SaltStack系统初始化

2401_89791684

于 2025-01-12 19:01:37 发布

阅读量657

点赞数 20

文章标签： saltstack

本文链接：https://blog.youkuaiyun.com/2401_89791684/article/details/145097467

版权

历史记录优化history

设置终端超时时间

配置yum源

安装各种agent pkg.installed 、file.managed、service.running

基础用户、用户审计、sudo权限设置

常用基础命令、命令别名

用户登录提示、PS1设置

状态文件目录结构

=======================================================================

[root@master ~]# cd /srv/salt/base/

[root@master base]# tree init/

init/

├── chrony

│ ├── files

│ │ └── chrony.conf

│ └── main.sls

├── firewalld

│ └── main.sls

├── history

│ └── main.sls

├── kernel

│ ├── files

│ │ ├── limits.conf

│ │ └── sysctl.conf

│ └── main.sls

├── sshd

│ ├── files

│ │ ├── sshd_config

│ └── main.sls

├── salt-minion

│ ├── files

│ │ └── minion.j2

│ └── main.sls

├── user

│ └── main.sls

├── selinux

│ ├── files

│ │ └── config

│ └── main.sls

├── timeout

│ └── main.sls

├── yum

│ ├── files

│ │ ├── centos-7.repo

│ │ ├── centos-8.repo

│ │ ├── epel-7.repo

│ │ ├── epel-8.repo

│ │ ├── salt-7.repo

│ │ └── salt-8.repo

│ └── main.sls

└── zabbix-agentd

├── files

│ ├── zabbix-5.4.4.tar.gz

│ ├── zabbix_agentd.conf.j2

│ └── zabbix.sh

└── main.sls

15 directories, 23 files

selinux

[root@master init]# cd selinux/

[root@master selinux]# ls

files main.sls

[root@master selinux]# cat main.sls

/etc/selinux/config:

file.managed:

source: salt://init/selinux/files/config
user: root
group: root
mode: ‘0644’

‘setenforce 0’:

cmd.run

[root@master selinux]# cat files/config

This file controls the state of SELinux on the system.

SELINUX= can take one of these three values:

enforcing - SELinux security policy is enforced.

permissive - SELinux prints warnings instead of enforcing.

disabled - No SELinux policy is loaded.

SELINUX=disabled

SELINUXTYPE= can take one of these three values:

targeted - Targeted processes are protected,

minimum - Modification of targeted policy. Only selected processes are protected.

mls - Multi Level Security protection.

SELINUXTYPE=targeted

防火墙

[root@master firewalld]# cat main.sls

firewalld.service:

service.dead:

enable: false

chrony时间同步

[root@master chrony]# cat files/chrony.conf

Use public servers from the pool.ntp.org project.

Please consider joining the pool (http://www.pool.ntp.org/join.html).

pool time1.aliyun.com iburst #修改时间同步服务器地址

Record the rate at which the system clock gains/losses time.

driftfile /var/lib/chrony/drift

…

[root@master chrony]# cat main.sls

include:

init.yum.main

chrony:

pkg.installed:

/etc/chrony.conf:

file.managed:

source: salt://init/chrony/files/chrony.conf
user: root
group: root
mode: ‘0644’

chrony.service:

service.running:

enable: true

文件描述符与内核优化

[root@master kernel]# cp /etc/security/limits.conf files/

[root@master kernel]# cp /etc/sysctl.conf files/

[root@master kernel]# vim files/limits.conf

#ftp hard nproc 0

#@student - maxlogins 4

           soft    nofile         65535  	#添加

           hard    nofile         65535  	#添加

[root@master kernel]# cat files/sysctl.conf

For more information, see sysctl.conf(5) and sysctl.d(5).

net.ipv4ip_forward = 1 #末尾添加这句

[root@master kernel]# cat main.sls

/etc/security/limits.conf:

file.managed:

source: salt://init/kernel/files/limits.conf
user: root
group: root
mode: ‘0644’

