centos7最小化安装以后

Posted 2020-11-07

1、最小化安装centos 7.4
确认系统版本
cat /etc/redhat-release

确认系统内核信息
uname -a
Linux localhost 3.10.0-862.2.3.el7.x86_64 #1 SMP Wed May 9 18:05:47 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

2、配置网卡随机启动
[[email protected] ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="dhcp"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="no"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="ens33"
UUID="6fde7ed4-7be9-4e2f-adbe-755b4d174a04"
DEVICE="ens33"
ONBOOT="yes"

[[email protected] ~]# vim /etc/resolv.conf
search yourdomain
nameserver 114.114.114.114
nameserver 114.114.115.115

3、更新系统。并安装必要组件
[[email protected] ~]# yum update -y
[[email protected] ~]# reboot
[[email protected] ~]# yum install -y man make vim make gcc wget kernel-devel kernel-headers fuse fuse-libs net-tools
如果是在vmware虚拟机中还需要安装vmware tools，
[[email protected] ~]# yum install open-vm-tools (此处较之前源码编辑安装有较大的不同，源码安装vmware-tools方式官方不再推荐)
[[email protected] ~]# yum install -y lsof bridge-utils (这是两个和网络相关的工具包lsof brctl)
[[email protected] ~]# yum install -y usbutils pciutils sg3_utils (这是三个和硬件设备相关的工具包usb,scsi设备）
[[email protected] ~]# yum install -y powertop （这是电源管理的工具包）
[[email protected] ~]# yum install -y unzip bzip2 （安装bz2的解压缩支持）
[[email protected] ~]# yum install -y bind-utils (host、nslookup、dig等DNS工具)

配置epel源
[[email protected] ~]# yum install -y epel-release
[[email protected] ~]# yum update -y

4、更改系统参数
更改系统时区
[[email protected] ~]# cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
或者
[[email protected] ~]# ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
再或者
[[email protected] ~]# timedatectl set-timezone Asia/Shanghai
查看时间状态：
[[email protected] ~]# timedatectl status
Local time: Mon 2018-05-21 14:40:15 CST
Universal time: Mon 2018-05-21 06:40:15 UTC
RTC time: Mon 2018-05-21 06:40:15
Time zone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: no
DST active: n/a

设置 RTC in local TZ
[[email protected] ~]# timedatectl set-local-rtc 1
[[email protected] ~]# timedatectl status
Local time: Mon 2018-05-21 14:41:37 CST
Universal time: Mon 2018-05-21 06:41:37 UTC
RTC time: Mon 2018-05-21 14:41:37
Time zone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: yes
DST active: n/a

Warning: The system is configured to read the RTC time in the local time zone.
This mode can not be fully supported. It will create various problems
with time zone changes and daylight saving time adjustments. The RTC
time is never updated, it relies on external facilities to maintain it.
If at all possible, use RTC in UTC by calling
‘timedatectl set-local-rtc 0‘.

更改系统名称
hostnamectl set-hostname centos7
查看配置文件
cat /etc/hostname

查看host基本信息
[[email protected] ~]# hostnamectl status
Static hostname: centos7
Icon name: computer-vm
Chassis: vm
Machine ID: 7c394c36404b44d6aa78258caa290aa4
Boot ID: 38cd2eb7e7b34b149309fb17bc163e41
Virtualization: vmware
Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-862.2.3.el7.x86_64
Architecture: x86-64

同步系统时间
[[email protected] ~]# yum install -y ntp
[[email protected] ~]# systemctl enable ntpd
[[email protected] ~]# systemctl start ntpd
[[email protected] ~]# ntpdate -u ntp1.aliyun.com #生产环境能不用就不用这个命令，太暴力，有潜在的风险。

[[email protected] ~]# vim /etc/ntp.conf
添加
server ntp1.aliyun.com iburst

centos7系统最小化安装，已经默认安装了chronyd实践服务。
[[email protected] ~]# systemctl status chronyd
[[email protected] ~]# cat /etc/sysconfig/chrony.conf

chronyd还可以通过开启#keyfile /etc/chrony.keys参数来提升安全性。
[[email protected] ~]# cat /etc/chrony.keys

