---

title: “Configure PXE (Network Boot) installation Server on CentOS 7.x”
date: 2019-02-12T09:38:46
slug: configure-pxe-network-boot-installation-server-on-centos-7-x

---

yum install dhcp tftp tftp-server syslinux vsftpd xinetd

vi /etc/dhcp/dhcpd.conf

# DHCP Server Configuration file.

ddns-update-style interim;
ignore client-updates;
authoritative;
allow booting;
allow bootp;
allow unknown-clients;

# internal subnet for my DHCP Server
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.200 10.0.0.250;
option domain-name-servers 10.0.0.1;
option domain-name "openstack.local";
option routers 10.0.0.1;
option broadcast-address 10.0.0.255;
default-lease-time 600;
max-lease-time 7200;
next-server 10.0.0.5;
}

host controller.openstack.local {
 hardware ethernet 52:54:00:37:2a:4e;
 option host-name controller;
 fixed-address 10.0.0.11;
 filename "pxelinux.0";
}

vi /etc/xinetd.d/tftp
service tftp
{
 socket\_type = dgram
 protocol = udp
 wait = yes
 user = root
 server = /usr/sbin/in.tftpd
 server\_args = -s /var/lib/tftpboot
 disable = no
 per\_source = 11
 cps = 100 2
 flags = IPv4
}

cp -v /usr/share/syslinux/pxelinux.0 /var/lib/tftpboot
cp -v /usr/share/syslinux/menu.c32 /var/lib/tftpboot
cp -v /usr/share/syslinux/memdisk /var/lib/tftpboot
cp -v /usr/share/syslinux/mboot.c32 /var/lib/tftpboot
cp -v /usr/share/syslinux/chain.c32 /var/lib/tftpboot
mkdir /var/lib/tftpboot/pxelinux.cfg
mkdir /var/lib/tftpboot/networkboot

Mount Centos  ISO and copy content to /var/ftp/pub/

mount /dev/cdrom /mnt
cd /mnt/
cp -av \* /var/ftp/pub/

cp /mnt/images/pxeboot/vmlinuz /var/lib/tftpboot/networkboot/
cp /mnt/images/pxeboot/initrd.img /var/lib/tftpboot/networkboot/

Generate Root Password

openssl passwd -1 Pxe@123#
$1$e2wrcGGX$tZPQKPsXVhNmbiGg53MN41

Create kickstart file (Replace Password and URLs)

vi /var/ftp/pub/centos7.cfg

#platform=x86, AMD64, or Intel EM64T
#version=DEVEL
# Firewall configuration
firewall --disabled
# Install OS instead of upgrade
install
# Use FTP installation media
url --url="ftp://10.0.0.5/pub/"
# Root password
rootpw --iscrypted $1$B8PHMhWg$89J2kxGGtxIc/RdA9/3OI1
# System authorization information
auth useshadow passalgo=sha512
# Use graphical install
graphical
firstboot disable
# System keyboard
keyboard de
# System language
lang en\_US
# SELinux configuration
selinux disabled
# Installation logging level
logging level=info
# System timezone
timezone Europe/Amsterdam
# System bootloader configuration
bootloader location=mbr
ignoredisk --only-use=sda
clearpart --all --initlabel
part swap --asprimary --fstype="swap" --size=1024 --ondisk=sda
part /boot --fstype xfs --size=300 --ondisk=sda
part pv.01 --size=1 --grow --ondisk=sda
volgroup root\_vg01 pv.01
logvol / --fstype xfs --name=lv\_01 --vgname=root\_vg01 --size=1 --grow
%packages

@^minimal
@core
%end
network --device=eth0 --bootproto=dhcp
network --device=eth1 --bootproto=static
%addon com\_redhat\_kdump --disable --reserve-mb='auto'

