使用saltstack配置系统初始化

整体结构

[root@master salt]# tree base/
base/
└── init
    ├── base_pkg
    │   └── main.sls
    ├── chrony
    │   ├── files
    │   │   └── chrony.conf
    │   └── main.sls
    ├── firewalld
    │   └── firewall.sls
    ├── history
    │   └── main.sls
    ├── kernel
    │   ├── files
    │   │   ├── limits.conf
    │   │   └── sysctl.conf
    │   └── main.sls
    ├── salt_minion
    │   ├── files
    │   │   └── minion.j2
    │   └── main.sls
    ├── selinux
    │   ├── files
    │   │   └── config
    │   └── main.sls
    ├── service
    │   └── main.sls
    ├── tmout
    │   └── main.sls
    ├── yum
    │   ├── files
    │   │   ├── centos7.repo
    │   │   ├── centos8.repo
    │   │   ├── epel.repo
    │   │   └── salt.repo
    │   └── main.sls
    └── zabbix_agentd
        ├── files
        │   ├── zabbix-5.4.4.tar.gz
        │   └── zabbix_agentd.conf.j2
        └── main.sls

1. 关闭selinux

[root@master init]# tree selinux/
selinux/
├── files
│   └── config
└── main.sls

/etc/selinux/config:
  file.managed:
    - source: salt://init/selinux/files/config
    - user: root
    - group: root
    - mode: '0644'

"setenforce 0":
  cmd.run

2. 关闭防火墙

root@master init]# cat service/main.sls 
postfix.service:
  service.dead:
    - enable: false

3. 时间同步(chrony)

[root@master init]# tree  chrony/
chrony/
├── files
│   └── chrony.conf
└── main.sls



root@master init]# cat chrony/main.sls 
chrony:
  pkg.installed

/etc/chrony.conf:
  file.managed:
    - source: salt://init/chrony/files/chrony.conf
    - user: root
    - group: root
    - mode: '0644'

chronyd.service:
  service.running:
    - enable: true

4. 内核优化

[root@master init]# tree kernel/
kernel/
├── files
│   ├── limits.conf
│   └── sysctl.conf
└── main.sls

1 directory, 3 files


[root@master init]# cat kernel/main.sls 
/etc/sysctl.conf:
  file.managed:
    - source: salt://init/kernel/files/sysctl.conf
    - user: root
    - group: root
    - mode: '0644'
    
/etc/security/limits.conf:
  file.managed:
    - source: salt://init/kernel/files/limits.conf
    - user: root
    - group: root
    - mode: '0644'

'sysctl -p':
  cmd.run

5. 精简开机系统服务(只开启sshd服务)

[root@master init]# tree ssh/
ssh/
├── files
│   └── sshd_config
└── main.sls

1 directory, 2 files



[root@master init]# cat ssh/main.sls 
postfix.service:
  service.dead:
    - enable: false

/etc/ssh/sshd_conf:
  file.managed:
    - source: salt://init/ssh/files/sshd_conf
    - user: root
    - group: root
    - mode: 644
[root@master init]# 

6. 历史记录优化history(记录时间，用户)

[root@master init]# tree history/
history/
└── main.sls

0 directories, 1 file
[root@master init]# 

[root@master init]# cat history/main.sls
etc/profile:
  file.append:
    - text: 'export HISTTIMEFORMAT="%F %T `whoami` "'

7.设置终端超时时间

[root@master init]# tree tmout/
tmout/
└── main.sls

0 directories, 1 file
[root@master init]# 


[root@master tmout]# cat main.sls 
/etc/profile:
  file.append:
    - text: 'export TMOUT=300'

8.配置YUM源

[root@master init]# tree yum/
yum/
├── files
│   ├── centos7.repo
│   ├── centos8.repo
│   ├── epel.repo
│   ├── salt-7.repo
│   └── salt-8.repo
└── main.sls

1 directory, 6 files
[root@master init]# 


[root@master yum]# cat main.sls 
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'
{% endif %}

/etc/yum.repos.d/epel.repo:
  file.managed:
    - source: salt://init/yum/files/epel.repo
    - user: root
    - group: root
    - mode: '0644'

/etc/yum.repos.d/salt-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/salt-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'
[root@master yum]# 

9. 安装zabbix_agent

[root@master init]# tree zabbix_agentd/
zabbix_agentd/
├── files
│   ├── zabbix-5.4.4.tar.gz
│   └── zabbix_agentd.conf.j2
└── main.sls

1 directory, 3 files

[root@master zabbix_agentd]# cat main.sls 
include:
  - init.yum.main

zabbix_agentd-package:
  pkg.installed:
    - pkgs:
      - make
      - gcc
      - gcc-c++
      - pcre-devel

create-zabbix-user:
  user.present:
    - name: zabbix
    - createhome: false
    - system: true
    - shell: /sbin/nologin

/usr/src/zabbix-5.4.4.tar.gz:
  file.managed:
    - source: salt://init/zabbix_agentd/files/zabbix-5.4.4.tar.gz
    - user: root
    - group: root
    - mode: '0644'
   

zabbix-install:
  cmd.script:
    - name: salt://init/zabbix_agentd/files/install.sh
    - unless: test -d /usr/src/zabbix-5.4.4

/usr/local/etc/zabbix_agentd.conf:
  file.managed:
    - source: salt://init/zabbix_agentd/files/zabbix_agentd.conf.j2
    - user: root
    - group: root
    - mode: '0644'
    - template: jinja

'zabbix_agentd':
  cmd.run 
[root@master zabbix_agentd]# 

10. 安装salt-minion

[root@master init]# tree salt_minion/
salt_minion/
├── files
│   └── minion.j2
└── main.sls

1 directory, 2 files
[root@master init]#


[root@master init]# cat salt_minion/main.sls 
include:
  - init.yum.main

salt-minion:
  pkg.installed

/etc/salt/minion:
  file.managed:
    - source: salt://init/salt-mainion/files/minion.j2
    - user: root
    - group: root
    - mode: '0644'
    - template: jinja
    
salt-minion.service:
  service.running:
    - enable: true
[root@master init]# 

[root@master init]# cat salt-minion/files/minion.j2
# Set the location of the salt master server. If the master server cannot be
# resolved, then the minion will fail to start.
#master: salt
master: {{ pillar['master_ip'] }}

11. 安装常用基础包

[root@master init]# tree base_pkg/
base_pkg/
└── main.sls

install_base-packages:
  pkg.installed:
    - pkgs:
      - screen
      - tree
      - psmisc
      - openssl
      - openssl-devel
      - telnet
      - iftop
      - iotop
      - sysstat
      - wget
      - ntpdate
      - dos2unix
      - lsof
      - net-tools
      - vim-enhanced
      - zip
      - unzip
      - bzip2
      - bind-utils
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf