Password-free deployment method and device in Linux environment and medium

Abstract

The invention discloses a password-free deployment method and device in a Linux environment and a medium, and is suitable for a terminal cluster, and the method comprises the steps: obtaining a plurality of UDP data packets; performing hierarchical verification on the plurality of UDP data packets; if the verification fails or the data of the plurality of UDP data packets are incomplete, the plurality of UDP data packets are obtained again; and if the verification is successful and the data of the plurality of UDP data packets are complete, installing the plurality of UDP data packets to a user directory without password or installing the plurality of UDP data packets to a system directory according to a preset mode. According to the password-free deployment method and device in the Linux environment and the medium provided by the invention, the UDP data packet is transmitted to the terminal in a broadcast form, so that the waiting time can be reduced; according to the method, data integrity can be ensured through hierarchical verification of the data packet, user directory password-free installation is executed, system directory installation is executed through a predefined password-free strategy, root permission verification and redundant operation are reduced, and the problem that the redundant operation of repeated permission verification is difficult to eliminate, so that the terminal cluster deployment efficiency is improved can be solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a secret-free deployment method, device and medium in a Linux environment. Background Art

[0002] In the field of software deployment in Linux environments, package management tools can automate the downloading, dependency resolution, and installation of software packages, significantly simplifying the complexity of software deployment. Administrators can implement large-scale software deployments using simple command-line instructions, eliminating the need to manually manage the dependencies and installation steps for each package. Existing technologies commonly use package management tools such as apt-get install or yuminstall to implement batch software installation. However, when performing file operations involving critical system directories (such as / usr / lib and / etc), these solutions require users to enter the root password through an interactive terminal to obtain the necessary system permissions.

[0003] However, existing technologies have significant shortcomings in software deployment. Users need to enter passwords to operate system files every time they install the entire package, which is extremely time-consuming and labor-intensive in large-scale deployments. Specifically, the permission verification process is redundant, requiring frequent manual password entry, increasing operation and maintenance costs. Batch deployment is inefficient, and the time cost increases linearly with the number of devices. In addition, the plaintext storage of passwords in automated scripts violates the security access control requirements of the ISO / IEC 27001 standard and poses a security risk. These problems need to be urgently addressed to optimize the deployment process and improve operation and maintenance efficiency. Summary of the Invention

[0004] The present invention provides a secret-free deployment method, device and medium in a Linux environment to solve the problem of difficulty in eliminating redundant operations of repeated permission verification, thereby improving the efficiency of terminal cluster deployment.

[0005] To achieve the above objectives, this application provides a secret-free deployment method in a Linux environment, applicable to terminal clusters, including:

[0006] Acquire a plurality of UDP data packets; wherein the plurality of UDP data packets are obtained by the host dividing the installation package into a plurality of UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form;

[0007] Performing layered verification on the plurality of UDP data packets;

[0008] If the verification fails or the data of the several UDP data packets are incomplete, the several UDP data packets are re-acquired; if the verification succeeds and the data of the several UDP data packets are complete, the several UDP data packets are installed to the user directory without password or to the system directory according to the preset method; wherein, the preset method is to execute the installation command according to the root authority when the command path and parameters of the several UDP data packets match the regular expression in the no-password policy file; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

[0009] The present invention controls the host to transmit UDP data packets to the terminal cluster in a broadcast form, so that multiple terminals can receive and process data packets at the same time. This batch processing method reduces the waiting time of a single terminal and improves the overall deployment efficiency. The terminal cluster performs hierarchical verification on the received UDP data packets to ensure the integrity and correctness of the data. Since the user directory usually does not contain sensitive files, it can be installed without secrets; the system directory contains sensitive files, which requires privileged operations and strict permission control; therefore, when performing installation under the user directory, there is no need to enter a password and the installation can be performed directly, which improves the automation and efficiency of the installation process. For the corresponding installation method of the system directory, the traditional deployment method requires the user to enter the root password for verification each time an operation requiring root permission is performed; in the present invention, by pre-defining a secret-free policy file and matching it using regular expressions, the system can directly execute the installation command according to the matching result after confirming the validity of the data packet, without the need for password verification each time, which significantly reduces the number of permission verifications, thereby reducing redundant operations.

[0010] Compared with the existing technology, the present invention transmits UDP data packets to the terminal in the form of broadcast, which can reduce the waiting time; the layered verification of the data packet can ensure the integrity of the data, perform password-free installation of the user directory, and perform system directory installation through a predefined password-free strategy, reducing root permission verification and redundant operations. Therefore, it can solve the problem of redundant operations that are difficult to eliminate repeated permission verification, thereby improving the efficiency of terminal cluster deployment.

[0011] As a preferred solution, layered verification is performed on the plurality of UDP data packets, specifically:

[0012] Performing CRC32 check on the plurality of UDP data packets according to the check value added by the host;

[0013] Perform MD5 check on the UDP data packets according to the hash value provided by the host.

[0014] In this preferred solution, the CRC32 checksum can effectively detect errors at the data bit level, thereby ensuring the integrity of the data packet. The MD5 checksum generates a fixed-length hash value and is very sensitive to any slight changes in the data packet content; therefore, the MD5 checksum can further reduce the risk of data being modified or tampered with.

[0015] As a preferred solution, a CRC32 check is performed on the plurality of UDP packets according to the check value attached by the host, specifically:

[0016] Obtaining an additional first check value from the end of the preset data of the plurality of UDP data packets;

[0017] Calculate the CRC32 checksum of each UDP data packet in the plurality of UDP data packets;

[0018] If the CRC32 check value of each UDP data packet is consistent with the corresponding check value in the first check value, the several UDP data packets are considered to be valid; if the CRC32 check value of each UDP data packet is inconsistent with the corresponding check value in the first check value, the several UDP data packets are considered to have been transmitted incorrectly.

[0019] In this preferred solution, since each data packet undergoes an independent CRC32 check, even if an error occurs in a data packet during transmission, it will not affect the correctness of other data packets. This reduces the risk of error accumulation and makes the transmission of the entire data packet sequence more stable and reliable.

[0020] As a preferred solution, an MD5 check is performed on the UDP packets according to the hash value provided by the host, specifically:

[0021] After the file transfer is completed, obtaining first hash values ​​of the plurality of UDP data packets from the host;

[0022] Calculate the MD5 hash value of the entire UDP data packets;

[0023] If the MD5 hash value is consistent with the first hash value, the plurality of UDP data packets are considered to be valid; if they are inconsistent, the plurality of UDP data packets are considered to be transmitted in error.

[0024] In this preferred solution, since the MD5 algorithm has good hash distribution characteristics, even slight changes in the data packet will cause the generated hash value to change significantly; therefore, by calculating the MD5 hash value of the entire UDP data packet and comparing it with the first hash value obtained from the host, it is possible to accurately determine whether the data packet remains intact during transmission.

