batata.cfg

#
#  From: Miguel Filho <miguel.filho@gmail.com>
#
# kickstart Xen dom0 32 bit
bootloader --location=mbr
zerombr
cmdline
firewall --disabled
firstboot --disable
keyboard br-abnt2
lang en_US
reboot
url --url=http://mirrors.ic.unicamp.br/centos/5/os/i386
network --bootproto=static --device=eth0 --gateway=xxx --ip=xxx --nameserver=xxx --netmask=255.255.255.192 --onboot=on --hostname="xxxx"
rootpw xuxuxu
selinux --disabled
skipx
timezone --isUtc America/Sao_Paulo
install

clearpart --all 
part /boot --asprimary --fstype="ext3" --size=100
# change here!
part pv.01 --size=1 --grow --ondisk=hde
part pv.02 --size=1 --grow --ondisk=hdg
volgroup volumes pv.01 pv.02
logvol  /  --fstype="ext3" --vgname=volumes  --size=10240  --name=root --fsoptions="noatime,nodiratime"
logvol  /var  --fstype="ext3" --vgname=volumes  --size=6114  --name=var --fsoptions="noatime,nodiratime"
logvol  /tmp  --fstype="ext3" --vgname=volumes  --size=2048  --name=tmp --fsoptions="noatime,nodiratime"
logvol  swap --fstype swap  --vgname=volumes  --size=1024  --name=swap

%packages --nobase
-sysklogd
-selinux-policy-targeted
-selinux-policy
-gtk2
-ecryptfs-utils
-trousers
-avahi
xorg-x11-xauth
iptables
audit
autofs
nfs-utils
ntsysv
rsyslog
vixie-cron
crontabs
vim-enhanced
psacct
postfix
screen
man
nc
ntp
amanda-client
sudo
rsync
tcpdump
nmap
iptraf
lynx
wget
curl
strace
dstat
tcsh
quota
bind-utils
tmpwatch
krb5-workstation
pam_krb5
openldap-clients
nss_ldap
cyrus-sasl-gssapi
xen
kernel-xen

%post
chvt 3
(
echo "[+] Ajustando repositorios"
sed -i "/^#*mirrorlist=/d" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/^#baseurl=http:\/\/mirror.centos.org/baseurl=http:\/\/mirrors.ic.unicamp.br/" /etc/yum.repos.d/CentOS-Base.repo
sed -i "s/enabled=1/enabled=0/" /etc/yum/pluginconf.d/fastestmirror.conf

echo "[+] Atualizando pacotes"
yum clean all
yum -y update
yum clean packages

echo "[+] Configurando autenticacao"
authconfig  --enableldap --enableldapauth
--ldapserver="ldap://ldap1.xxx ldap://ldap2.xxx" \
--ldapbasedn="dc=xx,dc=xx,dc=br" --enablekrb5 --krb5realm=XX.XXXX.XX \
--krb5kdc="kerberos1.xxx kerberos2.xxx" \
--krb5adminserver=kerberos1.xxx --enableldaptls --update
echo "TLS_REQCERT never" >> /etc/openldap/ldap.conf

/usr/sbin/ntpdate -u xxx.xxx

echo "[+] Inserindo chaves do Kerberos"
echo -n "[-] Username: "
read username
echo -n "[-] Senha: "
modes=$(stty -g)
stty -echo
read password
stty $oldmodes

/usr/kerberos/sbin/kadmin -w $password -p $username -q 'addprinc -randkey
nfs/xxx'
/usr/kerberos/sbin/kadmin -w $password -p $username -q 'addprinc -randkey
ssh/xxx'
/usr/kerberos/sbin/kadmin -w $password -p $username -q 'addprinc -randkey
host/xxx'
/usr/kerberos/sbin/kadmin -w $password -p $username -q 'ktadd -e
des-cbc-crc:normal nfs/xxx'
/usr/kerberos/sbin/kadmin -w $password -p $username -q 'ktadd ssh/xxx'
/usr/kerberos/sbin/kadmin -w $password -p $username -q 'ktadd host/xxx'

echo "[+] Configurando autofs no LDAP"
cat > /etc/sysconfig/autofs <<EOF
SEARCH_BASE="ou=AutoMount,dc=ic,dc=unicamp,dc=br"
MAP_OBJECT_CLASS="automountMap"
ENTRY_OBJECT_CLASS="automount"
MAP_ATTRIBUTE="ou"
ENTRY_ATTRIBUTE="cn"
VALUE_ATTRIBUTE="automountInformation"
LOGGING="verbose"
EOF

cat > /etc/autofs_ldap_auth.conf <<EOF
<?xml version="1.0" ?>
<autofs_ldap_sasl_conf
        usetls="yes"
        tlsrequired="yes"
        authrequired="yes"
        authtype="ANONYMOUS"
/>
EOF

echo "[+] Configurando NFSv4"
sed -i "s/^#SECURE_NFS=\"yes\"/SECURE_NFS=\"yes\"/" /etc/sysconfig/nfs
sed -i "s/^#RPCGSSDARGS=\"-vvv\"/RPCGSSDARGS=\"-vvv\"/" /etc/sysconfig/nfs

