# 主机名命名规范
# 格式：[环境]-[角色]-[编号]
# 示例：prod-web-001, test-db-002

# 批量设置主机名
# 使用Ansible批量设置主机名
—
– hosts: all
become: yes
tasks:
– name: Set hostname
hostname:
name: “{{ env }}-{{ role }}-{{ serial }}”

# 验证主机名设置
$ hostnamectl status
Static hostname: prod-web-001
Icon name: computer-vm
Chassis: vm
Machine ID: 1234567890abcdef1234567890abcdef
Boot ID: 0987654321fedcba0987654321fedcba
Virtualization: kvm
Operating System: Red Hat Enterprise Linux 10.0 (Ootpa)
CPE OS Name: cpe:/o:redhat:enterprise_linux:10::baseos
Kernel: Linux 4.18.0-305.el10.x86_64
Architecture: x86-64

# 网络配置标准
# IP地址规划：192.168.[环境].[编号]
# 子网掩码：255.255.255.0
# 网关：192.168.[环境].1
# DNS：企业内部DNS服务器

# 批量配置网络
# 使用Ansible批量配置网络
—
– hosts: all
become: yes
tasks:
– name: Configure network
nmcli:
conn_name: eth0
ifname: eth0
type: ethernet
ip4: “{{ ip_address }}/24”
gw4: “{{ gateway }}”
dns4: “{{ dns_servers }}”
state: present
autoconnect: yes

# 验证网络配置
$ nmcli connection show eth0
NAME UUID TYPE DEVICE
eth0 12345678-1234-1234-1234-1234567890ab ethernet eth0

$ ip addr show eth0
2: eth0: mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::211:22ff:fe33:4455/64 scope link
valid_lft forever preferred_lft forever

# 时间同步配置标准
# NTP服务器：企业内部NTP服务器
# 时间同步频率：每小时同步一次
# 时区：Asia/Shanghai

# 批量配置时间同步
# 使用Ansible批量配置chrony
—
– hosts: all
become: yes
tasks:
– name: Install chrony
dnf:
name: chrony
state: present

– name: Configure chrony
template:
src: chrony.conf.j2
dest: /etc/chrony.conf

– name: Start and enable chronyd
systemd:
name: chronyd
state: started
enabled: yes

# 验证时间同步
$ chronyc sources
210 Number of sources = 4
MS Name/IP address Stratum Poll Reach LastRx Last sample
==============================================================================
^* ntp1.fgedu.net.cn 2 6 37 58 -127us[-127us] +/- 18ms
^+ ntp2.fgedu.net.cn 2 6 37 59 +123us[+123u学习交流加群风哥微信: itpux-coms] +/- 21ms
^- ntp3.fgedu.net.cn 3 6 37 57 -345us[-345us] +/- 25ms
^? ntp4.fgedu.net.cn 0 6 0 – +0ns[ +0ns] +/- 0ns

$ timedatectl status
Local time: Mon 2026-04-03 10:00:00 CST
Universal time: Mon 2026-04-03 02:00:00 UTC
RTC time: Mon 2026-04-03 02:00:00
Time zone: Asia/Shanghai (CST, +0800)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

# 使用Ansible批量部署配置
# 目录结构
ansible/
├── inventory/
│ └── hosts
├── playbooks/
│ ├── basic-config.yml
│ ├── security-config.yml
│ └── service-config.yml
├── roles/
│ ├── base/
│ │ ├── tasks/
│ │ ├── templates/
│ │ └── files/
│ ├── security/
│ │ ├── tasks/
│ │ ├── templates/
│ │ └── files/
│ └── service/
│ ├── tasks/
│ ├── templates/
│ └── files/
└── vars/
└── main.yml

# 执行批量部署
$ ansible-playbook -i inventory/hosts playbooks/basic-config.yml

PLAY [all] ********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [prod-web-001]
ok: [prod-web-002]
ok: [prod-web-003]

TASK [base : Set hostname] ****************************************************
ok: [prod-web-001]
ok: [prod-web-002]
ok: [prod-web-003]

TASK [base : Configure network] ************************************************
ok: [prod-web-001]
ok: [prod-web-002]
ok: [prod-web-003]

TASK [base : Configure time synchronization] ***********************************
ok: [prod-web-001]
ok: [prod-web-002]
ok: [prod-web-003]

PLAY RECAP ********************************************************************
prod-web-001 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
prod-web-002 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
prod-web-003 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

# 配置验证脚本
#!/bin/bash

# 验证主机名
HOSTNAME=$(hostname)
if [[ $HOSTNAME =~ ^[a-z]+-[a-z]+-[0-9]+$ ]]; then
echo “✓ Hostname format is correct: $HOSTNAME”
else
echo “✗ Hostname format is incorrect: $HOSTNAME”
fi

# 验证网络配置
IP_ADDRESS=$(ip addr show eth0 | grep inet | grep -v inet6 | awk ‘{print $2}’)
if [[ $IP_ADDRESS =~ ^192\.168\.[0-9]+\.[0-9]+/24$ ]]; then
echo “✓ IP address format is correct: $IP_ADDRESS”
else
echo “✗ IP address format is incorrect: $IP_ADDRESS”
fi

# 验证时间同步
CHRONY_STATUS=$(chronyc sources | grep “^*” | wc -l)
if [ $CHRONY_STATUS -eq 1 ]; then
echo “✓ Time synchronization is working”
else
echo “✗ Time synchronization is not working”
fi

# 验证防火墙状态
FIREWALL_STATUS=$(systemctl is-active firewalld)
if [ “$FIREWALL_STATUS” = “active” ]; then
echo “✓ Firewall is active”
else
echo “✗ Firewall is not active”
fi

# 验证SELinux状态
SELINUX_STATUS=$(getenforce)
if [ “$SELINUX_STATUS” = “Enforcing” ]; then
echo “✓ SELinux is in Enforcing mode”
else
echo “✗ SELinux is not in Enforcing mode”
fi

# 执行验证
$ ./config_verification.sh
✓ Hostname format is correct: prod-web-001
✓ IP address format is correct: 192.168.1.100/24
✓ Time synchronization is working
✓ Firewall is active
✓ SELinux is in Enforcing mode

# 配置监控
# 使用Prometheus监控配置状态
# 配置监控指标：
# – 配置文件哈希值
# – 服务状态
# – 配置合规性
风哥提示：