----- "Kai Schaetzl" <maillists at conactive.com> wrote: > Ben Montanelli wrote on Wed, 04 Feb 2009 11:50:04 -0500: > > > I guess many of us want the optimized "grail" dom0. > > There is none. It depends on your needs. This is pretty close to one. :) I also attached a trimmed down version of the kickstart config I use for dom0s. Some of it is irrelevant to many people, but I figured someone would find something useful in it, like fixing some of the brokenness. Some of the packages (like the ones for NTP, MD RAID, IPMI, LUKS, and iSCSI) can be removed if you don't need them. ntpd and snmpd can be disabled if you don't need/use them, or for security policy reasons, as well. dom0 services: srv1:[1:13pm]:120:~# chkconfig --list | grep :on acpid 0:off 1:off 2:off 3:on 4:on 5:on 6:off auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off cpuspeed 0:off 1:on 2:on 3:on 4:on 5:on 6:off crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off edac 0:off 1:off 2:on 3:on 4:on 5:on 6:off ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off libvirtd 0:off 1:off 2:off 3:on 4:on 5:on 6:off lm_sensors 0:off 1:off 2:on 3:on 4:on 5:on 6:off lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off mcstrans 0:off 1:off 2:on 3:on 4:on 5:on 6:off mdmonitor 0:off 1:off 2:on 3:on 4:on 5:on 6:off network 0:off 1:off 2:on 3:on 4:on 5:on 6:off ntpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off restorecond 0:off 1:off 2:on 3:on 4:on 5:on 6:off smartd 0:off 1:off 2:on 3:on 4:on 5:on 6:off snmpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off syslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off sysstat 0:off 1:off 2:on 3:on 4:off 5:on 6:off xend 0:off 1:off 2:on 3:on 4:on 5:on 6:off xendomains 0:off 1:off 2:off 3:on 4:on 5:on 6:off dom0 kickstart: [...] services --disabled=avahi-daemon,gpm,haldaemon,kudzu,messagebus,netfs --enabled=ntpd,snmpd [...] %packages --nobase @core xen kernel-xen libvirt postfix ntp net-snmp sudo sysstat rsync tcpdump tcsh bzip2 man lsof smartmontools mailx screen vim-enhanced isns-utils iscsi-initiator-utils cryptsetup-luks vconfig acpid audit cpuspeed mdadm psacct xorg-x11-xauth edac-utils memtest86+ patch which yum-protectbase OpenIPMI OpenIPMI-tools %post touch /.autorelabel sed -i '/^\[/aprotect=1' /etc/yum.repos.d/CentOS-Base.repo cat << _EOF_ >> /etc/sysctl.conf net.core.rmem_max = 1048576 net.core.rmem_default = 1048576 net.core.wmem_max = 1048576 net.core.wmem_default = 1048576 vm.swappiness = 1 _EOF_ cat << _EOF_ > /etc/snmp/snmpd.conf [...] # This is so SNMP reports correct interface rates interface bond0 161 1000000000 interface bond0.10 135 1000000000 interface bond0.20 135 1000000000 interface bond0.30 135 1000000000 interface bond0.40 135 1000000000 interface bond0.101 135 1000000000 [...] _EOF_ sed -i 's/^[ \t]*LoginGraceTime.*/#&/g' /etc/ssh/sshd_config sed -i 's/^[ \t]*PermitRootLogin.*/#&/g' /etc/ssh/sshd_config sed -i 's/^[ \t]*MaxAuthTries.*/#&/g' /etc/ssh/sshd_config sed -i 's/^[ \t]*PasswordAuthentication.*/#&/g' /etc/ssh/sshd_config sed -i 's/^[ \t]*MaxStartups.