1、PAM和google模塊實(shí)現(xiàn)ssh雙因子安全驗(yàn)證陷揪。
在手機(jī)應(yīng)用市場(chǎng)搜索：身份驗(yàn)證器或authenticator腿准，并安裝APP
修改/etc/pam.d/sshd文件，將google的PAM模塊加入進(jìn)去實(shí)現(xiàn)
安裝google-authenticator模塊
[root@centos8 ~]# yum -y install epel-release.noarch
[root@centos8 ~]# yum makecache
[root@centos8 ~]# yum install -y google-authenticator.x86_64
初始化驗(yàn)證功能
[root@centos8 ~]# google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos8%3Fsecret%3DBZVPXXFINW5SMMSPBMVQMB5R54%26issuer%3Dcentos8
Failed to use libqrencode to show QR code visually for scanning.
Consider typing the OTP secret into your app manually.
Your new secret key is: BZVPXXFINW5SMMSPBMVQMB5R54
Enter code from app (-1 to skip): -1 #這里需要輸入用身份驗(yàn)證器掃碼上面給出的地址獲取到的code滓鸠。測(cè)試的時(shí)候跳過(guò)這一步雁乡，直接輸入-1，可以用下面給出的緊急驗(yàn)證碼登錄測(cè)試使用
Code confirmation skipped
Your emergency scratch codes are:
27273600
44505367
78109426
65720380
84362481
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
修改ssh登錄配置并重啟服務(wù)
#/etc/pam.d/sshd文件糜俗，修改或添加下行保存
#auth required pam_google_authenticator.so
[root@centos8 ~]# sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#編輯/etc/ssh/sshd_config找到下行
#ChallengeResponseAuthentication no
#更改為
#ChallengeResponseAuthentication yes
[root@centos8 ~]# sed -i 's/.*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
#重啟SSH服務(wù)
[root@centos8 ~]# service sshd restart
驗(yàn)證登錄
[root@1288-9 ~]# ssh 192.168.1.8
Verification code:
Password:
Last login: Wed Jul 14 09:44:57 2021 from 192.168.1.1
[root@centos8 ~]#
2踱稍、使用chrony實(shí)現(xiàn)內(nèi)網(wǎng)時(shí)間同步（一臺(tái)node1從外網(wǎng)同步時(shí)間，其余機(jī)器從node1同步時(shí)間）悠抹。
1珠月、 安裝chrony軟件
yum -y install chrony
2、修改配置文件/etc/chrony.conf
node1 ip 192.168.122.18
server s1b.time.edu.cn iburst
allow 192.168.0.0/16
其他選項(xiàng)默認(rèn)
其他節(jié)點(diǎn)ip在192.168網(wǎng)段內(nèi)
server 192.168.122.18 iburst
其他選項(xiàng)默認(rèn)
3锌钮、啟用chronyd服務(wù),檢查服務(wù)是否可連接
systemctl start chronyd.service
chronyc sources210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.122.18 6 6 377 24 -802ns[ -44us] +/- 140ms（如果未生效桥温，請(qǐng)檢查防火墻規(guī)則）
3、利用cobbler實(shí)現(xiàn)系統(tǒng)自動(dòng)化安裝梁丘。
1侵浸、安裝cobbler
[root@centos8 ~]# dnf install epel-releas
[root@centos8 ~]# dnf -y module enable cobbler
[root@centos8 ~]# dnf install cobbler
關(guān)閉selinux 啟動(dòng)httpd和cobbler服務(wù)
setenforce=0
systemctl start cobblerd httpd tftp
systemctl enable cobblerd httpd tftp
2、檢測(cè)cobbler的運(yùn)行環(huán)境,并根據(jù)提示逐步配置cobbler
[root@centos8 ~]# cobbler check
The following are potential configuration items that you may want to fix:
1: The 'server' field in /etc/cobbler/settings must be set to something other than localhost, or automatic installation features will not work. This should be a resolvable hostname or IP for the boot server as reachable by all machines that will use it.
2: For PXE to be functional, the 'next_server' field in /etc/cobbler/settings must be set to something other than 127.0.0.1, and should match the IP of the boot server on the PXE network.
