1、PAM和google模块实现ssh双因子安全验证。
#1 安装配置
[root@centos7 ~]# yum install -y epel-release.noarch
[root@centos7 ~]# yum makecache
[root@centos7 ~]# yum install -y google-authenticator.x86_64
#/etc/pam.d/sshd文件，修改或添加下行保存
#auth required pam_google_authenticator.so
[root@centos7 ~]# sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#编辑/etc/ssh/sshd_config找到下行
#ChallengeResponseAuthentication no
#更改为
#ChallengeResponseAuthentication yes
[root@centos7 ~]# sed -i 's/.*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
[root@centos7 ~]# google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos7%3Fsecret%3DV2LN2COWOYPU6QJX3DMUB3WYVI%26issuer%3Dcentos7
#运行后会出现二维码，然后打开手机下载的身份验证器（安卓）或者authenticator（苹果）软件，扫描二维码，绑定手机与服务器的关系。
#也可以使用下面的紧急救援码
[root@centos7 ~]# cat .google_authenticator
V2LN2COWOYPU6QJX3DMUB3WYVI
" RATE_LIMIT 3 30 1616226105
" WINDOW_SIZE 17
" DISALLOW_REUSE 53874203
" TOTP_AUTH
59672647
50003896
86574759
54898834
38498481
#2 使用另外一台服务器进行验证
[root@centos17 ~]# ssh root@10.0.0.7
Verification code: #这里输入app的临时码 进行二次验证
Password: #这里输入服务器密码
Last login: Sat Mar 20 15:26:16 2021 from 10.0.0.17
[root@centos7 ~]#
2、使用chrony实现内网时间同步（一台node1从外网同步时间，其余机器从node1同步时间）。
#1 设置内网同步服务器，指向阿里云，修改下面内容
#IP：10.0.0.7
[root@centos7 ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool ntp.aliyun.com iburst
pool ntp1.aliyun.com iburst
# Allow NTP client access from local network.
#allow 192.168.0.0/16
allow 10.0.0.0/24
# Serve time even if not synchronized to a time source.
local stratum 10
[root@centos7 ~]# systemctl restart chronyd
#2 时间同步验证
[root@centos7 ~]# date -s '1 year'
Sun Mar 20 16:28:29 CST 2022
[root@centos7 ~]# date
Sun Mar 20 16:28:41 CST 2022
[root@centos7 ~]# chronyc sources -v
210 Number of sources = 2
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? 203.107.6.88 2 6 377 64 -4791us[ +8760h] +/- 22ms
^* 120.25.115.20 2 6 377 1 +842us[ +8760h] +/- 20ms
[root@centos7 ~]# date
Sun Mar 20 16:30:46 CST 2022
#3 另外一台机器从内网时间服务器进行同步
#IP:10.0.0.17
[root@centos17 ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
server 10.0.0.7 iburst
[root@centos17 ~]# date
Sun Mar 21 00:32:22 CST 2021
[root@centos17 ~]# systemctl restart chronyd
[root@centos17 ~]# date
Sun Mar 21 00:32:47 CST 2021
[root@centos17 ~]# date
Sat Mar 20 16:47:17 CST 2021
3、利用cobbler实现系统自动化安装。
两台主机
一台主机：CentOS 7 充当 Cobbler，http，dhcp，tftp 服务器，并关闭防火墙和SELinux
一台主机：充当测试机，用于实现自动化安装Linux系统
#1 安装相关包并启动服务
[root@centos7 ~]# yum -y install epel-release
[root@centos7 ~]# yum install cobbler dhcp -y
[root@centos7 ~]# systemctl enable --now cobblerd httpd tftp dhcpd
Created symlink from /etc/systemd/system/multi-user.target.wants/cobblerd.service to /usr/lib/systemd/system/cobblerd.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
Created symlink from /etc/systemd/system/sockets.target.wants/tftp.socket to /usr/lib/systemd/system/tftp.socket.
Created symlink from /etc/systemd/system/multi-user.target.wants/dhcpd.service to /usr/lib/systemd/system/dhcpd.service.
Job for dhcpd.service failed because the control process exited with error code. See "systemctl status dhcpd.service" and "journalctl -xe" for details.
#2 修改cobbler相关的配置
[root@centos7 ~]# cobbler check
The following are potential configuration items that you may want to fix:
1 : The 'server' field in /etc/cobbler/settings must be set to something other than localhost, or kickstarting features will not work. This should be a resolvable hostname or IP for the boot server as reachable by all machines that will use it.
2 : For PXE to be functional, the 'next_server' field in /etc/cobbler/settings must be set to something other than 127.0.0.1, and should match the IP of the boot server on the PXE network.