*/#&/g' /etc/ssh/sshd_config cat << _EOF_ >> /etc/ssh/sshd_config LoginGraceTime 1m PermitRootLogin forced-commands-only MaxAuthTries 2 PasswordAuthentication no MaxStartups 2 _EOF_ sed -i 's#kernel /xen.*#& dom0_mem=2G#' /boot/grub/grub.conf sed -i 's#module /vmlinuz.*#& elevator=deadline#' /boot/grub/grub.conf cat << _EOF_ >> /etc/modprobe.conf alias bond0 bonding options bond0 mode=balance-rr miimon=100 updelay=1000 options netloop nloopbacks=64 options forcedeth max_interrupt_work=10 _EOF_ touch /etc/sysconfig/iptables sed -i -r 's/^IPTABLES_MODULES=.*/#&/' /etc/sysconfig/iptables-config sed -i -r '/^#IPTABLES_MODULES=.*/a \IPTABLES_MODULES=""' /etc/sysconfig/iptables-config cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-bond0 DEVICE=bond0 BOOTPROTO=none ONBOOT=yes USERCTL=no _EOF_ cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-bond0.10 DEVICE=bond0.10 BOOTPROTO=none ONBOOT=yes USERCTL=no VLAN=yes BRIDGE=br10 _EOF_ cat << _EOF_ > /etc/sysconfig/network-scripts/ifcfg-br10 DEVICE=br10 TYPE=Bridge BOOTPROTO=static BROADCAST=<xxx> IPADDR=<xxx> NETMASK=<xxx> NETWORK=<xxx> IPV6INIT=yes IPV6_AUTOCONF=yes ONBOOT=yes DELAY=0 STP=on _EOF_ sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth0 cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth0 BOOTPROTO=none ONBOOT=yes MASTER=bond0 SLAVE=yes USERCTL=no _EOF_ sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth1 cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth1 BOOTPROTO=none ONBOOT=yes MASTER=bond0 SLAVE=yes USERCTL=no _EOF_ sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth2 cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth2 BOOTPROTO=none ONBOOT=yes MASTER=bond0 SLAVE=yes USERCTL=no _EOF_ sed -i -r '/^(HWADDR=|#)/!d' /etc/sysconfig/network-scripts/ifcfg-eth3 cat << _EOF_ >> /etc/sysconfig/network-scripts/ifcfg-eth3 BOOTPROTO=none ONBOOT=yes MASTER=bond0 SLAVE=yes USERCTL=no _EOF_ sed -i -r 's/(SYNC_HWCLOCK=).*/\1yes/' /etc/sysconfig/ntpd cat << _EOF_ > /root/xendomains.patch --- /etc/init.d/xendomains.dist 2008-11-04 09:57:48.000000000 -0600 +++ /etc/init.d/xendomains 2008-11-04 09:58:30.000000000 -0600 @@ -175,9 +175,9 @@ parseln() { - name=\`echo "\$1" | cut -c0-17\` + name=\`echo "\$1" | cut -d' ' -f1\` name=\${name%% *} - rest=\`echo "\$1" | cut -c18- \` + rest=\`echo "\$1" | cut -d' ' -f2-\` read id mem cpu vcpu state tm < <(echo "\$rest") } _EOF_ patch -p0 < /root/xendomains.patch mv /etc/xen/xend-config.sxp /etc/xen/xend-config.sxp.dist cat << _EOF_ > /etc/xen/xend-config.sxp # -*- sh -*- (xend-unix-server yes) (xend-unix-path /var/lib/xend/xend-socket) (xend-relocation-server yes) (xend-relocation-port 8002) (xend-relocation-address '<xxx>') (xend-relocation-hosts-allow '^localhost\$ ^localhost\\\\.localdomain\$ ^<xxx>\$') (network-script /bin/true) (vif-script vif-bridge) (dom0-min-mem 768) (dom0-cpus 1) (vncpasswd '') _EOF_ sed -i -r 's/^XENDOMAINS_SAVE=.*/#&/' /etc/sysconfig/xendomains sed -i '/^#XENDOMAINS_SAVE=/a \XENDOMAINS_SAVE=' /etc/sysconfig/xendomains rm -f /etc/libvirt/qemu/networks/autostart/default.xml mkdir /root/.ssh cat << _EOF_ > /root/.ssh/authorized_keys command="/usr/bin/virt-manager" ssh-rsa <xxx> <xxx> _EOF_ %end -- Christopher G. Stach II