echo "[+] Configurando amanda"
cat > /var/lib/amanda/.amandahosts <<EOF
amandahost amanda
amandahost.localdomain amanda
xxx amanda
EOF

cat > /etc/xinetd.d/amanda <<EOF
service amanda
{
        socket_type             = dgram
        protocol                = udp
        wait                    = yes
        user                    = amanda
        group                   = disk
        server                  = /usr/lib/amanda/amandad
        disable                 = no
        server_args     = -auth=bsd amdump
}
EOF

echo "[+] Logrotate"

cat > /etc/logrotate.conf <<EOF

weekly
rotate 12
create
compress
include /etc/logrotate.d

/var/log/wtmp {
    monthly
    minsize 1M
    create 0664 root utmp
    rotate 12
}
EOF

cat > /etc/logrotate.d/psacct <<EOF
/var/account/pacct {
    compress
    delaycompress
    notifempty
    daily
    rotate 366
    create 0600 root root
    postrotate
	if [ -f /var/lock/subsys/psacct ]; then
	        /usr/sbin/accton /var/account/pacct
	fi
    endscript
}
EOF

echo "[+] Sudo"
cat > /etc/sudoers <<EOF
Defaults    requiretty

Defaults    env_reset
Defaults    env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR \
                        LS_COLORS MAIL PS1 PS2 QTDIR USERNAME \
                        LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION \
                        LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC \
                        LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS \
                        _XKB_CHARSET XAUTHORITY"
%admsis ALL=(ALL)        ALL
EOF

echo "[+] Ajustando SSH"
cat > /etc/ssh/sshd_config <<EOF
Port 694
SyslogFacility AUTHPRIV
LogLevel VERBOSE
LoginGraceTime 15s
AllowGroups admins root
PermitRootLogin without-password
MaxStartups 2
ChallengeResponseAuthentication no
AllowTcpForwarding no
X11Forwarding no
Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc
MACs hmac-sha1
GSSAPIAuthentication yes
UsePAM yes

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
Subsystem       sftp    /usr/libexec/openssh/sftp-server
EOF

mkdir /root/.ssh
cat > /root/.ssh/authorized_keys <<EOF
from="xxx" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAzmhMmtYXOPaCGCvjau5nPnMbDANg0785lgT5bLhHQ7+jGIf9E3qfQYrHmtaEI3ghhEf1DTcGTTUmXV0xifo8pQRjs0f715IvZO2bYGTTsi6dkcVOxM1rujdejHzRj+d2tqZcfNGhl/asa1JeO1ulfhvNFWHETRaytiATlhslYsMuKDuIsR00exUdonIdSTYo9oeTCKhFaOHx2OV8Db+EMfnxhimbN4bJdGyD5LcNqeK4+1tpVa7/C/CsRvF+fFiVc+3cSOYVf0OHSnqZesFZ2GBRPA9pZ3HVh9rGfQpEwXAmx4VUDq+if+awYOE00GmD106asXGQmRIhVknJlamPHw== miguel@quake
EOF

echo "[+] Ajustando hosts.allow"
cat > /etc/hosts.allow <<EOF
sshd: @admsis
EOF

echo "[+] Ajustando hosts.deny"
cat > /etc/hosts.deny <<EOF
ALL: ALL
EOF
echo "[+] Ajustando GRUB"
sed -i "s/\(kernel.*\/xen.gz.*\)/\1 dom0_mem=256m/" /boot/grub/menu.lst

echo "[+] Criando bridge br0"
cat > /etc/sysconfig/network-scripts/ifcfg-br0 <<EOF
DEVICE=br0
BOOTPROTO=static
NO_ALIASROUTING=yes
IPADDR=143.xxx.xxx
NETMASK=255.255.255.192
ONBOOT=yes
TYPE=Bridge
EOF

echo "[+] Criando eth0"
MAC=$(egrep HWADDR /etc/sysconfig/network-scripts/ifcfg-eth0)
cat > /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
DEVICE=eth0
BOOTPROTO=none
$MAC
ONBOOT=yes
BRIDGE=br0
TYPE=Ethernet
EOF

echo "[+] Configurando xend"
sed -i 's/^(network-script network-bridge)$/#(network-script network-bridge)/' /etc/xen/xend-config.sxp

echo "[+] Desligando servicos"
chkconfig gpm off
chkconfig iscsi off
chkconfig iscsid off
chkconfig haldaemon off
chkconfig libvirtd off
chkconfig kudzu off
chkconfig messagebus off
chkconfig gpm off
chkconfig avahi-daemon off
chkconfig rawdevices off
chkconfig iptables off
chkconfig ip6tables off
chkconfig saslauthd off
chkconfig mcstrans off
chkconfig restorecond off
chkconfig nfslock on
chkconfig psacct on
chkconfig rsyslog on
chkconfig rpcgssd on

echo "[+] Amen!"
) 2>&1 | tee /root/ks-post.log

chvt 1