3 : change 'disable' to 'no' in /etc/xinetd.d/tftp
4 : Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may run 'cobbler get-loaders' to download them, or, if you only want to handle x86/x86_64 netbooting, you may ensure that you have installed a *recent* version of the syslinux package installed and can ignore this message entirely. Files in this directory, should you want to support all architectures, should include pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobbler get-loaders' command is the easiest way to resolve these requirements.
5 : enable and start rsyncd.service with systemctl
6 : debmirror package is not installed, it will be required to manage debian deployments and repositories
7 : ksvalidator was not found, install pykickstart
8 : The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is still set to 'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
9 : fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
Restart cobblerd and then run 'cobbler sync' to apply changes.
#生成新密码，默认安装好的系统root密码为cobbler
[root@centos7 ~]# openssl passwd -1 '123456'
$1$CTGcyJOY$tQBZAZdaYCapXzgwYUWje1
#根据以上提示，只需要做1，2，8这三项即可，修改下面四行
[root@centos7 ~]# vim /etc/cobbler/settings
default_password_crypted: "$1$CTGcyJOY$tQBZAZdaYCapXzgwYUWje1"
next_server：< tftp服务器的 IP 地址>
server：<cobbler服务器的 IP 地址>
manage_dhcp：1 #设置为1，表示通过cobbler生成dhcpd.conf配置文件
#3 实现dhcp服务
[root@centos7 ~]# systemctl restart cobblerd.service
[root@centos7 ~]# vim /etc/cobbler/dhcp.template
#修改下面部分内容
subnet 10.0.0.0 netmask 255.255.255.0 {
option routers 10.0.0.2;
option domain-name-servers 180.76.76.76,223.6.6.6;
option subnet-mask 255.255.255.0;
range dynamic-bootp 10.0.0.50 10.0.0.100;
default-lease-time 21600;
max-lease-time 43200;
next-server $next_server;
[root@centos7 ~]# cobbler sync
[root@centos7 ~]# systemctl start dhcpd
#4 下载启动的相关文件
[root@centos7 ~]# cobbler get-loaders
task started: 2021-03-21_044611_get_loaders
task started (id=Download Bootloader Content, time=Sun Mar 21 04:46:11 2021)
downloading https://cobbler.github.io/loaders/README to /var/lib/cobbler/loaders/README
downloading https://cobbler.github.io/loaders/COPYING.elilo to /var/lib/cobbler/loaders/COPYING.elilo
downloading https://cobbler.github.io/loaders/COPYING.yaboot to /var/lib/cobbler/loaders/COPYING.yaboot
downloading https://cobbler.github.io/loaders/COPYING.syslinux to /var/lib/cobbler/loaders/COPYING.syslinux
downloading https://cobbler.github.io/loaders/elilo-3.8-ia64.efi to /var/lib/cobbler/loaders/elilo-ia64.efi
downloading https://cobbler.github.io/loaders/yaboot-1.3.17 to /var/lib/cobbler/loaders/yaboot
downloading https://cobbler.github.io/loaders/pxelinux.0-3.86 to /var/lib/cobbler/loaders/pxelinux.0
downloading https://cobbler.github.io/loaders/menu.c32-3.86 to /var/lib/cobbler/loaders/menu.c32
downloading https://cobbler.github.io/loaders/grub-0.97-x86.efi to /var/lib/cobbler/loaders/grub-x86.efi
downloading https://cobbler.github.io/loaders/grub-0.97-x86_64.efi to /var/lib/cobbler/loaders/grub-x86_64.efi
*** TASK COMPLETE ***
[root@centos7 ~]# ls /var/lib/cobbler/loaders/
COPYING.elilo COPYING.yaboot grub-x86_64.efi menu.c32 README
COPYING.syslinux elilo-ia64.efi grub-x86.efi pxelinux.0 yaboot
[root@centos7 ~]# tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
│ └── grub
│ └── menu.lst
├── etc
├── grub
│ ├── efidefault
│ └── images -> ../images
├── images
├── images2
├── memdisk
├── menu.c32
├── ppc
├── pxelinux.0
├── pxelinux.cfg
│ └── default
└── s390x
└── profile_list
10 directories, 7 files
[root@centos7 ~]# cobbler sync
task started: 2021-03-21_045123_sync
task started (id=Sync, time=Sun Mar 21 04:51:23 2021)
running pre-sync triggers
cleaning trees
removing: /var/lib/tftpboot/pxelinux.cfg/default
removing: /var/lib/tftpboot/grub/images
removing: /var/lib/tftpboot/grub/efidefault
