一、主节点配置

注意：以下所有命令和脚本都是在 centos7 环境运行。
主节点：用于其他所有机器

  1. # 在主节点安装 ansible 用于控制其他机器
  2. yun update && yun install python3 python3-pip && pip3 install --upgrade pip
  4. pip3 install ansible
  6. yum install sshpass -y
  8. export ANSIBLE_HOST_KEY_CHECKING=False  # 屏蔽密码警告，需要设置
  9. export ANSIBLE_FORKS=3 # ansible 工作并发数，可以不设置

上面命令全部执行完毕且没有异常之后，开始简单配置 ansible。
新建文件：/etc/ansible/hosts

  1. [ssr] # 此处ssr只是个标签名字，后面会用到
  2. 54.169.168.254
  3. 54.169.111.130
  4. 13.228.203.107
  5. ... 被控制机器ip列表
  7. [all:vars]
  8. ansible_ssh_port=22 # 机器远程ssh连接端口，如果不知道默认就是22
  9. ansible_ssh_user=root # 机器连接用户名
  10. ansible_ssh_pass=Rzxxxxx # 机器连接密码

新建文件：/root/install-ssr-server.sh，改文件为ssr服务安装脚本
改脚本的第292行的41218是机器需要映射的端口，可以自行修改。
该脚本可以通过远程或者拷贝的方式新建，远程可使用：wget “https://github.com/h1code2/opt/raw/main/shell/install-ssr.sh“ -O install-ssr-server.sh 下载

