saltstack-系统初始化

• 关闭防火墙
• 关闭SELINUX
• 时间同步（配置ntp、chrony）
• 文件描述符，修改/etc/security/limits.conf配置最大文件打开数
• 内核优化（内存、tcp） sysctl
• SSH服务优化（关闭DNS解析、修改端口）
• 精简开机系统服务（只开启SSHD服务）
• DNS解析
• 历史记录优化history（记录时间、用户）

export HISTTIMEFORMAT="%F %T `whoami`"
1

• 设置终端超时时间 export TMOUT=300 、etc/profile file.append
• 配置yum源
• 安装各种agent，如zabbix_agent、salt-minion
• 基础用户、用户审计、sudo权限设置
• 常用基础命令，命令别名
• 用户登录提示、PS1设置

目录树

[root@master ~]# tree /srv/salt/base/
/srv/salt/base/
└── init
    ├── base-pkg
    │   └── main.sls
    ├── chrony
    │   ├── files
    │   │   └── chrony.conf
    │   └── main.sls
    ├── firewall
    │   └── main.sls
    ├── history
    │   └── main.sls
    ├── kernel
    │   ├── files
    │   │   ├── limits.conf
    │   │   └── sysctl.conf
    │   └── main.sls
    ├── main.sls
    ├── salt-minion
    │   ├── files
    │   │   └── minion
    │   └── main.sls
    ├── selinux
    │   ├── files
    │   │   └── config
    │   └── main.sls
    ├── timeout
    │   └── main.sls
    ├── yum
    │   ├── files
    │   │   ├── centos-7.repo
    │   │   ├── centos-8.repo
    │   │   ├── epel-7.repo
    │   │   ├── epel-8.repo
    │   │   ├── salt-7.repo
    │   │   └── salt-8.repo
    │   └── main.sls
    └── zabbix_agent
        ├── files
        │   ├── install.sh
        │   ├── zabbix-5.4.4.tar.gz
        │   ├── zabbix_agentd
        │   ├── zabbix_agentd.conf
        │   └── zabbix_agentd.service
        └── main.sls

17 directories, 27 files

selinux

[root@master base]# cat init/selinux/files/config 
...省略
#     disabled - No SELinux policy is loaded.
SELINUX=disabled		//修改为disabled
# SELINUXTYPE= can take one of these three values:
...省略


[root@master base]# cat init/selinux/main.sls 
/etc/selinux/config:
  file.managed:
    - source: salt://init/selinux/files/config
    - user: root
    - group: root
    - mode: '0644'

'setenforce 0':
  cmd.run

firewall

[root@master base]# cat init/firewall/main.sls 
firewalld.service:
  service.dead:
    - enable: false

chrony

[root@master base]# cat init/chrony/files/chrony.conf 
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool time1.aliyun.comp iburst		//修改同步时间服务器

[root@master base]# cat init/chrony/main.sls 
include:
  - init.yum.main

chrony:
  pkg.installed

/etc/chrony.conf:
  file.managed:
    - source: salt://init/chrony/files/chrony.conf
    - user: root
    - group: root
    - mode: '0644'

chronyd.service:
  service.running:
    - enable: true

history

[root@master base]# cat init/history/main.sls 
/etc/profile:
  file.append:
    - text: 'export HISTTIMEFORMAT="%F %T `whoami`"'

timeout

[root@master base]# cat init/timeout/main.sls 
/etc/profile:
  file.append:
    - text: 'export TMOUT=300'

kernel

[root@master base]# cat init/kernel/files/limits.conf 
...省略			//在配置文件最后添加以下两行
*               soft     nofile        65535
*               hard     nofile        65535

[root@master base]# cat init/kernel/files/sysctl.conf 
...省略
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ip_forward = 1			//在配置文件最后添加一行

[root@master base]# cat init/kernel/main.sls 
/etc/security/limits.conf:
  file.managed:
    - source: salt://init/kernel/files/limits.conf
    - user: root
    - group: root
    - mode: '0664'

