前面我们已经了解了saltstack的基础功能，现在就可以使用saltstack为初始化新安装的linux系统。

初始化列表:

1.关闭selinux
3.修改sshd配置文件
4.内核优化
5.ulimit修改
6.history记录
7.时区修改及添加cron
8.安装epel
9.修改resolv解析文件
10.软件安装
好了，此前我们已经修改了salt的base目录，默认在/srv/salt 下我们调整到/etc/salt目录下了
现在呢，我们需要去建立一个目录专门用于存放初始化sls的。

[root@localhost base]# pwd
/etc/salt/base

[root@localhost base]# mkdir init

date_time.sls

系统时区修改

[root@localhost init]# vim date_time.sls date_time:pkg.installed:- name: ntpdate- unless: rpm -qa | grep ntpdatecmd.run:- name:  rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && ntpdate pool.ntp.org- require:- pkg: ntpdatecron.present:- name: /usr/sbin/ntpdate pool.ntp.org >/dev/null- user: root- minute: '*/5'- require:- pkg: ntpdate

epel.sls

epel文件调整，系统为centos 7

[root@localhost init]#vim epel.sls epel_install:pkg.installed:- sources:- epel-release: http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm- unless: rpm -qa | grep epel-release-7-5

history.sls

修改操作命令记录

[root@localhost init]# vim history.sls /etc/bashrc:file.append:- text:- HISTTIMEFORMAT="%F %T `whoami` "cmd.run:- name: source /etc/bashrc

limits.sls

limits参数调整

[root@localhost init]# vim limits.sls /etc/security/limits.conf:file.append:- text:- '* hard nofile 204800'- '* soft nofile 204800'/etc/profile:file.append:- text:- 'ulimit -c unlimited'~/.bashrc:file.append:- text:- alias vi='"'vim'"'

resolv.sls

DNS解析文件修改

[root@localhost init]#vim resolv.sls resolv:file.managed:- name: /etc/resolv.conf- source: salt://init/resolv.conf
[root@localhost init]# vim resolv.conf
# Generated by NetworkManager
nameserver 114.114.114.114
nameserver 8.8.8.8
[root@localhost init]#

selinux.sls

selinux卸载

[root@localhost init]# vim selinux.sls selinux:cmd.run:- name: yum remove selinux-policy -y

soft_install.sls

基础软件安装

[root@localhost init]# vim soft_install.sls soft-install:pkg.installed:- names:- lrzsz- telnet- openssh-clients- ftp- sysstat- bc- rsync- wget- screen- dstat- vim-enhanced- gcc- gcc-c++- make- dos2unix- net-tools
[root@localhost init]#

sshd_config.sls

SSHD配置文件调整

[root@localhost init]# vim sshd_config.sls sshd:file.managed:- name: /etc/ssh/sshd_config- source: salt://init/sshd_configservice.running:- enable: True- reload: True- watch:- file: /etc/ssh/sshd_config

[root@localhost init]# vim sshd_config
Port 22
Protocol 2
SyslogFacility AUTHPRIV
PasswordAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication yes
Compression yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
X11Forwarding yes
UsePAM yes
UseDNS no
Subsystem       sftp    /usr/libexec/openssh/sftp-server
LogLevel  DEBUG#allowusers root@192.168.140.129
#allowusers root@192.168.140.1

sysctl.sls

内核参数调整

[root@localhost init]# vim sysctl.sls
net.ipv4.conf.default.rp_filter:sysctl.present:- value: 1
net.ipv4.conf.default.accept_source_route:sysctl.present:- value: 0kernel.sysrq:sysctl.present:- value: 0kernel.core_uses_pid:sysctl.present:- value: 1kernel.msgmnb:sysctl.present:- value: 65536kernel.msgmax:sysctl.present:- value: 65536kernel.shmmax:sysctl.present:- value: 68719476736kernel.shmall:sysctl.present:- value: 4294967296kernel.shmmni:sysctl.present:- value: 4096kern.maxfiles:sysctl.present:- value: 65536net.ipv4.tcp_fin_timeout:sysctl.present:- value: 30net.ipv4.tcp_keepalive_time:sysctl.present:- value: 1200net.ipv4.tcp_window_scaling:sysctl.present:- value: 1net.ipv4.tcp_sack:sysctl.present:- value: 1net.ipv4.tcp_syncookies:sysctl.present:- value: 1net.ipv4.tcp_tw_reuse:sysctl.present:- value: 1net.ipv4.tcp_tw_recycle:sysctl.present:- value: 1net.ipv4.ip_local_port_range:sysctl.present:- value: 1024 65000net.ipv4.tcp_max_tw_buckets:sysctl.present:- value: 6000net.ipv4.tcp_max_syn_backlog:sysctl.present:- value: 65535net.core.netdev_max_backlog:sysctl.present:- value: 262144net.core.wmem_default:sysctl.present:- value: 8388608net.core.rmem_default:sysctl.present:- value: 8388608net.core.rmem_max:sysctl.present:- value: 16777216net.core.wmem_max:sysctl.present:- value: 16777216net.ipv4.tcp_timestamps:sysctl.present:- value: 0net.ipv4.tcp_synack_retries:sysctl.present:- value: 2net.ipv4.tcp_syn_retries:sysctl.present:- value: 2net.ipv4.tcp_mem:sysctl.present:- value: 94500000 915000000 927000000net.ipv4.tcp_max_orphans:sysctl.present:- value: 3276800
[root@localhost init]#

建立入口文件及管理文件

[root@localhost base]# pwd
/etc/salt/base
[root@localhost base]# ls
init  system_init.sls  top.sls
[root@localhost base]# vim system_init.sls
include:- init.selinux- init.epel- init.date_time- init.soft_install- init.history- init.limits- init.sysctl- init.sshd_config- init.resolv
[root@localhost base]# vim top.sls
base:'*':- system_init
[root@localhost base]#

执行命令

[root@localhost base]# salt '*' state.highstate test=True     执行前先测试
[root@localhost base]#  salt '*' state.highstate