  1. #!/bin/bash
  2. # shadowsocksR/SSR CentOS 7/8一键安装
  4. RED="\033[31m"      # Error message
  5. GREEN="\033[32m"    # Success message
  6. YELLOW="\033[33m"   # Warning message
  7. BLUE="\033[36m"     # Info message
  8. PLAIN='\033[0m'
  10. V6_PROXY=""
  11. IP=`curl -sL -4 ip.sb`
  12. if [[ "$?" != "0" ]]; then
  13.     IP=`curl -sL -6 ip.sb`
  14.     V6_PROXY="https://gh.hijk.art/"
  15. fi
  17. FILENAME="ShadowsocksR-v3.2.2"
  18. URL="${V6_PROXY}https://github.com/shadowsocksrr/shadowsocksr/archive/3.2.2.tar.gz"
  19. BASE=`pwd`
  21. OS=`hostnamectl | grep -i system | cut -d: -f2`
  23. CONFIG_FILE="/etc/shadowsocksR.json"
  25. colorEcho() {
  26.     echo -e "${1}${@:2}${PLAIN}"
  27. }
  30. checkSystem() {
  31.     result=$(id | awk '{print $1}')
  32.     if [ $result != "uid=0(root)" ]; then
  33.         colorEcho $RED " 请以root身份执行该脚本"
  34.         exit 1
  35.     fi
  37.     if [ ! -f /etc/centos-release ];then
  38.         res=`which yum`
  39.         if [ "$?" != "0" ]; then
  40.             colorEcho $RED " 系统不是CentOS"
  41.             exit 1
  42.          fi
  43.     else
  44.         result=`cat /etc/centos-release|grep -oE "[0-9.]+"`
  45.         main=${result%%.*}
  46.         if [ $main -lt 7 ]; then
  47.             colorEcho $RED " 不受支持的CentOS版本"
  48.             exit 1
  49.          fi
  50.     fi
  51. }
  53. slogon() {
  54.     clear
  55.     echo "#############################################################"
  56.     echo -e "#         ${RED} ShadowsocksR/SSR 一键安装脚本${PLAIN}           #"
  57.     echo "#############################################################"
  58.     echo ""
  59. }
  61. getData() {
  62.     read -p " 请设置SSR的密码（不输入则随机生成）:" PASSWORD
  63.     [ -z "$PASSWORD" ] && PASSWORD=`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1`
  64.     echo ""
  65.     colorEcho $BLUE " 密码： $PASSWORD"
  66.     echo ""
  68.     while true
  69.     do
  70.         read -p " 请设置SSR的端口号[1-65535]:" PORT
  71.         [ -z "$PORT" ] && PORT="12345"
  72.         if [ "${PORT:0:1}" = "0" ]; then
  73.             echo -e " ${RED}端口不能以0开头${PLAIN}"
  74.             exit 1
  75.         fi
  76.         expr $PORT + 0 &>/dev/null
  77.         if [ $? -eq 0 ]; then
  78.             if [ $PORT -ge 1 ] && [ $PORT -le 65535 ]; then
  79.                 echo ""
  80.                 colorEcho $BLUE " 端口号： $PORT"
  81.                 echo ""
  82.                 break
  83.             else
  84.                 colorEcho $RED " 输入错误，端口号为1-65535的数字"
  85.             fi
  86.         else
  87.             colorEcho $RED " 输入错误，端口号为1-65535的数字"
  88.         fi
  89.     done
  92.     colorEcho $BLUE " 请选择SSR的加密方式:"
  93.     echo "  1)aes-256-cfb"
  94.     echo "  2)aes-192-cfb"
  95.     echo "  3)aes-128-cfb"
  96.     echo "  4)aes-256-ctr"
  97.     echo "  5)aes-192-ctr"
  98.     echo "  6)aes-128-ctr"
  99.     echo "  7)aes-256-cfb8"
  100.     echo "  8)aes-192-cfb8"
  101.     echo "  9)aes-128-cfb8"
  102.     echo "  10)camellia-128-cfb"
  103.     echo "  11)camellia-192-cfb"
  104.     echo "  12)camellia-256-cfb"
  105.     echo "  13)chacha20-ietf"
  106.     read -p " 请选择加密方式（默认aes-256-cfb）" answer
  107.     if [ -z "$answer" ]; then
  108.         METHOD="aes-256-cfb"
  109.     else
  110.         case $answer in
  111.         1)
  112.             METHOD="aes-256-cfb"
  113.             ;;
  114.         2)
  115.             METHOD="aes-192-cfb"
  116.             ;;
  117.         3)
  118.             METHOD="aes-128-cfb"
  119.             ;;
  120.         4)
  121.             METHOD="aes-256-ctr"
  122.             ;;
  123.         5)
  124.             METHOD="aes-192-ctr"
  125.             ;;
  126.         6)
  127.             METHOD="aes-128-ctr"
  128.             ;;
  129.         7)
  130.             METHOD="aes-256-cfb8"
  131.             ;;
  132.         8)
  133.             METHOD="aes-192-cfb8"
  134.             ;;
  135.         9)
  136.             METHOD="aes-128-cfb8"
  137.             ;;
  138.         10)
  139.             METHOD="camellia-128-cfb"
  140.             ;;
  141.         11)
  142.             METHOD="camellia-192-cfb"
  143.             ;;
  144.         12)
  145.             METHOD="camellia-256-cfb"
  146.             ;;
  147.         13)
  148.             METHOD="chacha20-ietf"
  149.             ;;
  150.         *)
  151.             colorEcho $RED " 无效的选择，使用默认加密方式"
  152.             METHOD="aes-256-cfb"
  153.         esac
  154.     fi
  155.     echo ""
  156.     colorEcho $BLUE " 加密方式： $METHOD"
  157.     echo ""
  159.     colorEcho $BLUE " 请选择SSR协议："
  160.     echo "   1)origin"
  161.     echo "   2)verify_deflate"
  162.     echo "   3)auth_sha1_v4"
  163.     echo "   4)auth_aes128_md5"
  164.     echo "   5)auth_aes128_sha1"
  165.     echo "   6)auth_chain_a"
  166.     echo "   7)auth_chain_b"
  167.     echo "   8)auth_chain_c"
  168.     echo "   9)auth_chain_d"
  169.     echo "   10)auth_chain_e"
  170.     echo "   11)auth_chain_f"
  171.     read -p " 请选择SSR协议（默认origin）" answer
