SaltStack 九

# salt-api
https://docs.saltstack.com/en/latest/topics/netapi/writing.html
1. yum install salt-api
2. yum install pyOpenSSL
3. salt-call --local tls.create_self_signed_cert
[ERROR   ] You should upgrade pyOpenSSL to at least 0.14.1 to enable the use of X509 extensions
local:
    Created Private Key: "/etc/pki/tls/certs/localhost.key." Created Certificate: "/etc/pki/tls/certs/localhost.crt."
4. vim  /etc/salt/master.d/api.conf
rest_cherrypy:
  host: 192.168.2.103
  port: 8000
  ssl_cert: /etc/pki/tls/certs/localhost.crt
  ssl_key: /etc/pki/tls/certs/localhost.key
5. useradd -M -s /sbin/nologin saltapi  # 創建用戶 -M 不創建home目錄 -s 僅做驗證
6. echo "saltapi" | passwd saltapi --stdin # 非交互式創建密碼
7. vim /etc/salt/master.d/auth.conf
external_auth:
  pam:
    saltapi:
      - .*
      - '@wheel'
      - '@runner'
      - '@jobs'
8. systemctl restart salt-master
9. systemctl start salt-api
10. curl -sSk http://192.168.2.103:8000/login \
	-H 'Accept: application/x-yaml' \
	-H 'X-Auth-Token: xxxxxxxxxxxxxxxxxxxx' \
	-d username='saltapi' \
	-d password='saltapi' \
	-d eauth='pam'