saltstack之系统初始化状态编写

1. 目录结构

[root@master base]# pwd
/srv/salt/base

[root@master init]# tree .
.
├── basepkg
│   └── main.sls
├── chrony
│   ├── files
│   │   └── chrony.conf
│   └── main.sls
├── firewalld
│   └── main.sls
├── history
│   └── main.sls
├── kernel
│   ├── files
│   │   ├── limits.conf
│   │   └── sysctl.conf
│   └── main.sls
├── salt-minion
│   ├── files
│   │   └── minion.j2
│   └── main.sls
├── selinux
│   ├── files
│   │   └── config
│   └── main.sls
├── server
│   └── main.sls
├── sshd
│   ├── files
│   │   └── sshd_config
│   └── main.sls
├── timeout
│   └── main.sls
├── yum
│   ├── files
│   │   ├── centos-7.repo
│   │   ├── centos-8.repo
│   │   ├── epel-7.repo
│   │   ├── epel-8.repo
│   │   ├── salt-7.repo
│   │   └── salt-8.repo
│   └── main.sls
└── zabbix
    ├── files
    │   ├── install.sh
    │   ├── zabbix-5.4.4.tar.gz
    │   └── zabbix_agentd.conf.j2
    └── main.sls

2. 关闭selinux

[root@node1 selinux]# pwd
/etc/selinux
//将修改好的selinux的配置文件传到对端
[root@master selinux]# cat main.sls 
/etc/selinux/config:
  file.managed:
    - source: salt://init/selinux/files/config
    - user: root
    - group: root
    - mode: 644

'setenforce 0':
  cmd.run

[root@node1 selinux]# cat config 

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing  //此处为开启状态
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted


[root@master selinux]# salt node1 state.sls init.selinux.main
node1:
----------
          ID: /etc/selinux/config
    Function: file.managed
      Result: True
     Comment: File /etc/selinux/config updated
     Started: 18:49:26.626348
    Duration: 53.341 ms
     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -4,7 +4,7 @@
                   #     enforcing - SELinux security policy is enforced.
                   #     permissive - SELinux prints warnings instead of enforcing.
                   #     disabled - No SELinux policy is loaded.
                  -SELINUX=enforcing
                  +SELINUX=disabled
                   # SELINUXTYPE= can take one of these three values:
                   #     targeted - Targeted processes are protected,
                   #     minimum - Modification of targeted policy. Only selected processes are protected. 

Summary for node1
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:  53.341 ms


[root@node1 selinux]# cat config 

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled  //关闭状态
# SELINUXTYPE= can take one of these three values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

3. 关闭防火墙

[root@node1 selinux]# systemctl enable --now firewalld.service

[root@node1 selinux]# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendo>
   Active: active (running) since Fri 2021-11-12 19:11:20 CST; 16s ago
     Docs: man:firewalld(1)
 Main PID: 3384 (firewalld)
    Tasks: 2 (limit: 11301)

[root@master init]# pwd
/srv/salt/base/init
[root@master init]# ls
fire.sls  selinux
[root@master init]# cat fire.sls 
firewalld.service:
  service.dead:
    - enable: false


[root@master init]# salt node1 state.sls init.fire
node1:
----------
          ID: firewalld.service
    Function: service.dead
      Result: True
     Comment: Service firewalld.service has been disabled, and is dead
     Started: 19:12:25.215859
    Duration: 1044.361 ms
     Changes:   
              ----------
              firewalld.service:
                  True

Summary for node1
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:   1.044 s


[root@node1 selinux]# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vend>
   Active: inactive (dead)
     Docs: man:firewalld(1)

4. 时间同步(chrony)

用阿里云的服务器来进行时间同步
[root@master chrony]# ls
files  main.sls
[root@master chrony]# cat main.sls 
chrony:
  pkg.installed

/etc/chrony.conf:
  file.managed:
    - source: salt://init/chrony/files/chrony.conf
    - user: root
    - group: root
    - mode: 644

chronyd.service:
  service.running:
    - enable: true

[root@master chrony]# ls files/
chrony.conf

[root@master chrony]# head -5 files/chrony.conf 
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool time1.aliyun.com iburst   //此处写阿里云的服务器的地址

