前言
在金融行业中我所接触的操作系统主要是AIX
和SLES(SuSE Linux Enterprise Server)
,也许大家平时用得更多是CentOS
,虽然有部分差异但原理都是相通的,SMIT
和YaST
也是灰常实用的功能,推荐大家有机会尝试体验下。因为网上关于SuSE自动化部署的参考文章较少,这套自动化部署方案已经被验证并在生产系统使用了1年半,配置相对成熟和稳定。遵循Don't Repeat Yourself
原则,本文主要介绍基于AutoYaST实现半自动化SuSE定制光盘和PXE网络全自动化安装SuSE的实践过程,如需了解更加详细的参数说明可以参考扩展阅读中的SuSE官网。
AutoYaST是自动化部署SuSE的黄金搭档
更新历史
2015年05月28日 - 初稿
阅读原文 - http://wsgzao.github.io/post/autoyast/
扩展阅读
- SuSE - https://www.suse.com/zh-cn/
- AutoYaST - http://doc.opensuse.org/projects/autoyast/
SuSE自动安装光盘
定制版本
SUSE Linux Enterprise Server 11 (x86_64)
VERSION = 11
PATCHLEVEL = 2
下载地址 - https://www.suse.com/zh-cn/download-linux/
AutoYast简介
AutoYast是SuSE Linux的自动安装工具。通过AutoYast,在DHCP、TFTP、PXE服务的支持下,通过FTP、NFS等网络安装源可以实现SuSE Linux的完全无人值守自动安装。但是,这种方式必须建立独立的服务器且客户端支持PXE网络启动,在现场没有网络或者系统不支持客户端网卡的场景下不适合,通过AutoYast制作的SuSE Linux一键安装光盘可以满足上述场景。本文主要介绍SuSE Linux Enterprise Server 11(简称SLES11)一键安装光盘的制作, 其他SuSE Linux仅供参考。
生成AutoYaST配置文件
AutoYast配置成功后,生成一个名为autoinst.xml的XML配置文件,SuSE Linux通过这个文件控制操作系统的安装。AutoYast生成配置文件有3种方式:
1. 系统安装时自动生成
2. 系统安装后通过运行命令生成
3. 直接编辑生成(偷懒最佳姿势
)
系统安装时生成配置文件
按照正常步骤安装SLES11,把必须的软件全部安装。运行到最后一步“安装已完成”,勾选“为AutoYast复制此系统”,系统开始克隆系统生成配置文件,并弹出提示窗口。生成配置文件用时约2分钟左右,生成的配置文件位于/root目录下。
运行命令生成或者修改配置文件
如果在系统安装时没有生成配置文件,可以运行命令生成。在系统中打开终端,以root用户运行命令yast2 autoyast
,打开AutoYast配置窗口,选择“工具”->“创建参考配置文件”,弹出“创建参考控制文件”窗口。勾选需要配置的项目,如软件包选择、语言、分区、键盘布局、防火墙、网络设置等,AutoYast根据选择的项目从系统获取相关配置信息。选择“文件”->“保存”,弹出“另存为”窗口,输入文件名“autoinst.xml”,选择“保存”,系统提示文件保存到指定目录下。
有时我们需要对模块做些调整,比如磁盘分区、软件包等。以调整磁盘分区为例介绍配置文件的修改。
以root用户运行yast2 autoyast
,打开AutoYast窗口,选择“文件”->“打开”,选择autoinst.xml文件,等系统读取配置后,在AutoYast窗口显示配置配件名称,修改后保存即可。
制作安装光盘
AutoYast配置文件生成后,可以开始制作一键安装光盘了。制作一键安装光盘需要用到SLES11的原安装光盘的数据。
#首先复制SLES11原安装光盘的数据到指定目录
mkdir /tmp/sles11
cp -R /media/S*/* /tmp/sles11
#复制autoinst.xml
cp /root/autoinst.xml /tmp/sles11
#编辑isolinux.cfg文件,找到# install所在位置
cd boot/x86_64/loader/
vi isolinux.cfg
# install
append initrd=initrd autoyast=file:///autoinst.xml splash=silent showopts
:x!
#运行mkisofs命令生成自动安装光盘
cd /tmp/sles11
mkisofs -R -o /tmp/SLES11-SP2-64-AUTO.iso -b boot/x86_64/loader/isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table .
