CentOS6.x系统下智能初始化脚本
PS：自动化运维，逐渐替代传统的运维工作，也是运维当今趋势。那么作为一名合格的Linux运维工程师，自然是需要把繁琐的工作变得简单化。例如：当你需要给100台linux服务器安装系统时，你不能一台一台操作；这样很费时，费力而且还得不到领导的赏识，那为什么不考虑无人值守批量安装呢？考虑到系统的安全，可能你还需要对系统进行优化，难道你一台一台去操作，这不是你所想的，既然如此，为何不考虑自己编写脚本批量去操作，如下图所示：
提示：
操作机在生产环境下，需要提供公网地址，当前仅为测试环境，IP为私网地址。考虑到服务器在各地IDC机房上架后，可能都需要初始化系统，这不仅仅是为了系统安全考虑，更重要的是能批量去管理与维护，让我们的工作能够更轻松，智能，更有效率。为了满足各地互联网用户更快速的访问，服务器会分布在全国各地的IDC机房，远程管理，维护是必然的，你不能那台服务器需要安装某个服务，你就跑哪里。通过SSH远程管理，很方便，在此我建议运维的朋友，在各地的服务器上架之后创建一个普通用户，用于远程登录各地的服务器，然后切换到root用户下，避免用root超级用户登录，可以使你的系统更加安全。那么如何批量登录各地的服务器，提示使用expect，SSH免**认证的方式，实现不用输入用户名或密码，智能化登录。
一、CentOS6.x系统智能初始化脚本如下：
[[email protected] scripts]# cat system_auto_initialize.sh #!/bin/bash # author cfwl create date of 2012-10-21 # blog http://cfwlxf.blog.51cto.com # source user shell variable PATH=/sbin:/bin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin export PATH # Source system network library. . /etc/sysconfig/network # Source system function library. . /etc/init.d/functions SYSTEM_HOSTNAME(){ # Source system network library. . /etc/sysconfig/network # Update name of system host printf "\033[33mplease input system host name:\033[0m " STR read STR # Judge system hostname hostname $STR sed -i "s/HOSTNAME=$HOSTNAME/HOSTNAME=$STR/" /etc/sysconfig/network # Judge system hostname if equal user input name HOSTNAME=$(awk -F '=' '/HOSTNAME/{print $2}' /etc/sysconfig/network) if [ "$HOSTNAME" = "$STR" ] then sleep 2 printf "\033[35msystem host name is update by: $STR\033[0m $str\n" else printf "\033[35msystem host name is not update\033[0m\n" exit 0 fi } # Update System SSH Service Port SYSTEM_SSH_PORT(){ #create user remote manage server printf "\033[35mCreate ordinary user, Used for remote login server,please input string \'y\': \033[0m" LOGIN read LOGIN if [ "$LOGIN" = "y" ] then read -p "Please input user name,must begin with the string: " NAME useradd $NAME read -p "Please input user $NAME of password: " PASSWORD echo $PASSWORD | passwd --stdin $NAME > /dev/null 2>&1 USER_NAME=$(grep ^$NAME /etc/passwd | grep -Po '.*(?=:x)') [ ${USER_NAME} = ${NAME} ] && printf "\033[35mUser $NAME by create.\033[0m\n" else printf "\033[31mError: The string you input errors,please again input string.\033[om" fi SSH_CONFIG=/etc/ssh/sshd_config #Backup SSH configuration cp -a ${SSH_CONFIG} ${SSH_CONFIG}.save #Chage SSH server of port sed -i '/^#Port/s/#Port 22/Port 65535/g' $SSH_CONFIG sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' $SSH_CONFIG sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' $SSH_CONFIG sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' $SSH_CONFIG sleep 2 #Prompt user Close system iptables . INFORMATION=$(/etc/init.d/iptables status) printf "\033[32mYou need Close Iptables,Avoid administrators cannot access SSH service,please input string \'y\':\033[0m" STR read STR if [ ${STR} = "y" ] then /etc/init.d/iptables stop && sleep 1 && printf "\033[35m$INFORMATION\033[0m\n" else printf "\033[31mError: Please input string \'y\',Close system iptables.\033[0m" exit 0 fi #Pormpt user restart SSH service sleep 1 printf "\033[32mYou need to restart the SSH service,configuration to take effect. 1> Input \"y\", Now restart to SSH service. 2> Input \"n\", Later in the manual restart. Please input string \"y/n\": \033[0m" RETVAL read RETVAL [ "$RETVAL" = "y" ] && sleep 2 && /etc/init.d/sshd restart [ "$RETVAL" = "n" ] && sleep 2 && action "Later on please manual restart SSH service" true } # Close system Selinux and iptables function SYSTEM_IPV4_FORWARD(){ #Close syetem selinux and iptalbes forward sed -i '/^SELINUX/s/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config RETVAL=$(awk -F '=' '/^SELINUX=/{print $NF}' /etc/selinux/config) [ "$RETVAL" = "disabled" ] && sleep 1 && printf "\033[36mSelinux Change [$RETVAL], please restart system by tack effect.