一、环境准备：
操作系统：linux7.1——64
安装好操作系统（将防火墙 selinux关闭）
1、配置系统软件包环境
#yum –y install vim net-tools
#默认centos7.0最小化安装没有ifconfig net-tools生成ifconfig
2、安装依赖软件包
yum-y install createrepo httpd mkisofs python-netaddr python-urlgrabber rsyncsyslinux tftp-server yum-utils mod_ssl mod_wsgi git make python-develpython-setuptools fence-agents pykickstart dhcp rpm-build edpatch perl-Compress-Zlib perl-libwww-perl perl-Digest-SHA
二、开始安装cobbler2.6.9
1.安装PyYAML 下载地址: http://pyyaml.org/download/pyyaml/PyYAML-3.11.tar.gz #tar -zxvf PyYAML-3.11.tar.gz -C /usr/src/ #cd /usr/src/PyYAML-3.11/ #python setup.py install 2.安装Django 下载地址: https://pypi.python.org/packages/source/D/Django/Django-1.8.4.tar.gz #tar -zxvf Django-1.8.4.tar.gz -C /usr/src/ #cd /usr/src/Django-1.8.4 #python setup.py install 3.安装Markdown 下载地址: https://pypi.python.org/packages/source/M/Markdown/Markdown-2.6.2.tar.gz # tar –zxvf Markdown-2.6.2.tar.gz –C/usr/src/ #cd /usr/src/Markdown-2.6.2 #python setup.py install 4.安装Cheetah 下载地址: https://pypi.python.org/packages/source/C/Cheetah/Cheetah-2.4.4.tar.gz #tar –zxvf Cheetah-2.4.4.tar.gz –C /usr/src #cd /usr/src/Cheetah-2.4.4 #python setup.py install 5.安装simplejson 下载地址:https://pypi.python.org/packages/source/s/simplejson/simplejson-3.8.0.tar.gz # tar –zxvf simplejson-3.8.0.tar.gz #cd /usr/src/simplejson-3.8.0/ #python setup.py install 6.安装cobbler 下载地址: https://github.com/cobbler/cobbler/releases/tag/v2.6.9 #tar –zxvf cobbler-2.6.9.tar.gz -d/usr/src #cd /usr/src/cobbler-2.6.9 # make && make install #mkdir /var/www/cobbler/web #mkdir -p /srv/www/cobbler/svc #makewebtest
----以上软件包，我已经上传共享网盘，大家可以下载：http://pan.baidu.com/s/1boX7BGz
三、配置cobbler
1．配置cobbler
修改cobbler的Server配置文件 vim /etc/cobbler/settings 242 manage_dhcp: 1 261 manage_rsync: 1 272 next_server: 192.168.0.1 (IP修改成本机地址) 384 server: 192.168.0.1 (IP修改成本机地址) (配置开机登录密码) #openssl passwd -1 -salt ‘root‘ ‘11111111‘ #root用户名，11111111是系统登录密码 （修改/etc/cobbler/settings文件） 101 default_password_crypted: " $1$root$46Dy7n8T8GRp0Mont0Mcw1"
2.配置dhcpd /etc/cobbler/dhcp.template
subnet 192.168.2.0 netmask 255.255.255.0 { （添加作用域）
option routers 192.168.2.100; （dhcp主机地址）
option domain-name-servers 192.168.2.100;
option subnet-mask 255.255.255.0;
range dynamic-bootp 192.168.2.110 192.168.2.254; （要分配IP地址池）
default-lease-time 21600;
max-lease-time 43200;
next-server $next_server;
class "pxeclients" {
match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
if option pxe-system-type = 00:02 {
filename "ia64/elilo.efi";
} else if option pxe-system-type = 00:06 {
filename "grub/grub-x86.efi";
} else if option pxe-system-type = 00:07 {
filename "grub/grub-x86_64.efi";
} else {
filename "pxelinux.0";
}
}
}
3、修改/etc/cobbler/tftpd.template文件
[[email protected] ~]# vi /etc/cobbler/tftpd.template
# default: off
# description: The tftp server serves files using the trivial file transfer # protocol. The tftp protocol is often used to boot diskless # workstations, download configuration files to network-aware printers, # and to start the installation process for some operating systems.