removing: /var/lib/tftpboot/s390x/profile_list
copying bootloaders
trying hardlink /var/lib/cobbler/loaders/pxelinux.0 -> /var/lib/tftpboot/pxelinux.0
copying: /var/lib/cobbler/loaders/pxelinux.0 -> /var/lib/tftpboot/pxelinux.0
trying hardlink /var/lib/cobbler/loaders/menu.c32 -> /var/lib/tftpboot/menu.c32
copying: /var/lib/cobbler/loaders/menu.c32 -> /var/lib/tftpboot/menu.c32
trying hardlink /var/lib/cobbler/loaders/yaboot -> /var/lib/tftpboot/yaboot
trying hardlink /var/lib/cobbler/loaders/grub-x86.efi -> /var/lib/tftpboot/grub/grub-x86.efi
trying hardlink /var/lib/cobbler/loaders/grub-x86_64.efi -> /var/lib/tftpboot/grub/grub-x86_64.efi
copying distros to tftpboot
copying images
generating PXE configuration files
generating PXE menu structure
rendering DHCP files
generating /etc/dhcp/dhcpd.conf
rendering TFTPD files
generating /etc/xinetd.d/tftp
cleaning link caches
running post-sync triggers
running python triggers from /var/lib/cobbler/triggers/sync/post/*
running python trigger cobbler.modules.sync_post_restart_services
running: dhcpd -t -q
received on stdout:
received on stderr:
running: service dhcpd restart
received on stdout:
received on stderr: Redirecting to /bin/systemctl restart dhcpd.service
running shell triggers from /var/lib/cobbler/triggers/sync/post/*
running python triggers from /var/lib/cobbler/triggers/change/*
running python trigger cobbler.modules.manage_genders
running python trigger cobbler.modules.scm_track
running shell triggers from /var/lib/cobbler/triggers/change/*
*** TASK COMPLETE ***
[root@centos7 ~]# tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
│ └── grub
│ └── menu.lst
├── etc
├── grub
│ ├── efidefault
│ ├── grub-x86_64.efi
│ ├── grub-x86.efi
│ └── images -> ../images
├── images
├── images2
├── memdisk
├── menu.c32
├── ppc
├── pxelinux.0
├── pxelinux.cfg
│ └── default
├── s390x
│ └── profile_list
└── yaboot
10 directories, 10 files
#5 修改菜单的标题信息
[root@centos7 ~]#vim /etc/cobbler/pxe/pxedefault.template
MENU TITLE Cobbler | http://www.magedu.com/
[root@centos7 ~]#cobbler sync
[root@centos7 ~]#cat /var/lib/tftpboot/pxelinux.cfg/default
DEFAULT menu
PROMPT 0
MENU TITLE Cobbler | http://www.magedu.com/ #默认为：http://cobbler.github.io/
TIMEOUT 200
TOTALTIMEOUT 6000
ONTIMEOUT local
LABEL local
MENU LABEL (local)
MENU DEFAULT
LOCALBOOT -1
MENU end
[root@centos7 ~]#cobbler sync
#6 导入CentOS系统的安装文件，生成相应的YUM源
[root@centos7 ~]# mkdir /mnt/centos7
[root@centos7 ~]# mount /dev/sr0 /mnt/centos7
mount: /dev/sr0 is write-protected, mounting read-only
[root@centos7 ~]# cobbler import --name=centos-7.7-x86_64 --path=/mnt/centos7 --arch=x86_64
task started: 2021-03-21_053827_import
task started (id=Media import, time=Sun Mar 21 05:38:27 2021)
Found a candidate signature: breed=redhat, version=rhel6
Found a candidate signature: breed=redhat, version=rhel7
Found a matching signature: breed=redhat, version=rhel7
Adding distros from path /var/www/cobbler/ks_mirror/centos-7.7-x86_64:
creating new distro: centos-7.7-x86_64
trying symlink: /var/www/cobbler/ks_mirror/centos-7.7-x86_64 -> /var/www/cobbler/links/centos-7.7-x86_64
creating new profile: centos-7.7-x86_64
associating repos
checking for rsync repo(s)
checking for rhn repo(s)
checking for yum repo(s)
starting descent into /var/www/cobbler/ks_mirror/centos-7.7-x86_64 for centos-7.7-x86_64
processing repo at : /var/www/cobbler/ks_mirror/centos-7.7-x86_64
need to process repo/comps: /var/www/cobbler/ks_mirror/centos-7.7-x86_64
looking for /var/www/cobbler/ks_mirror/centos-7.7-x86_64/repodata/*comps*.xml
Keeping repodata as-is :/var/www/cobbler/ks_mirror/centos-7.7-x86_64/repodata
*** TASK COMPLETE ***
[root@centos7 ~]# du -sh /var/www/cobbler/ks_mirror/*
4.5G /var/www/cobbler/ks_mirror/centos-7.7-x86_64
4.0K /var/www/cobbler/ks_mirror/config
[root@centos7 ~]# cobbler distro list
centos-7.7-x86_64
#默认生成的是最小化安装