# Record the rate at which the system clock gains/losses time.

[root@master chrony]# salt node1 state.sls  init.chrony.main

5. 内核优化与文件描述

[root@master kernel]# pwd
/srv/salt/base/init/kernel
[root@master kernel]# ls
files


[root@master kernel]# cp /etc/security/limits.conf files/
[root@master kernel]# cp /etc/sysctl.conf files/

[root@master files]# tail -4 limits.conf   //在最后添加两行内容
#@student        -       maxlogins       4
*               soft     nofile           65535  //这个是软限制，最大的65535个文件打开数
*               hard     nofile          65535  //这个是硬限制，这个也是65535个文件数
# End of file

[root@master files]# tail -1 sysctl.conf   //在最后一行添加此内容，也可以添加一些其他的内核参数。
net.ipv4.ip_forward = 1


[root@master kernel]# cat main.sls 
/etc/security/limits.conf:
  file.managed:
    - source: salt://init/kernel/files/limits.conf
    - user: root
    - group: root
    - mode: 644

/etc/sysctl.conf:
  file.managed:
    - source: salt://init/kernel/files/sysctl.conf
    - user: root
    - group: root
    - mode: 644
  cmd.run:
    - name: sysctl -p  //这条命令在反复执行的情况下也不会报错或警告，所以不用考虑幂等性的问题。

6. ssh服务优化

[root@master sshd]# ls
files  main.sls
[root@master sshd]# ls files/
sshd_config

[root@master files]# head -17 sshd_config 
#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
Port 1024  //将远程连接的默认的22端口号改为1024，这样为了安全防止别人攻击，这里最大可改的端口号为65535

[root@master sshd]# cat main.sls 
/etc/ssh/sshd_config:
  file.managed:
    - source: salt://init/sshd/files/sshd_config

start-sshd:
  service.running:
    - name: sshd
    - reload: true
    - watch:  //这个参数的意思是如果下面的文件的内容发生改变就重新加载/重新启动sshd服务
      - file: /etc/ssh/sshd_config

7. 精简开机系统服务

//就是开机启动时可以将不必要的服务停止，可以只留一个ssh服务，写法如下：

[root@master server]# cat main.sls 
stop-service:
  service.dead:
    - name:   //这个地方就写你想要关闭的服务的名称就可以了。
    - enable: false

8. 历史记录优化、设置终端超时时间

[root@master history]# pwd
/srv/salt/base/init/history

[root@master history]# cat main.sls 
/etc/profile:
  file.append:
    - text: 
      - 'export HISTTIMEFORMAT="%F %T `whoami` "'
[root@master history]# salt node1 state.sls init.history.main

[root@master timeout]# pwd
/srv/salt/base/init/timeout

[root@master timeout]# cat main.sls 
/etc/profile:
  file.append:
    - text: export TMOUT=300
[root@master init]# salt node1 state.sls init.timeout.main

9. yum源

salt源的下载地址

// 到阿里云镜像站下载centos7和8，epel7和8的网络源。
然后删除网络源中的不必要的内容。

[root@master files]# pwd
/srv/salt/base/init/yum/files
[root@master files]# sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' *.repo  //这条命令在只有centos7和8的情况下执行，确保你的files目录下只有7和8的源

[root@master yum.repos.d]# pwd
/etc/yum.repos.d
[root@master yum.repos.d]# yum install -y https://mirrors.aliyun.com/epel/epel-release-latest-8.noarch.rpm  //执行此命令后会有很多epel源，将epel.repo这个源移到files目录下，并改名为epel-8.repo
下面两条命令只针对epel8
[root@master files]# sed -i 's|^metalink|#metalink|' epel-8.repo  //使用此命令注释epel源中的metalink

[root@master files]# sed -i 's|^#baseurl=https://download.example/pub|baseurl=https://mirrors.aliyun.com|' epel-8.repo  //取消注释

[root@master yum]# cat main.sls 
{% if grains['os'] == 'RedHat' %}
/etc/yum.repos.d/centos-{{ grains['osmajorrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/centos-{{ grains['osmajorrelease'] }}.repo
    - user: root
    - group: root
    - mode: 644
{% endif %}

/etc/yum.repos.d/epel-{{ grains['osmajorrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/epel-{{ grains['osmajorrelease'] }}.repo
    - user: root
    - group: root
    - mode: 644