  172.     if [ -z "$answer" ]; then
  173.         PROTOCOL="origin"
  174.     else
  175.         case $answer in
  176.         1)
  177.             PROTOCOL="origin"
  178.             ;;
  179.         2)
  180.             PROTOCOL="verify_deflate"
  181.             ;;
  182.         3)
  183.             PROTOCOL="auth_sha1_v4"
  184.             ;;
  185.         4)
  186.             PROTOCOL="auth_aes128_md5"
  187.             ;;
  188.         5)
  189.             PROTOCOL="auth_aes128_sha1"
  190.             ;;
  191.         6)
  192.             PROTOCOL="auth_chain_a"
  193.             ;;
  194.         7)
  195.             PROTOCOL="auth_chain_b"
  196.             ;;
  197.         8)
  198.             PROTOCOL="auth_chain_c"
  199.             ;;
  200.         9)
  201.             PROTOCOL="auth_chain_d"
  202.             ;;
  203.         10)
  204.             PROTOCOL="auth_chain_e"
  205.             ;;
  206.         11)
  207.             PROTOCOL="auth_chain_f"
  208.             ;;
  209.         *)
  210.             colorEcho $RED " 无效的选择，使用默认协议"
  211.             PROTOCOL="origin"
  212.         esac
  213.     fi
  214.     echo ""
  215.     colorEcho $BLUE " SSR协议： $PROTOCOL"
  216.     echo ""
  219.     colorEcho $BLUE " 请选择SSR混淆模式："
  220.     echo "   1)plain"
  221.     echo "   2)http_simple"
  222.     echo "   3)http_post"
  223.     echo "   4)tls1.2_ticket_auth"
  224.     echo "   5)tls1.2_ticket_fastauth"
  225.     read -p " 请选择混淆模式（默认plain）" answer
  226.     if [ -z "$answer" ]; then
  227.         OBFS="plain"
  228.     else
  229.         case $answer in
  230.         1)
  231.             OBFS="plain"
  232.             ;;
  233.         2)
  234.             OBFS="http_simple"
  235.             ;;
  236.         3)
  237.             OBFS="http_post"
  238.             ;;
  239.         4)
  240.             OBFS="tls1.2_ticket_auth"
  241.             ;;
  242.         5)
  243.             OBFS="tls1.2_ticket_fastauth"
  244.             ;;
  245.         *)
  246.             colorEcho $RED " 无效的选择，使用默认混淆模式"
  247.             OBFS="plain"
  248.         esac
  249.     fi
  250.     echo ""
  251.     colorEcho $BLUE " 混淆模式： $OBFS"
  252.     echo ""
  253. }
  255. preinstall() {
  256.     colorEcho $BLUE " 更新系统..."
  257.     yum clean all
  258.     #yum update -y
  259.     colorEcho $BLUE " 安装必要软件"
  260.     yum install -y epel-release telnet curl wget vim net-tools libsodium openssl unzip tar qrencode
  261.     res=`which wget`
  262.     [ "$?" != "0" ] && yum install -y wget
  263.     res=`which netstat`
  264.     [ "$?" != "0" ] && yum install -y net-tools
  265.     if [ $main -eq 8 ]; then
  266.         ln -s /usr/bin/python3 /usr/bin/python
  267.     fi
  269.     if [ -s /etc/selinux/config ] && grep 'SELINUX=enforcing' /etc/selinux/config; then
  270.         sed -i 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
  271.         setenforce 0
  272.     fi
  273. }
  275. installSSR() {
  276.     if [ ! -d /usr/local/shadowsocks ]; then
  277.         echo 下载安装文件
  278.         if ! wget --no-check-certificate -O ${FILENAME}.tar.gz ${URL}; then
  279.             echo -e " [${RED}Error${PLAIN}] 下载文件失败!"
  280.             exit 1
  281.         fi
  283.         tar -zxf ${FILENAME}.tar.gz
  284.         mv shadowsocksr-3.2.2/shadowsocks /usr/local
  285.         if [ ! -f /usr/local/shadowsocks/server.py ]; then
  286.             colorEcho $RED " $OS 安装失败"
  287.             cd ${BASE} && rm -rf shadowsocksr-3.2.2 ${FILENAME}.tar.gz
  288.             exit 1
  289.         fi
  290.         cd ${BASE} && rm -rf shadowsocksr-3.2.2 ${FILENAME}.tar.gz
  291.     fi
  292.         PORT=41218
  293.         PASSWORD="uzon57jd0v869t7w"
  294.         METHOD="chacha20-ietf"
  295.         PROTOCOL="auth_aes128_sha1"
  296.         OBFS="plain"
  298.      cat > $CONFIG_FILE<<-EOF
  299. {
  300.     "server":"0.0.0.0",
  301.     "server_ipv6":"::",
  302.     "server_port":${PORT},
  303.     "local_port":1080,
  304.     "password":"${PASSWORD}",
  305.     "timeout":600,
  306.     "method":"${METHOD}",
  307.     "protocol":"${PROTOCOL}",
  308.     "protocol_param":"",
  309.     "obfs":"${OBFS}",
  310.     "obfs_param":"",
  311.     "redirect":"",
  312.     "dns_ipv6":false,
  313.     "fast_open":false,
  314.     "workers":1
  315. }
  316. EOF
  318. cat > /usr/lib/systemd/system/shadowsocksR.service <<-EOF
  319. [Unit]
  320. Description=shadowsocksR
  321. Documentation=https://hijk.art/
  322. After=network-online.target
  323. Wants=network-online.target
  325. [Service]
  326. Type=forking
  327. LimitNOFILE=32768
  328. ExecStart=/usr/local/shadowsocks/server.py -c $CONFIG_FILE -d start
  329. ExecReload=/bin/kill -s HUP \$MAINPID
  330. ExecStop=/bin/kill -s TERM \$MAINPID
  332. [Install]
  333. WantedBy=multi-user.target
  334. EOF
  336.     systemctl daemon-reload
  337.     systemctl enable shadowsocksR && systemctl restart shadowsocksR
  338.     sleep 3
  339.     res=`netstat -nltp | grep ${PORT} | grep python`
