1、PAM和google模塊實現(xiàn)ssh雙因子安全驗證。
#1 安裝配置
[root@centos7 ~]# yum install -y epel-release.noarch
[root@centos7 ~]# yum makecache
[root@centos7 ~]# yum install -y google-authenticator.x86_64
#/etc/pam.d/sshd文件，修改或添加下行保存
#auth required pam_google_authenticator.so
[root@centos7 ~]# sed -i '1a\auth required pam_google_authenticator.so' /etc/pam.d/sshd
#編輯/etc/ssh/sshd_config找到下行
#ChallengeResponseAuthentication no
#更改為
#ChallengeResponseAuthentication yes
[root@centos7 ~]# sed -i 's/.*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' /etc/ssh/sshd_config
[root@centos7 ~]# google-authenticator
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@centos7%3Fsecret%3DV2LN2COWOYPU6QJX3DMUB3WYVI%26issuer%3Dcentos7
#運行后會出現(xiàn)二維碼，然后打開手機下載的身份驗證器（安卓）或者authenticator（蘋果）軟件，掃描二維碼，綁定手機與服務(wù)器的關(guān)系。
#也可以使用下面的緊急救援碼
[root@centos7 ~]# cat .google_authenticator
V2LN2COWOYPU6QJX3DMUB3WYVI
" RATE_LIMIT 3 30 1616226105
" WINDOW_SIZE 17
" DISALLOW_REUSE 53874203
" TOTP_AUTH
59672647
50003896
86574759
54898834
38498481
#2 使用另外一臺服務(wù)器進行驗證
[root@centos17 ~]# ssh root@10.0.0.7
Verification code: #這里輸入app的臨時碼 進行二次驗證
Password: #這里輸入服務(wù)器密碼
Last login: Sat Mar 20 15:26:16 2021 from 10.0.0.17
[root@centos7 ~]#
2、使用chrony實現(xiàn)內(nèi)網(wǎng)時間同步（一臺node1從外網(wǎng)同步時間，其余機器從node1同步時間）。
#1 設(shè)置內(nèi)網(wǎng)同步服務(wù)器，指向阿里云，修改下面內(nèi)容
#IP：10.0.0.7
[root@centos7 ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool ntp.aliyun.com iburst
pool ntp1.aliyun.com iburst
# Allow NTP client access from local network.
#allow 192.168.0.0/16
allow 10.0.0.0/24
# Serve time even if not synchronized to a time source.
local stratum 10
[root@centos7 ~]# systemctl restart chronyd
#2 時間同步驗證
[root@centos7 ~]# date -s '1 year'
Sun Mar 20 16:28:29 CST 2022
[root@centos7 ~]# date
Sun Mar 20 16:28:41 CST 2022
[root@centos7 ~]# chronyc sources -v
210 Number of sources = 2
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? 203.107.6.88 2 6 377 64 -4791us[ +8760h] +/- 22ms
^* 120.25.115.20 2 6 377 1 +842us[ +8760h] +/- 20ms
[root@centos7 ~]# date
Sun Mar 20 16:30:46 CST 2022
#3 另外一臺機器從內(nèi)網(wǎng)時間服務(wù)器進行同步
#IP:10.0.0.17
[root@centos17 ~]# vim /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
server 10.0.0.7 iburst
[root@centos17 ~]# date
Sun Mar 21 00:32:22 CST 2021
[root@centos17 ~]# systemctl restart chronyd
[root@centos17 ~]# date
Sun Mar 21 00:32:47 CST 2021
[root@centos17 ~]# date
Sat Mar 20 16:47:17 CST 2021
3、利用cobbler實現(xiàn)系統(tǒng)自動化安裝。
兩臺主機
一臺主機：CentOS 7 充當(dāng) Cobbler，http，dhcp，tftp 服務(wù)器，并關(guān)閉防火墻和SELinux
一臺主機：充當(dāng)測試機，用于實現(xiàn)自動化安裝Linux系統(tǒng)
#1 安裝相關(guān)包并啟動服務(wù)
[root@centos7 ~]# yum -y install epel-release
[root@centos7 ~]# yum install cobbler dhcp -y
[root@centos7 ~]# systemctl enable --now cobblerd httpd tftp dhcpd
Created symlink from /etc/systemd/system/multi-user.target.wants/cobblerd.service to /usr/lib/systemd/system/cobblerd.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
Created symlink from /etc/systemd/system/sockets.target.wants/tftp.socket to /usr/lib/systemd/system/tftp.socket.
