RockyLinux 9.3 64bit kickstart

[更新: 2023年12月14日]

さくらのクラウド用パブリックアーカイブで使用している、RockyLinux 9.3 用の kickstart ファイルです。その他の変更点は リリースノート をご覧ください。

# Kickstart for Rocky Linux 9.3 x86_64

text
lang en_US.UTF-8
keyboard --vckeymap=jp --xlayouts='jp'
timezone --utc Asia/Tokyo
timesource --ntp-server ntp1.sakura.ad.jp

rootpw --iscrypted nope
selinux --disabled
firewall --enabled

zerombr
ignoredisk --only-use=vda
bootloader --location=mbr --driveorder="vda" --boot-drive=vda --append="consoleblank=0"

network --bootproto=dhcp --device=link --activate --onboot=on
services --enabled=firewalld --disabled=auditd,kdump,messagebus,wpa_supplicant,abrt-ccpp,abrt-oops,abrt-vmcore,abrt-xorg,abrtd,avahi-daemon,lvm2-lvmetad.socket,lvm2-monitor,smartd,ntpdate

part biosboot --fstype=biosboot --onpart=vda1
part /      --fstype=ext4 --onpart=vda2

shutdown

%packages
@^minimal-environment
@development

cloud-utils-growpart
gdisk
langpacks-ja
traceroute

# Performance improvement
tuned

# Not required
-cockpit
-microcode_ctl
-qemu-guest-agent

%end

%pre
sed -i 's/metadata_csum,64bit,//' /etc/mke2fs.conf
sgdisk -Z -n 1::+1M -t 1:ef02 -c 1:"BIOS boot partition" -n 2:: -t 2:8300 -c 2:"Linux filesystem" /dev/vda
%end


%post
#set -x

passwd -d root

# network
cat << 'EOF' > /etc/sysconfig/network
NETWORKING=yes
#NETWORKING_IPV6=yes
HOSTNAME=localhost.localdomain
EOF

cat << 'EOF' > /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO="dhcp"
ONBOOT="yes"
EOF

cat << 'EOF' > /etc/resolv.conf
nameserver 133.242.0.3
nameserver 133.242.0.4
#nameserver 2403:3a00::1
EOF

cat >> /etc/sysctl.conf <<-EOF

# Do not accept RA
net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.eth0.accept_ra=0
EOF

# Add elrepo&epel Repository
dnf -y install epel-release

# sshd
sed -i -e "/\#MaxSessions 10$/a #AllowUsers\nDenyUsers toor administrator administrateur admin adm test guest info mysql user oracle" /etc/ssh/sshd_config
sed -i -e '/GSSAPIAuthentication yes$/d' /etc/ssh/sshd_config
sed -i -e '/^GSSAPICleanupCredentials yes$/d' /etc/ssh/sshd_config

# fail2ban
yum -y install fail2ban --enablerepo=epel
systemctl enable fail2ban
touch /var/log/fail2ban.log
sed -i -E 's/^(logtarget =).*/\1 \/var\/log\/fail2ban.log/' /etc/fail2ban/fail2ban.conf

# fail2ban local.conf
cat <<'EOL' >/etc/fail2ban/jail.d/local.conf
[sshd]
enabled = true
EOL

# postfix
sed -i -e 's/^#mynetworks_style = host$/mynetworks_style = host/' /etc/postfix/main.cf

# grub
sed -i -e 's/^GRUB_CMDLINE_LINUX=\"\(.*\)"/GRUB_CMDLINE_LINUX=\"consoleblank=0 net.ifnames=0 biosdevname=0\"/' /etc/default/grub
grub2-mkconfig -o /etc/grub2.cfg
sed -i 's/^options.*/options \$kernelopts \$tuned_params/' /boot/loader/entries/*.conf

# autofsck
echo 'AUTOFSCK_DEF_CHECK=yes' >> /etc/sysconfig/autofsck

# DNF
echo 'fastestmirror=true' >> /etc/dnf/dnf.conf

# Networking
sed -i -e 's/After=network.target/After=network-online.target/' /usr/lib/systemd/system/rc-local.service

# udev
rm -f /etc/udev/rules.d/70-persistent-net.rules

rm -f /etc/sysconfig/network-scripts/ifcfg-ens3

# remove random-seed
rm -fv /var/lib/systemd/random-seed

# remove machine-id
cat /dev/null > /etc/machine-id
cat /dev/null > /var/lib/dbus/machine-id


%end