[0025] As a preferred solution, if the verification fails or the data of the plurality of UDP data packets is incomplete, the plurality of UDP data packets are re-acquired, specifically:

[0026] If the layered check fails, a retransmission request is initiated to the host according to the frame sequence number corresponding to the frame data that failed the check, to obtain a first target lost frame;

[0027] Writing the first target lost frame into corresponding positions of the plurality of UDP data packets to obtain updated and reassembled plurality of UDP data packets;

[0028] If the data of the plurality of UDP data packets are incomplete, obtaining a second target lost frame according to the frame sequence number of the lost frame;

[0029] The second target lost frame is written into corresponding positions of the plurality of UDP data packets to obtain the updated and reassembled plurality of UDP data packets.

[0030] In this preferred solution, once a verification failure is detected, a retransmission request is initiated based on the frame sequence number, which can quickly locate and repair lost or damaged data frames, thereby improving data transmission reliability. By retransmitting only the lost or damaged frame data instead of the entire file or data packet, network bandwidth waste can be reduced.

[0031] As a preferred solution, if the data of the plurality of UDP data packets is incomplete, the second target lost frame is obtained according to the frame sequence number of the lost frame, specifically:

[0032] Creating corresponding status management bytes according to the number of slices of the plurality of UDP data packets to record the receiving status of each frame;

[0033] When the expected target frame sets of the plurality of UDP data packets are received, if the data of the expected target frame sets are incomplete, defining the frames in the expected target frame sets with a reception status of not received as lost frames, and setting the corresponding positions of the lost frames in the status management byte to zero;

[0034] Initiate a retransmission request to the host according to the frame sequence number of the lost frame, and reacquire the lost frame to obtain a second target lost frame; wherein the sequence number of the lost frame is determined according to the bit set to zero in the status management byte.

[0035] This preferred solution creates a status management byte to record the reception status of each frame. This allows for clear tracking of the reception status of each UDP packet, providing an efficient data foundation for subsequent lost frame detection and retransmission requests. After the expected target frame set is received, the status management byte comparison can accurately identify which frames were lost, avoiding unnecessary retransmission requests and improving data transmission efficiency.

[0036] As a preferred solution, the password-free policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package, specifically:

[0037] Extracting the command path and target path pattern of the system directory operation from the file list of the installation package;

[0038] Generate a command whitelist using a regular expression engine based on the command path and target path patterns;

[0039] The command whitelist is converted into a matching rule of sudo, and the matching rule of sudo is split into independent atomic policy files to obtain the secret-free policy file.

[0040] This preferred solution utilizes a regular expression engine to generate a command whitelist, which precisely matches the system directory operation commands required by the installation package, enhancing the accuracy and pertinence of the policy file. By converting the command whitelist into sudo matching rules and splitting it into independent, atomic policy files, this allows for precise control over specific operations, reducing the risk of unauthorized operations and enhancing system security.

[0041] As a preferred solution, the plurality of UDP data packets are installed to the user directory without being encrypted or to the system directory according to a preset method, specifically:

[0042] Obtaining a target path from the file lists of the plurality of UDP data packets;

[0043] Execute the installation process of the several UDP data packets according to the target path; if the target path is in the user directory, decompress or copy the several UDP data packets without a password; if the target path is in the system directory, perform privileged operations on the several UDP data packets according to the preset method; the privileged operation refers to the automated script executing the copy command with root privileges through the pre-configured password-free sudo rule

[0044] In this preferred solution, because user directories are personal and typically don't contain sensitive system files, password-free installation reduces risk. However, system directories contain sensitive system files and configurations, so performing installation operations in these directories requires privileges and is secured through strict permission control. Therefore, when performing installation in user directories, no password is required, improving the automation and efficiency of the installation process. When performing privileged operations in system directories, pre-configured password-free sudo rules allow automated scripts to temporarily execute commands with root privileges, eliminating the need to wait for the user to enter a password, thus accelerating the installation process.

[0045] The present application also provides a secret-free deployment device in a Linux environment, which is applicable to a terminal cluster and includes a data module, a verification module, and an installation module;

[0046] The data module is used to obtain a plurality of UDP data packets; wherein the plurality of UDP data packets are obtained by the host dividing the installation package into a plurality of UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form;

[0047] The verification module is used to perform layered verification on the plurality of UDP data packets;

[0048] The installation module is used to re-acquire the several UDP data packets if the verification fails or the data of the several UDP data packets are incomplete; if the verification succeeds and the data of the several UDP data packets are complete, the several UDP data packets are installed to the user directory without password or to the system directory according to a preset method; wherein, the preset method is to execute the installation command according to the root authority when the command path and parameters of the several UDP data packets match the regular expression in the no-password policy file; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

[0049] The present application also provides a storage medium on which a computer program is stored. The computer program is called and executed by a computer to implement the above-mentioned method for secret-free deployment in a Linux environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a flow chart of a secret-free deployment method in a Linux environment provided by an embodiment of the present application;

[0051] Figure 2 This is a schematic diagram of the system framework provided by the embodiment of the present application;

[0052] Figure 3 This is a schematic diagram of uploading the installation package provided in an embodiment of the present application to a terminal;

[0053] Figure 4 This is a diagram showing the terminal frame reception flag bit provided in an embodiment of the present application;

[0054] Figure 5 This is a schematic diagram of the frame protocol provided in an embodiment of the present application;

[0055] Figure 6 This is a schematic diagram of file frame splicing provided by an embodiment of the present application;

[0056] Figure 7 This is a schematic diagram of the one-click installation process provided by an embodiment of the present application;

[0057] Figure 8 This is a structural diagram of a password-free deployment device in a Linux environment provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0059] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" and "second" may explicitly or implicitly include one or more of such features. In the description of this application, unless otherwise specified, "several" means two or more.

[0060] The embodiment of the present application provides a password-free deployment method in a Linux environment, which aims to solve the pain point of the traditional solution that requires manual entry of the root password each time the operating system directory file is opened, and realizes single authorization and batch operation through a permission management mechanism; breaks through the efficiency bottleneck of traditional serial deployment, provides parallel batch deployment capabilities without manual intervention, decouples operation and maintenance time from the number of devices, and significantly improves efficiency.

[0061] Example 1:

[0062] See also Figure 1 The embodiment of the present application provides a secret-free deployment method in a Linux environment, which is applicable to a terminal cluster, including S1 to S3. The specific implementation steps are as follows:

[0063] S1. Obtain several UDP data packets; wherein, the several UDP data packets are obtained by the host dividing the installation package into several UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form.

