前面我們已經瞭解了saltstack的基礎功能,現在就可以使用saltstack爲初始化新安裝的linux系統。
初始化列表:
1.關閉selinux 3.修改sshd配置文件 4.內核優化 5.ulimit修改 6.history記錄 7.時區修改及添加cron 8.安裝epel 9.修改resolv解析文件 10.軟件安裝 好了,此前我們已經修改了salt的base目錄,默認在/srv/salt 下我們調整到/etc/salt目錄下了 現在呢,我們需要去建立一個目錄專門用於存放初始化sls的。
[root@localhost base]# pwd /etc/salt/base
[root@localhost base]# mkdir init
date_time.sls
系統時區修改
[root@localhost init]# vim date_time.sls date_time: pkg.installed: - name: ntpdate - unless: rpm -qa | grep ntpdate cmd.run: - name: rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && ntpdate pool.ntp.org - require: - pkg: ntpdate cron.present: - name: /usr/sbin/ntpdate pool.ntp.org >/dev/null - user: root - minute: '*/5' - require: - pkg: ntpdate
epel.sls
epel文件調整,系統爲centos 7
[root@localhost init]#vim epel.sls epel_install: pkg.installed: - sources: - epel-release: http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm - unless: rpm -qa | grep epel-release-7-5
history.sls
修改操作命令記錄
[root@localhost init]# vim history.sls /etc/bashrc: file.append: - text: - HISTTIMEFORMAT="%F %T `whoami` " cmd.run: - name: source /etc/bashrc
limits.sls
limits參數調整
[root@localhost init]# vim limits.sls /etc/security/limits.conf: file.append: - text: - '* hard nofile 204800' - '* soft nofile 204800' /etc/profile: file.append: - text: - 'ulimit -c unlimited' ~/.bashrc: file.append: - text: - alias vi='"'vim'"'
resolv.sls
DNS解析文件修改
[root@localhost init]#vim resolv.sls resolv: file.managed: - name: /etc/resolv.conf - source: salt://init/resolv.conf [root@localhost init]# vim resolv.conf # Generated by NetworkManager nameserver 114.114.114.114 nameserver 8.8.8.8 [root@localhost init]#
selinux.sls
selinux卸載
[root@localhost init]# vim selinux.sls selinux: cmd.run: - name: yum remove selinux-policy -y
soft_install.sls
基礎軟件安裝
[root@localhost init]# vim soft_install.sls soft-install: pkg.installed: - names: - lrzsz - telnet - openssh-clients - ftp - sysstat - bc - rsync - wget - screen - dstat - vim-enhanced - gcc - gcc-c++ - make - dos2unix - net-tools [root@localhost init]#
sshd_config.sls
SSHD配置文件調整
[root@localhost init]# vim sshd_config.sls sshd: file.managed: - name: /etc/ssh/sshd_config - source: salt://init/sshd_config service.running: - enable: True - reload: True - watch: - file: /etc/ssh/sshd_config
[root@localhost init]# vim sshd_config Port 22 Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes PermitEmptyPasswords no ChallengeResponseAuthentication yes Compression yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS X11Forwarding yes UsePAM yes UseDNS no Subsystem sftp /usr/libexec/openssh/sftp-server LogLevel DEBUG #allowusers [email protected] #allowusers [email protected]
sysctl.sls
內核參數調整
[root@localhost init]# vim sysctl.sls net.ipv4.conf.default.rp_filter: sysctl.present: - value: 1 net.ipv4.conf.default.accept_source_route: sysctl.present: - value: 0 kernel.sysrq: sysctl.present: - value: 0 kernel.core_uses_pid: sysctl.present: - value: 1 kernel.msgmnb: sysctl.present: - value: 65536 kernel.msgmax: sysctl.present: - value: 65536 kernel.shmmax: sysctl.present: - value: 68719476736 kernel.shmall: sysctl.present: - value: 4294967296 kernel.shmmni: sysctl.present: - value: 4096 kern.maxfiles: sysctl.present: - value: 65536 net.ipv4.tcp_fin_timeout: sysctl.present: - value: 30 net.ipv4.tcp_keepalive_time: sysctl.present: - value: 1200 net.ipv4.tcp_window_scaling: sysctl.present: - value: 1 net.ipv4.tcp_sack: sysctl.present: - value: 1 net.ipv4.tcp_syncookies: sysctl.present: - value: 1 net.ipv4.tcp_tw_reuse: sysctl.present: - value: 1 net.ipv4.tcp_tw_recycle: sysctl.present: - value: 1 net.ipv4.ip_local_port_range: sysctl.present: - value: 1024 65000 net.ipv4.tcp_max_tw_buckets: sysctl.present: - value: 6000 net.ipv4.tcp_max_syn_backlog: sysctl.present: - value: 65535 net.core.netdev_max_backlog: sysctl.present: - value: 262144 net.core.wmem_default: sysctl.present: - value: 8388608 net.core.rmem_default: sysctl.present: - value: 8388608 net.core.rmem_max: sysctl.present: - value: 16777216 net.core.wmem_max: sysctl.present: - value: 16777216 net.ipv4.tcp_timestamps: sysctl.present: - value: 0 net.ipv4.tcp_synack_retries: sysctl.present: - value: 2 net.ipv4.tcp_syn_retries: sysctl.present: - value: 2 net.ipv4.tcp_mem: sysctl.present: - value: 94500000 915000000 927000000 net.ipv4.tcp_max_orphans: sysctl.present: - value: 3276800 [root@localhost init]#
建立入口文件及管理文件
[root@localhost base]# pwd /etc/salt/base [root@localhost base]# ls init system_init.sls top.sls [root@localhost base]# vim system_init.sls include: - init.selinux - init.epel - init.date_time - init.soft_install - init.history - init.limits - init.sysctl - init.sshd_config - init.resolv [root@localhost base]# vim top.sls base: '*': - system_init [root@localhost base]#
執行命令
[root@localhost base]# salt '*' state.highstate test=True 執行前先測試 [root@localhost base]# salt '*' state.highstate