debian9自动化部署Fully Automatic Installation（FAI）
FAI是debian wiki推荐的自动化部署工具https://wiki.debian.org/FAI，FAI官网网址为http://fai-project.org
准备工作：已部署好的debian9，使用的版本为debian9.6.0。主机ip地址：192.168.1.99
配置FAI软件仓库
root@fai-server:~# vim /etc/apt/sources.list联网的情况下使用国内软件仓库，这边使用国内中科大debian仓库:
以下为sources.list中的内容
deb https://mirrors.ustc.edu.cn/debian/ stretch main contrib non-free
deb https://mirrors.ustc.edu.cn/debian/ stretch-updates main contrib non-free
deb https://mirrors.ustc.edu.cn/debian/ stretch-backports main contrib non-free
deb https://mirrors.ustc.edu.cn/debian-security/ stretch/updates main contrib non-free
deb http://mirrors.ustc.edu.cn/docker-ce/linux/debian stretch stable也可配置本地仓库（借助apt-mirror软件实现）:
root@fai-server:~# apt-get -y install apt-mirror修改apt-mirror的配置文件，配置软件仓库同步的源
root@fai-server:~# cat /etc/apt/mirror.list
############# config ##################
#
set base_path /debian9_mirror
#
set mirror_path $base_path/mirror
set skel_path $base_path/skel
set var_path $base_path/var
set cleanscript $var_path/clean.sh
# set defaultarch <running host architecture>
# set postmirror_script $var_path/postmirror.sh
set run_postmirror 0
set nthreads 20
set _tilde 0
#
############# end config ##############
deb http://ftp.hk.debian.org/debian stretch main contrib non-free
deb http://ftp.hk.debian.org/debian stretch-updates main contrib non-free
deb http://ftp.hk.debian.org/debian stretch-backports main contrib non-free
deb https://download.docker.com/linux/debian stretch stable
clean http://ftp.hk.debian.org/debian
clean https://download.docker.com/linux/debian
deb源根据自己的实际情况设置，这边添加的debian9（debian官方香港地址）的stretch、stretch-updates和stretch-backports的源（下载速度比中科大的快，不知道为什么-_-||）以及docker的软件仓库。
配置完成后退出，执行apt-mirror即可自动下载，数据量较大。
大小约为debian9：74G左右；docker-ce：692M左右
root@fai-server:~# du -h --max-depth=1 /debian_mirror/mirror/
692M /debian_mirror/mirror/download.docker.com
74G /debian_mirror/mirror/ftp.hk.debian.org
74G /debian_mirror/mirror/
软件仓库同步完成后，借助apache变成可访问的软件源
root@fai-server:~# apt-get -y install apache2做软连接至apache的html目录下
root@fai-server:~# ln -s /debian9_mirror/mirror/ftp.hk.debian.org/debian /var/www/html/debian
root@fai-server:~# ln -s /debian9_mirror/mirror/download.docker.com/linux/debian /var/www/html/docker修改source.list
root@fai-server:~# cat /etc/apt/sources.list
deb http://192.168.1.99/debian stretch main contrib non-free
deb http://192.168.1.99/debian stretch-updates main contrib non-free
deb http://192.168.1.99/debian stretch-backports main non-free contrib
deb http://192.168.1.99/docker stretch stable更新软件仓库。由于docker软件仓库没有gpg秘钥，会报错，可从https://download.docker.com/linux/debian/gpg 安装gpg秘钥文件。
为后面本地部署方便，可将该文件放apache的html目录下供本地机器下载使用，在需求安装docker-ce的服务器上执行“curl -fsSL http://192.168.1.99/gpg | apt-key add -”，
再执行apt-get update就不会报错了
准备工作完成后开始部署faiserver
安装软件包
root@fai-server:~# wget -O - https://fai-project.org/download/074BCDE4.asc | apt-key add -
root@fai-server:~# echo "deb http://fai-project.org/download stretch koeln" > /etc/apt/sources.list.d/fai.list
root@fai-server:~# apt-get update
root@fai-server:~# apt-get install aptitude -y
root@fai-server:~# aptitude install fai-quickstart -y
root@fai-server:~# apt-get install qemu-user-static -y配置DHCP服务(ipv4指定网卡，注释ipv6)
root@fai-server:~# cat /etc/default/isc-dhcp-server
...
...
# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
# Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACESv4="enp0s3"
#INTERFACESv6=""根据自身情况配置dhcp服务，next-server为tftp服务器的ip
root@fai-server:~# cat /etc/dhcp/dhcpd.conf
...
...
# This is a very basic subnet declaration.
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.20 192.168.1.90;
next-server 192.168.1.99;
filename "fai/pxelinux.0";
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
}
...
...DHCP配置错误日志路径为/var/log/daemon.log，有问题可自行通过这个日志排除.
