Initial commit
This commit is contained in:
commit
61c054b090
GPG Key ID:
DCDF010D946438C1
|
|
@ -0,0 +1,90 @@
|
|||
# This is a minimal Rocky kickstart designed for docker.
|
||||
# It will not produce a bootable system
|
||||
# To use this kickstart, run the following command
|
||||
# livemedia-creator --make-tar \
|
||||
# --iso=/path/to/boot.iso \
|
||||
# --ks=rocky-8.ks \
|
||||
# --image-name=rocky-root.tar.xz
|
||||
#
|
||||
|
||||
# Basic setup information
|
||||
text
|
||||
keyboard us
|
||||
rootpw --lock --iscrypted locked
|
||||
timezone --isUtc --nontp UTC
|
||||
selinux --enforcing
|
||||
firewall --disabled
|
||||
network --bootproto=dhcp --device=link --activate --onboot=on
|
||||
shutdown
|
||||
bootloader --disable
|
||||
lang en_US.UTF-8
|
||||
|
||||
|
||||
# Disk setup
|
||||
zerombr
|
||||
clearpart --all --initlabel
|
||||
autopart --noboot --nohome --noswap --nolvm --fstype=ext4
|
||||
|
||||
# Package setup
|
||||
%packages --excludedocs --instLangs=en --nocore --excludeWeakdeps
|
||||
rocky-release
|
||||
binutils
|
||||
-brotli
|
||||
bash
|
||||
hostname
|
||||
rootfiles
|
||||
coreutils-single
|
||||
glibc-minimal-langpack
|
||||
vim-minimal
|
||||
less
|
||||
-gettext*
|
||||
-firewalld
|
||||
-os-prober*
|
||||
tar
|
||||
-iptables
|
||||
iputils
|
||||
-kernel
|
||||
-dosfstools
|
||||
-e2fsprogs
|
||||
-fuse-libs
|
||||
-gnupg2-smime
|
||||
-libss
|
||||
-pinentry
|
||||
-shared-mime-info
|
||||
-trousers
|
||||
-xkeyboard-config
|
||||
-xfsprogs
|
||||
-qemu-guest-agent
|
||||
yum
|
||||
-grub\*
|
||||
|
||||
%end
|
||||
|
||||
%post --erroronfail --log=/root/anaconda-post.log
|
||||
# container customizations inside the chroot
|
||||
|
||||
echo 'container' > /etc/dnf/vars/infra
|
||||
|
||||
#Generate installtime file record
|
||||
/bin/date +%Y%m%d_%H%M > /etc/BUILDTIME
|
||||
|
||||
# Limit languages to help reduce size.
|
||||
LANG="en_US"
|
||||
echo "%_install_langs $LANG" > /etc/rpm/macros.image-language-conf
|
||||
|
||||
|
||||
# systemd fixes
|
||||
:> /etc/machine-id
|
||||
umount /run
|
||||
systemd-tmpfiles --create --boot
|
||||
# mask mounts and login bits
|
||||
systemctl mask systemd-logind.service getty.target console-getty.service sys-fs-fuse-connections.mount systemd-remount-fs.service dev-hugepages.mount
|
||||
|
||||
# Remove things we don't need
|
||||
rm -f /etc/udev/hwdb.bin
|
||||
rm -rf /usr/lib/udev/hwdb.d/
|
||||
rm -rf /boot
|
||||
rm -rf /var/lib/dnf/history.*
|
||||
|
||||
|
||||
%end
|
||||
|
|
@ -0,0 +1,221 @@
|
|||
text
|
||||
auth --enableshadow --passalgo=sha512
|
||||
shutdown
|
||||
firewall --enabled --service=ssh
|
||||
firstboot --disable
|
||||
keyboard us
|
||||
# System language
|
||||
lang en_US.UTF-8
|
||||
# Network information
|
||||
network --bootproto=dhcp --device=link --activate --onboot=on
|
||||
network --hostname=localhost.localdomain