%end
%post
rpm -Uvh https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm
yum -y install salt-minion
yum -y update
systemctl enable salt-minion
systemctl start salt-minion
echo "10.0.0.5 salt" >> /etc/hosts
sed -i -e 's/GRUB\_CMDLINE\_LINUX=.\*/GRUB\_CMDLINE\_LINUX="rd.lvm.lv=root\_vg01\/lv\_01 rhgb quiet net.ifnames=0 biosdevname=0"/' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg
echo "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin" >> /var/spool/cron/root
echo "@reboot salt-call state.apply > /tmp/out 2>&1" >> /var/spool/cron/root
%end
reboot

Create a PXE menu file

vi /var/lib/tftpboot/pxelinux.cfg/default

default menu.c32
prompt 0
timeout 30
MENU TITLE LinuxTechi.com PXE Menu
LABEL centos7\_x64
MENU LABEL CentOS 7\_X64
KERNEL /networkboot/vmlinuz
APPEND initrd=/networkboot/initrd.img inst.repo=ftp://10.0.0.5/pub ks=ftp://10.0.0.5/pub/centos7.cfg net.ifnames=0 biosdevname=0

Start Services

systemctl start xinetd
systemctl enable xinetd
systemctl start dhcpd.service
systemctl enable dhcpd.service
systemctl start vsftpd
systemctl enable vsftpd

Allow FTP connection (selinux)

setsebool -P allow\_ftpd\_full\_access 1

Allow Connections (Firewall)

firewall-cmd --add-service=ftp --permanent
firewall-cmd --add-service=dhcp --permanent
firewall-cmd --add-port=69/tcp --permanent
firewall-cmd --add-port=69/udp --permanent
firewall-cmd --add-port=4011/udp --permanent
firewall-cmd --add-port=4506/tcp --permanent
firewall-cmd --reload

Salt installieren

rpm -Uvh https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm
yum -y install salt-master epel-release git
yum install python-pip
pip install --upgrade pip

export VERSION=develop
for s in $(python -c "import site; print(' '.join(site.getsitepackages()))"); do
 pip install --install-option="--prefix=" --upgrade --force-reinstall -I \
 -t "$s" git+https://github.com/salt-formulas/reclass.git@${VERSION};
done

mkdir -p /srv/salt/inventory/{classes,hosts}
mkdir -p /srv/salt/pillar/{file\_tree,roots/base}
mkdir -p /srv/salt/state/base/basenode

[root@localhost ~]# tree /srv/salt/
/srv/salt/
├── inventory
│   ├── classes
│   └── hosts
│   └── controller.openstack.yml
├── pillar
│   ├── file\_tree
│   └── roots
│   └── base
└── state
 └── base
 └── basenode
 └── init.sls

10 directories, 2 files

vi /srv/salt/state/base/basenode/init.sls

mc:
 pkg.installed

vi /srv/salt/inventory/hosts/controller.openstack.yml

environment:
 base classes: {}
 applications:
 - basenode

vi /etc/salt/master.d/01-master.conf

keep\_jobs: 24
max\_open\_files: 16384
open\_mode: True
auto\_accept: True
state\_top: top.sls
reclass: &reclass
 storage\_type: yaml\_fs
 inventory\_base\_uri: /srv/salt/inventory
 nodes\_uri: hosts
 classes\_uri: classes
 class\_mappings: []
master\_tops:
 reclass: \*reclass
state\_output: changes
file\_roots:
 base:
 - /srv/salt/state/base
env\_order:
 - base
hash\_type: sha256
file\_ignore\_regex:
 - '/\.svn($|/)'
 - '/\.git($|/)'
file\_ignore\_glob:
 - '\*.pyc'
 - '\*/somefolder/\*.bak'
 - '\*.swp'
fileserver\_backend:
 - roots
pillar\_roots:
 base:
 - /srv/salt/pillar/roots/base
ext\_pillar:
 - reclass:
 storage\_type: yaml\_fs
 inventory\_base\_uri: /srv/salt/inventory
 nodes\_uri: hosts
 classes\_uri: classes
 class\_mappings: []
 - file\_tree:
 root\_dir: /srv/salt/pillar/file\_tree
 follow\_dir\_links: False
 keep\_newline: True
pillar\_source\_merging\_strategy: smart
log\_level: warning

