系统初始化状态编写

系统初始化状态编写

目录结构

[root@master init]# tree
.
├── basepkg
│   └── main.sls
├── chrony
│   ├── files
│   │   └── chrony.conf
│   └── main.sls
├── filrewalld
│   └── main.sls
├── histofy
│   └── main.sls
├── kernel
│   ├── files
│   │   ├── limits.conf
│   │   └── sysctl.conf
│   └── main.sls
├── salt_minion
│   ├── files
│   │   └── minion.j2
│   └── minion.sls
├── selinux
│   ├── files
│   │   └── config
│   └── main.sls
├── service
│   └── main.sls
├── ssh
│   ├── files
│   │   └── sshd_config
│   └── main.sls
├── timeout
│   └── main.sls
├── yum
│   ├── files
│   │   ├── centos-7.repo
│   │   ├── centos-8.repo
│   │   ├── epel.repo
│   │   └── salt.repo
│   └── main.sls
└── zabbix_agent
    ├── files
    │   ├── zabbix-5.4.4.tar.gz
    │   ├── zabbix_agentd.conf.j2
    │   └── zabbix_agent.sh
    └── main.sls

19 directories, 25 files

关闭selinux

[root@master selinux]# tree
.
├── files
│   └── config
└── main.sls

1 directory, 2 files

[root@master selinux]# cat main.sls 
/etc/selinux/config:
  file.managed:
    - source: salt://init/selinux/files/config
    - user: root
    - group: root
    - mode: '0644'

"setenforce 0":
  cmd.run:
    - require:
      - file: /etc/selinux/config

关闭防火墙

[root@master filrewalld]# tree
.
└── main.sls

0 directories, 1 file

[root@master filrewalld]# cat main.sls 
firewalld.service:
  service.dead:
    - enable: false

时间同步（配置ntp、chrony）

[root@master chrony]# tree
.
├── files
│   └── chrony.conf
└── main.sls

1 directory, 2 files

[root@master chrony]# cat main.sls 
chrony-install:
  pkg.installed:
   - name: chrony

/etc/chrony.conf:
  file.managed:
    - source: salt://init/chrony/files/chrony.conf
    - user: root
    - group: root
    - mode: '0644'

chronyd.service:
  service.running:
    - enable: true

文件描述符，修改/etc/security/limits.conf配置最大文件打开数,内存优化（内存、tcp）sysctl

[root@master kernel]# tree
.
├── files
│   ├── limits.conf
│   └── sysctl.conf
└── main.sls

1 directory, 3 files

[root@master kernel]# cat main.sls 
/etc/sysctl.conf:
  file.managed:
    - source: salt://init/kernel/files/sysctl.conf
    - user: root
    - group: root
    - mode: '0644'

/etc/security/limits.conf:
  file.managed:
    - source: salt://init/kernel/files/limits.conf
    - user: root
    - group: root
    - mode: '0644'

'sysctl -p':
  cmd.run

ssh服务优化（关闭dns解析、修改端口）

[root@master ssh]# tree
.
├── files
│   └── sshd_config
└── main.sls

1 directory, 2 files

[root@master ssh]# cat main.sls 
/etc/ssh/sshd_config:
  file.managed:
    - source: salt://init/ssh/files/sshd_config
    - user: root
    - group: root
    - mode: '0644'

sshd.service:
  service.running:
    - enable: true

精简开机系统服务（只开启sshd服务）

[root@master service]# cat main.sls 
postfix.service:
  service.dead:
    - enable: true
[root@master service]# tree
.
└── main.sls

0 directories, 1 file
[root@master service]# cat main.sls 
postfix.service:
  service.dead:
    - enable: true

历史记录优化history（记录时间、用户）

[root@master histofy]# tree
.
└── main.sls

0 directories, 1 file
[root@master histofy]# cat main.sls 
/etc/profile:
  file.line:
    - mode: insert
    - content: 'export HISTTIMEFORMAT="%F %T `whoami`"'
    - before: 'System'

设置终端超时时间

[root@master timeout]# tree
.
└── main.sls

0 directories, 1 file
[root@master timeout]# cat main.sls 
/etc/profile:
  file.append: 
    - text: 'export TMOUT=300'

配置yum源

[root@master yum]# tree
.
├── files
│   ├── centos-7.repo
│   ├── centos-8.repo
│   ├── epel.repo
│   └── salt.repo
└── main.sls

1 directory, 5 files
[root@master yum]# cat main.sls 
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo
  file.managed:
    - source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'
{% endif %}

/etc/yum.repos.d/epel.repo:
  file.managed:
    - source: salt://init/yum/files/epel.repo
    - user: root
    - group: root
    - mode: '0644'

/etc/yum.repos.d/salt.repo:
  file.managed:
    - source: salt://init/yum/files/salt.repo
    - user: root
    - group: root
    - mode: '0644'

安装各种agent，如zabbix_agent、salt-minion

##设置变量
[root@master prod]# cat serverip.sls 
master_ip: 192.168.240.50
Hostname: zabbix server
[root@master prod]# cat top.sls 
prod:
  '*':
    - serverip
[root@master prod]# salt '*' pillar.items
master:
    ----------
    Hostname:
        zabbix server
    master_ip:
        192.168.240.50

##zabbix_agent
[root@master zabbix_agent]# tree
.
├── files
│   ├── zabbix-5.4.4.tar.gz
│   ├── zabbix_agentd.conf.j2
│   └── zabbix_agent.sh
└── main.sls

1 directory, 4 files
[root@master zabbix_agent]# cat main.sls 
zabbix-agentpkg:
  pkg.installed:
    - pkgs:
      - wget 
      - make 
      - gcc 
      - gcc-c++ 
      - pcre-devel

zabbix:
  user.present:
    - shell: /sbin/nologin
    - createhome: false
    - system: true

/usr/src/zabbix-5.4.4.tar.gz:
  file.managed:
    - source: salt://init/zabbix_agent/files/zabbix-5.4.4.tar.gz

zabbix-installsh:
  cmd.script:
    - name: salt://init/zabbix_agent/files/zabbix_agent.sh

/usr/local/etc/zabbix_agentd.conf:
  file.managed:
    - source: salt://init/zabbix_agent/files/zabbix_agentd.conf.j2
    - user: root
    - group: root
    - mode: '0644'
    - template: jinja

zabbix_agentd:
  cmd.run


##salt-minion
[root@master salt_minion]# tree
.
├── files
│   └── minion.j2
└── minion.sls

1 directory, 2 files
[root@master salt_minion]# cat minion.sls 
include:
  - init.yum.main

salt-minion:
  pkg.installed:
    - pkg: salt-minion

/etc/salt/minion
  file.managed:
    - source: salt://init/salt_minion/files/minion.j2
    - user: root
    - user: root
    - mode: '0644'
    - template: jinja

salt-minion.service:
  service.running:
    - enable: true

安装常用的软件依赖包

[root@master basepkg]# tree
.
└── main.sls

0 directories, 1 file
[root@master basepkg]# cat main.sls 
include:
  - init.yum.main

install-base-package:
  pkg.install:
    - pkgs:
      - screen
      - tree
      - psmidc
      - openssl
      - openssl-devel
      - telnet
      - iftop
      - iotop
      - wget
      - dos2unix
      - lsof
      - net-tools
      - vim-enhanced
      - zip
      - sysstat
      - unzip 
      - bzip2
      - bind-utils
      - gcc
      - gcc-c++
      - make
      - autoconf