|
||||
# Root password
|
||||
rootpw --iscrypted thereisnopasswordanditslocked
|
||||
selinux --enforcing
|
||||
services --disabled="kdump" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd"
|
||||
timezone UTC --isUtc
|
||||
# Disk
|
||||
bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0 nvme_core.io_timeout=4294967295 nvme_core.max_retries=10" --location=mbr --timeout=1 --boot-drive=vda
|
||||
zerombr
|
||||
clearpart --all --initlabel
|
||||
reqpart
|
||||
part / --fstype="xfs" --ondisk=vda --size=7950
|
||||
|
||||
%pre --erroronfail
|
||||
/usr/sbin/parted -s /dev/vda mklabel gpt
|
||||
%end
|
||||
|
||||
%post --erroronfail
|
||||
passwd -d root
|
||||
passwd -l root
|
||||
|
||||
# pvgrub support
|
||||
echo -n "Creating grub.conf for pvgrub"
|
||||
rootuuid=$( awk '$2=="/" { print $1 };' /etc/fstab )
|
||||
mkdir /boot/grub
|
||||
echo -e 'default=0\ntimeout=0\n\n' > /boot/grub/grub.conf
|
||||
for kv in $( ls -1v /boot/vmlinuz* |grep -v rescue |sed s/.*vmlinuz-// ); do
|
||||
echo "title Rocky Linux 8 ($kv)" >> /boot/grub/grub.conf
|
||||
echo -e "\troot (hd0)" >> /boot/grub/grub.conf
|
||||
echo -e "\tkernel /boot/vmlinuz-$kv ro root=$rootuuid console=hvc0 LANG=en_US.UTF-8" >> /boot/grub/grub.conf
|
||||
echo -e "\tinitrd /boot/initramfs-$kv.img" >> /boot/grub/grub.conf
|
||||
echo
|
||||
done
|
||||
ln -sf grub.conf /boot/grub/menu.lst
|
||||
ln -sf /boot/grub/grub.conf /etc/grub.conf
|
||||
|
||||
# setup systemd to boot to the right runlevel
|
||||
rm -f /etc/systemd/system/default.target
|
||||
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
|
||||
echo .
|
||||
|
||||
dnf -C -y remove linux-firmware
|
||||
|
||||
# Remove firewalld; it is required to be present for install/image building.
|
||||
# but we dont ship it in cloud
|
||||
dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1"
|
||||
dnf -C -y remove avahi\*
|
||||
sed -i '/^#NAutoVTs=.*/ a\
|
||||
NAutoVTs=0' /etc/systemd/logind.conf
|
||||
|
||||
cat > /etc/sysconfig/network << EOF
|
||||
NETWORKING=yes
|
||||
NOZEROCONF=yes
|
||||
EOF
|
||||
|
||||
# For cloud images, 'eth0' _is_ the predictable device name, since
|
||||
# we don't want to be tied to specific virtual (!) hardware
|
||||
rm -f /etc/udev/rules.d/70*
|
||||
ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules
|
||||
|
||||
# simple eth0 config, again not hard-coded to the build hardware
|
||||
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
|
||||
DEVICE="eth0"
|
||||
BOOTPROTO="dhcp"
|
||||
ONBOOT="yes"
|
||||
TYPE="Ethernet"
|
||||
USERCTL="yes"
|
||||
PEERDNS="yes"
|
||||
IPV6INIT="no"
|
||||
PERSISTENT_DHCLIENT="1"
|
||||
EOF
|
||||
|
||||
echo "virtual-guest" > /etc/tuned/active_profile
|
||||
|
||||
# generic localhost names
|
||||
cat > /etc/hosts << EOF
|
||||
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||
|
||||
EOF
|
||||
echo .