[[email protected] ~]# chronyc keygen 1 MD5
1 MD5 HEX:49A5459F8C08120E541D061BA14D9E060FC82B2C

chronyc keygen语法
chronyc keygen [id [type [bits]]]
id为1-N的整数
type为SHA1,MD5
bits为80-4096位，默认是160bits

修改系统语言
修改为中文
[[email protected] ~]# localectl set-locale LANG=zh_CN.UTF-8
修改为英文
[[email protected]centos7 ~]# localectl set-locale LANG=en_US.UTF-8

5、封装系统
删除网卡的UUID
#sed -i ‘/UUID/d‘ /etc/sysconfig/network-scripts/ifcfg.ens33

编辑/etc/sysctl.conf来配置内核参数
net.ipv4.ip_forward = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
vm.swappiness = 0
net.ipv4.neigh.default.gc_stale_time=120

配置ipv4参数
#see details in https://help.aliyun.com/knowledge_detail/39428.html
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.conf.all.arp_announce=2
#see details in https://help.aliyun.com/knowledge_detail/41334.html
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2

在文件尾部写入如下行来禁用ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

使配置生效
[[email protected] ~]# sysctl -p

Sealing a Linux Template
Templates that have been created for Linux virtual machines must be generalized (sealed) before use. This section describes how to seal a template before use. This ensures that machine-specific settings are not propagated through the template.
Login to the virtual machine to be used as a template and flag the system for re-configuration by running the following command as root:

[[email protected] ~]# touch /.unconfigured

Remove ssh host keys. Run:
[[email protected] ~]# rm -rf /etc/ssh/sshhost*

Shut down the virtual machine. Run:
[[email protected] ~]# poweroff
The Linux virtual machine has now been sealed, and can be used as a template for Linux virtual machines.

如果使用的是vmware虚拟机，可以对此机器创建一个快照，
以后有新业务需要用到centos系统时，只需要右键此虚拟机依次选择->管理->克隆->选择已有的快照->选择创建连接克隆->配置克隆的虚拟机名称
点击完成即可快速生成一个新的Vmware虚拟机，开机即可使用。

附录1：使用阿里云的yum库（外部貌似不可用，需要在阿里云的ECS上使用）
CentOS
1、备份
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
2、下载新的CentOS-Base.repo 到/etc/yum.repos.d/
CentOS 5
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-5.repo
或者
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-5.repo
CentOS 6
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
或者
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
CentOS 7
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
或者
curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
3、之后运行yum makecache生成缓存

##epel 配置方法
###1、备份(如有配置其他epel源)
mv /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.backup
mv /etc/yum.repos.d/epel-testing.repo /etc/yum.repos.d/epel-testing.repo.backup
2、下载新repo 到/etc/yum.repos.d/
epel(RHEL 7)
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
epel(RHEL 6)
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo
epel(RHEL 5)
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-5.repo

附录2：
配置网卡随机启动
[[email protected] ~]# sed -i ‘s/ONBOOT="no"/ONBOOT="yes"/g‘ /etc/sysconfig/network-scripts/ifcfg-ens33

变更网卡参数，由dhcp改为static手动配置：
[[email protected] ~]# sed -i ‘s/BOOTPROTO="dhcp"/BOOTPROTO="static"/g‘ /etc/sysconfig/network-scripts/ifcfg-ens33
更暴力一点
[[email protected] ~]# sed -i ‘s/dhcp/static/g‘ /etc/sysconfig/network-scripts/ifcfg-*

写入静态IP参数
[[email protected] ~]# cat << EOF >> /etc/sysconfig/network-scripts/ifcfg-ens33

IPADDR=192.168.230.200
NETMASK=255.255.255.0
GATEWAY=192.168.230.2
DNS1=114.114.114.114
DNS2=114.114.115.115
EOF

删除网卡的UUID
#sed -i ‘/UUID/d‘ /etc/sysconfig/network-scripts/ifcfg.ens33