service tftp
{
disable = yes （改为no）
socket_type = dgram
protocol = udp
wait = yes
user = $user
server = $binary
server_args = -B 1380 -v -s $args
per_source = 11
cps = 100 2
flags = IPv4
}
#systemctl restart cobblerd ---启动cobbler
get-loaders下载（需要开公网，如果没有开通公网就按照下面的方法将文件导入相关目录）
[[email protected] ~]# cobbler get-loaders
task started (id=Download Bootloader Content, time=Fri May 27 10:06:42 2016)
downloading http://cobbler.github.com/loaders/README to /var/lib/cobbler/loaders/README
downloading http://cobbler.github.com/loaders/COPYING.elilo to /var/lib/cobbler/loaders/COPYING.elilo
downloading http://cobbler.github.com/loaders/COPYING.yaboot to /var/lib/cobbler/loaders/COPYING.yaboot
downloading http://cobbler.github.com/loaders/COPYING.syslinux to /var/lib/cobbler/loaders/COPYING.syslinux
downloading http://cobbler.github.com/loaders/elilo-3.8-ia64.efi to /var/lib/cobbler/loaders/elilo-ia64.efi
downloading http://cobbler.github.com/loaders/yaboot-1.3.17 to /var/lib/cobbler/loaders/yaboot
downloading http://cobbler.github.com/loaders/pxelinux.0-3.86 to /var/lib/cobbler/loaders/pxelinux.0
downloading http://cobbler.github.com/loaders/menu.c32-3.86 to /var/lib/cobbler/loaders/menu.c32
downloading http://cobbler.github.com/loaders/grub-0.97-x86.efi to /var/lib/cobbler/loaders/grub-x86.efi
downloading http://cobbler.github.com/loaders/grub-0.97-x86_64.efi to /var/lib/cobbler/loaders/grub-x86_64.efi
*** TASK COMPLETE ***
注意：上面这些文件我已经下载好，就在上面共享的文件里面，文件是loaders.zip，解压出来将里面的东西拷贝到/var/lib/cobbler/loaders/目录下即可
4、查看cobbler check （检查环境是否满足要求）
[[email protected] ~]# cobbler check The following are potential configuration items that you may want to fix: 1 : debmirror package is not installed, it will be required to manage debian deployments and repositories （这个错误可以忽略） Restart cobblerd and then run ‘cobbler sync‘ to apply changes.
5、重启cobbler和dhcp，httpd等
systemctl start httpd.service
cobbler sync
6、导入ISO镜像
首先上传ISO镜像并挂载到 /test 目录下
mount -o loop /root/rhel-server-7.1-x86_64-dvd /test
然后执行：cobbler import --path=/test/ --name=linux7.1 --arch=x86_64
7、查看cobbler默认使用的ks引导文件
[[email protected] ~]# cobbler report
Kickstart : /var/lib/cobbler/kickstarts/sample_end.ks （默认使用的这个文件，）
##########################################################################################################################
8、修改适合自己的ks文件，修改sample_end.ks 文件即可（修改前做好备份）
修改好的文件如下（可以根据自己的需要更改配置文件，务必将安全加固配置也做好！）：
[[email protected] ~]# cat /var/lib/cobbler/kickstarts/sample_end.ks # kickstart template for Fedora 8 and later. # (includes %end blocks) # do not use with earlier distros #platform=x86, AMD64, or Intel EM64T # System authorization information auth --useshadow --enablemd5 # System bootloader configuration bootloader --location=mbr # Partition clearing information clearpart --all --initlabel # Use text mode install text # Firewall configuration firewall --disable # Run the Setup Agent on first boot firstboot --disable # System keyboard keyboard us # System language lang en_US # Use network installation url --url=$tree # If any cobbler repo definitions were referenced in the kickstart profile, include them here. $yum_repo_stanza # Network information $SNIPPET(‘network_config‘) # Reboot after installation reboot #Root password rootpw --iscrypted $default_password_crypted # SELinux