3: SELinux is enabled. Please review the following wiki page for details on ensuring Cobbler works correctly in your SELinux environment:
https://github.com/cobbler/cobbler/wiki/Selinux
4: some network boot-loaders are missing from /var/lib/cobbler/loaders, you may run 'cobbler get-loaders' to download them, or, if you only want to handle x86/x86_64 netbooting, you may ensure that you have installed a *recent* version of the syslinux package installed and can ignore this message entirely. Files in this directory, should you want to support all architectures, should include pxelinux.0, menu.c32, and yaboot. The 'cobbler get-loaders' command is the easiest way to resolve these requirements.
5: reposync is not installed, install yum-utils or dnf-plugins-core
6: yumdownloader is not installed, install yum-utils or dnf-plugins-core
7: debmirror package is not installed, it will be required to manage debian deployments and repositories
8: ksvalidator was not found, install pykickstart
9: The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is still set to 'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
10: fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
Restart cobblerd and then run 'cobbler sync' to apply changes.
- The 'server' field in /etc/cobbler/settings must be set to something other than localhost, or kickstarting features will not work. This should be a resolvable hostname or IP for the boot server as reachable by all machines that will use it.
修改/etc/cobbler/settings中的 server 為本機(jī)地址
sed -i.bak s/^server:.*/server:" 192.168.122.18"/ /etc/cobbler/settings
- For PXE to be functional, the 'next_server' field in /etc/cobbler/settings must be set to something other than 127.0.0.1, and should match the IP of the boot server on the PXE network.
修改/etc/cobbler/settings中的 next_server 為本機(jī)地址
sed -i.bak s/^next_server:.*/next_server:" 192.168.122.18"/ /etc/cobbler/settings
- SELinux is enabled. Please review the following wiki page for details on ensuring cobbler works correctly in your SELinux environment:
https://github.com/cobbler/cobbler/wiki/Selinux
- SELinux is enabled. Please review the following wiki page for details on ensuring cobbler works correctly in your SELinux environment:
設(shè)置 SELinux 為disabled,重啟服務(wù)器
sed -i s/^SELINUX=.*/SELINUX=disabled/ /etc/selinux/config
- some network boot-loaders are missing from /var/lib/cobbler/loaders, you may run 'cobbler get-loaders' to download them, or, if you only want to handle x86/x86_64 netbooting, you may ensure that you have installed a recent version of the syslinux package installed and can ignore this message entirely. Files in this directory, should you want to support all architectures, should include pxelinux.0, menu.c32, and yaboot. The 'cobbler get-loaders' command is the easiest way to resolve these requirements.
安裝syslinux
[root@centos8 ~]# dnf -y install syslinux
聯(lián)網(wǎng)下載boot引導(dǎo)程序文件
cobbler get-loaders （如果要配置代理在/etc/cobbler/settings文件 proxy_url_ext: 項(xiàng)）
如果報(bào)404錯(cuò)誤氛谜，修改/usr/lib/python2.7/site-packages/cobbler/action_dlcontent.py
#content_server = "https://cobbler.github.io/loaders"
content_server = "https://dgoodwin.fedorapeople.org/loaders"
files 列表修改為https://dgoodwin.fedorapeople.org/loaders存在的對(duì)應(yīng)文件列表（README文件可忽略）
cp -a /usr/share/syslinux/{pxelinux.0,menu.c32} /var/lib/tftpboot
- 5 reposync is not installed, install yum-utils or dnf-plugins-core
- 6 yumdownloader is not installed, install yum-utils or dnf-plugins-core
安裝dnf-plugins-core
[root@centos8 ~]# dnf -y install yum-utils dnf-plugins-core
- debmirror package is not installed, it will be required to manage debian deployments and repositories
[root@centos8 ~]# dnf -y install debmirror
安裝后再次執(zhí)行cobbler check會(huì)提示需要在/etc/debmirror.conf 中注釋掉 dists和arches 行
sed -i.bak '/dists\|arches/s/^/#/' /etc/debmirror.conf
- ksvalidator was not found, install pykickstar
[root@centos8 ~]# dnf -y install pykickstart
- The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is still set to 'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
[root@centos8 ~]# openssl passwd -1 -salt 'cobbler' 'cobbler'
$1$cobbler$M6SE55xZodWc9.vAKLJs6.