Created symlink from /etc/systemd/system/multi-user.target.wants/dhcpd.service to /usr/lib/systemd/system/dhcpd.service.
Job for dhcpd.service failed because the control process exited with error code. See "systemctl status dhcpd.service" and "journalctl -xe" for details.
#2 修改cobbler相關(guān)的配置
[root@centos7 ~]# cobbler check
The following are potential configuration items that you may want to fix:
1 : The 'server' field in /etc/cobbler/settings must be set to something other than localhost, or kickstarting features will not work. This should be a resolvable hostname or IP for the boot server as reachable by all machines that will use it.
2 : For PXE to be functional, the 'next_server' field in /etc/cobbler/settings must be set to something other than 127.0.0.1, and should match the IP of the boot server on the PXE network.
3 : change 'disable' to 'no' in /etc/xinetd.d/tftp
4 : Some network boot-loaders are missing from /var/lib/cobbler/loaders, you may run 'cobbler get-loaders' to download them, or, if you only want to handle x86/x86_64 netbooting, you may ensure that you have installed a *recent* version of the syslinux package installed and can ignore this message entirely. Files in this directory, should you want to support all architectures, should include pxelinux.0, menu.c32, elilo.efi, and yaboot. The 'cobbler get-loaders' command is the easiest way to resolve these requirements.
5 : enable and start rsyncd.service with systemctl
6 : debmirror package is not installed, it will be required to manage debian deployments and repositories
7 : ksvalidator was not found, install pykickstart
8 : The default password used by the sample templates for newly installed machines (default_password_crypted in /etc/cobbler/settings) is still set to 'cobbler' and should be changed, try: "openssl passwd -1 -salt 'random-phrase-here' 'your-password-here'" to generate new one
9 : fencing tools were not found, and are required to use the (optional) power management features. install cman or fence-agents to use them
Restart cobblerd and then run 'cobbler sync' to apply changes.
#生成新密碼，默認(rèn)安裝好的系統(tǒng)root密碼為cobbler
[root@centos7 ~]# openssl passwd -1 '123456'
$1$CTGcyJOY$tQBZAZdaYCapXzgwYUWje1
#根據(jù)以上提示，只需要做1，2，8這三項即可，修改下面四行
[root@centos7 ~]# vim /etc/cobbler/settings
default_password_crypted: "$1$CTGcyJOY$tQBZAZdaYCapXzgwYUWje1"
next_server：< tftp服務(wù)器的 IP 地址>
server：<cobbler服務(wù)器的 IP 地址>
manage_dhcp：1 #設(shè)置為1，表示通過cobbler生成dhcpd.conf配置文件
#3 實現(xiàn)dhcp服務(wù)
[root@centos7 ~]# systemctl restart cobblerd.service
[root@centos7 ~]# vim /etc/cobbler/dhcp.template
#修改下面部分內(nèi)容
subnet 10.0.0.0 netmask 255.255.255.0 {
option routers 10.0.0.2;
option domain-name-servers 180.76.76.76,223.6.6.6;
option subnet-mask 255.255.255.0;
range dynamic-bootp 10.0.0.50 10.0.0.100;
default-lease-time 21600;
max-lease-time 43200;
next-server $next_server;
[root@centos7 ~]# cobbler sync
[root@centos7 ~]# systemctl start dhcpd
