----- "Kai Schaetzl" <maillists(a)conactive.com> wrote:
> Ben Montanelli wrote on Wed, 04 Feb 2009 11:50:04 -0500:
>
> > I guess many of us want the optimized "grail" dom0.
>
> There is none. It depends on your needs.
This is pretty close to one. :) I also attached a trimmed down version of the kickstart config I use for dom0s. Some of it is irrelevant to many people, but I figured someone would find something useful in it, like fixing some of the brokenness. Some of the packages (like the ones for NTP, MD RAID, IPMI, LUKS, and iSCSI) can be removed if you don't need them. ntpd and snmpd can be disabled if you don't need/use them, or for security policy reasons, as well.
dom0 services:
srv1:[1:13pm]:120:~# chkconfig --list | grep :on
acpid 0:off 1:off 2:off 3:on 4:on 5:on 6:off
auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
cpuspeed 0:off 1:on 2:on 3:on 4:on 5:on 6:off
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
edac 0:off 1:off 2:on 3:on 4:on 5:on 6:off
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
libvirtd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
lm_sensors 0:off 1:off 2:on 3:on 4:on 5:on 6:off
lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off
mcstrans 0:off 1:off 2:on 3:on 4:on 5:on 6:off
mdmonitor 0:off 1:off 2:on 3:on 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
ntpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off
restorecond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
smartd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
snmpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
syslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sysstat 0:off 1:off 2:on 3:on 4:off 5:on 6:off
xend 0:off 1:off 2:on 3:on 4:on 5:on 6:off
xendomains 0:off 1:off 2:off 3:on 4:on 5:on 6:off
dom0 kickstart:
[...]
services --disabled=avahi-daemon,gpm,haldaemon,kudzu,messagebus,netfs --enabled=ntpd,snmpd
[...]
%packages --nobase
@core
xen
kernel-xen
libvirt
postfix
ntp
net-snmp
sudo
sysstat
rsync
tcpdump
tcsh
bzip2
man
lsof
smartmontools
mailx
screen
vim-enhanced
isns-utils
iscsi-initiator-utils
cryptsetup-luks
vconfig
acpid
audit
cpuspeed
mdadm
psacct
xorg-x11-xauth
edac-utils
memtest86+
patch
which
yum-protectbase
OpenIPMI
OpenIPMI-tools
%post
touch /.autorelabel
sed -i '/^\[/aprotect=1' /etc/yum.repos.d/CentOS-Base.repo
cat << _EOF_ >> /etc/sysctl.conf
net.core.rmem_max = 1048576
net.core.rmem_default = 1048576
net.core.wmem_max = 1048576
net.core.wmem_default = 1048576
vm.swappiness = 1
_EOF_
cat << _EOF_ > /etc/snmp/snmpd.conf
[...]
# This is so SNMP reports correct interface rates
interface bond0 161 1000000000
interface bond0.10 135 1000000000
interface bond0.20 135 1000000000
interface bond0.30 135 1000000000
interface bond0.40 135 1000000000
interface bond0.101 135 1000000000
[...]
_EOF_
sed -i 's/^[ \t]*LoginGraceTime.*/#&/g' /etc/ssh/sshd_config
sed -i 's/^[ \t]*PermitRootLogin.*/#&/g' /etc/ssh/sshd_config
sed -i 's/^[ \t]*MaxAuthTries.*/#&/g' /etc/ssh/sshd_config
sed -i 's/^[ \t]*PasswordAuthentication.*/#&/g' /etc/ssh/sshd_config
sed -i 's/^[ \t]*MaxStartups.*/#&/g' /etc/ssh/sshd_config
cat << _EOF_ >> /etc/ssh/sshd_config
LoginGraceTime 1m
PermitRootLogin forced-commands-only
MaxAuthTries 2
PasswordAuthentication no
MaxStartups 2
_EOF_
sed -i 's#kernel /xen.*#& dom0_mem=2G#' /boot/grub/grub.conf
sed -i 's#module /vmlinuz.*#& elevator=deadline#' /boot/grub/grub.conf
cat << _EOF_ >> /etc/modprobe.conf
alias bond0 bonding
options bond0 mode=balance-rr miimon=100 updelay=1000
options netloop nloopbacks=64
options forcedeth max_interrupt_work=10
_EOF_
touch /etc/sysconfig/iptables
sed -i -r 's/^IPTABLES_MODULES=.*/#&/' /etc/sysconfig/iptables-config
sed -i -r '/^#IPTABLES_MODULES=.*/a \IPTABLES_MODULES=""' /etc/sysconfig/iptables-config
cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-bond0
DEVICE=bond0
BOOTPROTO=none
ONBOOT=yes
USERCTL=no
_EOF_
cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-bond0.10
DEVICE=bond0.10
BOOTPROTO=none
ONBOOT=yes
USERCTL=no
VLAN=yes
BRIDGE=br10
_EOF_
cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-br10
DEVICE=br10
TYPE=Bridge
BOOTPROTO=static
BROADCAST=<xxx>
IPADDR=<xxx>
NETMASK=<xxx>
NETWORK=<xxx>
IPV6INIT=yes
IPV6_AUTOCONF=yes
ONBOOT=yes
DELAY=0
STP=on
_EOF_
sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth0
cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth0
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes
USERCTL=no
_EOF_
sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth1
cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth1
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes
USERCTL=no
_EOF_
sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth2
cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth2
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes
USERCTL=no
_EOF_
sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth3
cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth3
BOOTPROTO=none
ONBOOT=yes
MASTER=bond0
SLAVE=yes
USERCTL=no
_EOF_
sed -i -r 's/(SYNC_HWCLOCK=).*/\1yes/' /etc/sysconfig/ntpd
cat << _EOF_ > /root/xendomains.patch
--- /etc/init.d/xendomains.dist 2008-11-04 09:57:48.000000000 -0600
+++ /etc/init.d/xendomains 2008-11-04 09:58:30.000000000 -0600
@@ -175,9 +175,9 @@
parseln()
{
- name=\`echo "\$1" | cut -c0-17\`
+ name=\`echo "\$1" | cut -d' ' -f1\`
name=\${name%% *}
- rest=\`echo "\$1" | cut -c18- \`
+ rest=\`echo "\$1" | cut -d' ' -f2-\`
read id mem cpu vcpu state tm < <(echo "\$rest")
}
_EOF_
patch -p0 < /root/xendomains.patch
mv /etc/xen/xend-config.sxp /etc/xen/xend-config.sxp.dist
cat << _EOF_ > /etc/xen/xend-config.sxp
# -*- sh -*-
(xend-unix-server yes)
(xend-unix-path /var/lib/xend/xend-socket)
(xend-relocation-server yes)
(xend-relocation-port 8002)
(xend-relocation-address '<xxx>')
(xend-relocation-hosts-allow '^localhost\$ ^localhost\\\\.localdomain\$ ^<xxx>\$')
(network-script /bin/true)
(vif-script vif-bridge)
(dom0-min-mem 768)
(dom0-cpus 1)
(vncpasswd '')
_EOF_
sed -i -r 's/^XENDOMAINS_SAVE=.*/#&/' /etc/sysconfig/xendomains
sed -i '/^#XENDOMAINS_SAVE=/a \XENDOMAINS_SAVE=' /etc/sysconfig/xendomains
rm -f /etc/libvirt/qemu/networks/autostart/default.xml
mkdir /root/.ssh
cat << _EOF_ > /root/.ssh/authorized_keys
command="/usr/bin/virt-manager" ssh-rsa <xxx> <xxx>
_EOF_
%end
--
Christopher G. Stach II
