Ben oui mais non (sinon trop facile).
Je monte un serveur d’install pour les linux debian squeeze/wheezy 32/64.
Je mets la machine à installer dans le même vlan que l’interface qui sert pour le pxe.
voila comment je fais :
Preseed qui demande uniquement la partitionnement
un script late command :
[code]#!/bin/bash
update cache, upgrade, install default packages
sed -i ‘s/debian/zenewone/g’ /etc/hosts
sed -i ‘s/debian/zenewone/g’ /etc/hostname
aptitude update
aptitude upgrade
aptitude install linux-headers-$(uname -r) make gcc grc vim telnet screen tcpdump less iproute ifenslave snmpd bzip2 curl htop rar nagios-nrpe-server firmware-linux firmware-linux-free firmware-linux-nonfree -y
download and install vmware tools
wget http://IP_Pxe/post/vmware.tar.gz -O /root/vmware.tar.gz
tar -xzvf /root/vmware.tar.gz -C /root/
perl /root/vmware-tools-distrib/vmware-install.pl -d
Configure default bashrc file
if [ -f “/root/.bashrc” ]; then
mv /root/.bashrc /root/.bashrc_old
fi
cat << EOF_BASHRC > /root/.bashrc
~/.bashrc: executed by bash(1) for non-login shells.
umask 022
alias rm='rm -i’
alias cp='cp -i’
alias mv=‘mv -i’
Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
EOF_BASHRC
Configure profile
if [ -f “/etc/profile” ] ; then
mv /etc/profile /etc/profile_old
fi
cat << EOF_PROFILE > /etc/profile
/etc/profile: system-wide .profile file for the Bourne shell (sh(1))
and Bourne compatible shells (bash(1), ksh(1), ash(1), …).
if [ “`id -u`” -eq 0 ]; then
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
else
PATH="/usr/local/bin:/usr/bin:/bin:/usr/games"
fi
if [ “$PS1” ]; then
if [ “$BASH” ]; then
PS1=’[\u@\h \W]# ‘
else
if [ “`id -u`” -eq 0 ]; then
PS1=’$ ‘
else
PS1=’# ‘
fi
fi
fi
ulimit -n 2048
eval `dircolors`
alias ls=‘ls --color=auto ‘;
alias ll=‘ls -l’;
alias dir=‘ls --color=auto --format=vertical’;
alias vdir=‘ls --color=auto --format=long’;
alias ols=’/bin/ls’;
if [ -x /usr/bin/grc ] ; then
alias cl=’/usr/bin/grc -es --colour=auto’
alias configure='cl ./configure’
alias diff='cl diff’
alias make='cl make’
alias gcc='cl gcc’
alias g++='cl g++'
alias as='cl as’
alias ld='cl ld’
alias netstat='cl netstat’
alias ping='cl ping’
alias tcpdump='cl tcpdump’
alias tail='cl tail’
fi
export PATH
EOF_PROFILE
Configure sshd file
if [ -f “/etc/ssh/sshd_config” ] ; then
cp /etc/ssh/sshd_config /etc/ssh/sshd_config_old
fi
cat << EOF_SSHD > /etc/ssh/sshd_config
SSHD configuration file
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
Banner /etc/issue.net
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost no
EOF_SSHD
if [ ! -d “/root/.ssh/” ] ; then
mkdir /root/.ssh/
fi
if [ -f “/root/.ssh/authorized_keys” ] ; then
mv /root/.ssh/authorized_keys /root/.ssh/authorized_keys_old
fi
cat << EOF_AUTHORIZED > /root/.ssh/authorized_keys
Clef1
Clef2
Clef3
EOF_AUTHORIZED
configure vim conf file
sed -i ‘s/"syntax on/syntax on/g’ /etc/vim/vimrc
if ! grep -E “noautoindent” /etc/vim/vimrc ; then
echo “set noautoindent” >> /etc/vim/vimrc
fi
if ! grep -E “hlsearch” /etc/vim/vimrc ; then
echo “set hlsearch” >> /etc/vim/vimrc
fi
compress logrotate archives
if [ -f “/etc/logrotate.conf” ]; then
sed -i ‘s/#compress/compress/g’ /etc/logrotate.conf
fi
#configure sysctl
if [ -f “/etc/sysctl.conf” ]; then
mv /etc/sysctl.conf /etc/sysctl.conf_
fi
cat << EOF_SYSCTL > /etc/sysctl.conf
sysctl.conf(5) for more details.
net.ipv4.icmp_echo_ignore_broadcasts = 1
Controls IP packet forwarding
net.ipv4.ip_forward = 0
Controls source route verification
net.ipv4.conf.default.rp_filter = 1
Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
kernel.panic = 7
Controls whether core dumps will append the PID to the core filename.
Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
The following line is necessary for GFS to function properly.
kernel.panic_on_oops = 1
kernel.shmmax = 2147483648
kernel.shmmni = 4096
kernel.shmall = 2097152
kernel.sem = 250 32000 100 128
fs.file-max = 65536
net.ipv4.ip_local_port_range = 1024 65000
#You do not need to adjust rmem_default or wmem_default (at least not for TCP tuning). These are the default buffer sizes for non-TCP sockets (e.g. unix domain sockets, UDP, etc).
increase Linux TCP buffer limits
net.core.rmem_default = 8388608
net.core.rmem_max = 8388608
net.core.wmem_default = 8388608
net.core.wmem_max = 8388608
increase Linux autotuning TCP buffer limits
net.ipv4.tcp_rmem = 4096 87380 8388608
net.ipv4.tcp_wmem = 4096 65536 8388608
net.ipv4.tcp_abort_on_overflow = 1
net.core.netdev_max_backlog=2500
net.ipv4.tcp_rfc1337=1
net.ipv4.tcp_syncookies=1
Decrease the time default value for tcp_fin_timeout connection
net.ipv4.tcp_fin_timeout = 15
Decrease the time default value for tcp_keepalive_time connection
net.ipv4.tcp_keepalive_time = 300
Increases the size of the socket queue (effectively, q0).
net.ipv4.tcp_max_syn_backlog = 512
Turn off the tcp_window_scaling
net.ipv4.tcp_window_scaling = 0
Turn off the tcp_sack
net.ipv4.tcp_sack = 0
Turn off the tcp_timestamps
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_max_orphans=2048
#vm.min_free_kbytes = 204800
#vm.lower_zone_protection = 1024
vm.page-cluster = 20
#vm.swappiness = 200
#vm.vm_vfs_scan_ratio = 2
vm.overcommit_memory = 1
vm.overcommit_ratio = 50
net.core.optmem_max = 10240
vm.overcommit_memory = 1
vm.overcommit_ratio = 50
net.core.optmem_max = 10240
Controls IP packet forwarding
net.ipv4.ip_forward = 1
net.ipv6.conf.all.autoconf=0
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.default.autoconf=0
net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
EOF_SYSCTL
blacklist ipv6
if [ -f “/etc/modprobe.d/blacklist.conf” ] ; then
cp /etc/modprobe.d/blacklist.conf /etc/modprobe.d/blacklist.conf_old
fi
echo “blacklist ipv6” >> /etc/modprobe.d/blacklist.conf
Cnfigure snmpd file
if [ -f “/etc/snmp/snmpd.conf” ] ; then
mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf_old
fi
cat << EOF_SNMPD > /etc/snmp/snmpd.conf
agentaddress 0.0.0.0:161
rocommunity public Ip_server_snmp
trapcommunity public
trapsink 127.0.0.1
syslocation Dedibox
EOF_SNMPD
Nrpe Configuration
if [ -f “/etc/nagios/nrpe.cfg” ] ; then
mv /etc/nagios/nrpe.cfg /etc/nagios/nrpe.cfg_old
fi
cat << EOF_NRPE > /etc/nagios/nrpe.cfg
cat << EOF_NRPE > /etc/nagios/nrpe.cfg
#log_facility=daemon
log_facility=daemon
pid_file=/var/run/nagios/nrpe.pid
server_port=5666
#server_address=127.0.0.1
nrpe_user=nagios
nrpe_group=nagios
allowed_hosts=Ip_servernrpe
dont_blame_nrpe=1
allow_nasty_meta_chars=1
command_prefix=/usr/bin/sudo
debug=0
command_timeout=60
#connection_timeout=300
#allow_weak_random_seed=1
#include=<somefile.cfg>
#include_dir=
#include_dir=
command[check_users]=/usr/lib/nagios/plugins/check_users -w 5 -c 10
command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$
command[check_hda1]=/usr/lib/nagios/plugins/check_disk -w 20% -c 10% -p /dev/hda1
command[check_zombie_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s Z
command[check_total_procs]=/usr/lib/nagios/plugins/check_procs -w 150 -c 200
command[check_swap]=/usr/lib/nagios/plugins/check_swap -w $ARG1$ -c $ARG2$
command[check_memory]=/usr/lib/nagios/plugins/check_memory -w $ARG1$ -c $ARG2$
command[check_mem]=/usr/lib/nagios/plugins/check_memory.pl $ARG1$
command[check_procs_ssh]=/usr/lib/nagios/plugins/check_procs -C sshd -w 1:20 -c 1:40
command[runaway_proc]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ --metric=CPU -v
command[check_procs_apache]=/usr/lib/nagios/plugins/check_procs -C apache2 -w $ARG1$ -c $ARG2$
command[check_procs_mysql]=/usr/lib/nagios/plugins/check_procs -C mysqld -w 1:20 -c 1:40
command[check_mysql_listener_local]=/usr/lib/nagios/plugins/check_tcp -H 127.0.0.1 -p 3306 -w 2 -c 5
