64.deb

注意：Nolan Nichols 发布了一个构建 virtuoso-opensource 7.1 服务器的 dockerfile（尽管它也没有isql）。

6.1 服务器包（包括isql）

Openlink 有关于做我想做的事情的说明，但对于旧版本，我无法弄清楚如何将这些说明调整到 7.1。

 sudo apt-get update
 sudo aptitude install dpkg-dev build-essential
 mkdir C
 cd C
 apt-get source virtuoso-opensource
 cd virtuoso-opensource-6.1.2+dfsg1/
 sudo aptitude build-dep virtuoso-opensource
 dpkg-buildpackage -rfakeroot
 ls
      libvirtodbc0_6.1.2+dfsg1-1ubuntu4_amd64.deb
      libvirtuoso5.5-cil_6.1.2+dfsg1-1ubuntu4_amd64.deb
      virtuoso-minimal_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-nepomuk_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-opensource-6.0_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-opensource-6.1.2+dfsg1
      virtuoso-opensource_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-opensource_6.1.2+dfsg1-1ubuntu4_amd64.changes
      virtuoso-opensource_6.1.2+dfsg1-1ubuntu4.diff.gz
      virtuoso-opensource_6.1.2+dfsg1-1ubuntu4.dsc
      virtuoso-opensource_6.1.2+dfsg1.orig.tar.gz
      virtuoso-opensource-6.1_6.1.2+dfsg1-1ubuntu4_amd64.deb
      virtuoso-opensource-6.1-bin_6.1.2+dfsg1-1ubuntu4_amd64.deb
      virtuoso-opensource-6.1-common_6.1.2+dfsg1-1ubuntu4_amd64.deb
      virtuoso-server_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-bpel_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-conductor_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-demo_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-doc_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-isparql_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-ods_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-cartridges_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-sparqldemo_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-syncml_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vad-tutorial_6.1.2+dfsg1-1ubuntu4_all.deb
      virtuoso-vsp-startpage_6.1.2+dfsg1-1ubuntu4_all.deb

六个月以来，我们一直在使用 PowerBroker Identity Services Open 成功地对来自 ubuntu 主机的活动目录用户进行身份验证。

apt-get upgrade最近，在用户一次执行 200 多个包后，AD 身份验证在多个工作站上停止工作。身份验证尝试给出错误“密码无效”、“用户帐户已过期”或“您的帐户是否被锁定？”

我无法将问题与特定的软件包升级相关联，但使用相同软件包版本从头开始构建的工作站不会遇到此问题。我已经尝试重新安装 PBIS 并验证了所有配置文件，但我遗漏了一些东西....我很茫然，并且希望得到任何人的任何建议。下次发生这种情况时，我宁愿不必重建另一个盒子！

身份验证尝试

我首先验证了 AD 用户帐户已启用、未锁定且未过期。本地用户身份验证通过 lightdm 和 ssh 工作正常。

1. 轻量级

   • 有效凭证
     • 错误返回给用户“密码无效，请重试。”
     • auth.log：没有
     • 系统日志：没有

   • 密码错误

     • 错误返回给用户“密码无效，请重试。”

     • 身份验证日志：

       lightdm: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:username][error code:40022]
       

     • 系统日志：

       lsass: [LwKrb5GetTgtImpl /builder/src-buildserver/Platform-8.0/src/linux/lwadvapi/threaded/krbtgt.c:276] KRB5 Error code: -1765328360 (Message: Preauthentication failed)
       lsass: [lsass] Failed to authenticate user (name = 'username') -> error = 40022, symbol = LW_ERROR_PASSWORD_MISMATCH, client pid = 17768
       

2. SSH

   • 有效凭证

     • 使用“IP_ADDRESS 关闭连接”的 ssh 断开连接。

     • 身份验证日志：

       sshd[18237]: error: PAM: User account has expired for DOMAIN\\USER from HOSTNAME
       sshd[18237]: error: Received disconnect from IP_ADDRESS: 13: Unable to authenticate [preauth]
       

     • 系统日志：没有

   • 密码错误

     • 使用“IP_ADDRESS 关闭连接”的 ssh 断开连接。

     • 身份验证日志：

       sshd[18276]: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:domain\username][error code:40022]
       sshd[18272]: error: PAM: Authentication failure for domain\\username from hostname
       