  340.     if [ "${res}" = "" ]; then
  341.         colorEcho $RED " ssr启动失败，请检查端口是否被占用！"
  342.         exit 1
  343.     fi
  344. }
  346. setFirewall() {
  347.     systemctl status firewalld > /dev/null 2>&1
  348.     if [[ $? -eq 0 ]];then
  349.         firewall-cmd --permanent --add-service=http
  350.         firewall-cmd --permanent --add-port=${PORT}/tcp
  351.         firewall-cmd --permanent --add-port=${PORT}/udp
  352.         firewall-cmd --reload
  353.     else
  354.         nl=`iptables -nL | nl | grep FORWARD | awk '{print $1}'`
  355.         if [[ "$nl" != "3" ]]; then
  356.             iptables -I INPUT -p tcp --dport 80 -j ACCEPT
  357.             iptables -I INPUT -p tcp --dport ${PORT} -j ACCEPT
  358.             iptables -I INPUT -p udp --dport ${PORT} -j ACCEPT
  359.         fi
  360.     fi
  361. }
  363. installBBR() {
  364.     result=$(lsmod | grep bbr)
  365.     if [ "$result" != "" ]; then
  366.         colorEcho $GREEN " BBR模块已安装"
  367.         INSTALL_BBR=false
  368.         return
  369.     fi
  370.     res=`hostnamectl | grep -i openvz`
  371.     if [ "$res" != "" ]; then
  372.         colorEcho $YELLOW " openvz机器，跳过安装"
  373.         INSTALL_BBR=false
  374.         return
  375.     fi
  377.     echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
  378.     echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
  379.     sysctl -p
  380.     result=$(lsmod | grep bbr)
  381.     if [[ "$result" != "" ]]; then
  382.         colorEcho $GREEN " BBR模块已启用"
  383.         INSTALL_BBR=false
  384.         return
  385.     fi
  387.     colorEcho $BLUE " 安装BBR模块..."
  388.     rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
  389.     rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-4.el7.elrepo.noarch.rpm
  390.     yum --enablerepo=elrepo-kernel install kernel-ml -y
  391.     yum remove kernel-3.* -y
  392.     grub2-set-default 0
  393.     echo "tcp_bbr" >> /etc/modules-load.d/modules.conf
  394.     INSTALL_BBR=true
  395. }
  397. info() {
  398.     port=`grep server_port $CONFIG_FILE| cut -d: -f2 | tr -d \",' '`
  399.     res=`netstat -nltp | grep ${port} | grep python`
  400.     [ -z "$res" ] && status="${RED}已停止${PLAIN}" || status="${GREEN}正在运行${PLAIN}"
  401.     password=`grep password $CONFIG_FILE| cut -d: -f2 | tr -d \",' '`
  402.     method=`grep method $CONFIG_FILE| cut -d: -f2 | tr -d \",' '`
  403.     protocol=`grep protocol $CONFIG_FILE| cut -d: -f2 | tr -d \",' '`
  404.     obfs=`grep obfs $CONFIG_FILE| cut -d: -f2 | tr -d \",' '`
  406.     p1=`echo -n ${password} | base64 -w 0`
  407.     p1=`echo -n ${p1} | tr -d =`
  408.     res=`echo -n "${IP}:${port}:${protocol}:${method}:${obfs}:${p1}/?remarks=&protoparam=&obfsparam=" | base64 -w 0`
  409.     res=`echo -n ${res} | tr -d =`
  410.     link="ssr://${res}"
  412.     echo ""
  413.     echo ============================================
  414.     echo -e " ${BLUE}ssr运行状态：${PLAIN}${status}"
  415.     echo -e " ${BLUE}ssr配置文件：${PLAIN}${RED}$CONFIG_FILE${PLAIN}"
  416.     echo ""
  417.     echo -e " ${RED}ssr配置信息：${PLAIN}"
  418.     echo -e "   ${BLUE}IP(address):${PLAIN}  ${RED}${IP}${PLAIN}"
  419.     echo -e "   ${BLUE}端口(port)：${PLAIN}${RED}${port}${PLAIN}"
  420.     echo -e "   ${BLUE}密码(password)：${PLAIN}${RED}${password}${PLAIN}"
  421.     echo -e "   ${BLUE}加密方式(method)：${PLAIN} ${RED}${method}${PLAIN}"
  422.     echo -e "   ${BLUE}协议(protocol)：${PLAIN} ${RED}${protocol}${PLAIN}"
  423.     echo -e "   ${BLUE}混淆(obfuscation)：${PLAIN} ${RED}${obfs}${PLAIN}"
  424.     echo
  425.     echo -e " ${BLUE}ssr链接:${PLAIN} $link"
  426.     echo $link > ssr.txt
  427. #    qrencode -o - -t utf8 $link
  428. }
  430. bbrReboot() {
  431.     if [ "${INSTALL_BBR}" == "true" ]; then
  432.         echo
  433.         echo  为使BBR模块生效，系统将在30秒后重启
  434.         echo
  435.         echo -e " 您可以按 ctrl + c 取消重启，稍后输入 ${RED}reboot${PLAIN} 重启系统"
  436.         sleep 30
  437.         reboot
  438.     fi
  439. }
  442. install() {
  443.     echo -n "系统版本:  "
  444.     cat /etc/centos-release
  445.     checkSystem
  446. #    getData
  447.     preinstall
  448. #    installBBR
  449.     installSSR
  450. #    setFirewall
  452.     info
  454. #    bbrReboot
  455. }
  457. uninstall() {
  458.     echo ""
  459.     read -p " 确定卸载SSR吗？(y/n)" answer
  460.     [ -z ${answer} ] && answer="n"
  462.     if [ "${answer}" == "y" ] || [ "${answer}" == "Y" ]; then
  463.         rm -f $CONFIG_FILE
  464.         rm -f /var/log/shadowsocks.log
  465.         rm -rf /usr/local/shadowsocks
  466.         systemctl disable shadowsocksR && systemctl stop shadowsocksR && rm -rf /usr/lib/systemd/system/shadowsocksR.service
  467.     fi
  468.     echo -e " ${RED}卸载成功${PLAIN}"
  469. }
  471. slogon
  473. action=$1
  474. [ -z $1 ] && action=install
  475. case "$action" in
  476.     install|uninstall|info)
  477.         ${action}
  478.         ;;
  479.     *)
  480.         echo " 参数错误"
  481.         echo " 用法: `basename $0` [install|uninstall]"
  482.         ;;
  483. esac