[0064] In the embodiment of the present application, step S1 includes S1.1 to S1.2, wherein S1.1 is the process of creating a password-free policy file and determining a terminal cluster, and S1.2 is the process of the host sending data to the terminal cluster, specifically:

[0065] S1.1. On the local computer host (i.e., the local host), the operation and maintenance personnel pre-selects an installation package stored locally and containing a file manifest (manifest) using the one-click upgrade tool. The installation package includes the software package and the files required for software deployment.

[0066] Extract the specific command path and target path pattern of system directory operations from the file list of the installation package;

[0067] Generate a command whitelist based on the command path and target path patterns using a regular expression engine;

[0068] The command whitelist is converted into sudo matching rules, and the sudo matching rules are split into independent atomic policy files to obtain a secret-free policy file. "Sudo" is the core permission management tool in the Linux system. The rules defined in its configuration file ( / etc / sudoers) are used to control the permissions of users or programs to execute privileged commands.

[0069] The host sends UDP multicast packets to a designated port on a pre-set multicast address to identify the device cluster. For example, UDP multicast (224.0.0.1:9999) is used to quickly discover device clusters; "224.0.0.1" is the pre-set multicast address, and "9999" is the designated port. UDP multicast is also used to issue commands.

[0070] The specific process of creating a password-free policy file is as follows:

[0071] ① Dynamic permission configuration technology based on installation package feature analysis: By deeply parsing the file manifest within the installation package, it automatically identifies specific command paths that require operating system directories (such as / usr / bin / cp and / bin / mv) and target path patterns (such as / usr / lib / *.so and / etc / conf.d / [az].conf). This step provides a precise basis for subsequent permission configuration.

[0072] ② Implementation of the principle of least privilege: To adhere to the principle of least privilege, a regular expression engine is used to dynamically generate a whitelist of exact-matching commands and convert this whitelist into matching rules for sudo. For example, a rule such as " / usr / bin / cp / tmp / [A-Za-z0-9]*.so / usr / lib / " can be generated, thus avoiding the global password-free policy (such as NOPASSWD:ALL) used in traditional methods. This approach ensures that only necessary command and path combinations are granted password-free execution permissions.

[0073] ③ Atomic Policy Deployment: To enhance policy manageability and security, sudo matching rules are split into separate files (for example, / etc / sudoers.d / deploy_rule). These files serve as confidentiality-free policy files. Furthermore, these policy files are read-only by executing the chmod 0440 command, preventing unauthorized modification or disclosure. "chmod 0440" is a file permission setting command in Linux / Unix systems that sets permissions for files or directories in octal mode.

[0074] In this embodiment, S1.1 uses a regular expression engine to generate a command whitelist, which can accurately match the system directory operation commands required to be executed in the installation package, enhancing the accuracy and pertinence of the policy file. The command whitelist is converted into sudo matching rules and split into independent atomic policy files, achieving precise control over specific operations, reducing the risk of unauthorized operations, and enhancing system security.

[0075] In addition, the risk of unauthorized operations is reduced through policy file permission control (chmod 0440).

[0076] S1.2. In the host, the installation package is divided into several UDP data packets according to the data fragmentation strategy;

[0077] After the operation and maintenance personnel clicks confirm, several UDP data packets of the installation package are transmitted to the service program of the terminal cluster in the form of broadcast, and the password-free policy file is distributed to all terminal devices in the terminal cluster.

[0078] The control terminal cluster obtains several UDP data packets and non-encryption policy files.

[0079] The data fragmentation strategy is specifically as follows: framing according to MTU=1500 bytes, and appending a CRC32 check value (ie, a first check value) to the end of the preset data in each frame.

[0080] Furthermore, the one-click upgrade tool enables multi-threaded communication (based on the epoll model) and supports breakpoint resumption (recording the Last_ACK sequence number). This means that it can leverage Linux's epoll I / O multiplexing mechanism to efficiently manage a large number of concurrent connections, allowing it to simultaneously process data transmission requests from thousands of terminals within a single thread, reducing resource consumption and improving broadcast efficiency. Furthermore, it can customize reliable transmission based on the UDP protocol (User Datagram Protocol), marking the transmission progress by recording the last confirmed ACK sequence number (Last_ACK). This allows it to resume transmission from the "Last_ACK+1" sequence number after a network interruption, avoiding the retransmission of received data packets.

[0081] In addition, the terminal cluster's service program includes a security sandbox module (Seccomp policy) and can monitor the integrity of the " / etc / sudoers.d / " file in real time (inotify mechanism). That is, through the Linux kernel's Seccomp (Secure Computing) mechanism, it limits the system calls (syscalls) that can be called by the service program, thereby preventing malicious code or misoperation from executing dangerous instructions (such as execve and mount), thereby enhancing the security of the service program; it uses the inotify API to monitor file change events (such as creation, modification, and deletion) in the " / etc / sudoers.d / " directory. When it detects that the secret-free policy file (such as deploy_rule) has been tampered with, it immediately triggers an alarm or recovery operation to ensure the legitimacy of the permission configuration.

[0082] The continuous transmission strategy used to transmit several UDP packets adopts the following design:

[0083] ① Protocol header design: Each UDP packet header contains the following fields: SEQ / ACK sequence number (32 bits): identifies the order of the data packets and the reception confirmation status. FLAG flags (SYN / ACK / FIN): control the start, response, and termination of the transmission session. Frame offset (Offset): marks the storage location of the data in the file, solving the problem of UDP packet sequence disorder. Valid data frame (Data): carries the actual transmission of the installation package fragment content. CHECKSUM checksum (16 bits): verifies the integrity of the single frame data.

[0084] ② Breakpoint resume support: The control terminal cluster persistently records the last successfully received ACK sequence number (Last_ACK). When the transmission interruption is restored, the host resumes the transmission from the "Last_ACK+1" sequence number to avoid repeated transmission of received data.

[0085] To apply this application example, please refer to Figure 2 , Figure 2 This is a schematic diagram of the system framework provided in an embodiment of the present application, which shows the system framework for network communication between the local host and the terminal cluster.

[0086] S2. Perform layered verification on several UDP data packets.

[0087] Step S2 of the embodiment of the present application includes S2.1 to S2.2, wherein S2.1 is a process of performing CRC32 check on a number of UDP data packets, and S2.2 is a process of performing MD5 check on a number of UDP data packets, specifically:

[0088] S2.1. In the terminal cluster, obtain a first checksum value attached to the end of preset data of a plurality of UDP data packets;

[0089] Calculate the CRC32 checksum of each UDP data packet in several UDP data packets;

[0090] If the CRC32 check value of each UDP data packet is consistent with the corresponding check value in the first check value, the check is successful and the UDP data packets are considered to be valid; if the CRC32 check value of each UDP data packet is inconsistent with the corresponding check value in the first check value, the check fails and the UDP data packets are considered to be transmitted incorrectly.