我的配置文件
预设分区
名称 | 格式 | 大小 |
---|---|---|
swap | swap | 16G |
boot | ext3 | 120M |
LVM | ||
root | ext3 | 5G |
usr | ext3 | 10G |
var | ext3 | 5G |
opt | ext3 | 10G |
home | ext3 | 15G |
tmp | ext3 | 10G |
总计 | 71G |
预装软件包
KDE Desktop Environment
Oracle Server Base
C/C++ Compiler and Tools
nmap
java-1_6_0
libstdc++43-devel-32bit
预设语言
主要:英语
添加:中文
预设用户名/密码
root/如果你直接复用我的配置文件请私信我获取密码
预设网络配置
禁用服务:防火墙,IPv6
autoinst.xml
<?xml version="1.0"?>
<!DOCTYPE profile>
<profile xmlns="http://www.suse.com/1.0/yast2ns" xmlns:config="http://www.suse.com/1.0/configns">
<bootloader>
<device_map config:type="list">
<device_map_entry>
<firmware>fd0</firmware>
<linux>/dev/fd0</linux>
</device_map_entry>
<device_map_entry>
<firmware>hd0</firmware>
<linux>/dev/sda</linux>
</device_map_entry>
</device_map>
<global>
<activate>true</activate>
<boot_boot>true</boot_boot>
<default>SUSE Linux Enterprise Server 11 SP2 - 3.0.13-0.27</default>
<generic_mbr>true</generic_mbr>
<gfxmenu>/boot/message</gfxmenu>
<lines_cache_id>3</lines_cache_id>
<timeout config:type="integer">8</timeout>
</global>
<initrd_modules config:type="list">
<initrd_module>
<module>mptspi</module>
</initrd_module>
<initrd_module>
<module>ata_piix</module>
</initrd_module>
<initrd_module>
<module>ata_generic</module>
</initrd_module>
</initrd_modules>
<loader_type>grub</loader_type>
<sections config:type="list">
<section>
<append>resume=/dev/sda1 splash=silent showopts</append>
<image>/boot/vmlinuz-3.0.13-0.27-default</image>
<initial>1</initial>
<initrd>/boot/initrd-3.0.13-0.27-default</initrd>
<lines_cache_id>0</lines_cache_id>
<name>SUSE Linux Enterprise Server 11 SP2 - 3.0.13-0.27</name>
<original_name>linux</original_name>
<root>/dev/system/root</root>
<type>image</type>
<vgamode>0x317</vgamode>
</section>
<section>
<append>showopts ide=nodma apm=off noresume edd=off powersaved=off nohz=off highres=off processor.max_cstate=1 nomodeset x11failsafe</append>
<image>/boot/vmlinuz-3.0.13-0.27-default</image>
<initrd>/boot/initrd-3.0.13-0.27-default</initrd>
<lines_cache_id>1</lines_cache_id>
<name>Failsafe -- SUSE Linux Enterprise Server 11 SP2 - 3.0.13-0.27</name>
<original_name>failsafe</original_name>
<root>/dev/system/root</root>
<type>image</type>
<vgamode>0x317</vgamode>
</section>
<section>
<blockoffset>1</blockoffset>
<chainloader>/dev/fd0</chainloader>
<lines_cache_id>2</lines_cache_id>
<name>Floppy</name>
<noverifyroot>true</noverifyroot>
<original_name>floppy</original_name>
<type>other</type>
</section>
</sections>
</bootloader>
<ca_mgm>
<CAName>YaST_Default_CA</CAName>
<ca_commonName>YaST Default CA (site)</ca_commonName>
<country>CN</country>
<password>ENTER PASSWORD HERE</password>
<server_email>postmaster@site</server_email>
<takeLocalServerName config:type="boolean">true</takeLocalServerName>
</ca_mgm>
<deploy_image>
<image_installation config:type="boolean">false</image_installation>
</deploy_image>
<firewall>
<FW_ALLOW_FW_BROADCAST_DMZ>no</FW_ALLOW_FW_BROADCAST_DMZ>
<FW_ALLOW_FW_BROADCAST_EXT>no</FW_ALLOW_FW_BROADCAST_EXT>
<FW_ALLOW_FW_BROADCAST_INT>no</FW_ALLOW_FW_BROADCAST_INT>
<FW_CONFIGURATIONS_DMZ></FW_CONFIGURATIONS_DMZ>
<FW_CONFIGURATIONS_EXT></FW_CONFIGURATIONS_EXT>
<FW_CONFIGURATIONS_INT></FW_CONFIGURATIONS_INT>
<FW_DEV_DMZ></FW_DEV_DMZ>
<FW_DEV_EXT>any eth0</FW_DEV_EXT>
<FW_DEV_INT></FW_DEV_INT>
<FW_FORWARD_ALWAYS_INOUT_DEV></FW_FORWARD_ALWAYS_INOUT_DEV>
<FW_FORWARD_MASQ></FW_FORWARD_MASQ>
<FW_IGNORE_FW_BROADCAST_DMZ>no</FW_IGNORE_FW_BROADCAST_DMZ>
<FW_IGNORE_FW_BROADCAST_EXT>yes</FW_IGNORE_FW_BROADCAST_EXT>
<FW_IGNORE_FW_BROADCAST_INT>no</FW_IGNORE_FW_BROADCAST_INT>
<FW_IPSEC_TRUST>no</FW_IPSEC_TRUST>
<FW_LOAD_MODULES>nf_conntrack_netbios_ns</FW_LOAD_MODULES>
<FW_LOG_ACCEPT_ALL>no</FW_LOG_ACCEPT_ALL>
<FW_LOG_ACCEPT_CRIT>yes</FW_LOG_ACCEPT_CRIT>
<FW_LOG_DROP_ALL>no</FW_LOG_DROP_ALL>
<FW_LOG_DROP_CRIT>yes</FW_LOG_DROP_CRIT>
<FW_MASQUERADE>no</FW_MASQUERADE>
<FW_PROTECT_FROM_INT>no</FW_PROTECT_FROM_INT>
<FW_ROUTE>no</FW_ROUTE>
<FW_SERVICES_ACCEPT_DMZ></FW_SERVICES_ACCEPT_DMZ>
<FW_SERVICES_ACCEPT_EXT></FW_SERVICES_ACCEPT_EXT>
<FW_SERVICES_ACCEPT_INT></FW_SERVICES_ACCEPT_INT>
<FW_SERVICES_ACCEPT_RELATED_DMZ></FW_SERVICES_ACCEPT_RELATED_DMZ>
<FW_SERVICES_ACCEPT_RELATED_EXT></FW_SERVICES_ACCEPT_RELATED_EXT>
<FW_SERVICES_ACCEPT_RELATED_INT></FW_SERVICES_ACCEPT_RELATED_INT>
<FW_SERVICES_DMZ_IP></FW_SERVICES_DMZ_IP>
<FW_SERVICES_DMZ_RPC></FW_SERVICES_DMZ_RPC>
<FW_SERVICES_DMZ_TCP></FW_SERVICES_DMZ_TCP>
<FW_SERVICES_DMZ_UDP></FW_SERVICES_DMZ_UDP>