|
||||
|
||||
systemctl mask tmp.mount
|
||||
|
||||
cat <<EOL > /etc/sysconfig/kernel
|
||||
# UPDATEDEFAULT specifies if new-kernel-pkg should make
|
||||
# new kernels the default
|
||||
UPDATEDEFAULT=yes
|
||||
|
||||
# DEFAULTKERNEL specifies the default kernel package type
|
||||
DEFAULTKERNEL=kernel
|
||||
EOL
|
||||
|
||||
# make sure firstboot doesn't start
|
||||
echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot
|
||||
|
||||
# rocky cloud user
|
||||
echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers
|
||||
sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg
|
||||
|
||||
dnf clean all
|
||||
|
||||
# XXX instance type markers - MUST match Rocky Infra expectation
|
||||
echo 'ec2' > /etc/yum/vars/infra
|
||||
|
||||
# change dhcp client retry/timeouts to resolve #6866
|
||||
cat >> /etc/dhcp/dhclient.conf << EOF
|
||||
|
||||
timeout 300;
|
||||
retry 60;
|
||||
EOF
|
||||
|
||||
|
||||
rm -rf /var/log/yum.log
|
||||
rm -rf /var/lib/yum/*
|
||||
rm -rf /root/install.log
|
||||
rm -rf /root/install.log.syslog
|
||||
rm -rf /root/anaconda-ks.cfg
|
||||
rm -rf /var/log/anaconda*
|
||||
|
||||
rm -f /var/lib/systemd/random-seed
|
||||
|
||||
cat /dev/null > /etc/machine-id
|
||||
|
||||
echo "Fixing SELinux contexts."
|
||||
touch /var/log/cron
|
||||
touch /var/log/boot.log
|
||||
mkdir -p /var/cache/yum
|
||||
/usr/sbin/fixfiles -R -a restore
|
||||
|
||||
# remove these for ec2 debugging
|
||||
sed -i -e 's/ rhgb quiet//' /boot/grub/grub.conf
|
||||
|
||||
cat > /etc/modprobe.d/blacklist-nouveau.conf << EOL
|
||||
blacklist nouveau
|
||||
EOL
|
||||
|
||||
# enable resizing on copied AMIs
|
||||
echo 'install_items+=" sgdisk "' > /etc/dracut.conf.d/sgdisk.conf
|
||||
|
||||
echo 'add_drivers+="xen-netfront xen-blkfront "' > /etc/dracut.conf.d/xen.conf
|
||||
# Rerun dracut for the installed kernel (not the running kernel):
|
||||
KERNEL_VERSION=$(rpm -q kernel --qf '%{V}-%{R}.%{arch}\n')
|
||||
dracut -f /boot/initramfs-$KERNEL_VERSION.img $KERNEL_VERSION
|
||||
|
||||
|
||||
# reorder console entries
|
||||
sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg
|
||||
|
||||
true
|
||||
|
||||
%end
|
||||
|
||||
%packages
|
||||
@core
|
||||
chrony
|
||||
dnf
|
||||
yum
|
||||
cloud-init
|
||||
cloud-utils-growpart
|
||||
NetworkManager
|
||||
dracut-config-generic
|
||||
dracut-norescue
|
||||
firewalld
|
||||
gdisk
|
||||
grub2
|
||||
kernel
|
||||
nfs-utils
|
||||
rsync
|
||||
tar
|
||||
dnf-utils
|
||||
yum-utils
|
||||
-aic94xx-firmware
|
||||
-alsa-firmware
|
||||
-alsa-lib
|
||||
-alsa-tools-firmware
|
||||
-ivtv-firmware
|
||||
-iwl100-firmware
|
||||
-iwl1000-firmware
|
||||
-iwl105-firmware
|
||||
-iwl135-firmware
|
||||
-iwl2000-firmware
|
||||
-iwl2030-firmware
|
||||
-iwl3160-firmware
|
||||
-iwl3945-firmware
|
||||
-iwl4965-firmware
|
||||
-iwl5000-firmware
|
||||
-iwl5150-firmware
|
||||
-iwl6000-firmware
|
||||
-iwl6000g2a-firmware
|
||||
-iwl6000g2b-firmware
|
||||
-iwl6050-firmware
|
||||
-iwl7260-firmware
|
||||
-libertas-sd8686-firmware
|
||||
-libertas-sd8787-firmware
|
||||
-libertas-usb8388-firmware
|
||||
-biosdevname
|
||||
-iprutils
|
||||
-plymouth
|
||||
|
||||
python3-jsonschema
|
||||
qemu-guest-agent
|
||||
dhcp-client
|
||||
cockpit-ws
|
||||
cockpit-system
|
||||
-langpacks-*
|
||||
-langpacks-en
|
||||
|
||||
rocky-release
|
||||
rng-tools
|
||||
%end
|
||||