[0091] In this embodiment S2.1, since each data packet undergoes an independent CRC32 check, even if an error occurs in a data packet during transmission, it will not affect the correctness of other data packets. This reduces the risk of error accumulation and makes the transmission of the entire data packet sequence more stable and reliable.

[0092] S2.2. After the file transfer is completed, obtain the first hash values ​​of several UDP data packets from the host;

[0093] Calculate the MD5 hash value of several UDP packets as a whole;

[0094] If the MD5 hash value is consistent with the first hash value, the verification is successful and the UDP data packets are considered valid; if they are inconsistent, the verification fails and the UDP data packets are considered to be transmitted incorrectly.

[0095] Furthermore, the above-mentioned CRC32 check and MD5 check methods are summarized as layered check.

[0096] In this embodiment S2.2, since the MD5 algorithm has good hash distribution characteristics, even slight changes in the data packet will cause the generated hash value to change significantly; therefore, by calculating the MD5 hash value of the entire UDP data packet and comparing it with the first hash value obtained from the host, it is possible to accurately determine whether the data packet remains intact during transmission.

[0097] In summary, the CRC32 checksum in Example S2 can effectively detect errors at the data bit level, thereby ensuring the integrity of the data packet. The MD5 checksum generates a fixed-length hash value and is very sensitive to any minor changes in the data packet content; therefore, the MD5 checksum can further reduce the risk of data being incorrectly modified or tampered with.

[0098] S3. If the verification fails or the data of several UDP data packets are incomplete, the several UDP data packets are re-acquired; if the verification succeeds and the data of several UDP data packets are complete, the several UDP data packets are installed without password to the user directory or to the system directory according to the preset method; wherein the preset method means that when the command path and parameters of the several UDP data packets match the regular expression in the no-password policy file, the installation command is executed according to the root authority; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

[0099] Step S3 of the embodiment of the present application includes S3.1 to S3.2, wherein S3.1 is a process of performing retransmission control when verification fails or the data of several UDP data packets are incomplete, and S3.2 is a process of installing several UDP data packets, specifically:

[0100] S3.1. In the terminal cluster, if the layered verification fails, the terminal considers the frame data invalid and initiates a retransmission request to the host based on the frame sequence number corresponding to the frame data that failed verification, thereby obtaining the first target lost frame.

[0101] The first target lost frame is written into corresponding positions of a plurality of UDP data packets to obtain a plurality of updated and reassembled UDP data packets.

[0102] Create corresponding status management bytes according to the number of slices of several UDP data packets to record the receiving status of each frame;

[0103] When the expected target frame sets of several UDP data packets are received, if the data of the expected target frame sets are incomplete, the frames in the expected target frame sets with the reception status of not received are defined as lost frames, and the corresponding positions of the lost frames in the status management bytes are set to zero;

[0104] A retransmission request is initiated to the host according to the frame sequence number of the lost frame, and the lost frame is re-acquired to obtain a second target lost frame; wherein the sequence number of the lost frame is determined according to the bit set to zero in the status management byte, and the "bit" contains both position and status information.

[0105] If all target loss frames in the expected target frame set are successfully received and pass the layered verification, the second target loss frame is written into corresponding positions of the plurality of UDP data packets to obtain the updated and reassembled plurality of UDP data packets.

[0106] To apply this application example, please refer to Figure 3-6 , Figure 3 This is a schematic diagram of uploading an installation package to a terminal provided in an embodiment of the present application, which shows the process of a local host uploading an installation package to terminal 4 in a terminal cluster.

[0107] Figure 4 This is a diagram showing the terminal frame reception flag bit provided in an embodiment of the present application. Figure 5 This is a schematic diagram of the frame protocol provided in the embodiment of the present application. Figure 6 This is a schematic diagram of file frame splicing provided by an embodiment of the present application;

[0108] When dealing with UDP packet loss, if the terminal fails to receive a frame of data for some reason, it can identify the lost frame through a specific calculation process and send a retransmission request to the host accordingly. Figure 4-6 This calculation process (i.e., the process of reacquiring the corresponding data if the data of the expected target frame set is incomplete) is summarized as follows:

[0109] Figure 4 This section details how the terminal cluster determines the number of frames a file is divided into based on the "frames" field in the frame protocol. To this end, the control terminal cluster allocates a memory space (consisting of several bytes), where each byte can mark the reception status of eight frames. For example, if the file is divided into 128 frames, the receiver needs to allocate 16 bytes to track the reception status of each frame. Whenever a frame is successfully received and verified, the receiver sets the corresponding bit to 1; if reception fails or times out, the corresponding bit remains 0. After all frame reception attempts are completed, the control terminal cluster checks these flag bits, identifies the bits that are 0, and thus determines the sequence number of the lost frame and initiates a retransmission request to the host. It is important to note that the receiver attempts to retransmit each frame up to three times; if all three attempts fail, the receiver abandons the retransmission of the frame.

[0110] Figure 5 The detailed structure of the frame protocol is revealed. The "frame" field indicates the total number of frames in the file, the "cur_frame" field represents the sequence number of the current frame, the "offset" field indicates where the current frame data should be stored in the file, and the "data" field contains the valid data content. Furthermore, the "checksum" field verifies the validity of the "data" field to ensure data accuracy.

[0111] Figure 6 The issue of packet reordering that can occur when using the UDP protocol was highlighted. To address this issue, the control terminal cluster uses the "offset" field to accurately write received valid data to the specified location in the file. This mechanism ensures that even if network packet reordering is disrupted, the data frames written to the file remain in the correct order.

[0112] Through this design, the terminal cluster can effectively deal with the packet loss problem in UDP transmission and ensure the integrity and accuracy of the data.

[0113] In this embodiment S3.1, once a verification failure is detected, a retransmission request is initiated based on the frame sequence number, which can quickly locate and repair the lost or damaged data frame, thereby improving the reliability of data transmission. By retransmitting only the lost or damaged frame data instead of the entire file or data packet, network bandwidth waste can be reduced;

[0114] Furthermore, by creating a status management byte to record the reception status of each frame, the reception status of each UDP packet can be clearly tracked, providing an efficient data foundation for subsequent lost frame detection and retransmission requests. After the expected target frame set is received, the status management byte can be compared to accurately identify which frames were lost, avoiding unnecessary retransmission requests and improving data transmission efficiency.

[0115] S3.2. If the layered verification succeeds and the data of the plurality of UDP data packets is intact, the target path is obtained from the file list of the plurality of UDP data packets. A successful layered verification includes a case where the layered verification of the plurality of UDP data packets succeeds, and also includes a case where the layered verification of the plurality of UDP data packets fails, but the data is re-obtained to obtain updated and reassembled plurality of UDP data packets, and the layered verification succeeds.

