[root@node1 selinux]# pwd
/etc/selinux
//将修改好的selinux的配置文件传到对端
[root@master selinux]# cat main.sls
/etc/selinux/config:
file.managed:
- source: salt://init/selinux/files/config
- user: root
- group: root
- mode: 644
'setenforce 0':
cmd.run
[root@node1 selinux]# cat config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing //此处为开启状态
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
[root@master selinux]# salt node1 state.sls init.selinux.main
node1:
----------
ID: /etc/selinux/config
Function: file.managed
Result: True
Comment: File /etc/selinux/config updated
Started: 18:49:26.626348
Duration: 53.341 ms
Changes:
----------
diff:
---
+++
@@ -4,7 +4,7 @@
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
-SELINUX=enforcing
+SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
Summary for node1
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 53.341 ms
[root@node1 selinux]# cat config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled //关闭状态
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
3. 关闭防火墙
[root@node1 selinux]# systemctl enable --now firewalld.service
[root@node1 selinux]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendo>
Active: active (running) since Fri 2021-11-12 19:11:20 CST; 16s ago
Docs: man:firewalld(1)
Main PID: 3384 (firewalld)
Tasks: 2 (limit: 11301)
[root@master init]# pwd
/srv/salt/base/init
[root@master init]# ls
fire.sls selinux
[root@master init]# cat fire.sls
firewalld.service:
service.dead:
- enable: false
[root@master init]# salt node1 state.sls init.fire
node1:
----------
ID: firewalld.service
Function: service.dead
Result: True
Comment: Service firewalld.service has been disabled, and is dead
Started: 19:12:25.215859
Duration: 1044.361 ms
Changes:
----------
firewalld.service:
True
Summary for node1
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 1.044 s
[root@node1 selinux]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vend>
Active: inactive (dead)
Docs: man:firewalld(1)
4. 时间同步(chrony)
用阿里云的服务器来进行时间同步
[root@master chrony]# ls
files main.sls
[root@master chrony]# cat main.sls
chrony:
pkg.installed
/etc/chrony.conf:
file.managed:
- source: salt://init/chrony/files/chrony.conf
- user: root
- group: root
- mode: 644
chronyd.service:
service.running:
- enable: true
[root@master chrony]# ls files/
chrony.conf
[root@master chrony]# head -5 files/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool time1.aliyun.com iburst //此处写阿里云的服务器的地址
# Record the rate at which the system clock gains/losses time.
[root@master chrony]# salt node1 state.sls init.chrony.main
[root@master sshd]# ls
files main.sls
[root@master sshd]# ls files/
sshd_config
[root@master files]# head -17 sshd_config
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
Port 1024 //将远程连接的默认的22端口号改为1024,这样为了安全防止别人攻击,这里最大可改的端口号为65535
[root@master sshd]# cat main.sls
/etc/ssh/sshd_config:
file.managed:
- source: salt://init/sshd/files/sshd_config
start-sshd:
service.running:
- name: sshd
- reload: true
- watch: //这个参数的意思是如果下面的文件的内容发生改变就重新加载/重新启动sshd服务
- file: /etc/ssh/sshd_config