#4 下載啟動的相關(guān)文件
[root@centos7 ~]# cobbler get-loaders
task started: 2021-03-21_044611_get_loaders
task started (id=Download Bootloader Content, time=Sun Mar 21 04:46:11 2021)
downloading https://cobbler.github.io/loaders/README to /var/lib/cobbler/loaders/README
downloading https://cobbler.github.io/loaders/COPYING.elilo to /var/lib/cobbler/loaders/COPYING.elilo
downloading https://cobbler.github.io/loaders/COPYING.yaboot to /var/lib/cobbler/loaders/COPYING.yaboot
downloading https://cobbler.github.io/loaders/COPYING.syslinux to /var/lib/cobbler/loaders/COPYING.syslinux
downloading https://cobbler.github.io/loaders/elilo-3.8-ia64.efi to /var/lib/cobbler/loaders/elilo-ia64.efi
downloading https://cobbler.github.io/loaders/yaboot-1.3.17 to /var/lib/cobbler/loaders/yaboot
downloading https://cobbler.github.io/loaders/pxelinux.0-3.86 to /var/lib/cobbler/loaders/pxelinux.0
downloading https://cobbler.github.io/loaders/menu.c32-3.86 to /var/lib/cobbler/loaders/menu.c32
downloading https://cobbler.github.io/loaders/grub-0.97-x86.efi to /var/lib/cobbler/loaders/grub-x86.efi
downloading https://cobbler.github.io/loaders/grub-0.97-x86_64.efi to /var/lib/cobbler/loaders/grub-x86_64.efi
*** TASK COMPLETE ***
[root@centos7 ~]# ls /var/lib/cobbler/loaders/
COPYING.elilo COPYING.yaboot grub-x86_64.efi menu.c32 README
COPYING.syslinux elilo-ia64.efi grub-x86.efi pxelinux.0 yaboot
[root@centos7 ~]# tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
│ └── grub
│ └── menu.lst
├── etc
├── grub
│ ├── efidefault
│ └── images -> ../images
├── images
├── images2
├── memdisk
├── menu.c32
├── ppc
├── pxelinux.0
├── pxelinux.cfg
│ └── default
└── s390x
└── profile_list
10 directories, 7 files
[root@centos7 ~]# cobbler sync
task started: 2021-03-21_045123_sync
task started (id=Sync, time=Sun Mar 21 04:51:23 2021)
running pre-sync triggers
cleaning trees
removing: /var/lib/tftpboot/pxelinux.cfg/default
removing: /var/lib/tftpboot/grub/images
removing: /var/lib/tftpboot/grub/efidefault
removing: /var/lib/tftpboot/s390x/profile_list
copying bootloaders
trying hardlink /var/lib/cobbler/loaders/pxelinux.0 -> /var/lib/tftpboot/pxelinux.0
copying: /var/lib/cobbler/loaders/pxelinux.0 -> /var/lib/tftpboot/pxelinux.0
trying hardlink /var/lib/cobbler/loaders/menu.c32 -> /var/lib/tftpboot/menu.c32
copying: /var/lib/cobbler/loaders/menu.c32 -> /var/lib/tftpboot/menu.c32
trying hardlink /var/lib/cobbler/loaders/yaboot -> /var/lib/tftpboot/yaboot
trying hardlink /var/lib/cobbler/loaders/grub-x86.efi -> /var/lib/tftpboot/grub/grub-x86.efi
trying hardlink /var/lib/cobbler/loaders/grub-x86_64.efi -> /var/lib/tftpboot/grub/grub-x86_64.efi
copying distros to tftpboot
copying images
generating PXE configuration files
generating PXE menu structure
rendering DHCP files
generating /etc/dhcp/dhcpd.conf
rendering TFTPD files
generating /etc/xinetd.d/tftp
cleaning link caches
running post-sync triggers