[0116] The operation and maintenance personnel click on the one-click batch installation and confirm. After receiving the installation instruction, the service program of the terminal cluster starts to execute the automated script and performs the installation process of several UDP data packets according to the target path. Specifically: if the target path is in the user directory, then the several UDP data packets are decompressed or copied without a password, that is, the relevant files are directly installed in the user directory, and this operation does not require entering the system password; if the target path is in the system directory, privileged operations are performed on the several UDP data packets in a preset manner, that is, the relevant files are installed in the system directory, and this operation requires a system password; and the privileged operation means that the automated script temporarily executes the copy command with root privileges through the pre-configured password-free sudo rule (that is, the sudo matching rule).

[0117] Among them, the preset method means that when the command path and parameters of several UDP data packets match the regular expression in the non-confidential policy file, the installation command is executed according to the root authority, and the regular expression consists of three parts: command path regular expression + parameter pattern regular expression + target path regular expression; the non-confidential policy file is generated by the regular expression engine based on the command path and target path declared in the file list in the installation package, and the generation process of the non-confidential policy file is specifically explained in step S1.

[0118] To apply this application example, please refer to Figure 7 , Figure 7This is a schematic diagram of the one-click installation process provided by an embodiment of the present application, which shows the process of the host in the first embodiment sending an installation package to a terminal cluster (terminal) and installing it.

[0119] The implementation plan of this embodiment 1 is applicable to all Linux systems (such as Ubuntu 18.04 and above, CentOS 7 and above), and can cover common system requirements of enterprise-level environments.

[0120] This embodiment S3.2 describes the execution process of the installation script. Since the user directory is personal and usually does not contain sensitive system files, the risk of password-free installation is low; while the system directory contains sensitive system files and configurations, privileges are required to perform installation operations in these directories, and security is ensured through strict permission control. Therefore, when performing installation in the user directory, there is no need to enter a password, which improves the automation and efficiency of the installation process; when performing privileged operations in the system directory, since the password-free configuration for the specific commands targeted by the sudo file (i.e., the commands that require decompression or copying files to the system directory involved in the installation of the entire package by the installation script) has been completed in advance, there is no need to enter a password to obtain root permissions during the execution of the automated script; through the pre-configured password-free sudo rules, the automated script can temporarily execute commands with root permissions without waiting for the user to enter a password, thereby speeding up the installation process.

[0121] Overall, this embodiment has the following beneficial effects:

[0122] This application controls the host to transmit UDP data packets to the terminal cluster in a broadcast format, so that multiple terminals can receive and process data packets at the same time. This batch processing method reduces the waiting time of a single terminal and improves the overall deployment efficiency. The terminal cluster performs layered verification on the received UDP data packets to ensure the integrity and correctness of the data. Since the user directory usually does not contain sensitive files, it can be installed without a password; the system directory contains sensitive files and requires privileged operations and strict permission control; therefore, when performing installation in the user directory, there is no need to enter a password and the installation can be performed directly, which improves the automation and efficiency of the installation process. For the corresponding installation method of the system directory, the traditional deployment method requires the user to enter the root password for verification every time an operation that requires root permission is performed; in this application, an automated script is used to install the entire package, and the sudo command is used to allow ordinary users to obtain root permissions. In this way, during the installation process, the automated script can obtain system directory file permissions without entering a password, which significantly reduces the number of permission verifications, thereby reducing redundant operations and saving operation and maintenance time investment costs.

[0123] Example 2:

[0124] See also Figure 8 , an embodiment of the present application provides a secret-free deployment device in a Linux environment, applicable to a terminal cluster, comprising a data module 10, a verification module 20 and an installation module 30;

[0125] The data module 10 is used to obtain a plurality of UDP data packets; wherein the plurality of UDP data packets are obtained by the host dividing the installation package into a plurality of UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form;

[0126] Verification module 20, used for performing layered verification on a number of UDP data packets;

[0127] The installation module 30 is used to re-acquire several UDP data packets if the verification fails or the data of several UDP data packets are incomplete; if the verification succeeds and the data of several UDP data packets are complete, the several UDP data packets are installed to the user directory without password or to the system directory according to the preset method; wherein the preset method means that when the command path and parameters of several UDP data packets match the regular expression in the no-password policy file, the installation command is executed according to the root authority; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

[0128] In one embodiment, the data module 10 includes a creation unit and a sending unit, wherein the creation unit is a process of creating a secret-free policy file and determining a terminal cluster, and the sending unit is a process of the host sending data to the terminal cluster;

[0129] The creation unit is used for the operation and maintenance personnel to pre-select an installation package stored locally and containing a file list (manifest list) in the host of the local computer (i.e., the local host) through the one-click upgrade tool; wherein the installation package includes the software package and the files required for software deployment;

[0130] The creation unit is also used to extract the specific command path and target path pattern of the system directory operation from the file list of the installation package;

[0131] The creation unit is also used to generate a command whitelist through a regular expression engine based on the command path and target path patterns;

[0132] The creation unit is also used to convert the command whitelist into sudo matching rules and split the sudo matching rules into independent atomic policy files to obtain the secret-free policy files. Among them, "sudo" is the core permission management tool of the Linux system. The rules defined in its configuration file ( / etc / sudoers) are used to control the permissions of users or programs to execute privileged commands.

[0133] The creation unit is also used by the host to send UDP multicast packets to a designated port on a pre-set multicast address, thereby identifying the terminal cluster. For example, UDP multicast (224.0.0.1:9999) is used to quickly discover device clusters; where "224.0.0.1" is the pre-set multicast address and "9999" is the designated port. UDP multicast is also used to issue commands.

[0134] The specific process of creating a password-free policy file is as follows:

[0135] ① Dynamic permission configuration technology based on installation package feature analysis: By deeply parsing the file manifest within the installation package, it automatically identifies specific command paths that require operating system directories (such as / usr / bin / cp and / bin / mv) and target path patterns (such as / usr / lib / *.so and / etc / conf.d / [az].conf). This step provides a precise basis for subsequent permission configuration.

[0136] ② Implementation of the principle of least privilege: To adhere to the principle of least privilege, a regular expression engine is used to dynamically generate a whitelist of exact-matching commands and convert this whitelist into matching rules for sudo. For example, a rule such as " / usr / bin / cp / tmp / [A-Za-z0-9]*.so / usr / lib / " can be generated, thus avoiding the global password-free policy (such as NOPASSWD:ALL) used in traditional methods. This approach ensures that only necessary command and path combinations are granted password-free execution permissions.

[0137] ③ Atomic Policy Deployment: To enhance policy manageability and security, sudo matching rules are split into separate files (for example, / etc / sudoers.d / deploy_rule). These files serve as confidentiality-free policy files. Furthermore, these policy files are read-only by executing the chmod 0440 command, preventing unauthorized modification or disclosure. "chmod 0440" is a file permission setting command in Linux / Unix systems that sets permissions for files or directories in octal mode.