command[check_disk_all]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -e -l -X tmpfs
command[check_apt]=/usr/lib/nagios/plugins/check_apt
command[check_yum]=/usr/lib/nagios/plugins/check_yum
command[check_deb_pkg]=/usr/lib/nagios/plugins/check_debian_packages --timeout=60
#command[check_users]=/usr/lib/nagios/plugins/check_users -w $ARG1$ -c $ARG2$
#command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$
#command[check_disk]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
#command[check_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
include=/etc/nagios/nrpe_local.cfg
include_dir=/etc/nagios/nrpe.d/
EOF_NRPE
debconf-set-selections <<< "postfix postfix/mailname string $(cat /etc/hostname)"
debconf-set-selections <<< "postfix postfix/main_mailer_type string ‘no configuration’"
aptitude install -y postfix
if [ -f “/etc/postfix/main.cf” ] ; then
mv /etc/postfix/main.cf /etc/postfix/main.cf_old
fi
cat << EOF_MAIN > /etc/postfix/main.cf
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
appending .domain is the MUA’s job.
append_dot_mydomain = no
Uncomment the next line to generate “delayed mail” warnings
#delay_warning_time = 4h
readme_directory = no
TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
information on enabling SSL in the smtp client.
myhostname = $(cat /etc/hostname)
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $(cat /etc/hostname), localhost.localdomain, localhost
relayhost = ip_server_mail
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
EOF_MAIN
if [ -f “/etc/aliases” ] ; then
mv /etc/aliases /etc/aliases_old
fi
cat << EOF_ALIAS > /etc/aliases
/etc/aliases
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root
root: noc@domaine.com
EOF_ALIAS
postalias /etc/aliases
if [ -f “/etc/motd” ] ; then
mv /etc/motd /etc/motd_old
fi
cat << EOF_MOTD > /etc/motd
######################################################################
######################################################################
######################################################################
Please change :
- network configuration
- root password
- server hostname
by invoking : /root/network_wheezy_amd64.sh
######################################################################
######################################################################
######################################################################
EOF_MOTD
wget http://ip_pxe/post/network_wheezy_amd64.sh -O /root/network_wheezy_amd64.sh
[/code]
et le second script à lancer une fois le serveur démarré :
[code]#!/bin/bash
OLD_HOSTNAME="$(hostname)"
echo "This is the actual hostname : $OLD_HOSTNAME"
echo "Please enter the new name :"
read NEW_HOSTNAME
echo "changing server name from $OLD_HOSTNAME to $NEW_HOSTNAME"
sleep 5
sed -i “s/$OLD_HOSTNAME/$NEW_HOSTNAME/g” /etc/hostname
sed -i “s/$OLD_HOSTNAME/$NEW_HOSTNAME/g” /etc/hosts
sed -i “s/$OLD_HOSTNAME/$NEW_HOSTNAME/g” /etc/postfix/main.cf
echo "###########################"
echo "Please enter the new password for root user :"
read NEW_ROOTPASS
echo -e “$NEW_ROOTPASS\n$NEW_ROOTPASS” | passwd -q
echo "###########################"
if [ -f “/etc/network/interfaces” ] ; then
mv /etc/network/interfaces /etc/network/interfaces_old
fi
echo "Enter the lasr octal value for the Ip : 192.168.1.XXX"
read NEW_IP
cat << EOF_NETWORKFILE > /etc/network/interfaces
auto lo
iface lo inet loopback
allow-hotplug eth0
iface eth0 inet static
address 192.168.1.$NEW_IP
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.254
EOF_NETWORKFILE
aptitude remove -y isc-dhcp-client isc-dhcp-common
aptitude purge -y isc-dhcp-client isc-dhcp-common
echo "##########################"
if [ -f “/etc/motd” ] ; then
mv /etc/motd /etc/motd_old
fi
cat << EOF_MOTD > /etc/motd
##################################################################
Privacy connection only
Only reserved to Tof
If you"re not, please disconnect
EOF_MOTD
shutdown -r now
[/code]
ça semble bien marché