/etc/sysctl.conf:
  file.managed:
    - source: salt://init/kernel/files/sysctl.conf
    - user: root
    - group: root
    - mode: '0664'
  cmd.run:
    - name: sysctl -p

yum

[root@master base]# tree init/yum/
init/yum/
├── files
│   ├── centos-7.repo
│   ├── centos-8.repo
│   ├── epel-7.repo
│   ├── epel-8.repo
│   ├── salt-7.repo
│   └── salt-8.repo
└── main.sls

1 directory, 7 files

[root@master base]# cat init/yum/main.sls 
{% if grains['os'] == 'RedHat' %}		//如果系统时redhat就配置基础源centos-7/8.repo
/etc/yum.repos.d/centos-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/centos-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'
{% endif %}

/etc/yum.repos.d/epel-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/epel-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'

/etc/yum.repos.d/salt-{{ grains['osrelease'] }}.repo:
  file.managed:
    - source: salt://init/yum/files/salt-{{ grains['osrelease'] }}.repo
    - user: root
    - group: root
    - mode: '0644'

salt-minion

[root@master base]# head -17 init/salt-minion/files/minion | tail -1
master: {{ pillar['master_ip'] }}		//使用变量指定master IP

[root@master base]# cat /srv/pillar/base/salt-minion.sls
master_ip: 192.168.237.170		//在pillar目录下定义变量

[root@master base]# cat init/salt-minion/main.sls 
include:		//导入配置yum源的状态文件
  - init.yum.main

salt-minion:
  pkg.installed

/etc/salt/minion:
  file.managed:
    - source: salt://init/salt-minion/files/minion.j2
    - user: root
    - group: root
    - mode: '0644'

salt-minion.service:
  service.running:
    - enable: true

zabbix-agent

[root@master init]# tree zabbix_agent/
zabbix_agent/
├── files
│   ├── install.sh
│   ├── zabbix-5.4.4.tar.gz
│   ├── zabbix_agentd
│   ├── zabbix_agentd.conf
│   └── zabbix_agentd.service
└── main.sls

1 directory, 6 files

[root@master base]# cat init/zabbix_agent/files/zabbix_agentd.conf 
...省略
113 Server={{ pillar['zabbix_server_ip'] }}
...
154 ServerActive={{ pillar['zabbix_server_ip'] }}
...
165 Hostname={{ pillar['zabbix_agent_hostname'] }}
...省略

[root@master base]# cat zabbix_agent.sls 		//定义pillar变量
zabbix_server_ip: 192.168.237.170
zabbix_agent_hostname: node1

[root@master init]# cat zabbix_agent/main.sls 
include:
  - init.selinux.main
  - init.firewall.main
  - init.yum.main
  - init.base-pkg.main
  
zabbix:
  user.present:
    - createhome: false
    - system: true
    - shell: /sbin/nologin

/usr/src/zabbix-5.4.4:
  archive.extracted:
    - source: salt://init/zabbix_agent/files/zabbix-5.4.4.tar.gz

salt://init/zabbix_agent/files/install.sh:
  cmd.script

/usr/local/etc/zabbix_agentd.conf:
  file.managed:
    - source: salt://init/zabbix_agent/files/zabbix_agentd.conf
    - user: root
    - group: root
    - mode: '0644'

/etc/init.d/zabbix_agentd:
  file.managed:
    - source: salt://init/zabbix_agent/files/zabbix_agentd
    - user: root
    - group: root
    - mode: '0755'

/usr/lib/systemd/system/zabbix_agentd.service:
  file.managed:
    - source: salt://init/zabbix_agent/files/zabbix_agentd.service
    - user: root
    - group: root
    - mode: '0644'

zabbix_agentd.service:
  service.running:
    - enable: true

base-pkg

[root@master base]# cat init/base-pkg/main.sls 
include:
  - init.yum.main

install-base-packages:
  pkg.installed:
    - pkgs:
      - screen
      - tree
      - psmisc
      - openssl
      - openssl-devel
      - telnet
      - iftop
      - iotop
      - sysstat
      - wget
      - dos2unix
      - unix2dos
      - lsof
      - net-tools
      - vim-enhanced
      - zip
      - unzip
      - bzip2
      - bind-utils
      - gcc
      - gcc-c++
      - glibc
      - make
      - autoconf