[0138] This embodiment uses a regular expression engine to generate a command whitelist, which can accurately match the system directory operation commands required by the installation package, enhancing the accuracy and pertinence of the policy file. The command whitelist is converted into sudo matching rules and split into independent atomic policy files, achieving precise control over specific operations, reducing the risk of unauthorized operations, and enhancing system security.

[0139] In addition, the risk of unauthorized operations is reduced through policy file permission control (chmod 0440).

[0140] The sending unit is used to split the installation package into several UDP data packets according to the data fragmentation strategy in the host;

[0141] The sending unit is further used to transmit several UDP data packets of the installation package to the service program of the terminal cluster in a broadcast form after the operation and maintenance personnel clicks to confirm, and distribute the password-free policy file to all terminal devices in the terminal cluster.

[0142] The sending unit is also used to control the terminal cluster to obtain a number of UDP data packets and non-encryption policy files.

[0143] The data fragmentation strategy is specifically as follows: framing according to MTU=1500 bytes, and appending a CRC32 check value (ie, a first check value) to the end of the preset data in each frame.

[0144] Furthermore, the one-click upgrade tool enables multi-threaded communication (based on the epoll model) and supports breakpoint resumption (recording the Last_ACK sequence number). This means that it can leverage Linux's epoll I / O multiplexing mechanism to efficiently manage a large number of concurrent connections, allowing it to simultaneously process data transmission requests from thousands of terminals within a single thread, reducing resource consumption and improving broadcast efficiency. Furthermore, it can customize reliable transmission based on the UDP protocol (User Datagram Protocol), marking the transmission progress by recording the last confirmed ACK sequence number (Last_ACK). This allows it to resume transmission from the "Last_ACK+1" sequence number after a network interruption, avoiding the retransmission of received data packets.

[0145] In addition, the terminal cluster's service program includes a security sandbox module (Seccomp policy) and can monitor the integrity of the " / etc / sudoers.d / " file in real time (inotify mechanism). That is, through the Linux kernel's Seccomp (Secure Computing) mechanism, it limits the system calls (syscalls) that can be called by the service program, thereby preventing malicious code or misoperation from executing dangerous instructions (such as execve and mount), thereby enhancing the security of the service program; it uses the inotify API to monitor file change events (such as creation, modification, and deletion) in the " / etc / sudoers.d / " directory. When it detects that the secret-free policy file (such as deploy_rule) has been tampered with, it immediately triggers an alarm or recovery operation to ensure the legitimacy of the permission configuration.

[0146] The continuous transmission strategy used to transmit several UDP packets adopts the following design:

[0147] ① Protocol header design: Each UDP packet header contains the following fields: SEQ / ACK sequence number (32 bits): identifies the order of the data packets and the reception confirmation status. FLAG flags (SYN / ACK / FIN): control the start, response, and termination of the transmission session. Frame offset (Offset): marks the storage location of the data in the file, solving the problem of UDP packet sequence disorder. Valid data frame (Data): carries the actual transmission of the installation package fragment content. CHECKSUM checksum (16 bits): verifies the integrity of the single frame data.

[0148] ② Breakpoint resume support: The control terminal cluster persistently records the last successfully received ACK sequence number (Last_ACK). When the transmission interruption is restored, the host resumes the transmission from the "Last_ACK+1" sequence number to avoid repeated transmission of received data.

[0149] To apply this application example, please refer to Figure 2 , Figure 2 This is a schematic diagram of the system framework provided in an embodiment of the present application, which shows the system framework for network communication between the local host and the terminal cluster.

[0150] In one embodiment, the verification module 20 includes a first verification unit and a second verification unit, wherein the first verification unit is a process of performing CRC32 verification on a number of UDP data packets, and the second verification unit is a process of performing MD5 verification on a number of UDP data packets;

[0151] The first verification unit is configured to obtain an additional first verification value from the end of preset data of a plurality of UDP data packets in the terminal cluster;

[0152] The first check unit is further used to calculate the CRC32 check value of each UDP data packet in the plurality of UDP data packets;

[0153] The first verification unit is also used to: if the CRC32 check value of each UDP data packet is consistent with the corresponding check value in the first check value, the verification is successful, and the several UDP data packets are considered to be valid; if the CRC32 check value of each UDP data packet is inconsistent with the corresponding check value in the first check value, the verification fails, and it is considered that the several UDP data packets are transmitted incorrectly.

[0154] In the first check unit of this embodiment, since each data packet undergoes an independent CRC32 check, even if an error occurs in a data packet during transmission, it will not affect the correctness of other data packets. This reduces the risk of error accumulation and makes the transmission of the entire data packet sequence more stable and reliable.

[0155] A second verification unit is used to obtain first hash values ​​of a plurality of UDP data packets from the host after the file transfer is completed;

[0156] The second verification unit is further used to calculate the MD5 hash value of the entire UDP data packets;

[0157] The second verification unit is further configured to: if the MD5 hash value is consistent with the first hash value, the verification is successful and the plurality of UDP data packets are considered valid; if they are inconsistent, the verification fails and the plurality of UDP data packets are considered to have been transmitted in error.

[0158] The second verification unit is further configured to summarize the above-mentioned CRC32 verification and MD5 verification methods into a layered verification.

[0159] In the second verification unit of this embodiment, since the MD5 algorithm has good hash distribution characteristics, even if there is only a slight change in the data packet, the generated hash value will cause a significant change; therefore, by calculating the MD5 hash value of the entire UDP data packet and comparing it with the first hash value obtained from the host, it is possible to accurately determine whether the data packet remains intact during transmission.

[0160] In summary, the CRC32 checksum of the verification module 20 in this embodiment can effectively detect errors at the data bit level, thereby ensuring the integrity of the data packet. The MD5 checksum generates a fixed-length hash value and is very sensitive to any slight changes in the data packet content; therefore, the MD5 checksum can further reduce the risk of data being accidentally modified or tampered with.

[0161] In one embodiment, the installation module 30 includes a retransmission unit and an installation unit, wherein the retransmission unit is a process of performing retransmission control when verification fails or data of several UDP data packets are incomplete, and the installation unit is a process of installing several UDP data packets;

[0162] The retransmission unit is configured to, in a terminal cluster, if the layered verification fails, deem the frame data invalid, and initiate a retransmission request to the host according to the frame sequence number corresponding to the frame data that failed the verification, thereby obtaining the first target lost frame;

[0163] The retransmission unit is further configured to write the first target lost frame into corresponding positions of a plurality of UDP data packets to obtain a plurality of updated and reassembled UDP data packets.