新建文件：/etc/anbsible/install-ssr.yaml , 注意该文件拷贝时格式不能错误。

  1. - hosts: ssr
  2.   remote_user: root
  3.   tasks:
  4.   - name: 更新软件源
  5.     shell: yum update -y
  6.   - name: 安装基础包
  7.     shell: yum install libsodium.x86_64 wget -y
  8.   - name: 删除之前ssr安装脚本
  9.     shell: rm -rf /tmp/*install-ssr*
  10.   - name: 拷贝安装脚本到其他机器
  11.     copy:
  12.       src: /root/install-ssr-server.sh
  13.       dest: /tmp/install-ssr.sh
  14.   - name: 修改脚本权限777
  15.     shell: chmod 777 /tmp/install-ssr.sh
  16.   - name: 开始安装ssr服务
  17.     shell: sh /tmp/install-ssr.sh

二、开始使用 ansible

1.给所有机器安装 ssr 服务

  1. # 该命令在主节点上执行
  2. ansible playbook /etc/ansible/install-ssr.yaml
  3. # 等待该命令运行完毕即可，运行时长和被控制机器数量有关。

2.获取所有机器上所有的ssr地址信息

  1. # 其中 ssr 是上面配置文件中的标签名字，可以根据实际情况进行修改
  2. ansible ssr -a 'cat /root/ssr.txt' | grep ssr > ssr-info.txt
  3. # 下面这条命令导出ssr地址信息会包含对应的vps公网ip
  4. ansible ssr -m shell -a 'AA=`cat /root/ssr.txt` && BB=`curl -s ip.sb` && echo -e "$AA\t$BB"' | grep ssr > ssr-info.txt
  5. # 执行该命令之后，会在当前路径下生成已给 ssr-info.txt 文件，该文件包含所有机器上启用的ssr地址。

建议：主节点配置好一点可以提高部署速度

异常处理：

出现以下异常提示：
fatal: [13.229.56.59]: FAILED! => {“msg”: “Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host’s fingerprint to your known_hosts file to manage this host.”}

  1. # 重新设置一下环境变量
  2. export ANSIBLE_HOST_KEY_CHECKING=False