configuration selinux --disabled # Do not configure the X Window System skipx # System timezone timezone Asia/Shanghai # Install OS instead of upgrade install # Clear the Master Boot Record zerombr clearpart --all clearpart --none --initlabel # Disk partitioning information part /boot --fstype="xfs" --ondisk=sda --size=500 part pv.10 --fstype="lvmpv" --ondisk=sda --size=35000 volgroup rootvg --pesize=4096 pv.10 logvol /var --fstype="xfs" --size=5000 --name=var --vgname=rootvg logvol / --fstype="xfs" --size=10000 --name=root --vgname=rootvg logvol swap --fstype="swap" --size=500 --name=swap --vgname=rootvg logvol /usr --fstype="xfs" --size=5000 --name=usr --vgname=rootvg %pre $SNIPPET(‘log_ks_pre‘) $SNIPPET(‘kickstart_start‘) $SNIPPET(‘pre_install_network_config‘) # Enable installation monitoring $SNIPPET(‘pre_anamon‘) %end %packages @base @core @desktop-debugging @development @dial-up @fonts @gnome-desktop @guest-agents @guest-desktop-agents @input-methods @internet-browser @kde-desktop @multimedia @print-client @security-tools @x11 kexec-tools %end %post --nochroot $SNIPPET(‘log_ks_post_nochroot‘) %end %post $SNIPPET(‘log_ks_post‘) # Start yum configuration $yum_config_stanza # End yum configuration $SNIPPET(‘post_install_kernel_options‘) $SNIPPET(‘post_install_network_config‘) $SNIPPET(‘func_register_if_enabled‘) $SNIPPET(‘download_config_files‘) $SNIPPET(‘koan_environment‘) $SNIPPET(‘redhat_register‘) $SNIPPET(‘cobbler_register‘) # Enable post-install boot notification $SNIPPET(‘post_anamon‘) # Start final steps $SNIPPET(‘kickstart_done‘) # End final steps #system security setting for RHEL6 # Change default runlevel to 3 sed -i ‘s/id:[0-5]:/id:3:/‘ /etc/inittab #Add mantinance user groupadd admin groupadd test groupadd -g 402 test2 usermod -G wheel root useradd -g admin -G wheel admin useradd -g test -G adm test useradd -u 402 -g 402 -G wheel test2 echo ‘122234‘ |passwd --stdin admin1 echo ‘1234445‘ |passwd --stdin test2 echo ‘1233444‘ |passwd --stdin test echo export PATH=. >> /home/test/.bash_profile ln -s /bin/bash /bin/rbash cp /bin/su /home/test/su chmod 4755 /home/test/su touch /var/spool/cron/unionmon cp /etc/login.defs /etc/login.defs`date +%Y%m%d` # Security hardening for /etc/issue rm -rf /etc/issue /etc/issue.net # Security hardening for /etc/profile sed -i -e ‘s/umask 002/umask 027/‘ -e ‘s/umask 022/umask 027/‘ /etc/profile echo ‘HISTSIZE=1000‘ >> /etc/profile echo ‘HISTFILESIZE=1000‘ >> /etc/profile echo ‘export HISTTIMEFORMAT="%Y%m%d-%H%M%S: "‘ >> /etc/profile echo "export TMOUT=120" >> /etc/profile echo "PS1=`whoami`@`hostname`$‘[$PWD]‘" >> /etc/profile # Security hardening for /etc/login.defs cp /etc/login.defs /etc/login.defs`date +%Y%m%d` sed -i "s/^PASS_MIN_LEN.*/PASS_MIN_LEN 8/" /etc/login.defs sed ‘6d‘ /etc/pam.d/su echo "auth required pam_wheel.so use_uid" >> /etc/pam.d/su # Security hardening for PAM related sed -i ‘s/pam_cracklib.so.*/pam_cracklib.so try_first_pass retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 difok=3/‘ /etc/pam.d/system-auth sed -i ‘s/pam_unix.so sha512/pam_unix.so sha512 remember=5/‘ /etc/pam.d/system-auth sed -i ‘s/pam_cracklib.so.*/pam_cracklib.so try_first_pass retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 difok=3/‘ /etc/pam.d/password-auth sed -i ‘s/pam_unix.so sha512/pam_unix.so sha512 remember=5/‘ /etc/pam.d/password-auth sed -i ‘s/^auth.