     • 系统日志

       lsass: [LwKrb5GetTgtImpl /builder/src-buildserver/Platform-8.0/src/linux/lwadvapi/threaded/krbtgt.c:276] KRB5 Error code: -1765328360 (Message: Preauthentication failed)
       lsass: [lsass] Failed to authenticate user (name = 'domain\username') -> error = 40022, symbol = LW_ERROR_PASSWORD_MISMATCH, client pid = 18276
       

3. 只是尝试一些疯狂的本地东西（不，该帐户未锁定在 AD 中）

           root@hostname:~# su - domain\\username
           su: Authentication failure
           (Ignored)
           reenter password for pam_mount:
           DOMAIN\username@hostname:~$ sudo cat /etc/fstab
           [sudo] password for DOMAIN\username:
           sudo: account validation failure, is your account locked?
           DOMAIN\username@hostname:~$
   

配置

• Ubuntu 14.04
• PBIS 开放 8.0.1.2029 (pbis-open-8.0.1.2029.linux.x86_64.deb.sh)

• /opt/pbis/bin/config --dump

  AllowDeleteTo ""  
  AllowReadTo ""  
  AllowWriteTo ""
  MaxDiskUsage 104857600
  MaxEventLifespan 90
  MaxNumEvents 100000
  DomainSeparator "\\"
  SpaceReplacement "^"
  EnableEventlog false
  Providers "ActiveDirectory"
  DisplayMotd false
  PAMLogLevel "error"
  UserNotAllowedError "Access denied"
  AssumeDefaultDomain true
  CreateHomeDir true
  CreateK5Login true
  SyncSystemTime true
  TrimUserMembership true
  LdapSignAndSeal false
  LogADNetworkConnectionEvents true
  NssEnumerationEnabled true
  NssGroupMembersQueryCacheOnly true
  NssUserMembershipQueryCacheOnly false
  RefreshUserCredentials true
  CacheEntryExpiry 14400
  DomainManagerCheckDomainOnlineInterval 300
  DomainManagerUnknownDomainCacheTimeout 3600
  MachinePasswordLifespan 2592000
  MemoryCacheSizeCap 0
  HomeDirPrefix "/home"
  HomeDirTemplate "%H/%D/%U"
  RemoteHomeDirTemplate ""
  HomeDirUmask "022"
  LoginShellTemplate "/bin/bash"
  SkeletonDirs "/etc/skel"
  UserDomainPrefix "DOMAIN.COM"
  DomainManagerIgnoreAllTrusts false
  DomainManagerIncludeTrustsList
  DomainManagerExcludeTrustsList
  RequireMembershipOf "DOMAIN\\DOMAIN-GROUP"
  Local_AcceptNTLMv1 true
  Local_HomeDirTemplate "%H/local/%D/%U"
  Local_HomeDirUmask "022"
  Local_LoginShellTemplate "/bin/sh"
  Local_SkeletonDirs "/etc/skel"
  UserMonitorCheckInterval 1800
  LsassAutostart true
  EventlogAutostart true
  

• /opt/pbis/bin/get-status

  LSA Server Status:
  
  Compiled daemon version: 8.0.1.2029
  Packaged product version: 8.0.2029.67662
  Uptime:        1 days 1 hours 4 minutes 26 seconds
  
  [Authentication provider: lsa-activedirectory-provider]
  
          Status:        Online
          Mode:          Un-provisioned
          Domain:        DOMAIN.COM
          Domain SID:    S-1-5-21-3537566271-1428921453-776812789
          Forest:        domain.com
          Site:          NYC
          Online check interval:  300 seconds
          [Trusted Domains: 1]
  
  
          [Domain: DOMAIN]
  
