使用SaltStack一键完成centos6/7的操作系统初始化配置

深夜放福利！

刚刚设计和测试完成的，Salt一键初始化配置CentOS6/7操作系统功能模块。
有了这个，领导终于不用担心我做不好个系统了啊 ?

划重点：

• centos6、centos7通用，初次执行时，如果下载安装包不是太慢的话，全过程大约需要3分钟。
• 幂等，就是说这个初始化配置命令在一个主机上反复执行多少次，都是一个相同的结果，不多、不少、不错。

注：如果你刚好碰到了其它的意外情况，不妨通知我，个别地方考虑不周，在所难免

主要包含以下几方面的配置内容：

• 安装常用工具包
• 安装和设置中文字符集
• 关停不使用的系统服务
• 调整几个工具的文件使用权限
• 关闭selinux
• 禁止ssh服务使用DNS解析
• 操作系统内核参数调优

Salt配置模块主文件

main_init.sls

## ================安装常用工具包======================================
epel-release:
  pkg.installed
commom pachages for centos6 and 7:
  pkg.installed:
    - pkgs:
      - vim-minimal
      - vim-common
      - vim-filesystem
      - wget
      - gcc
      - gcc-c++
      - automake
      - autoconf
      - cronie
      - ntp
      - sysstat
      - iotop
      - lsof
      - tcpdump
      - telnet
      - traceroute
      - mtr
      - lrzsz
      - mailx
      - iproute
      - net-tools
      {% if grains['osmajorrelease'] == 6 %}
      - nc
      {% elif grains['osmajorrelease'] == 7 %}
      - nmap-ncat
      {% endif %}
      - nload
      - iftop
      - dos2unix

## ================安装和设置中文字符集==================================
{% if grains['osmajorrelease'] == 6 %}
zh lang pachages for centos6:
  pkg.group_installed:
    - name: Chinese Support
    - skip:
      - ibus-table-cangjie
      - ibus-table-erbi
      - ibus-table-wubi
zh_CN.UTF-8 setting in i18n:
  file.managed:
    - name: /etc/sysconfig/i18n
    - source: salt://system_init/general_init/zh_CN.UTF-8.conf
    - user: root
    - group: root
{% elif grains['osmajorrelease'] == 7 %}
zh lang pachages for centos7:
  pkg.installed:
    - name: kde-l10n-Chinese
zh_CN.UTF-8 setting in i18n:
  file.managed:
    - name: /etc/locale.conf
    - source: salt://system_init/general_init/zh_CN.UTF-8.conf
    - user: root
    - group: root	
{% endif %}

## ================关停不使用的系统服务，如果有的话========================
stop unnecessary service:
  service.dead:
    {% set unservices = ['acpid', 'bluetooth', 'cups', 'yum-updatesd', 'nfslock', 'avahi-daemon', 'NetworkManager', 'ip6tables'] %}
    {% for unservice in unservices %}
    - names:
      - {{ unservice }}
    - enable: False
    {% endfor %}
# 由于auditd在centos7上有特殊设置，无法通过systemctl关闭服务，故使用以下的变通方法
shutdown auditd service:
  cmd.run:
    - name: service auditd stop
    - onlyif: service auditd status
disable auditd service:
  service.disabled:
    - name: auditd

## ================调整几个工具的文件权限，以允许普通用户可以使用===============
lsof file mode change:
  file.managed:
    - name: /usr/sbin/lsof
    - user: root
    - group: root
    - mode: 4755
tcpdump file mode change:
  file.managed:
    - name: /usr/sbin/tcpdump
    - user: root
    - group: root
    - mode: 4755
mtr file mode change:
  file.managed:
    - name: /usr/sbin/mtr
    - user: root
    - group: root
    - mode: 4755

## =================关闭selinux=============================================
update the /etc/selinux/conf:
  file.replace:
    - name: /etc/selinux/config
    - pattern: 'SELINUX=enforcing'
    - repl: 'SELINUX=disabled'

## =================禁止ssh服务使用DNS解析===================================
update the /etc/ssh/sshd_config:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: '#UseDNS yes'
    - repl: 'UseDNS no'

## ==================操作系统内核参数调优====================================
limit for number of user processes:
  file.managed:
    {% if grains['osmajorrelease'] == 6 %}
    - name: /etc/security/limits.d/90-nproc.conf
    {% elif grains['osmajorrelease'] == 7 %}
    - name: /etc/security/limits.d/20-nproc.conf
    {% endif %}
    - source: salt://system_init/general_init/user-nproc.conf
    - user: root
    - group: root
    - mode: 644
limit for number of user opened files:
  file.managed:
    - name: /etc/security/limits.d/user-nofile.conf
    - source: salt://system_init/general_init/user-nofile.conf
    - user: root
    - group: root
    - mode: 644
customed sysctl parameters:
  file.managed:
    - name: /etc/sysctl.d/customed-sysctl.conf
    - source: salt://system_init/general_init/customed-sysctl.conf
    - user: root
    - group: root
    - mode: 644

下面是几个涉及到的附属资源文件。

字符集配置文件

zh_CN.UTF-8.conf

LANG="zh_CN.UTF-8"

用户打开的最大进程数配置

user-nproc.conf

# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.

*          soft    nproc     50000
root       soft    nproc     unlimited

用户打开的最大文件数配置

user-nofile.conf

# Default limit for number of user's files to open
* soft nofile 60000
* hard nofile 60000

系统内核参数优化

customed-sysctl.conf

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv4.ip_local_port_range = 1024 65000
vm.swappiness = 10
net.core.somaxconn=2048

执行Salt状态模块同步命令

无论是centos6，还是centos7，只需要登录salt minion主机节点，执行下面的状态同步命令salt-call state.apply main_init即可

Summary for local
-------------
Succeeded: 22 (changed=3)
Failed:     0
-------------
Total states run:     22
Total run time:    1.753 s

real	0m7.384s
user	0m2.798s
sys	0m1.480s

# time salt-call state.apply main_init

• 因为执行完状态同步命令后屏幕打印的信息太多，所以上面截取的实际上是结果中末尾的统计内容。
• 最后一行是实际执行的salt命令。