[0164] The retransmission unit is further used to create corresponding status management bytes according to the number of slices of several UDP data packets to record the receiving status of each frame;

[0165] The retransmission unit is further configured to, when the expected target frame sets of the plurality of UDP data packets are received, if the data of the expected target frame sets are incomplete, define the frames in the expected target frame sets with a reception status of not received as lost frames, and set the corresponding positions of the lost frames in the status management bytes to zero;

[0166] The retransmission unit is further configured to initiate a retransmission request to the host according to the frame sequence number of the lost frame, and reacquire the lost frame to obtain a second target lost frame; wherein the sequence number of the lost frame is determined based on the bit set to zero in the status management byte, and the "bit" includes both position and status information.

[0167] The retransmission unit is further configured to write the second target lost frame into corresponding positions of several UDP data packets if all target lost frames in the expected target frame set are successfully received and pass the layered verification, thereby obtaining several updated and reassembled UDP data packets.

[0168] To apply this application example, please refer to Figure 3-6 , Figure 3 This is a schematic diagram of uploading an installation package to a terminal provided in an embodiment of the present application, which shows the process of a local host uploading an installation package to terminal 4 in a terminal cluster.

[0169] Figure 4 This is a diagram showing the terminal frame reception flag bit provided in an embodiment of the present application. Figure 5 This is a schematic diagram of the frame protocol provided in the embodiment of the present application. Figure 6 This is a schematic diagram of file frame splicing provided by an embodiment of the present application;

[0170] When dealing with UDP packet loss, if the terminal fails to receive a frame of data for some reason, it can identify the lost frame through a specific calculation process and send a retransmission request to the host accordingly. Figure 4-6 This calculation process (i.e., the process of reacquiring the corresponding data if the data of the expected target frame set is incomplete) is summarized as follows:

[0171] Figure 4This section details how the terminal cluster determines the number of frames a file is divided into based on the "frames" field in the frame protocol. To this end, the control terminal cluster allocates a memory space (consisting of several bytes), where each byte can mark the reception status of eight frames. For example, if the file is divided into 128 frames, the receiver needs to allocate 16 bytes to track the reception status of each frame. Whenever a frame is successfully received and verified, the receiver sets the corresponding bit to 1; if reception fails or times out, the corresponding bit remains 0. After all frame reception attempts are completed, the control terminal cluster checks these flag bits, identifies the bits that are 0, and thus determines the sequence number of the lost frame and initiates a retransmission request to the host. It is important to note that the receiver attempts to retransmit each frame up to three times; if all three attempts fail, the receiver abandons the retransmission of the frame.

[0172] Figure 5 The detailed structure of the frame protocol is revealed. The "frame" field indicates the total number of frames in the file, the "cur_frame" field represents the sequence number of the current frame, the "offset" field indicates where the current frame data should be stored in the file, and the "data" field contains the valid data content. Furthermore, the "checksum" field verifies the validity of the "data" field to ensure data accuracy.

[0173] Figure 6 The issue of packet reordering that can occur when using the UDP protocol was highlighted. To address this issue, the control terminal cluster uses the "offset" field to accurately write received valid data to the specified location in the file. This mechanism ensures that even if network packet reordering is disrupted, the data frames written to the file remain in the correct order.

[0174] Through this design, the terminal cluster can effectively deal with the packet loss problem in UDP transmission and ensure the integrity and accuracy of the data.

[0175] In this embodiment, the retransmission unit initiates a retransmission request based on the frame sequence number once a verification failure is detected, which can quickly locate and repair lost or damaged data frames, thereby improving data transmission reliability. By retransmitting only the lost or damaged frame data, rather than the entire file or data packet, network bandwidth waste can be reduced.

[0176] Furthermore, by creating a status management byte to record the reception status of each frame, the reception status of each UDP packet can be clearly tracked, providing an efficient data foundation for subsequent lost frame detection and retransmission requests. After the expected target frame set is received, the status management byte can be compared to accurately identify which frames were lost, avoiding unnecessary retransmission requests and improving data transmission efficiency.

[0177] The installation unit is configured to obtain a target path from a file list of the plurality of UDP data packets if the layered verification succeeds and the data of the plurality of UDP data packets are complete; wherein the layered verification success includes a case where the layered verification of the plurality of UDP data packets succeeds, and also includes a case where the layered verification of the plurality of UDP data packets fails, but the plurality of UDP data packets are updated and reassembled by reacquiring data and the layered verification succeeds;

[0178] The installation unit is also used for the operation and maintenance personnel to click one-click batch installation and confirm. After receiving the installation instruction, the service program of the terminal cluster starts to execute the automated script and executes the installation process of several UDP data packets according to the target path. Specifically: if the target path is in the user directory, then without the need for a password, several UDP data packets are decompressed or copied, that is, the relevant files are directly installed in the user directory, and this operation does not require entering the system password; if the target path is in the system directory, privileged operations are performed on several UDP data packets in a preset manner, that is, the relevant files are installed in the system directory, and this operation requires a system password; and the privileged operation refers to the automated script temporarily executing the copy command with root privileges through the pre-configured password-free sudo rule (that is, the sudo matching rule).

[0179] Among them, the preset method means that when the command path and parameters of several UDP data packets match the regular expression in the non-confidential policy file, the installation command is executed according to the root authority, and the regular expression is composed of three parts: command path regular expression + parameter pattern regular expression + target path regular expression; the non-confidential policy file is generated by the regular expression engine based on the command path and target path declared in the file list in the installation package, and the generation process of the non-confidential policy file is specifically described in data module 10.

[0180] To apply this application example, please refer to Figure 7 , Figure 7 This is a schematic diagram of the one-click installation process provided in an embodiment of the present application, which shows the process of the host in the second embodiment sending the installation package to the terminal cluster (terminal) and installing it.

[0181] The implementation plan of this second embodiment is applicable to all Linux systems (such as Ubuntu 18.04 and above, CentOS 7 and above), and can cover common system requirements of enterprise-level environments.

[0182] The installation unit of this embodiment describes the execution process of the installation script. Since the user directory belongs to individuals and usually does not contain sensitive system files, the risk of password-free installation is low; while the system directory contains sensitive system files and configurations, privileges are required to perform installation operations in these directories, and security is ensured through strict permission control. Therefore, when performing installation in the user directory, there is no need to enter a password, which improves the automation and efficiency of the installation process; when performing privileged operations in the system directory, since the password-free configuration for the specific commands targeted by the sudo file (i.e., the commands that require decompression or copying files to the system directory involved in the installation of the entire package by the installation script) has been completed in advance, there is no need to enter a password to obtain root permissions during the execution of the automated script; through the pre-configured password-free sudo rules, the automated script can temporarily execute commands with root permissions without waiting for the user to enter a password, thereby speeding up the installation process.

