saltstack 初始化LINUX系統
阿新 • • 發佈:2018-10-05
text http its mps pool clu network sta dst
前面我們已經了解了saltstack的基礎功能,現在就可以使用saltstack為初始化新安裝的linux系統。
初始化列表:
1.關閉selinux
3.修改sshd配置文件
4.內核優化
5.ulimit修改
6.history記錄
7.時區修改及添加cron
8.安裝epel
9.修改resolv解析文件
10.軟件安裝
好了,此前我們已經修改了salt的base目錄,默認在/srv/salt 下我們調整到/etc/salt目錄下了
現在呢,我們需要去建立一個目錄專門用於存放初始化sls的。
[root@localhost base]# pwd
/etc/salt/base
[root@localhost base]# mkdir init
date_time.sls
系統時區修改
[root@localhost init]# vim date_time.sls date_time: pkg.installed: - name: ntpdate - unless: rpm -qa | grep ntpdate cmd.run: - name: rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && ntpdate pool.ntp.org - require: - pkg: ntpdate cron.present: - name: /usr/sbin/ntpdate pool.ntp.org >/dev/null - user: root - minute: '*/5' - require: - pkg: ntpdate
epel.sls
epel文件調整,系統為centos 7
[root@localhost init]#vim epel.sls
epel_install:
pkg.installed:
- sources:
- epel-release: http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm
- unless: rpm -qa | grep epel-release-7-5
history.sls
修改操作命令記錄
[root@localhost init]# vim history.sls /etc/bashrc: file.append: - text: - HISTTIMEFORMAT="%F %T `whoami` " cmd.run: - name: source /etc/bashrc
limits.sls
limits參數調整
[root@localhost init]# vim limits.sls
/etc/security/limits.conf:
file.append:
- text:
- '* hard nofile 204800'
- '* soft nofile 204800'
/etc/profile:
file.append:
- text:
- 'ulimit -c unlimited'
~/.bashrc:
file.append:
- text:
- alias vi='"'vim'"'
resolv.sls
DNS解析文件修改
[root@localhost init]#vim resolv.sls
resolv:
file.managed:
- name: /etc/resolv.conf
- source: salt://init/resolv.conf
[root@localhost init]# vim resolv.conf
# Generated by NetworkManager
nameserver 114.114.114.114
nameserver 8.8.8.8
[root@localhost init]#
selinux.sls
selinux卸載
[root@localhost init]# vim selinux.sls
selinux:
cmd.run:
- name: yum remove selinux-policy -y
soft_install.sls
基礎軟件安裝
[root@localhost init]# vim soft_install.sls
soft-install:
pkg.installed:
- names:
- lrzsz
- telnet
- openssh-clients
- ftp
- sysstat
- bc
- rsync
- wget
- screen
- dstat
- vim-enhanced
- gcc
- gcc-c++
- make
- dos2unix
- net-tools
[root@localhost init]#
sshd_config.sls
SSHD配置文件調整
[root@localhost init]# vim sshd_config.sls
sshd:
file.managed:
- name: /etc/ssh/sshd_config
- source: salt://init/sshd_config
service.running:
- enable: True
- reload: True
- watch:
- file: /etc/ssh/sshd_config
[root@localhost init]# vim sshd_config
Port 22
Protocol 2
SyslogFacility AUTHPRIV
PasswordAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication yes
Compression yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes
UsePAM yes
UseDNS no
Subsystem sftp /usr/libexec/openssh/sftp-server
LogLevel DEBUG
#allowusers [email protected]
#allowusers [email protected]
sysctl.sls
內核參數調整
[root@localhost init]# vim sysctl.sls
net.ipv4.conf.default.rp_filter:
sysctl.present:
- value: 1
net.ipv4.conf.default.accept_source_route:
sysctl.present:
- value: 0
kernel.sysrq:
sysctl.present:
- value: 0
kernel.core_uses_pid:
sysctl.present:
- value: 1
kernel.msgmnb:
sysctl.present:
- value: 65536
kernel.msgmax:
sysctl.present:
- value: 65536
kernel.shmmax:
sysctl.present:
- value: 68719476736
kernel.shmall:
sysctl.present:
- value: 4294967296
kernel.shmmni:
sysctl.present:
- value: 4096
kern.maxfiles:
sysctl.present:
- value: 65536
net.ipv4.tcp_fin_timeout:
sysctl.present:
- value: 30
net.ipv4.tcp_keepalive_time:
sysctl.present:
- value: 1200
net.ipv4.tcp_window_scaling:
sysctl.present:
- value: 1
net.ipv4.tcp_sack:
sysctl.present:
- value: 1
net.ipv4.tcp_syncookies:
sysctl.present:
- value: 1
net.ipv4.tcp_tw_reuse:
sysctl.present:
- value: 1
net.ipv4.tcp_tw_recycle:
sysctl.present:
- value: 1
net.ipv4.ip_local_port_range:
sysctl.present:
- value: 1024 65000
net.ipv4.tcp_max_tw_buckets:
sysctl.present:
- value: 6000
net.ipv4.tcp_max_syn_backlog:
sysctl.present:
- value: 65535
net.core.netdev_max_backlog:
sysctl.present:
- value: 262144
net.core.wmem_default:
sysctl.present:
- value: 8388608
net.core.rmem_default:
sysctl.present:
- value: 8388608
net.core.rmem_max:
sysctl.present:
- value: 16777216
net.core.wmem_max:
sysctl.present:
- value: 16777216
net.ipv4.tcp_timestamps:
sysctl.present:
- value: 0
net.ipv4.tcp_synack_retries:
sysctl.present:
- value: 2
net.ipv4.tcp_syn_retries:
sysctl.present:
- value: 2
net.ipv4.tcp_mem:
sysctl.present:
- value: 94500000 915000000 927000000
net.ipv4.tcp_max_orphans:
sysctl.present:
- value: 3276800
[root@localhost init]#
建立入口文件及管理文件
[root@localhost base]# pwd
/etc/salt/base
[root@localhost base]# ls
init system_init.sls top.sls
[root@localhost base]# vim system_init.sls
include:
- init.selinux
- init.epel
- init.date_time
- init.soft_install
- init.history
- init.limits
- init.sysctl
- init.sshd_config
- init.resolv
[root@localhost base]# vim top.sls
base:
'*':
- system_init
[root@localhost base]#
執行命令
[root@localhost base]# salt '*' state.highstate test=True 執行前先測試
[root@localhost base]# salt '*' state.highstate
saltstack 初始化LINUX系統