配置TFTP服务
root@fai-server:~# sed -i 's/0.0.0.0:69/192.168.1.99:69/' /etc/default/tftpd-hpa配置fai的source.list（fai-steup -v时，从本地软件仓库拉取数据）
root@fai-server:~# cat /etc/apt/sources.list > /etc/fai/apt/sources.list配置fai-nfs服务
FAI_DEBOOTSTRAP：在创建nfsroot这个目录文件时，需要从指定的软件仓库下载debian的镜像和此版本debian所依赖的软件包，如果有本地的debian软件仓库，可指定为本地的软件仓库。
FAI_ROOTPW：为设定的新装机器开机密码，该密码对应明文为fai。如要修改，可通过命名mkpasswd生成新的MD5填入
root@fai-server:~# apt-get install whois -y
root@fai-server:~# echo "password" | mkpasswd -m md5 -s生成的密文即为password的MD5码，填入即可替换默认的fai密码
NFSROOT_ETC_HOSTS值为faiserver的IP
root@fai-server:~# cat /etc/fai/nfsroot.conf
# For a detailed description see nfsroot.conf(5)
# "<suite> <mirror>" for debootstrap
FAI_DEBOOTSTRAP="stretch http://192.168.1.99/debian"
FAI_ROOTPW='$1$ab9BtYz3$rmjVoBEilyld2TWF3fw9G.'
NFSROOT=/srv/fai/nfsroot
TFTPROOT=/srv/tftp/fai
NFSROOT_HOOKS=/etc/fai/nfsroot-hooks/
NFSROOT_ETC_HOSTS="192.168.1.99"
FAI_DEBOOTSTRAP_OPTS="--exclude=info"
# Configuration space
FAI_CONFIGDIR=/srv/fai/debian9_config创建FAI安装所需的文件（通过互联网的话，根据软件仓库传输的实际情况，需要花费一定时间，如果是本地软件仓库的话，很快就能结束，如果软件仓库中软件有问题，可能会报错，就需要自己去排查问题，就我遇到的问题而言，为软件下载残缺导致，将那个文件从官方仓库下载替换后即解决了。重新执行fai-setup -v时，要删除/srv/fai/下所有的文件才能执行）
确认hosts下本机ip的hostname存在，否则fai-setup -v时会不创建ssh秘钥，导致自动安装最后卡chboot and savelog阶段，虽然不影响安装，但需要手动干预，才能完成安装。
root@fai-server:~# cat /etc/hosts
192.168.1.99 fai-server
...部署fai
root@fai-server:~# fai-setup -v
Adding system user `fai' (UID 110) ...
Adding new user `fai' (UID 110) with group `nogroup' ...
Creating home directory `/var/log/fai/remote-logs' ...
Generating public/private rsa key pair.
Your identification has been saved in /var/log/fai/remote-logs/.ssh/id_rsa.
Your public key has been saved in /var/log/fai/remote-logs/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:YzXCxhaSvntjGmI5PuX0Z9V7H1NGIX2xTiUodoH+Dig fai@fai-server
The key's randomart image is:
+---[RSA 2048]----+
| ... ..+ooo|
| .+ .+ o .o=|
| . *ooo oo|
| .o o.. o. |
| .S. . . .o|
| .E.... o ...|
| =+.+ + + |
| o.oo.= o . . +|
| ...+ + .o|
+----[SHA256]-----+
Generating public/private ed25519 key pair.
Your identification has been saved in /var/log/fai/remote-logs/.ssh/id_ed25519.
Your public key has been saved in /var/log/fai/remote-logs/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:WOhJEuh49et8WM8/5ahozXr+XOCUCxEwd0ZseHOYaBc fai@fai-server
The key's randomart image is:
+--[ED25519 256]--+
| .. o.o=E+ |
| . .. . o++O . |
| o ...o ...+ o |
|. o +.+ . . |
| . +.S . + |
| . . + o. |
| o o = o+. |
| + o.*.o.. |
| oo+o++. |
+----[SHA256]-----+
Adding 192.168.1.99,fai-server to known_hosts.
Adding 172.17.0.1 to known_hosts.
/var/log/fai/remote-logs/.ssh/known_hosts created.
/var/log/fai/remote-logs/.ssh/authorized_keys created.
...
...
...
FAI packages and related packages inside the nfsroot:
dracut 044+241-3
dracut-network 044+241-3
fai-client 5.3.6
fai-nfsroot 5.3.6
fai-setup-storage 5.3.6
Waiting for background jobs to finish
[1]+ Done nice xz -q $NFSROOT/var/tmp/base.tar (wd: /srv/fai/nfsroot)
fai-make-nfsroot finished properly.
Log file written to /var/log/fai/fai-make-nfsroot.log
Your initial config space is now located in /srv/fai/debian9_config
Please don't forget to fill out the FAI questionnaire after you've finished your project with FAI.
FAI setup finished.
