DevOps SOP：基于阿里云ECS的通用系统安装及初始化

必要设置

Aliyun ECS 系统初始化

• Operating System: CentOS Linux 7 (Core)
• Kernel: Linux 3.10.0-693.17.1.el7.x86_64
• Architecture: x86-64

设置主机名称 hostname

# get hostname info
hostnamectl status

# set hostname
hostnamectl set-hostname your-name

解决语言区域问题 locale

# 查看当前系统的语言区域设置，报警如下：
# locale: Cannot set LC_CTYPE to default locale: No such file or directory
# locale: Cannot set LC_ALL to default locale: No such file or directory
locale

# 查看系统设置语言
cat /etc/locale.conf
# 查看系统能够支持的语言, 先确保语言列表中包含上面的语言设置
locale -a 

# 修复问题，将无法set的参数在下面的配置中新增
vim /etc/locale.conf
    LC_CTYPE="en_US.UTF-8"
    LC_ALL="en_US.UTF-8"

# 确认问题解决
locale

• 问题参考方案 Fix locale error

设置SSH登陆欢迎信息 welcome message

一般ssh默认的欢迎界面包括以下几个部分

1. greetings

###############################
# 自定义greetings
vim /etc/ssh/ssh_greetings.txt
    > ###############################
    > #                             #
    > #      This is greeting msg   #
    > #                             #
    > ###############################
# 修改ssh配置
vim /etc/ssh/sshd_config
    > Banner /etc/ssh/ssh_greetings.txt
# 重新加载配置
systemctl reload sshd

2. motd (message of the day)

###############################    
# 修改方式1：静态motd信息
vim /etc/motd 
# 重新加载配置
systemctl reload sshd

# 修改方式2：自定义motd
vim /etc/profile.d/motd.sh
    > #!/bin/bash
    > # 注: 登陆系统时会自动执行/etc/profile
    > # 其中会遍历/etc/profile.d/下的所有.sh可执行文件
    > echo -e "
    > ##################################
    > #
    > #     Welcome to `hostname`
    > #     This system is running `cat /etc/redhat-release`
    > #     kernel is `uname -r`
    > #     You are logged in as `whoami`
    > # 
    > #     GOD BLESS OUR SERVER !!!
    > #               -- DevOps Group
    > #
    > ##################################
    > "
# 增加文件可执行权限
chmod +x /etc/profile.d/motd.sh   
# 修改ssh配置
vim /etc/ssh/sshd_config
    > PrintMotd no # 关闭默认的motd打印
# 重新加载配置
systemctl reload sshd

3. last login informations

• 参考资料
  • CUSTOMIZE YOUR MOTD
  • Talking Cow
  • How to put commands in /etc/motd
  • How to customize your login msg

创建运维账户devops

1. Issue the useradd command to create a locked user account:

useradd devops
# or you can use "adduser "

2. Unlock the account by issuing the passwd command to assign a password and set password aging guidelines:

passwd devops

3. Use the usermod command to add the user to the wheel group.

# By default, on CentOS, members of the wheel group have sudo privileges.
usermod -aG wheel devops
# BTW，为用户添加sudo权限,还可以直接编辑sudoer文件"vim /etc/sudoers"

# get user | group info
id devops
groups devops

4. gen ssh key

# 切换账户
su - devops
# 生成ssh key
ssh-keygen

5. 设置用户的ssh公钥登录
   vim /home/devops/.ssh/authorized_keys

SSH安全设置

## 编辑ssh配置
sudo vim /etc/ssh/sshd_config 
  PermitRootLogin no ## 禁用服务器root用户的ssh登陆
  PasswordAuthentication no ## 禁用ssh用户密码登陆，仅能使用ssh pub key

## 重启sshd ，或者可以使用命令
systemctl restart sshd 

初始化运维工作区 work space

## 应用工程
mkdir -p /opt/apps
## 数据目录
mkdir -p /opt/data/tmp
## 软件目录
mkdir -p /opt/software
## 自定义软件安装位置
mkdir -p /opt/tools

通用工具

1. git
   sudo yum install git
2. vim plugin manager

## 下载vim-plug工具
curl -fLo ~/.vim/autoload/plug.vim --create-dirs \
    https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim

系统升级

# Install Extra Packages for Enterprise Linux
yum install epel-release

# Update yum
yum update

可选设置

安装进程守护 Supervisor

1. Install supervisor

# 安装
easy_install supervisor

# 配置启动项 Configs programs 
echo_supervisord_conf  > /etc/supervisord.conf
vim /etc/supervisord.conf
    > [program:foo_test]
    > command=/bin/cat
    
# 启动supervisor
supervisord -c /etc/supervisord.conf -n 

# 其它命令
supervisorctl
help
supervisorctl stop all    
supervisorctl status all

2. 通过systemd管理supervisor（进程守护＋开机启动）

## systemd常用命令
systemctl status
systemctl  # same as "systemctl list-units"
systemctl --failed
systemctl start[|stop|restart|reload|status|help] unit
systemctl reboot    # Shut down and reboot the system:
systemctl poweroff  # Shut down

## 在systemd中配置supervisor
vim /etc/systemd/system/supervisor.service
    # supervisord service for systemd (CentOS 7.0+)
    
    [Unit]
    Description=Supervisor daemon
    
    [Service]
    Type=forking
    ExecStart=/usr/bin/supervisord
    ExecStop=/usr/bin/supervisorctl $OPTIONS shutdown
    ExecReload=/usr/bin/supervisorctl $OPTIONS reload
    KillMode=process
    Restart=on-failure
    RestartSec=42s

## 加载supervisor服务
systemctl daemon-reload
systemctl status supervisor
systemctl start supervisor
systemctl is-enabled supervisor
systemctl enable supervisor

## 开机启动
ln -s '/etc/systemd/system/supervisor.service' '/etc/systemd/system/multi-user.target.wants/supervisor.service'

# 测试
reboot
systemctl reboot

3. 参考文档
   • Supervisor is based on four components: supervisord、supervisorctl、a web server、an XML-RPC Interface
   • How To Create a systemd Service in Linux
   • Supervisor/initscripts

安装Java开发环境 JDK Setup

• 下载 JDK 1.8 rpm包
• 安装JDK

# Check which specific RPM package provides the java.
rpm -q --whatprovides java

# Uninstall any earlier installations of the JDK packages.
rpm -e package_name 

# Install the package.
rpm -ivh jdk-8uversion-linux-x64.rpm

java -version
javac -version

---

• DEVOPS SOP (Standard operating procedur)
• Title: 《SOP-OPS-基于阿里云ECS的通用系统安装及初始化》
• Modify History:
  • 2018-02-27 v1.0
• Authors: Jacky.L、...
• Published:
  • 掘金