|
|
@ -0,0 +1,205 @@
|
|||
text
|
||||
auth --enableshadow --passalgo=sha512
|
||||
shutdown
|
||||
firewall --enabled --service=ssh
|
||||
firstboot --disable
|
||||
ignoredisk --only-use=vda
|
||||
keyboard us
|
||||
# System language
|
||||
lang en_US.UTF-8
|
||||
# Network information
|
||||
network --bootproto=dhcp --device=link --activate --onboot=on
|
||||
network --hostname=localhost.localdomain
|
||||
# Root password
|
||||
rootpw --iscrypted thereisnopasswordanditslocked
|
||||
selinux --enforcing
|
||||
services --disabled="kdump" --enabled="NetworkManager,sshd,rsyslog,chronyd,cloud-init,cloud-init-local,cloud-config,cloud-final,rngd"
|
||||
timezone UTC --isUtc
|
||||
# Disk
|
||||
bootloader --append="console=ttyS0,115200n8 no_timer_check crashkernel=auto net.ifnames=0" --location=mbr --timeout=1 --boot-drive=vda
|
||||
zerombr
|
||||
clearpart --all --initlabel
|
||||
reqpart
|
||||
part / --fstype="xfs" --ondisk=vda --size=8000
|
||||
|
||||
%post --erroronfail
|
||||
passwd -d root
|
||||
passwd -l root
|
||||
|
||||
# pvgrub support
|
||||
echo -n "Creating grub.conf for pvgrub"
|
||||
rootuuid=$( awk '$2=="/" { print $1 };' /etc/fstab )
|
||||
mkdir /boot/grub
|
||||
echo -e 'default=0\ntimeout=0\n\n' > /boot/grub/grub.conf
|
||||
for kv in $( ls -1v /boot/vmlinuz* |grep -v rescue |sed s/.*vmlinuz-// ); do
|
||||
echo "title Rocky Linux 8 ($kv)" >> /boot/grub/grub.conf
|
||||
echo -e "\troot (hd0)" >> /boot/grub/grub.conf
|
||||
echo -e "\tkernel /boot/vmlinuz-$kv ro root=$rootuuid console=hvc0 LANG=en_US.UTF-8" >> /boot/grub/grub.conf
|
||||
echo -e "\tinitrd /boot/initramfs-$kv.img" >> /boot/grub/grub.conf
|
||||
echo
|
||||
done
|
||||
ln -sf grub.conf /boot/grub/menu.lst
|
||||
ln -sf /boot/grub/grub.conf /etc/grub.conf
|
||||
|
||||
# setup systemd to boot to the right runlevel
|
||||
rm -f /etc/systemd/system/default.target
|
||||
ln -s /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
|
||||
echo .
|
||||
|
||||
dnf -C -y remove linux-firmware
|
||||
|
||||
# Remove firewalld; it is required to be present for install/image building.
|
||||
# but we dont ship it in cloud
|
||||
dnf -C -y remove firewalld --setopt="clean_requirements_on_remove=1"
|
||||
dnf -C -y remove avahi\*
|
||||
sed -i '/^#NAutoVTs=.*/ a\
|
||||
NAutoVTs=0' /etc/systemd/logind.conf
|
||||
|
||||
cat > /etc/sysconfig/network << EOF
|
||||
NETWORKING=yes
|
||||
NOZEROCONF=yes
|
||||
EOF
|
||||
|
||||
# Remove build-time resolvers to fix #16948
|
||||
echo > /etc/resolv.conf
|
||||
|
||||
# For cloud images, 'eth0' _is_ the predictable device name, since
|
||||
# we don't want to be tied to specific virtual (!) hardware
|
||||
rm -f /etc/udev/rules.d/70*
|
||||
ln -s /dev/null /etc/udev/rules.d/80-net-name-slot.rules
|
||||
|
||||
# simple eth0 config, again not hard-coded to the build hardware
|
||||
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
|
||||
DEVICE="eth0"
|
||||
BOOTPROTO="dhcp"
|
||||
ONBOOT="yes"
|
||||
TYPE="Ethernet"
|
||||
USERCTL="yes"
|
||||
PEERDNS="yes"
|
||||
IPV6INIT="no"
|
||||
PERSISTENT_DHCLIENT="1"
|
||||
EOF
|
||||
|
||||
echo "virtual-guest" > /etc/tuned/active_profile
|
||||
|
||||
# generic localhost names
|
||||
cat > /etc/hosts << EOF
|
||||
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
|
||||
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
|
||||
|
||||
EOF
|
||||
echo .
