整体结构
[root@master salt]# tree base/
base/
└── init
├── base_pkg
│ └── main.sls
├── chrony
│ ├── files
│ │ └── chrony.conf
│ └── main.sls
├── firewalld
│ └── firewall.sls
├── history
│ └── main.sls
├── kernel
│ ├── files
│ │ ├── limits.conf
│ │ └── sysctl.conf
│ └── main.sls
├── salt_minion
│ ├── files
│ │ └── minion.j2
│ └── main.sls
├── selinux
│ ├── files
│ │ └── config
│ └── main.sls
├── service
│ └── main.sls
├── tmout
│ └── main.sls
├── yum
│ ├── files
│ │ ├── centos7.repo
│ │ ├── centos8.repo
│ │ ├── epel.repo
│ │ └── salt.repo
│ └── main.sls
└── zabbix_agentd
├── files
│ ├── zabbix-5.4.4.tar.gz
│ └── zabbix_agentd.conf.j2
└── main.sls
1. 关闭selinux
[root@master init]# tree selinux/
selinux/
├── files
│ └── config
└── main.sls
/etc/selinux/config:
file.managed:
- source: salt://init/selinux/files/config
- user: root
- group: root
- mode: '0644'
"setenforce 0":
cmd.run
2. 关闭防火墙
root@master init]# cat service/main.sls
postfix.service:
service.dead:
- enable: false
3. 时间同步(chrony)
[root@master init]# tree chrony/
chrony/
├── files
│ └── chrony.conf
└── main.sls
root@master init]# cat chrony/main.sls
chrony:
pkg.installed
/etc/chrony.conf:
file.managed:
- source: salt://init/chrony/files/chrony.conf
- user: root
- group: root
- mode: '0644'
chronyd.service:
service.running:
- enable: true
4. 内核优化
[root@master init]# tree kernel/
kernel/
├── files
│ ├── limits.conf
│ └── sysctl.conf
└── main.sls
1 directory, 3 files
[root@master init]# cat kernel/main.sls
/etc/sysctl.conf:
file.managed:
- source: salt://init/kernel/files/sysctl.conf
- user: root
- group: root
- mode: '0644'
/etc/security/limits.conf:
file.managed:
- source: salt://init/kernel/files/limits.conf
- user: root
- group: root
- mode: '0644'
'sysctl -p':
cmd.run
5. 精简开机系统服务(只开启sshd服务)
[root@master init]# tree ssh/
ssh/
├── files
│ └── sshd_config
└── main.sls
1 directory, 2 files
[root@master init]# cat ssh/main.sls
postfix.service:
service.dead:
- enable: false
/etc/ssh/sshd_conf:
file.managed:
- source: salt://init/ssh/files/sshd_conf
- user: root
- group: root
- mode: 644
[root@master init]#
6. 历史记录优化history(记录时间,用户)
[root@master init]# tree history/
history/
└── main.sls
0 directories, 1 file
[root@master init]#
[root@master init]# cat history/main.sls
etc/profile:
file.append:
- text: 'export HISTTIMEFORMAT="%F %T `whoami` "'
7.设置终端超时时间
[root@master init]# tree tmout/
tmout/
└── main.sls
0 directories, 1 file
[root@master init]#
[root@master tmout]# cat main.sls
/etc/profile:
file.append:
- text: 'export TMOUT=300'
8.配置YUM源
[root@master init]# tree yum/
yum/
├── files
│ ├── centos7.repo
│ ├── centos8.repo
│ ├── epel.repo
│ ├── salt-7.repo
│ └── salt-8.repo
└── main.sls
1 directory, 6 files
[root@master init]#
[root@master yum]# cat main.sls
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo:
file.managed:
- source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
- user: root
- group: root
- mode: '0644'
{% endif %}
/etc/yum.repos.d/epel.repo:
file.managed:
- source: salt://init/yum/files/epel.repo
- user: root
- group: root
- mode: '0644'
/etc/yum.repos.d/salt-{{ grains['osrelease'] }}.repo:
file.managed:
- source: salt://init/yum/files/salt-{{ grains['osrelease'] }}.repo
- user: root
- group: root
- mode: '0644'
[root@master yum]#
9. 安装zabbix_agent
[root@master init]# tree zabbix_agentd/
zabbix_agentd/
├── files
│ ├── zabbix-5.4.4.tar.gz
│ └── zabbix_agentd.conf.j2
└── main.sls
1 directory, 3 files
[root@master zabbix_agentd]# cat main.sls
include:
- init.yum.main
zabbix_agentd-package:
pkg.installed:
- pkgs:
- make
- gcc
- gcc-c++
- pcre-devel
create-zabbix-user:
user.present:
- name: zabbix
- createhome: false
- system: true
- shell: /sbin/nologin
/usr/src/zabbix-5.4.4.tar.gz:
file.managed:
- source: salt://init/zabbix_agentd/files/zabbix-5.4.4.tar.gz
- user: root
- group: root
- mode: '0644'
zabbix-install:
cmd.script:
- name: salt://init/zabbix_agentd/files/install.sh
- unless: test -d /usr/src/zabbix-5.4.4
/usr/local/etc/zabbix_agentd.conf:
file.managed:
- source: salt://init/zabbix_agentd/files/zabbix_agentd.conf.j2
- user: root
- group: root
- mode: '0644'
- template: jinja
'zabbix_agentd':
cmd.run
[root@master zabbix_agentd]#
10. 安装salt-minion
[root@master init]# tree salt_minion/
salt_minion/
├── files
│ └── minion.j2
└── main.sls
1 directory, 2 files
[root@master init]#
[root@master init]# cat salt_minion/main.sls
include:
- init.yum.main
salt-minion:
pkg.installed
/etc/salt/minion:
file.managed:
- source: salt://init/salt-mainion/files/minion.j2
- user: root
- group: root
- mode: '0644'
- template: jinja
salt-minion.service:
service.running:
- enable: true
[root@master init]#
[root@master init]# cat salt-minion/files/minion.j2
# Set the location of the salt master server. If the master server cannot be
# resolved, then the minion will fail to start.
#master: salt
master: {{ pillar['master_ip'] }}
11. 安装常用基础包
[root@master init]# tree base_pkg/
base_pkg/
└── main.sls
install_base-packages:
pkg.installed:
- pkgs:
- screen
- tree
- psmisc
- openssl
- openssl-devel
- telnet
- iftop
- iotop
- sysstat
- wget
- ntpdate
- dos2unix
- lsof
- net-tools
- vim-enhanced
- zip
- unzip
- bzip2
- bind-utils
- gcc
- gcc-c++
- glibc
- make
- autoconf