<FW_SERVICES_EXT_IP></FW_SERVICES_EXT_IP>
<FW_SERVICES_EXT_RPC></FW_SERVICES_EXT_RPC>
<FW_SERVICES_EXT_TCP></FW_SERVICES_EXT_TCP>
<FW_SERVICES_EXT_UDP></FW_SERVICES_EXT_UDP>
<FW_SERVICES_INT_IP></FW_SERVICES_INT_IP>
<FW_SERVICES_INT_RPC></FW_SERVICES_INT_RPC>
<FW_SERVICES_INT_TCP></FW_SERVICES_INT_TCP>
<FW_SERVICES_INT_UDP></FW_SERVICES_INT_UDP>
<enable_firewall config:type="boolean">false</enable_firewall>
<start_firewall config:type="boolean">false</start_firewall>
</firewall>
<general>
<ask-list config:type="list"/>
<mode>
<confirm config:type="boolean">false</confirm>
</mode>
<mouse>
<id>none</id>
</mouse>
<proposals config:type="list"/>
<signature-handling>
<accept_file_without_checksum config:type="boolean">true</accept_file_without_checksum>
<accept_non_trusted_gpg_key config:type="boolean">true</accept_non_trusted_gpg_key>
<accept_unknown_gpg_key config:type="boolean">true</accept_unknown_gpg_key>
<accept_unsigned_file config:type="boolean">true</accept_unsigned_file>
<accept_verification_failed config:type="boolean">false</accept_verification_failed>
<import_gpg_key config:type="boolean">true</import_gpg_key>
</signature-handling>
<storage/>
</general>
<groups config:type="list">
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>100</gid>
<group_password>x</group_password>
<groupname>users</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>19</gid>
<group_password>x</group_password>
<groupname>floppy</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>1</gid>
<group_password>x</group_password>
<groupname>bin</groupname>
<userlist>daemon</userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>41</gid>
<group_password>x</group_password>
<groupname>xok</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>65533</gid>
<group_password>x</group_password>
<groupname>nobody</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>43</gid>
<group_password>x</group_password>
<groupname>modem</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>5</gid>
<group_password>x</group_password>
<groupname>tty</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>7</gid>
<group_password>x</group_password>
<groupname>lp</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>104</gid>
<group_password>!</group_password>
<groupname>uuidd</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>51</gid>
<group_password>!</group_password>
<groupname>postfix</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>115</gid>
<group_password>!</group_password>
<groupname>gdm</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>65534</gid>
<group_password>x</group_password>
<groupname>nogroup</groupname>
<userlist>nobody</userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>107</gid>
<group_password>!</group_password>
<groupname>oinstall</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>101</gid>
<group_password>!</group_password>
<groupname>messagebus</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>59</gid>
<group_password>!</group_password>
<groupname>maildrop</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>33</gid>
<group_password>x</group_password>
<groupname>video</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>3</gid>
<group_password>x</group_password>
<groupname>sys</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>15</gid>
<group_password>x</group_password>
<groupname>shadow</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>20</gid>
<group_password>x</group_password>
<groupname>cdrom</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>21</gid>
<group_password>x</group_password>
<groupname>console</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>42</gid>
<group_password>x</group_password>
<groupname>trusted</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>102</gid>
<group_password>!</group_password>
<groupname>haldaemon</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>106</gid>
<group_password>!</group_password>
<groupname>puppet</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>16</gid>
<group_password>x</group_password>
<groupname>dialout</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>110</gid>
<group_password>!</group_password>
<groupname>polkituser</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>10</gid>
<group_password>x</group_password>
<groupname>wheel</groupname>
<userlist></userlist>
</group>
<group>
<encrypted config:type="boolean">true</encrypted>
<gid>112</gid>
<group_password>!</group_password>
<groupname>pulse