                  DNS Domain:       domain.com
                  Netbios name:     DOMAIN
                  Forest name:      domain.com
                  Trustee DNS name:
                  Client site name: NYC
                  Domain SID:       S-1-5-21-3537566271-1428921453-776812789
                  Domain GUID:      0b6b6d88-ea48-314a-8bad-a997a57bc1f4
                  Trust Flags:      [0x001d]
                                    [0x0001 - In forest]
                                    [0x0004 - Tree root]
                                    [0x0008 - Primary]
                                    [0x0010 - Native]
                  Trust type:       Up Level
                  Trust Attributes: [0x0000]
                  Trust Direction:  Primary Domain
                  Trust Mode:       In my forest Trust (MFT)
                  Domain flags:     [0x0001]
                                    [0x0001 - Primary]
  
                  [Domain Controller (DC) Information]
  
                          DC Name:              dc2.nyc.domain.com
                          DC Address:           10.x.x.50
                          DC Site:              NYC
                          DC Flags:             [0x0000f1fc]
                          DC Is PDC:            no
                          DC is time server:    yes
                          DC has writeable DS:  yes
                          DC is Global Catalog: yes
                          DC is running KDC:    yes
  
                  [Global Catalog (GC) Information]
  
                          GC Name:              dc1.nyc.domain.com
                          GC Address:           10.x.x.50
                          GC Site:              NYC
                          GC Flags:             [0x0000f3fd]
                          GC Is PDC:            yes
                          GC is time server:    yes
                          GC has writeable DS:  yes
                          GC is running KDC:    yes
  

• /opt/pbis/bin/find-objects --user 用户名

  User object [1 of 1] (S-1-5-21-3537566271-1428921453-776812789-1107)
  ============
  Enabled: yes
  Distinguished name: CN=USERNAME,OU=User,OU=User Accounts,DC=domain,DC=com
  SAM account name: username
  NetBIOS domain name: DOMAIN
  UPN: [email protected]
  Display Name: First Last
  Alias: <null>
  UNIX name: DOMAIN\username
  GECOS: First LAst
  Shell: /bin/bash
  Home directory: /home/DOMAIN/username
  Windows home directory: \\domain.com\dfs\NYC\Users\username
  Local windows home directory:
  UID: 1023411283
  Primary group SID: S-1-5-21-3537566271-1428921453-776812789-513
  Primary GID: 1023410689
  Password expired: no
  Password never expires: yes
  Change password on next logon: no
  User can change password: yes
  Account disabled: no
  Account expired: no
  Account locked: no    
  

• /etc/pbis/pbis-krb5-ad.conf

  [libdefaults]
      default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
      default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
      preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
      dns_lookup_kdc = true
      pkinit_kdc_hostname = <DNS>
      pkinit_anchors = DIR:/var/lib/pbis/trusted_certs
      pkinit_cert_match = &&<EKU>msScLogin<PRINCIPAL>
      pkinit_eku_checking = kpServerAuth
      pkinit_win2k_require_binding = false
      pkinit_identities = PKCS11:/opt/pbis/lib/libpkcs11.so
  

• /etc/pam.d/common-session

  session [default=1]                     pam_permit.so
  session requisite                       pam_deny.so
  session required                        pam_permit.so
  session optional                        pam_umask.so
  session required                        pam_unix.so
  session optional                        pam_mount.so
  session [success=ok default=ignore]     pam_lsass.so
  session optional                        pam_systemd.so
  

• /etc/pam.d/common-auth

  auth    [success=2 default=ignore]      pam_unix.so nullok_secure
  auth    [success=1 default=ignore]      pam_lsass.so try_first_pass
  auth    requisite                       pam_deny.so
  auth    required                        pam_permit.so
  auth    optional                        pam_cap.so
  auth    optional                        pam_mount.so
  

• /opt/pbis/share/pbis.pam-auth-update

  Name: Likewise
  Default: yes
  Priority: 250
  Conflicts: winbind
  Auth-Type: Primary
  Auth:
          [success=end default=ignore]    pam_lsass.so try_first_pass
  Auth-Initial:
          [success=end default=ignore]    pam_lsass.so
  Account-Type: Primary
  Account:
          [success=ok new_authtok_reqd=ok default=ignore]         pam_lsass.so unknown_ok
          [success=end new_authtok_reqd=done default=ignore]      pam_lsass.so
  Session-Type: Additional
  Session:
          sufficient      pam_lsass.so
  Password-Type: Primary
  Password:
          [success=end default=ignore]    pam_lsass.so use_authtok try_first_pass
  Password-Initial:
          [success=end default=ignore]    pam_lsass.so
  