|
||||
|
||||
systemctl mask tmp.mount
|
||||
|
||||
cat <<EOL > /etc/sysconfig/kernel
|
||||
# UPDATEDEFAULT specifies if new-kernel-pkg should make
|
||||
# new kernels the default
|
||||
UPDATEDEFAULT=yes
|
||||
|
||||
# DEFAULTKERNEL specifies the default kernel package type
|
||||
DEFAULTKERNEL=kernel
|
||||
EOL
|
||||
|
||||
# make sure firstboot doesn't start
|
||||
echo "RUN_FIRSTBOOT=NO" > /etc/sysconfig/firstboot
|
||||
|
||||
# rocky cloud user
|
||||
echo -e 'rocky\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers
|
||||
sed -i 's/name: cloud-user/name: rocky/g' /etc/cloud/cloud.cfg
|
||||
|
||||
dnf clean all
|
||||
|
||||
# XXX instance type markers - MUST match Rocky Infra expectation
|
||||
echo 'genclo' > /etc/yum/vars/infra
|
||||
|
||||
# change dhcp client retry/timeouts to resolve #6866
|
||||
cat >> /etc/dhcp/dhclient.conf << EOF
|
||||
|
||||
timeout 300;
|
||||
retry 60;
|
||||
EOF
|
||||
|
||||
|
||||
rm -rf /var/log/yum.log
|
||||
rm -rf /var/lib/yum/*
|
||||
rm -rf /root/install.log
|
||||
rm -rf /root/install.log.syslog
|
||||
rm -rf /root/anaconda-ks.cfg
|
||||
rm -rf /var/log/anaconda*
|
||||
|
||||
rm -f /var/lib/systemd/random-seed
|
||||
|
||||
cat /dev/null > /etc/machine-id
|
||||
|
||||
echo "Fixing SELinux contexts."
|
||||
touch /var/log/cron
|
||||
touch /var/log/boot.log
|
||||
mkdir -p /var/cache/yum
|
||||
/usr/sbin/fixfiles -R -a restore
|
||||
|
||||
# reorder console entries
|
||||
sed -i 's/console=tty0/console=tty0 console=ttyS0,115200n8/' /boot/grub2/grub.cfg
|
||||
|
||||
true
|
||||
|
||||
%end
|
||||
|
||||
%packages
|
||||
@core
|
||||
chrony
|
||||
dnf
|
||||
yum
|
||||
cloud-init
|
||||
cloud-utils-growpart
|
||||
NetworkManager
|
||||
dracut-config-generic
|
||||
dracut-norescue
|
||||
firewalld
|
||||
gdisk
|
||||
grub2
|
||||
kernel
|
||||
nfs-utils
|
||||
rsync
|
||||
tar
|
||||
dnf-utils
|
||||
yum-utils
|
||||
-aic94xx-firmware
|
||||
-alsa-firmware
|
||||
-alsa-lib
|
||||
-alsa-tools-firmware
|
||||
-ivtv-firmware
|
||||
-iwl100-firmware
|
||||
-iwl1000-firmware
|
||||
-iwl105-firmware
|
||||
-iwl135-firmware
|
||||
-iwl2000-firmware
|
||||
-iwl2030-firmware
|
||||
-iwl3160-firmware
|
||||
-iwl3945-firmware
|
||||
-iwl4965-firmware
|
||||
-iwl5000-firmware
|
||||
-iwl5150-firmware
|
||||
-iwl6000-firmware
|
||||
-iwl6000g2a-firmware
|
||||
-iwl6000g2b-firmware
|
||||
-iwl6050-firmware
|
||||
-iwl7260-firmware
|
||||
-libertas-sd8686-firmware
|
||||
-libertas-sd8787-firmware
|
||||
-libertas-usb8388-firmware
|
||||
-biosdevname
|
||||
-iprutils
|
||||
-plymouth
|
||||
|
||||
python3-jsonschema
|
||||
qemu-guest-agent
|
||||
dhcp-client
|
||||
cockpit-ws
|
||||
cockpit-system
|
||||
-langpacks-*
|
||||
-langpacks-en
|
||||
|
||||
rocky-release
|
||||
rng-tools
|
||||
%end
|
||||
|
|
@ -0,0 +1,154 @@
|
|||
#url --mirrorlist=http://mirrors.rockylinux.org/mirrorlist?release=8&arch=x86_64&repo=BaseOS-8