[0183] Overall, this embodiment has the following beneficial effects:

[0184] This application controls the host to transmit UDP data packets to the terminal cluster in a broadcast format, so that multiple terminals can receive and process data packets at the same time. This batch processing method reduces the waiting time of a single terminal and improves the overall deployment efficiency. The terminal cluster performs layered verification on the received UDP data packets to ensure the integrity and correctness of the data. Since the user directory usually does not contain sensitive files, it can be installed without a password; the system directory contains sensitive files and requires privileged operations and strict permission control; therefore, when performing installation in the user directory, there is no need to enter a password and the installation can be performed directly, which improves the automation and efficiency of the installation process. For the corresponding installation method of the system directory, the traditional deployment method requires the user to enter the root password for verification every time an operation that requires root permission is performed; in this application, an automated script is used to install the entire package, and the sudo command is used to allow ordinary users to obtain root permissions. In this way, during the installation process, the automated script can obtain system directory file permissions without entering a password, which significantly reduces the number of permission verifications, thereby reducing redundant operations and saving operation and maintenance time investment costs.

[0185] Example 3:

[0186] An embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for free-of-confidence deployment in a Linux environment;

[0187] Wherein, the described method for non-confidential deployment in a Linux environment, if implemented in the form of a software functional unit and used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The described computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. Wherein, the described computer program includes computer program code, and the described computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The described computer-readable medium may include: any entity or device capable of carrying the described computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0188] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A secret-free deployment method in a Linux environment, characterized in that: Applicable to terminal clusters, including: Acquire a plurality of UDP data packets; wherein the plurality of UDP data packets are obtained by the host dividing the installation package into a plurality of UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form; Performing layered verification on the plurality of UDP data packets; If the verification fails or the data of the several UDP data packets are incomplete, the several UDP data packets are re-acquired; if the verification succeeds and the data of the several UDP data packets are complete, the several UDP data packets are installed to the user directory without password or to the system directory according to the preset method; wherein, the preset method is to execute the installation command according to the root authority when the command path and parameters of the several UDP data packets match the regular expression in the no-password policy file; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

2. The method for secret-free deployment in a Linux environment according to claim 1, wherein: Perform layered verification on the UDP packets, specifically: Performing CRC32 check on the plurality of UDP data packets according to the check value added by the host; Perform MD5 check on the UDP data packets according to the hash value provided by the host.

3. The method for secret-free deployment in a Linux environment according to claim 2, wherein: Perform CRC32 checks on the UDP packets according to the checksum added by the host, specifically: Obtaining an additional first check value from the end of the preset data of the plurality of UDP data packets; Calculate the CRC32 checksum of each UDP data packet in the plurality of UDP data packets; If the CRC32 check value of each UDP data packet is consistent with the corresponding check value in the first check value, the several UDP data packets are considered to be valid; if the CRC32 check value of each UDP data packet is inconsistent with the corresponding check value in the first check value, the several UDP data packets are considered to have been transmitted incorrectly.

4. The method for secret-free deployment in a Linux environment according to claim 2, wherein: Perform MD5 check on the UDP packets according to the hash value provided by the host, specifically: After the file transfer is completed, obtaining first hash values ​​of the plurality of UDP data packets from the host; Calculate the MD5 hash value of the entire UDP data packets; If the MD5 hash value is consistent with the first hash value, the plurality of UDP data packets are considered to be valid; if they are inconsistent, the plurality of UDP data packets are considered to be transmitted in error.

5. The method for secret-free deployment in a Linux environment according to claim 1, wherein: If the verification fails or the data of the plurality of UDP data packets is incomplete, the plurality of UDP data packets are retrieved again, specifically: If the layered check fails, a retransmission request is initiated to the host according to the frame sequence number corresponding to the frame data that failed the check, to obtain a first target lost frame; Writing the first target lost frame into corresponding positions of the plurality of UDP data packets to obtain updated and reassembled plurality of UDP data packets; If the data of the plurality of UDP data packets are incomplete, obtaining a second target lost frame according to the frame sequence number of the lost frame; The second target lost frame is written into corresponding positions of the plurality of UDP data packets to obtain the updated and reassembled plurality of UDP data packets.

6. The method for secret-free deployment in a Linux environment according to claim 5, wherein: If the data of the plurality of UDP data packets are incomplete, the second target lost frame is obtained according to the frame sequence number of the lost frame, specifically: Creating corresponding status management bytes according to the number of slices of the plurality of UDP data packets to record the receiving status of each frame; When the expected target frame sets of the plurality of UDP data packets are received, if the data of the expected target frame sets are incomplete, defining the frames in the expected target frame sets with a reception status of not received as lost frames, and setting the corresponding positions of the lost frames in the status management byte to zero; Initiate a retransmission request to the host according to the frame sequence number of the lost frame, and reacquire the lost frame to obtain a second target lost frame; wherein the sequence number of the lost frame is determined according to the bit set to zero in the status management byte.

7. The method for secret-free deployment in a Linux environment according to claim 1, wherein: The password-free policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package, specifically: Extracting the command path and target path pattern of the system directory operation from the file list of the installation package; Generate a command whitelist using a regular expression engine based on the command path and target path patterns; The command whitelist is converted into a matching rule of sudo, and the matching rule of sudo is split into independent atomic policy files to obtain the secret-free policy file.

8. The method for secret-free deployment in a Linux environment according to claim 1, wherein: Install the UDP data packets to the user directory without encryption or to the system directory in a preset manner, specifically: Obtaining a target path from the file lists of the plurality of UDP data packets; Execute the installation process of the several UDP data packets according to the target path; wherein, if the target path is in the user directory, decompress or copy the several UDP data packets without a password; if the target path is in the system directory, perform privileged operations on the several UDP data packets according to the preset method; the privileged operation refers to the automated script executing the copy command with root privileges through the pre-configured password-free sudo rule.

9. A secret-free deployment device in a Linux environment, characterized in that: Applicable to terminal clusters, including data module, verification module and installation module; The data module is used to obtain a plurality of UDP data packets; wherein the plurality of UDP data packets are obtained by the host dividing the installation package into a plurality of UDP data packets and transmitting them to the service program of the terminal cluster in a broadcast form; The verification module is used to perform layered verification on the plurality of UDP data packets; The installation module is used to re-acquire the several UDP data packets if the verification fails or the data of the several UDP data packets are incomplete; if the verification succeeds and the data of the several UDP data packets are complete, the several UDP data packets are installed to the user directory without password or to the system directory according to a preset method; wherein, the preset method is to execute the installation command according to the root authority when the command path and parameters of the several UDP data packets match the regular expression in the no-password policy file; the no-password policy file is generated by a regular expression engine based on the command path and target path declared in the file list in the installation package.

10. A storage medium, characterized in that: The storage medium stores a computer program, which is called and executed by a computer to implement a secret-free deployment method in a Linux environment as described in any one of claims 1 to 8.

Images