• /usr/share/lightdm/lightdm.conf.d/50-ubuntu.conf

  [SeatDefaults]
  user-session=ubuntu
  greeter-show-manual-login=true
  

• /usr/share/lightdm/lightdm.conf.d/50-unity-greeter.conf

  [SeatDefaults]
  allow-guest=false
  greeter-show-remote-login=false
  greeter-show-manual-login=true
  greeter-session=unity-greeter
  

我是新来的厨师，想使用 rabbitmq user_management 配方，而不是添加 rabbitmq 来宾帐户的默认行为。

我正在使用 chef-server 11.1.3 和 rabbitmq cookbook 版本 3.3.0 ( https://supermarket.getchef.com/cookbooks/rabbitmq ) 在 ubuntu 14.04 上安装和配置 rabbitmq 3.3.5。

我定义了一个厨师角色，我使用 user_management 配方和 disabled_users 删除来宾帐户，但每次运行厨师客户端时，来宾帐户首先添加到rabbitmq，然后再次删除（从“-执行”行中可以看到下面的 client.log 输出）。我究竟做错了什么？

/var/log/chef/client.log 输出

Recipe: rabbitmq::user_management
  * rabbitmq_user[guest] action addRecipe: <Dynamically Defined Resource>
  * execute[rabbitmqctl add_user guest] action run
    - execute rabbitmqctl add_user guest 'guest'

Recipe: rabbitmq::user_management
  * rabbitmq_user[guest] action set_tags (up to date)
  * rabbitmq_user[guest] action set_permissionsRecipe: <Dynamically Defined Resource>
  * execute[rabbitmqctl set_permissions  guest ".*" ".*" ".*"] action run
    - execute rabbitmqctl set_permissions  guest ".*" ".*" ".*"

Recipe: rabbitmq::user_management
  * rabbitmq_user[user1] action add (up to date)
  * rabbitmq_user[user1] action set_tags (up to date)
  * rabbitmq_user[user1] action set_permissionsRecipe: <Dynamically Defined Resource>
  * execute[rabbitmqctl set_permissions -p / user1 ".*" ".*" ".*"] action run
    - execute rabbitmqctl set_permissions -p / user1 ".*" ".*" ".*"

Recipe: rabbitmq::user_management
  * rabbitmq_user[guest] action deleteRecipe: <Dynamically Defined Resource>
  * execute[rabbitmqctl delete_user guest] action run
    - execute rabbitmqctl delete_user guest

我的厨师角色

{
  "name": "server-rabbitmq-test",
  "description": "testing",
  "json_class": "Chef::Role",
  "default_attributes": {
    "rabbitmq": {
      "version": "3.3.5",
      "use_distro_version": "true",
      "port": "5672",
      "virtualhosts": [
        "/vhost1"
      ],
      "disabled_users": [
        "guest"
      ],
      "enabled_users": [
        {
          "name": "user1",
          "password": "user1",
          "tag": "user tag",
          "rights": [
            {
              "vhost": "/vhost1",
              "conf": ".*",
              "write": ".*",
              "read": ".*"
            }
          ]
        }
      ]
    }
  },
  "override_attributes": {
  },
  "chef_type": "role",
  "run_list": [
    "recipe[rabbitmq]",
    "recipe[rabbitmq::mgmt_console]",
    "recipe[rabbitmq::policy_management]",
    "recipe[rabbitmq::user_management]",
    "recipe[rabbitmq::virtualhost_management]",
    "recipe[rabbitmq::plugin_management]"
  ],
  "env_run_lists": {
  }
}

修改rabbitmq食谱？？？

我可以通过更改 rabbitmq/attributes/default.rb 文件来停止该行为：

# users
default['rabbitmq']['enabled_users'] =
  [{ :name => 'guest', :password => 'guest', :rights =>
    [{ :vhost => nil , :conf => '.*', :write => '.*', :read => '.*' }]
  }]

对此：

# users
    default['rabbitmq']['enabled_users'] = []

但是必须有更好的方法来做到这一点，不是吗？

谢谢！！