\033[0m\n" sleep 2 #Close syetem iptables forward /etc/init.d/iptables stop && chkconfig iptables off } #Optimizing The System Service and Rsync System Time CLOSE_SYSTEM_SERVER(){ #Stop All System Serivce for server in `chkconfig --list | awk '{print $1}'`;do chkconfig $server off;done #Start Up Assign System Service for server in sshd messagebus rngd network crond rsyslog irqbalance;do chkconfig --level 35 $server on;done #Print modify alter of service RETVAL=$(chkconfig --list | egrep '3:on|5:on' | awk '{print $1}' | xargs) printf "\033[35mPrint current system auto start of server: $RETVAL\033[0m\n" #Rsync System Local Time RETVAL=$(rpm -qa ntp | wc -l) if [ $RETVAL = 1 ] then echo "5 * * * * ntpdate ntp.api.bz > /dev/null 2>&1" >> /var/spool/cron/root else yum install ntp echo "5 * * * * ntpdate ntp.api.bz > /dev/null 2>&1" >> /var/spool/cron/root fi } #Update Yum Source UPDATE_YUM_SOURCE(){ # Judge YUM_BACK_DIR directory if exist YUM_BACK_DIR=/etc/yum.repos.d/backup/ YUM_DIR=/etc/yum.repos./ [ ! -d ${YUM_BACK_DIR} ] && mkdir ${YUM_BACK_DIR} cd ${YUM_DIR} find . -type f -name "*.repo" | xargs mv -t ${YUM_BACK_DIR} RETVAL=0 #Determine the return value if 0. [ $? = ${RETVAL} ] && printf "\033[32m 1.Inland 163 yum source 2.Inland sohu yum source Judge:please input install 163 or sohu yum source:\033[0m" STR read STR case "$STR" in 163) wget http://mirrors.163.com/.help/CentOS6-Base-163.repo RETVAL=0 [ $? = ${RETVAL} ] && printf "\033[35mYum source is download successfully of 163 mirrors.\n\033[0m" sleep 2 rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6 yum update yum makecache ;; sohu) wget http://mirrors.sohu.com/help/CentOS-Base-sohu.repo RETVAL=0 [ $? = ${RETVAL} ] && printf "\033[35mYum source is download successfully of sohu mirrors.\n\033[0m" sleep 2 rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-* yum update yum makecache ;; *) echo -e "\033[31m Error: plase you input 163 or sohu.\033[0m" exit 0 esac } #By the user to enter the digital implementation corresponding function echo -e "\033[32m ---------------------------------------------------------------------------------------------------------------- | welcome to syetem initialize scripts | ---------------------------------------------------------------------------------------------------------------- |Judge: Scripts Can realize the function as follows: | |(1)Modification system host name . | |(2)Close system SELINXU and iptables. | |(3)Modification SSH service port as configure. | |(4)Close System Don't use of Service and update system time | |(5)Update System Yum Source | ----------------------------------------------------------------------------------------------------------------\033[0m" read -p "Please according number input you want execute of function: " number case "$number" in 1) SYSTEM_HOSTNAME RETVAL=0 [ $? = $RETVAL ] && action "System host name update successfully,please restart system." true ;; 2) SYSTEM_IPV4_FORWARD ;; 3) SYSTEM_SSH_PORT RETVAL=0 [ $? = $RETVAL ] && action "Update System SSH Service Port already successfully." true ;; 4) CLOSE_SYSTEM_SERVER RETVAL=0 [ $? = $RETVAL ] && action "Initialize Sytem Service already successfully." true ;; 5) UPDATE_YUM_SOURCE RETVAL=0 [ $? = $RETVAL ] && action "Update System Yum Source already successfully." true ;; *) printf "\033[36mError: please you input prompt dialog box of number:1-5\033[0m\n" ;; esac
二、初始化系统主机名
提示：
如果你的服务器主机名还是localhost，那么我建议你修改一个你容易辨认的主名字，如上图所示，SNS_SD_010_057，其中SNS表示联通，SD表示山东，010_057表示IP地址的后两位。
三、关闭系统Selinux与iptables，操作如下：
提示：
根据提示框中的信息，输入相应的数字执行初始化操作，关闭系统selinux防火墙后，需要重启服务器才能生效，若你很熟悉selinux命令setsebool则可添加相应的规则，当然可以不用重启，不过用setsebool操作起来很繁琐。我想说的是iptables已经很强大了，如果你的服务器不是特别重要，都可以选择close。
四、更改SSH服务主配置文件中的远程管理端口及相应参数，操作如下：
提示：
据上图所示，字符“y”表示立刻重启SSH服务器，“n”表示稍后手动重启，对于SSH配置文件的修改，可以考虑如下几点，1)修改SSH服务远程管理端口，上图中为65535，建议大于1024即可。2）拒绝root用户远程登陆，为了系统安全。3）拒绝空密码登陆，安全起见。4）避免DNS递归查询。从图中可以看出测试是OK。
五、关闭系统未使用，自动开启的服务，操作如下：
提示：
据上图所示，当前系统仅仅开启了crond、irqbalance、messagebus、network、rngd、rsyslog、sshd服务器，/etc/rc*.d/目录下的其他服务器都为关闭状态，其好处避免系统资源不必要的开销。如果想知道各服务进程的含义 ，请参考另一篇文档：http://cfwlxf.blog.51cto.com/3966339/1300732
六、更新系统yum源，升级软件包，操作如下：
提示：
图中提示了搜狐、163网站的yum源，如果你只安装的话，提示你是否更新，升级软件包输入n即可。
PS：此脚本在CentOS6.x下测试通过，至于CentOS5.x、Redhat5.x系列可以自行测试，后期的文章会涉及SSH免**远程登陆及expect的使用。
转载于:https://blog.51cto.com/cfwlxf/1316401