Log file written to /var/log/fai/fai-setup.log创建PXE启动配置文件
root@fai-server:~# fai-chboot -IBv -u nfs://192.168.1.99/srv/fai/debian9_config default
Booting kernel vmlinuz-4.9.0-8-amd64
append initrd=initrd.img-4.9.0-8-amd64 ip=dhcp
FAI_FLAGS=verbose,sshd,reboot FAI_CONFIG_SRC=nfs://192.168.1.99/srv/fai/debian9_config
default has no IP in hex default
Writing file /srv/tftp/fai/pxelinux.cfg/default for default编辑生成的启动配置文件
label XXXX就是关联下方kernel的启动内核，可一对一配置多个。安装启动时boot会提示，输入XXXX，就会从指定的内核启动。可设置时间参数（timeout 60）、默认启动内核参数（default XXXX）。
默认只有default、label两个参数，只有一个内核的话，不需要修改。
如果服务器第一启动项为网卡，那么会没有询问，直接自动安装系统，要小心。全新安装时可通过设置第一启动项为硬盘，第二启动项为网卡，这样硬盘没有启动引导的情况下会从网卡启动，安装结束后硬盘中有了系统引导，就不会从网卡启动了，避免了无限重装，同时也不需要人工干预。
root@fai-server:~# cat /srv/tftp/fai/pxelinux.cfg/default
# generated by fai-chboot for host default with IP no IP
default fai-generated
label fai-generated
kernel vmlinuz-4.9.0-8-amd64
append initrd=initrd.img-4.9.0-8-amd64 ip=dhcp LOGUSER=fai root=192.168.1.99:/srv/fai/nfsroot:vers=3 rootovl FAI_FLAGS=verbose,sshd,reboot FAI_CONFIG_SRC=nfs://192.168.1.99/srv/fai/debian9_config FAI_ACTION=install配置磁盘分区
root@fai-server:~# cat /srv/fai/debian9_config/disk_config/FAIBASE
# example of new config file for setup-storage
#
# <type> <mountpoint> <size> <fs type> <mount options> <misc options>
disk_config disk1 disklabel:msdos bootable:1 fstabkey:uuid
logical swap 8G swap sw
primary / 100-100% ext4 rw,noatime,errors=remount-ro根据自己的需求设置预安装软件
root@fai-server:~# cat /srv/fai/debian9_config/package_config/DEBIAN
PACKAGES install-norec
apt-transport-https # is only needed for stretch
debconf-utils
file
less
linuxlogo
rsync
openssh-client openssh-server
time
procinfo
nullmailer
eject
locales
console-setup kbd
pciutils usbutils
unattended-upgrades
vim
wget
software-properties-common
ca-certificates
curl
docker-ce
qemu-kvm
libvirt-clients
libvirt-daemon-system
bridge-utils
libguestfs-tools
virtinst
libosinfo-bin
ssh
...
...配置默认时区、root初始密码、普通账号等
root@fai-server:~# cat /srv/fai/debian9_config/class/FAIBASE.var
# default values for installation. You can override them in your *.var files
# allow installation of packages from unsigned repositories
FAI_ALLOW_UNSIGNED=1
# Set UTC=yes if your system clock is set to UTC (GMT), and UTC=no if not.
UTC=yes
TIMEZONE=Asia/Shanghai
# the hash of the root password for the new installed linux system
# pw is "fai"
ROOTPW='$1$ab9BtYz3$rmjVoBEilyld2TWF3fw9G.'
# errors in tasks greater than this value will cause the installation to stop
STOP_ON_ERROR=700
# set parameter for install_packges(8)
MAXPACKAGES=800
# a user account will be created
username=service
USERPW='$1$ab9BtYz3$rmjVoBEilyld2TWF3fw9G.'重启相关服务
root@fai-server:~# /etc/init.d/networking restart
root@fai-server:~# /etc/init.d/isc-dhcp-server restart
root@fai-server:~# /etc/init.d/tftpd-hpa restart
root@fai-server:~# /etc/init.d/rpcbind restart
root@fai-server:~# /etc/init.d/nfs-kernel-server restart测试自动化系统安装
略
自定义自动化部署脚本
fai在自动部署系统时，是依赖fai服务端的各类脚本实现，脚本在/srv/fai/debian9_config/scripts下各个相应的目录中，LAST目录是系统部署最后需要执行的脚本，但由于此次用于安装的是debian，为管理方便，将自定义的部署脚本放在DEBIAN目录下
root@fai-server:~# ls /srv/fai/debian9_config/scripts/DEBIAN/
10-rootpw 20-capabilities 30-interface 40-misc 50-start50-start即为自定义的脚本，在该脚本中，修改了ssh的禁用密码登陆和设置ssh秘钥登陆、加入部分软件源的key，以及创建的部分linux配置文件和启动脚本。
部署脚本的写法与寻常脚本区别不大，唯一的区别应该是路径问题，由于在部署过程中，磁盘是挂载状态使用的，所以路径有变化，参照系统自带脚本，在真实路径前加入$target即可，参考范例如下
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' $target/etc/ssh/sshd_config
...
mkdir -p $target/root/.ssh
touch $target/root/.ssh/authorized_keys
chmod 600 $target/root/.ssh/authorized_keys参考文档
https://blog.51cto.com/7938217/1701161
http://fai-project.org/fai-guide/
https://blog.51cto.com/7938217/1701161
https://blog.cavebeat.org/2017/07/local-apt-mirror-for-debian-stretch/