*pam_securetty.so/auth required pam_securetty.so/‘ /etc/pam.d/login sed -i "s/pam_env.so/&\nauth required pam_tally2.so deny=5 unlock_time=900/g" /etc/pam.d/system-auth # Security hardening for ssh echo "Authorized only. All activity will be monitored and reported." > /etc/ssh/ssh_banner chmod 644 /etc/ssh/ssh_banner sed -i "s/^#PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config echo "Banner /etc/ssh/ssh_banner" >> /etc/ssh/sshd_config # Security hardeing best practice: keep all binaries which have setuid bit set find / -xdev -type f -perm +6000 > /etc/ksinstall/sysinfobkg/sidfilelist # Customized settings in /etc/sysctl.conf sed -i -r ‘s/(kernel.sysrq = ).*/\11/‘ /etc/sysctl.conf # Customized resource limit settings cp /etc/security/limits.conf /etc/security/limits.conf`date +%Y%m%d` sed -i ‘s/# End of file/\* soft nproc 65536\n\* hard nproc 65536\n\* soft nofile 65536\n\* hard nofile 65536\n\* soft core 0\n\* hard core 0\n# End of file/‘ /etc/security/limits.conf sed -i ‘s/* soft nproc 1024/\* soft nproc 4096\n\* hard nproc 16384/‘ /etc/security/limits.d/90-nproc.conf systemctl stop chronyd.service systemctl disable chronyd.service # user security echo "umask 027" >> /etc/profile echo "umask 027" >> /etc/csh.login echo "umask 027" >> /etc/csh.cshrc echo "umask 027" >> /etc/bashrc # rsyslog.conf security cp /etc/rsyslog.conf /etc/rsyslog.conf`date +%Y%m%d` echo "authpriv.* /var/log/secure" >> /etc/rsyslog.conf echo "kern.warning;*.err;authpriv.none /var/log/syslog/kern.log" >> /etc/rsyslog.conf echo "*.info;mail.none;authpriv.none;cron.none /var/log/syslog/info.log" >> /etc/rsyslog.conf echo "*.emerg /var/log/syslog/emerg.log" >> /etc/rsyslog.conf echo "local7.* /var/log/syslog/local7.log" >> /etc/rsyslog.conf echo "*.info @132.77.220.74" >> /etc/rsyslog.conf systemctl stop avahi-daemon systemctl disable avahi-daemon systemctl disable telnet.socket systemctl stop telnet.socket systemctl restart xinetd yum -y install telnet >/dev/null yum -y install ntp >/dev/null yum -y install xinetd >/dev/null unlink /etc/systemd/system/default.target ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target reboot %end
上面这个配置文件大家可以作为参考，里面定义了创建用户，安全加固的一些配置，可以根据自己的需要自己适当调整
四、cobbler日常命令
######################################################################### cobbler 常用命令 cobbler check 核对当前设置是否有问题 cobbler list 列出所有的cobbler元素 cobbler report 列出元素的详细信息 cobbler sync 同步配置到数据目录,更改配置最好都要执行下 cobbler reposync 同步yum仓库 cobbler distro 查看导入的发行版系统信息 cobbler system 查看添加的系统信息 cobbler profile 查看配置信息 ############################################################################# cobbler常用配置文件 /etc/cobbler/cobbler_bash /etc/cobbler/completions /etc/cobbler/dhcp.template #dhcp 配置模板。 /etc/cobbler/distro_signatures.json /etc/cobbler/dnsmasq.template #dnsmasq的配置模板。 dnsmasq一个轻量的dhcp与dns转发功能的程序。 /etc/cobbler/import_rsync_whitelist /etc/cobbler/iso/buildiso.template #生成iso文件的模板。cobbler可以以distro来制作iso文件。 /etc/cobbler/modules.conf #cobbler用来管理其它程序的模块或者是引擎。 /etc/cobbler/named.template #named的配置模板， dns我们这里压根就不用安装。 /etc/cobbler/settings #主配置文件。 /etc/cobbler/tftpd.template #tftp配置模板。 /etc/httpd/conf.d/cobbler.conf #httpd的配置文件，用来把/var/www/cobbler目录由httpd输出，也就是可以通过httpd下
时间： 2024-10-16 10:48:31