systemctl enable salt-master
systemctl start salt-master

NFS Freigabe für Salt Scripte

yum -y install nfs-utils
#firewall-cmd --permanent --zone=public --add-service=ssh
firewall-cmd --permanent --zone=public --add-service=nfs
firewall-cmd --reload
systemctl enable nfs-server.service
systemctl start nfs-server.service
/etc/exports
/srv/salt/ 10.0.0.0/24(rw,sync,no\_subtree\_check)
exportfs -a

Am Client:

sudo mount -o soft -t nfs 10.0.0.5:/srv/salt/ /home/tay/openstack/salt

Install Vault

yum install unzip
curl https://releases.hashicorp.com/vault/1.0.3/vault\_1.0.3\_linux\_amd64.zip -o vault\_1.0.3\_linux\_amd64.zip
unzip vault\_1.0.3\_linux\_amd64.zip
mv vault /usr/bin/
export VAULT\_ADDR='http://10.0.0.5:8200'
vi /root/vault.hcl
backend "file" {
 path = "/var/lib/vault"
}
listener "tcp" {
 address = "0.0.0.0:8200"
 tls\_disable = 1
}
vault server -config=/root/vault.hcl &
vault operator init

Unseal Key 1: hiR5fSIEaS5NErWwmH/KGpwo1UDROL4nW5SyCwk6kMNm
Unseal Key 2: iYJrQ3UCIuuqwonQJWu4JoLj+/ElQfrKxtnEfd/H83rC
Unseal Key 3: 6+sPo592bAA9n5VCz9agyIW7Xrsb5dBsP7YEpK9gdP6c
Unseal Key 4: fxKfoRb6IWL5+07X25AmoHGbjwypX7592VydbBl3jpPU
Unseal Key 5: ItaavrSMOR8Qn3Q2wd7BDEVd76k2NDczstZnqWyWndKw

Initial Root Token: s.5qhccbKwytnpX5sEjLDBp3hg

3 Times: until Unseal Progress 2/3 is 3/3:
vault operator unseal
vault login <Initial Root Token>
vault write secret/openstack/RABBIT\_PASS password="abc123"

Create Salt Token (Read and List)
vi salt-policy.hcl
path "openstack/\*" {
 capabilities = ["read", "list"]
}
path "auth/\*" {
 capabilities = ["read", "list","sudo","create","update","delete"]
}

vault policy write salt-policy salt-policy.hcl
vault token create -policy=salt-policy

Key Value
token s.PCGMAcQTrN505EA8BIB3dLku
token\_accessor avIpcDUGvSTJMUmb910eXTUG
token\_duration 768h
token\_renewable true
token\_policies ["default" "salt-policy"]
identity\_policies []
policies ["default" "salt-policy"]

Create Entries

for NAME in ADMIN\_PASS CINDER\_DBPASS CINDER\_PASS DASH\_DBPASS DEMO\_PASS GLANCE\_DBPASS GLANCE\_PASS KEYSTONE\_DBPASS METADATA\_SECRET NEUTRON\_DBPASS NEUTRON\_PASS NOVA\_DBPASS NOVA\_PASS PLACEMENT\_PASS PLACEMENT\_DBPASS RABBIT\_PASS
do
 PW=`openssl rand -hex 10`
 vault write secret/openstack/${NAME} password=${PW}
done

vi /etc/salt/master.d/vault.conf (with token from 2nd step obove – vault token create -policy=salt-policy )

vault:
 url: http://10.0.0.5:8200
 auth:
 method: token
 token: s.mIeRDNYMeGhJv2W5e96DGr7z
 policies:
 - salt-policy

vi salt-policy.hcl

path "secret/\*" {
 capabilities = ["read", "list"]
}
path "auth/\*" {
 capabilities = ["read", "list","sudo","create","update","delete"]
}