CentOS6.x系统下智能初始化脚本
PS：自动化运维，逐渐替代传统的运维工作，也是运维当今趋势。那么作为一名合格的Linux运维工程师，自然是需要把繁琐的工作变得简单化。例如：当你需要给100台linux服务器安装系统时，你不能一台一台操作；这样很费时，费力而且还得不到领导的赏识，那为什么不考虑无人值守批量安装呢？考虑到系统的安全，可能你还需要对系统进行优化，难道你一台一台去操作，这不是你所想的，既然如此，为何不考虑自己编写脚本批量去操作，如下图所示：
提示：
操作机在生产环境下，需要提供公网地址，当前仅为测试环境，IP为私网地址。考虑到服务器在各地IDC机房上架后，可能都需要初始化系统，这不仅仅是为了系统安全考虑，更重要的是能批量去管理与维护，让我们的工作能够更轻松，智能，更有效率。为了满足各地互联网用户更快速的访问，服务器会分布在全国各地的IDC机房，远程管理，维护是必然的，你不能那台服务器需要安装某个服务，你就跑哪里。通过SSH远程管理，很方便，在此我建议运维的朋友，在各地的服务器上架之后创建一个普通用户，用于远程登录各地的服务器，然后切换到root用户下，避免用root超级用户登录，可以使你的系统更加安全。那么如何批量登录各地的服务器，提示使用expect，SSH免密钥认证的方式，实现不用输入用户名或密码，智能化登录。
一、CentOS6.x系统智能初始化脚本如下：
[root@hello scripts]# cat system_auto_initialize.sh
#!/bin/bash
# author cfwl create date of 2012-10-21
# blog http://cfwlxf.blog.51cto.com
# source user shell variable
PATH=/sbin:/bin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
export PATH
# Source system network library.
. /etc/sysconfig/network
# Source system function library.
. /etc/init.d/functions
SYSTEM_HOSTNAME(){
# Source system network library.
. /etc/sysconfig/network
# Update name of system host
printf "\033[33mplease input system host name:\033[0m " STR
read STR
# Judge system hostname
hostname $STR
sed -i "s/HOSTNAME=$HOSTNAME/HOSTNAME=$STR/" /etc/sysconfig/network
# Judge system hostname if equal user input name
HOSTNAME=$(awk -F '=' '/HOSTNAME/{print $2}' /etc/sysconfig/network)
if [ "$HOSTNAME" = "$STR" ]
then
sleep 2
printf "\033[35msystem host name is update by: $STR\033[0m $str\n"
else
printf "\033[35msystem host name is not update\033[0m\n"
exit 0
fi
}
# Update System SSH Service Port
SYSTEM_SSH_PORT(){
#create user remote manage server
printf "\033[35mCreate ordinary user, Used for remote login server,please input string \'y\': \033[0m" LOGIN
read LOGIN
if [ "$LOGIN" = "y" ]
then
read -p "Please input user name,must begin with the string: " NAME
useradd $NAME
read -p "Please input user $NAME of password: " PASSWORD
echo $PASSWORD | passwd --stdin $NAME > /dev/null 2>&1
USER_NAME=$(grep ^$NAME /etc/passwd | grep -Po '.*(?=:x)')
[ ${USER_NAME} = ${NAME} ] && printf "\033[35mUser $NAME by create.\033[0m\n"
else
printf "\033[31mError: The string you input errors,please again input string.\033[om"
fi
SSH_CONFIG=/etc/ssh/sshd_config
#Backup SSH configuration
cp -a ${SSH_CONFIG} ${SSH_CONFIG}.save
#Chage SSH server of port
sed -i '/^#Port/s/#Port 22/Port 65535/g' $SSH_CONFIG
sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' $SSH_CONFIG
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' $SSH_CONFIG
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' $SSH_CONFIG
sleep 2
#Prompt user Close system iptables .
INFORMATION=$(/etc/init.d/iptables status)
printf "\033[32mYou need Close Iptables,Avoid administrators cannot access SSH service,please input string \'y\':\033[0m" STR
read STR
if [ ${STR} = "y" ]
then
/etc/init.d/iptables stop && sleep 1 && printf "\033[35m$INFORMATION\033[0m\n"
else
printf "\033[31mError: Please input string \'y\',Close system iptables.\033[0m"
exit 0
fi
#Pormpt user restart SSH service
sleep 1
printf "\033[32mYou need to restart the SSH service,configuration to take effect.
1> Input \"y\", Now restart to SSH service.
2> Input \"n\", Later in the manual restart.