|
||||
#repo --name=AppStream --mirrorlist=http://mirrors.rockylinux.org/mirrorlist?release=8&arch=x86_64&repo=AppStream-8
|
||||
text
|
||||
keyboard --vckeymap us
|
||||
lang en_US
|
||||
skipx
|
||||
network --bootproto=dhcp --device=link --activate --onboot=on
|
||||
rootpw --plaintext vagrant
|
||||
firewall --disabled
|
||||
timezone --utc UTC
|
||||
services --enabled=vmtoolsd
|
||||
# The biosdevname and ifnames options ensure we get "eth0" as our interface
|
||||
# even in environments like virtualbox that emulate a real NW card
|
||||
bootloader --timeout=1 --append="no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 elevator=noop"
|
||||
zerombr
|
||||
clearpart --all --drives=vda
|
||||
part / --fstype=xfs --asprimary --size=1024 --grow --ondisk=vda
|
||||
|
||||
user --name=vagrant --plaintext --password=vagrant
|
||||
|
||||
shutdown
|
||||
|
||||
%packages --instLangs=en
|
||||
bash-completion
|
||||
man-pages
|
||||
bzip2
|
||||
rsync
|
||||
nfs-utils
|
||||
cifs-utils
|
||||
chrony
|
||||
yum-utils
|
||||
hyperv-daemons
|
||||
open-vm-tools
|
||||
# Vagrant boxes aren't normally visible, no need for Plymouth
|
||||
-plymouth
|
||||
# Microcode updates cannot work in a VM
|
||||
-microcode_ctl
|
||||
# Firmware packages are not needed in a VM
|
||||
-iwl100-firmware
|
||||
-iwl1000-firmware
|
||||
-iwl105-firmware
|
||||
-iwl135-firmware
|
||||
-iwl2000-firmware
|
||||
-iwl2030-firmware
|
||||
-iwl3160-firmware
|
||||
-iwl3945-firmware
|
||||
-iwl4965-firmware
|
||||
-iwl5000-firmware
|
||||
-iwl5150-firmware
|
||||
-iwl6000-firmware
|
||||
-iwl6000g2a-firmware
|
||||
-iwl6050-firmware
|
||||
-iwl7260-firmware
|
||||
# Don't build rescue initramfs
|
||||
-dracut-config-rescue
|
||||
%end
|
||||
|
||||
# kdump needs to reserve 160MB + 2bits/4kB RAM, and automatic allocation only
|
||||
# works on systems with at least 2GB RAM (which excludes most Vagrant boxes)
|
||||
# CBS doesn't support %addon yet https://bugs.centos.org/view.php?id=12169
|
||||
%addon com_redhat_kdump --disable
|
||||
%end
|
||||
|
||||
%post
|
||||
# configure swap to a file
|
||||
fallocate -l 2G /swapfile
|
||||
chmod 600 /swapfile
|
||||
mkswap /swapfile
|
||||
echo "/swapfile none swap defaults 0 0" >> /etc/fstab
|
||||
|
||||
# sudo
|
||||
echo "%vagrant ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/vagrant
|
||||
chmod 0440 /etc/sudoers.d/vagrant
|
||||
|
||||
# Fix for https://github.com/CentOS/sig-cloud-instance-build/issues/38
|
||||
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 << EOF
|
||||
DEVICE="eth0"
|
||||
BOOTPROTO="dhcp"
|
||||
ONBOOT="yes"
|
||||
TYPE="Ethernet"
|
||||
PERSISTENT_DHCLIENT="yes"
|
||||
EOF
|
||||
|
||||
# sshd: disable password authentication and DNS checks
|
||||
ex -s /etc/ssh/sshd_config <<EOF
|
||||
:%substitute/^\(PasswordAuthentication\) yes$/\1 no/
|
||||