/etc/sysctl.conf:

file.managed:

source: salt://init/kernel/files/sysctl.conf
user: root
group: root
mode: ‘0644’

cmd.run

name: sysctl -p

SSH服务优化

[root@master sshd]# vim main.sls

sshd-config:

file.managed:

name: /etc/ssh/sshd_config
source: salt://init/sshd/files/sshd_config
user: root
gourp: root
mode: 0600

service.running:

name: sshd
enable: True
reload: True
watch:
file: sshd-config

[root@master sshd]# cat files/sshd_config

semanage port -a -t ssh_port_t -p tcp #PORTNUMBER

Port 83 #自定端口

#AddressFamily any

history历史记录

[root@master history]# cat main.sls

/etc/profile:

file.append:

test: ‘export HISTTIMEFORMAT=“%F %T whoami”’

设置终端超时时间

[root@master timeout]# cat main.sls

/etc/profile:

file.append:

test: ‘export TMOUT=300’

配置yum源

yum源

https://mirrors.aliyun.com/repo/Centos-7.repo

https://mirrors.aliyun.com/repo/Centos-8.repo

sed -i -e ‘/mirrors.cloud.aliyuncs.com/d’ -e ‘/mirrors.aliyuncs.com/d’ *.repo

yum install -y https://mirrors.aliyun.com/epel/epel-release-latest-8.noarch.rpm

sed -i ‘s|^metalink|#metalink|’ epel.repo

sed -i ‘s|^#baseurl=https://download.example/pub|baseurl=https://mirrors.aliyun.com|’ epel.repo

wget http://mirrors.aliyun.com/repo/epel-7.repo

curl -fsSL https://repo.saltproject.io/py3/redhat/7/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo

curl -fsSL https://repo.saltproject.io/py3/redhat/8/x86_64/latest.repo | sudo tee /etc/yum.repos.d/salt.repo

[root@master yum]# ls files/

centos-7.repo centos-8.repo epel-7.repo epel-8.repo salt-8.repo salt-8.repo

[root@master yum]# cat main.sls

{% if grains[‘os’] == ‘RedHat’ %}

/etc/yum.repos.d/centos-{{ grains[‘osmajorrelease’] }}.repo:

file.managed:

source: salt://init/yum/files/centos-{{ grains[‘osmajorrelease’] }}.repo
user: root
group: root
mode: ‘0644’

{% endif %}

/etc/yum.repos.d/epel-{{ grains[‘osmajorrelease’] }}.repo:

file.managed:

source: salt://init/yum/files/epel-{{ grains[‘osmajorrelease’] }}.repo
user: root
group: root
mode: ‘0644’

/etc/yum.repos.d/salt-{{ grains[‘osmajorrelease’] }}.repo:

file.managed:

source: salt://init/yum/files/salt-{{ grains[‘osmajorrelease’] }}.repo
user: root
group: root
mode: ‘0644’

基础命令安装

[root@master basepkg]# cat main.sls

include:

init.yum.main

install-base-pkgages:

pkg.installed:

pkgs:
screen
tree
psmisc
openssl
openssl-devel
telnet
iftop
iotop
sysstat
wget
dos2unix
unix2dos
lsof
net-tools
vim-enhanced
zip
unzip
bzip2
bind-utils
gcc
gcc-c++
glibc
make
autoconf

安装各种agent ，安装salt-minion、zabbix-agent

salt-minion

[root@master salt-minion]# cp /etc/salt/minion ./files/minion.j2

[root@master salt-minion]# vim files/minion.j2

resolved, then the minion will fail to start.

#master: salt

master: {{ pillar[‘salt_master_ip’] }} #定义变量

//定义变量值

[root@master base]# pwd

/srv/pillar/base

[root@master base]# vim salt-minion.sls

[root@master base]# cat salt-minion.sls

salt_master_ip:192.168.129.134

[root@master salt-minion]# cat main.sls

include:

init.yum.main

salt-minion

pkg.installed

/etc/salt/minion:

file.managed:

source: salt://init/salt-minion/files/minion.j2
user: root
group: root
mode: ‘0644’
template: true

salt-minion.service:

service.running:

enable: true

zabbix-agent

[root@master zabbix-agentd]# ls

files main.sls

[root@master zabbix-agentd]# cat main.sls

include:

init.yum.main