Please input string \"y/n\": \033[0m" RETVAL
read RETVAL
[ "$RETVAL" = "y" ] && sleep 2 && /etc/init.d/sshd restart
[ "$RETVAL" = "n" ] && sleep 2 && action "Later on please manual restart SSH service" true
}
# Close system Selinux and iptables function
SYSTEM_IPV4_FORWARD(){
#Close syetem selinux and iptalbes forward
sed -i '/^SELINUX/s/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
RETVAL=$(awk -F '=' '/^SELINUX=/{print $NF}' /etc/selinux/config)
[ "$RETVAL" = "disabled" ] && sleep 1 && printf "\033[36mSelinux Change [$RETVAL], please restart system by tack effect.\033[0m\n"
sleep 2
#Close syetem iptables forward
/etc/init.d/iptables stop && chkconfig iptables off
}
#Optimizing The System Service and Rsync System Time
CLOSE_SYSTEM_SERVER(){
#Stop All System Serivce
for server in `chkconfig --list | awk '{print $1}'`;do chkconfig $server off;done
#Start Up Assign System Service
for server in sshd messagebus rngd network crond rsyslog irqbalance;do chkconfig --level 35 $server on;done
#Print modify alter of service
RETVAL=$(chkconfig --list | egrep '3:on|5:on' | awk '{print $1}' | xargs)
printf "\033[35mPrint current system auto start of server: $RETVAL\033[0m\n"
#Rsync System Local Time
RETVAL=$(rpm -qa ntp | wc -l)
if [ $RETVAL = 1 ]
then
echo "5 * * * * ntpdate ntp.api.bz > /dev/null 2>&1" >> /var/spool/cron/root
else
yum install ntp
echo "5 * * * * ntpdate ntp.api.bz > /dev/null 2>&1" >> /var/spool/cron/root
fi
}
#Update Yum Source
UPDATE_YUM_SOURCE(){
# Judge YUM_BACK_DIR directory if exist
YUM_BACK_DIR=/etc/yum.repos.d/backup/
YUM_DIR=/etc/yum.repos./
[ ! -d ${YUM_BACK_DIR} ] && mkdir ${YUM_BACK_DIR}
cd ${YUM_DIR}
find . -type f -name "*.repo" | xargs mv -t ${YUM_BACK_DIR}
RETVAL=0
#Determine the return value if 0.
[ $? = ${RETVAL} ] && printf "\033[32m
1.Inland 163 yum source
2.Inland sohu yum source
Judge:please input install 163 or sohu yum source:\033[0m" STR
read STR
case "$STR" in
163)
wget http://mirrors.163.com/.help/CentOS6-Base-163.repo
RETVAL=0
[ $? = ${RETVAL} ] && printf "\033[35mYum source is download successfully of 163 mirrors.\n\033[0m"
sleep 2
rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6
yum update
yum makecache
;;
sohu)
wget http://mirrors.sohu.com/help/CentOS-Base-sohu.repo
RETVAL=0
[ $? = ${RETVAL} ] && printf "\033[35mYum source is download successfully of sohu mirrors.\n\033[0m"
sleep 2
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-*
yum update
yum makecache
;;
*)
echo -e "\033[31m Error: plase you input 163 or sohu.\033[0m"
exit 0
esac
}
#By the user to enter the digital implementation corresponding function
echo -e "\033[32m
----------------------------------------------------------------------------------------------------------------
| welcome to syetem initialize scripts |
----------------------------------------------------------------------------------------------------------------
|Judge: Scripts Can realize the function as follows: |
|(1)Modification system host name . |
|(2)Close system SELINXU and iptables. |
|(3)Modification SSH service port as configure. |
|(4)Close System Don't use of Service and update system time |
|(5)Update System Yum Source |
----------------------------------------------------------------------------------------------------------------\033[0m"
read -p "Please according number input you want execute of function: " number
case "$number" in
1)
SYSTEM_HOSTNAME
RETVAL=0
[ $? = $RETVAL ] && action "System host name update successfully,please restart system." true
;;
2)
SYSTEM_IPV4_FORWARD
;;
3)
SYSTEM_SSH_PORT
RETVAL=0
[ $? = $RETVAL ] && action "Update System SSH Service Port already successfully." true
;;
4)
CLOSE_SYSTEM_SERVER
RETVAL=0
[ $? = $RETVAL ] && action "Initialize Sytem Service already successfully." true
;;
5)
UPDATE_YUM_SOURCE
RETVAL=0
[ $? = $RETVAL ] && action "Update System Yum Source already successfully." true
;;
*)
printf "\033[36mError: please you input prompt dialog box of number:1-5\033[0m\n"
;;
esac
二、初始化系统主机名
提示：
如果你的服务器主机名还是localhost，那么我建议你修改一个你容易辨认的主名字，如上图所示，SNS_SD_010_057，其中SNS表示联通，SD表示山东，010_057表示IP地址的后两位。
三、关闭系统Selinux与iptables，操作如下：
提示：
根据提示框中的信息，输入相应的数字执行初始化操作，关闭系统selinux防火墙后，需要重启服务器才能生效，若你很熟悉selinux命令setsebool则可添加相应的规则，当然可以不用重启，不过用setsebool操作起来很繁琐。我想说的是iptables已经很强大了，如果你的服务器不是特别重要，都可以选择close。
四、更改SSH服务主配置文件中的远程管理端口及相应参数，操作如下：
提示：
据上图所示，字符“y”表示立刻重启SSH服务器，“n”表示稍后手动重启，对于SSH配置文件的修改，可以考虑如下几点，1)修改SSH服务远程管理端口，上图中为65535，建议大于1024即可。2）拒绝root用户远程登陆，为了系统安全。3）拒绝空密码登陆，安全起见。4）避免DNS递归查询。从图中可以看出测试是OK。
五、关闭系统未使用，自动开启的服务，操作如下：
提示：
据上图所示，当前系统仅仅开启了crond、irqbalance、messagebus、network、rngd、rsyslog、sshd服务器，/etc/rc*.d/目录下的其他服务器都为关闭状态，其好处避免系统资源不必要的开销。如果想知道各服务进程的含义 ，请参考另一篇文档：http://cfwlxf.blog.51cto.com/3966339/1300732
六、更新系统yum源，升级软件包，操作如下：
提示：
图中提示了搜狐、163网站的yum源，如果你只安装的话，提示你是否更新，升级软件包输入n即可。
PS：此脚本在CentOS6.x下测试通过，至于CentOS5.x、Redhat5.x系列可以自行测试，后期的文章会涉及SSH免密钥远程登陆及expect的使用。