:%substitute/^#\(UseDNS\) yes$/&\r\1 no/
|
||||
:update
|
||||
:quit
|
||||
EOF
|
||||
cat >>/etc/sysconfig/sshd <<EOF
|
||||
|
||||
# Decrease connection time by preventing reverse DNS lookups
|
||||
# (see https://lists.centos.org/pipermail/centos-devel/2016-July/014981.html
|
||||
# and man sshd for more information)
|
||||
OPTIONS="-u0"
|
||||
EOF
|
||||
|
||||
# Default insecure vagrant key
|
||||
mkdir -m 0700 -p /home/vagrant/.ssh
|
||||
echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key" >> /home/vagrant/.ssh/authorized_keys
|
||||
chmod 600 /home/vagrant/.ssh/authorized_keys
|
||||
chown -R vagrant:vagrant /home/vagrant/.ssh
|
||||
|
||||
# Fix for issue #76, regular users can gain admin privileges via su
|
||||
ex -s /etc/pam.d/su <<'EOF'
|
||||
# allow vagrant to use su, but prevent others from becoming root or vagrant
|
||||
/^account\s\+sufficient\s\+pam_succeed_if.so uid = 0 use_uid quiet$/
|
||||
:append
|
||||
account [success=1 default=ignore] \\
|
||||
pam_succeed_if.so user = vagrant use_uid quiet
|
||||
account required pam_succeed_if.so user notin root:vagrant
|
||||
.
|
||||
:update
|
||||
:quit
|
||||
EOF
|
||||
|
||||
# systemd should generate a new machine id during the first boot, to
|
||||
# avoid having multiple Vagrant instances with the same id in the local
|
||||
# network. /etc/machine-id should be empty, but it must exist to prevent
|
||||
# boot errors (e.g. systemd-journald failing to start).
|
||||
:>/etc/machine-id
|
||||
|
||||
echo 'vag' > /etc/yum/vars/infra
|
||||
|
||||
# Blacklist the floppy module to avoid probing timeouts
|
||||
echo blacklist floppy > /etc/modprobe.d/nofloppy.conf
|
||||
chcon -u system_u -r object_r -t modules_conf_t /etc/modprobe.d/nofloppy.conf
|
||||
|
||||
# Customize the initramfs
|
||||
pushd /etc/dracut.conf.d
|
||||
# Enable VMware PVSCSI support for VMware Fusion guests.
|
||||
echo 'add_drivers+=" vmw_pvscsi "' > vmware-fusion-drivers.conf
|
||||
echo 'add_drivers+=" hv_netvsc hv_storvsc hv_utils hv_vmbus hid-hyperv "' > hyperv-drivers.conf
|
||||
# There's no floppy controller, but probing for it generates timeouts
|
||||
echo 'omit_drivers+=" floppy "' > nofloppy.conf
|
||||
popd
|
||||
# Fix the SELinux context of the new files
|
||||
restorecon -f - <<EOF
|
||||
/etc/sudoers.d/vagrant
|
||||
/etc/dracut.conf.d/vmware-fusion-drivers.conf
|
||||
/etc/dracut.conf.d/hyperv-drivers.conf
|
||||
/etc/dracut.conf.d/nofloppy.conf
|
||||
EOF
|
||||
|
||||
# Rerun dracut for the installed kernel (not the running kernel):
|
||||
KERNEL_VERSION=$(rpm -q kernel --qf '%{version}-%{release}.%{arch}\n')
|
||||
dracut -f /boot/initramfs-${KERNEL_VERSION}.img ${KERNEL_VERSION}
|
||||
|
||||
# Seal for deployment
|
||||
rm -rf /etc/ssh/ssh_host_*
|
||||
hostnamectl set-hostname localhost.localdomain
|
||||
rm -rf /etc/udev/rules.d/70-*
|
||||
%end
|
||||
Loading…
Reference in New Issue