running python triggers from /var/lib/cobbler/triggers/sync/post/*
running python trigger cobbler.modules.sync_post_restart_services
running: dhcpd -t -q
received on stdout:
received on stderr:
running: service dhcpd restart
received on stdout:
received on stderr: Redirecting to /bin/systemctl restart dhcpd.service
running shell triggers from /var/lib/cobbler/triggers/sync/post/*
running python triggers from /var/lib/cobbler/triggers/change/*
running python trigger cobbler.modules.manage_genders
running python trigger cobbler.modules.scm_track
running shell triggers from /var/lib/cobbler/triggers/change/*
*** TASK COMPLETE ***
[root@centos7 ~]# tree /var/lib/tftpboot/
/var/lib/tftpboot/
├── boot
│ └── grub
│ └── menu.lst
├── etc
├── grub
│ ├── efidefault
│ ├── grub-x86_64.efi
│ ├── grub-x86.efi
│ └── images -> ../images
├── images
├── images2
├── memdisk
├── menu.c32
├── ppc
├── pxelinux.0
├── pxelinux.cfg
│ └── default
├── s390x
│ └── profile_list
└── yaboot
10 directories, 10 files
#5 修改菜單的標(biāo)題信息
[root@centos7 ~]#vim /etc/cobbler/pxe/pxedefault.template
MENU TITLE Cobbler | http://www.magedu.com/
[root@centos7 ~]#cobbler sync
[root@centos7 ~]#cat /var/lib/tftpboot/pxelinux.cfg/default
DEFAULT menu
PROMPT 0
MENU TITLE Cobbler | http://www.magedu.com/ #默認(rèn)為：http://cobbler.github.io/
TIMEOUT 200
TOTALTIMEOUT 6000
ONTIMEOUT local
LABEL local
MENU LABEL (local)
MENU DEFAULT
LOCALBOOT -1
MENU end
[root@centos7 ~]#cobbler sync
#6 導(dǎo)入CentOS系統(tǒng)的安裝文件，生成相應(yīng)的YUM源
[root@centos7 ~]# mkdir /mnt/centos7
[root@centos7 ~]# mount /dev/sr0 /mnt/centos7
mount: /dev/sr0 is write-protected, mounting read-only
[root@centos7 ~]# cobbler import --name=centos-7.7-x86_64 --path=/mnt/centos7 --arch=x86_64
task started: 2021-03-21_053827_import
task started (id=Media import, time=Sun Mar 21 05:38:27 2021)
Found a candidate signature: breed=redhat, version=rhel6
Found a candidate signature: breed=redhat, version=rhel7
Found a matching signature: breed=redhat, version=rhel7
Adding distros from path /var/www/cobbler/ks_mirror/centos-7.7-x86_64:
creating new distro: centos-7.7-x86_64
trying symlink: /var/www/cobbler/ks_mirror/centos-7.7-x86_64 -> /var/www/cobbler/links/centos-7.7-x86_64
creating new profile: centos-7.7-x86_64
associating repos
checking for rsync repo(s)
checking for rhn repo(s)
checking for yum repo(s)
starting descent into /var/www/cobbler/ks_mirror/centos-7.7-x86_64 for centos-7.7-x86_64
processing repo at : /var/www/cobbler/ks_mirror/centos-7.7-x86_64
need to process repo/comps: /var/www/cobbler/ks_mirror/centos-7.7-x86_64
looking for /var/www/cobbler/ks_mirror/centos-7.7-x86_64/repodata/*comps*.xml
Keeping repodata as-is :/var/www/cobbler/ks_mirror/centos-7.7-x86_64/repodata
*** TASK COMPLETE ***
[root@centos7 ~]# du -sh /var/www/cobbler/ks_mirror/*
4.5G /var/www/cobbler/ks_mirror/centos-7.7-x86_64
4.0K /var/www/cobbler/ks_mirror/config
[root@centos7 ~]# cobbler distro list
centos-7.7-x86_64
#默認(rèn)生成的是最小化安裝