[root@centos8 ~]# sed -i.bak '/default_password_crypted:/s#".*"#"$1$cobbler$M6SE55xZodWc9.vAKLJs6."#' /etc/cobbler/settings
- fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
[root@centos8 ~]# dnf -y install fence-agents
重啟服務(wù)器關(guān)閉SELINUX
安裝dhcp服務(wù)
dnf -y install dhcpd
完成后修改修改dhcp配置文 /etc/cobbler/dhcp.template
subnet 192.168.122.0 netmask 255.255.255.0 {
option routers 192.168.122.1;
option domain-name-servers 10.98.48.151,10.72.55.103;
option subnet-mask 255.255.255.0;
range dynamic-bootp 192.168.122.100 192.168.122.254;
其他項(xiàng)目默認(rèn)
- 最后執(zhí)行cobbler sync 掏觉，服務(wù)就搭建完成了
3、導(dǎo)入鏡像進(jìn)行配置
更新/var/lib/cobbler/distro_signatures.json文件
[root@centos8 ~]# cobbler signature update
- 上傳iso鏡像到服務(wù)器值漫，創(chuàng)建鏡像掛載點(diǎn)
[root@centos8 ~]# mkdir -p /mnt/{7,8,16,18}
- 鏡像文件掛載到目錄
[root@centos8 ~]# mount /data/CentOS-7-x86_64-Minimal-2009.iso /mnt/7
[root@centos8 ~]# mount /data/ubuntu-16.04.6-server-amd64.iso /mnt/16
執(zhí)行mount -a 掛載命令
- 把掛載光盤(pán)鏡像的mnt目錄中的內(nèi)容導(dǎo)入到cobbler
[root@centos8 ~]# cobbler import --name=centos7 --path=/mnt/7 --arch=x86_64
[root@centos8 ~]# cobbler import --name=ubuntu16 --path=/mnt/16 --arch=x86_64
[root@centos8 ~]# cobbler distro list
centos7-x86_64
ubuntu16-hwe-x86_64
ubuntu16-x86_64
4澳腹、準(zhǔn)備 kickstart文件,并關(guān)聯(lián)至指定的YUM源
kickstart文件可以安裝一個(gè)模版服務(wù)器，從安裝好的服務(wù)器的/root/anaconda-ks.cfg 復(fù)制后修改
[root@centos8 ~]# cat /var/lib/cobbler/templates/centos7.ks
#version=DEVEL
# System authorization information
auth --enableshadow --passalgo=sha512
# Use CDROM installation media
#cdrom
# Use network installation
url --url=$tree #安裝方式使用cobbler默認(rèn)里的方式
# If any cobbler repo definitions were referenced in the kickstart profile, include them here.
$yum_repo_stanza
# Use graphical install
graphical #安裝界面可用圖形或字符 text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=vda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8
# Network information
network --bootproto=dhcp --device=eth0 --ipv6=auto --activate
network --hostname=localhost.localdomain
# Root password
rootpw --iscrypted $6$v0W40q80/7HPdeHr$dfHh.SdFzcs8ue.OUl7W5.0ku/xhWPKUXT.qSvYSLdz3C2OImdcRSr2Tde3woAK3qQoh.KWU8F1mYuclBTFIE0
# System services
services --enabled="chronyd"
# System timezone
timezone Asia/Shanghai --isUtc
user --groups=wheel --name=wx562635 --password=$6$tGpU7Mbs2bKeqnUu$rqXk6lDnt63cSE5m/LmLiY84HlaGFmgxCfJ27BpAPH2RCsptO6SbwIvaOgQ7W/toOiQvJMvt1qPJS/d47lhrr1 --iscrypted --gecos="wx562635"
# System bootloader configuration
bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=vda
autopart --type=lvm
# Partition clearing information
clearpart --all --initlabel
%packages
@^minimal
@core
chrony
kexec-tools
%end
%addon com_redhat_kdump --enable --reserve-mb='auto'
%end
%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
# Reboot after installation
reboot
[root@centos8 ~]# cobbler profile remove --name centos7-x86_64
[root@centos8 ~]# cobbler profile add --name=centos7-x86_64 --distro=centos7-x86_64 --template-files=/var/lib/cobbler/templates/centos7.ks --autoinstall=centos7.ks
全部配置完成就可以在服務(wù)器上選擇PXE網(wǎng)絡(luò)啟動(dòng)自動(dòng)安裝系統(tǒng)了
