iaas-pre-host.sh脚本详解(iaas2.0.3)

#/bin/bash        #声明解释器路径
source /etc/openstack/openrc.sh        #读取并执行openrc.sh

#Welcome page
cat > /etc/motd <<EOF 
 ################################
 #    Welcome  to  OpenStack    #
 ################################
EOF
#以EOF作为输入结束，创建文件并输出内容
1
2
3
4
5
6
7
8
9
10

#selinux
sed -i 's/SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config        #设置SELINUX状态为disabled，永久关闭
setenforce 0        #立即生效
1
2
3

#firewalld（防火墙：通信内核）
systemctl stop firewalld        #关闭firewalld
systemctl disable firewalld  >> /dev/null 2>&1       
#关闭firewalld开机自启，执行命令产生的2及1丢进/dev/null空设备（垃圾桶）中
# 标准输出: 1
# 标准错误: 2
1
2
3
4
5
6

#NetworkManager（网络配置工具）
systemctl stop NetworkManager >> /dev/null 2>&1        #关闭工具
systemctl disable NetworkManager >> /dev/null 2>&1        #关闭自启
yum remove -y NetworkManager firewalld        #卸载NetworkManager和firewalld
systemctl restart network        #重启网络服务
1
2
3
4
5

#iptables（防火墙：修改内核）
yum install  iptables-services  -y        #安装服务
if [ 0  -ne  $? ]; then
    echo -e "\033[31mThe installation source configuration errors\033[0m"
    exit 1
fi
systemctl restart iptables        #重启服务
iptables -F        #清除所有规则
iptables -X        #删除自定义链
iptables -Z        #清空链的计数器
/usr/sbin/iptables-save
systemctl stop iptables        #关闭服务
systemctl disable iptables        #关闭自启
1
2
3
4
5
6
7
8
9
10
11
12
13

# install package （安装程序包）
sed -i -e 's/#UseDNS yes/UseDNS no/g' -e 's/GSSAPIAuthentication yes/GSSAPIAuthentication no/g' /etc/ssh/sshd_config

#修改sshd_config文件相关配置，禁用DNS解析、禁用基于 GSSAPI 的用户认证
#目的是提高ssh连接速度
1
2
3
4
5

yum upgrade -y        #升级所有包
yum install python-openstackclient openstack-selinux openstack-utils crudini expect lsof net-tools vim -y
#安装openstack命令行客户端等相关软件
1
2
3

#hosts （hosts文件）
if [[ `ip a |grep -w $HOST_IP ` != '' ]];then 
    hostnamectl set-hostname $HOST_NAME
elif [[ `ip a |grep -w $HOST_IP_NODE ` != '' ]];then 
    hostnamectl set-hostname $HOST_NAME_NODE
else
    hostnamectl set-hostname $HOST_NAME
fi
sed -i -e "/$HOST_NAME/d" -e "/$HOST_NAME_NODE/d" /etc/hosts
echo "$HOST_IP $HOST_NAME" >> /etc/hosts
echo "$HOST_IP_NODE $HOST_NAME_NODE" >> /etc/hosts

#配置主机名及主机名解析
1
2
3
4
5
6
7
8
9
10
11
12
13

#ssh （网络传输协议）
if [[ ! -s ~/.ssh/id_rsa.pub ]];then
    ssh-keygen  -t rsa -N '' -f ~/.ssh/id_rsa -q -b 2048
fi
name=`hostname`
if [[ $name == $HOST_NAME ]];then
expect -c "set timeout -1;
               spawn ssh-copy-id  -i /root/.ssh/id_rsa $HOST_NAME_NODE;
               expect {
                   *password:* {send -- $HOST_PASS_NODE\r;
                        expect {
                            *denied* {exit 2;}
                            eof}
                    }
                   *(yes/no)* {send -- yes\r;exp_continue;}
                   eof         {exit 1;}
               }
               "
else
expect -c "set timeout -1;
               spawn ssh-copy-id  -i /root/.ssh/id_rsa $HOST_NAME;
               expect {
                   *password:* {send -- $HOST_PASS\r;
                        expect {
                            *denied* {exit 2;}
                            eof}
                    }
                   *(yes/no)* {send -- yes\r;exp_continue;}
                   eof         {exit 1;}
               }
               "
fi

#生成本节点秘钥传输给其他ssh节点，实现免密登录
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#chrony （网络时间协议）
yum install -y chrony        #安装chrony
if [[ $name == $HOST_NAME ]];then
        sed -i '3,6s/^/#/g' /etc/chrony.conf
        sed -i '7s/^/server controller iburst/g' /etc/chrony.conf
        echo "allow $network_segment_IP" >> /etc/chrony.conf
        echo "local stratum 10" >> /etc/chrony.conf

#删除首项注释、设置controller为ntp服务器、开放同网段ip、允许本地网络访问

else
        sed -i '3,6s/^/#/g' /etc/chrony.conf
        sed -i '7s/^/server controller iburst/g' /etc/chrony.conf
fi

systemctl restart chronyd
systemctl enable chronyd

#目的是使用chrony软件实现ntp服务
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#DNS （域名解析器）
if [[ $name == $HOST_NAME ]];then
yum install bind -y
sed -i -e '13,14s/^/\/\//g' \
-e '19s/^/\/\//g' \
-e '37,42s/^/\/\//g' \
-e 's/recursion yes/recursion no/g' \
-e 's/dnssec-enable yes/dnssec-enable no/g' \
-e 's/dnssec-validation yes/dnssec-validation no/g' /etc/named.conf 

#关闭递归请求、关闭dnssec安全扩展、关闭dnssec验证

systemctl start named.service
systemctl enable named.service
fi

#使用bind软件实现DNS服务，目的是将域名解析为ip地址

printf "\033[35mPlease Reboot or Reconnect the terminal\n\033[0m"
#输出重启提示，重新读取配置内容，目的是更新配置环境
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20