/etc/yum.repos.d/salt-{{ grains['osmajorrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/salt-{{ grains['osmajorrelease'] }}.repo
    - user: root
    - group: root
    - mode: 644


[root@master yum]# salt node1 state.sls init.yum.main

10. 安装zabbix_agentd

[root@master zabbix]# pwd
/srv/salt/base/init/zabbix

[root@master zabbix]# ls
files  main.sls

[root@master files]# mv zabbix_agentd.conf{,.j2}  //这里将zabbix_agentd的配置文件改为j2结尾，用于模板使用

[root@master files]# ls
install.sh  zabbix-5.4.4.tar.gz  zabbix_agentd.conf.j2

[root@master files]# cat install.sh 
#!/bin/bash

cd /usr/local/zabbix-5.4.4
./configure --enable-agent
make install


[root@master zabbix]# cat main.sls 
one:
  pkg.installed:
    - pkgs:
      - make
      - gcc
      - gcc-c++
      - openssl
      - openssl-devel
      - pcre
      - pcre-devel

two:
  archive.extracted:
    - name: /usr/local
    - source: salt://init/zabbix/files/zabbix-5.4.4.tar.gz
    - user: root
    - group: root
    - mode: 755

three:
  user.present: 
    - shell: /sbin/nologin
    - createhome: false
    - system: true

salt://init/zabbix/files/install.sh:
  cmd.script:
    - unless: test -f /usr/local/etc/zabbix_agentd.conf  //判断如果此路径下没有文件件就执行此脚本这样就具有幂等性
   
zabbix_file:
  file.managed:
    - name: /usr/local/etc/zabbix_agentd.conf
    - source: salt://init/zabbix/files/zabbix_agentd.conf.j2
    - template: jinja

[root@master base]# pwd
/srv/pillar/base

[root@master base]# cat salt-minion.sls   //这个是变量文件
master_ip: 192.168.182.141
[root@master base]# cat top.sls  //这个文件就是告诉对端到那个地方去找这个变量文件
base:
  'node1':
    - salt-minion


[root@master base]# vim /etc/salt/master  //在master文件里面添加这三行是为了定义这个/srv/pillar/base文件
865pillar_roots:
866  base:
867   - /srv/pillar/base
[root@master base]# systemctl restart salt-master.service  //修改配置文件需要重启服务

11. 安装salt-minion

[root@master base]# pwd
/srv/pillar/base
[root@master base]# cat salt-minion.sls 
master_ip: 192.168.182.141

[root@master base]# pwd
/srv/pillar/base
[root@master base]# cat salt-minion.sls 
master_ip: 192.168.182.141

[root@master base]# cat top.sls 
base:
  'node1':
    - salt-minion

[root@master salt-minion]# pwd
/srv/salt/base/init/salt-minion

[root@master files]# mv minion{,.j2}将此配置文件改为j2结尾的模板
[root@master salt-minion]# ls files/
minion.j2


[root@master base]# vim /etc/salt/master  //添加这三行
865 pillar_roots:
 866   base:
 867     - /srv/pillar/base
[root@master base]# systemctl restart salt-master.service  //重启服务

[root@master salt-minion]# cat main.sls 
include:
  - init.yum.main

salt-minion:
  pkg.installed

/etc/salt/minion:
  file.managed:
    - source: salt://init/salt-minion/files/minion.j2
    - user: root
    - group: root
    - mode: 644
    - template: jinja

salt-minion.service:
  service.running:
    - enable: true

[root@master files]# vim minion.j2
17 master: {{ pillar['master_ip'] }}
[root@master salt-minion]# salt node1 state.sls init.salt-minion.main

12. 基础命令

[root@master basepkg]# pwd
/srv/salt/base/init/basepkg
[root@master basepkg]# ls
main.sls

[root@master basepkg]# cat main.sls 
include:
  - init.yum.main
install-base-pkgages:
  pkg.installed:
    - pkgs:
      - screen
      - tree
      - psmisc
      - openssl
      - openssl-devel
      - telnet
      - iftop
      - iotop
      - sysstat
      - wget
      - dos2unix
      - lsof
      - net-tools
      - vim-enhanced
      - zip
      - unzip
      - bzip2
      - bind-utils
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf

[root@master basepkg]# salt node1 state.sls init.basepkg.main