Tech Notes

技术笔记Technical Notes

二十年IT基础设施运维经验沉淀，涵盖Windows Server、Linux系统管理、虚拟化平台、网络架构与安全合规等多个技术领域的实战心得与问题解决方案。Two decades of IT infrastructure experience distilled into practical notes covering Windows Server, Linux, virtualization, networking, and security compliance.

🪟 Windows Server 运维精要Windows Server Administration Essentials

曾在企业环境中管理数千台Windows Server（2012 R2 至 2025），积累了丰富的企业级Windows管理经验。核心工作涵盖GPO安全基线、Active Directory、WSUS补丁管理、Sysprep无人值守部署、KMS批量激活体系。Managed thousands of Windows Servers (2012 R2 to 2025) in enterprise environments, spanning GPO security baselines, Active Directory, WSUS patch management, Sysprep deployment, and KMS batch activation.

GPO安全基线加固 — 使用Microsoft Security Compliance Toolkit和LGPO工具批量部署安全基线，覆盖端口管控（135/445/NetBIOS）、远程桌面凭据保护、自动登录策略等GPO Security Hardening — Deploy security baselines via LGPO, covering port control (135/445/NetBIOS), RDP credential protection, and auto-logon policies
Active Directory域服务 — AD DS森林与域的规划部署、GPO设计与排错、DNS/DHCP集成、跨站点复制策略配置Active Directory — AD DS forest/domain planning, GPO design & troubleshooting, DNS/DHCP integration, cross-site replication
WSUS补丁管理 — 分批推送安全补丁，结合PowerShell脚本监控安装状态WSUS Patch Management — Staged security patch rollout with PowerShell-based installation monitoring
Windows故障转移集群 — Failover Clustering配置与仲裁模式选择，Hyper-V高可用集群、存储空间直通(S2D)实践Failover Clustering — Cluster configuration & quorum modes, Hyper-V HA clusters, Storage Spaces Direct (S2D)
Sysprep自动化部署 — 结合Windows ADK的应答文件与自定义脚本，实现操作系统的无人值守安装与初始化配置Sysprep Automated Deployment — Combine Windows ADK answer files with custom scripts for unattended OS installation
版本升级与迁移 — Windows Server标准版到数据中心版的在线升级、跨版本迁移的实战经验Version Upgrades — In-place upgrades from Standard to Datacenter edition, cross-version migration experience
KMS批量激活体系 — 部署KMS主机实现Windows Server与Office的企业级自动激活，覆盖全版本（2012-2025）。常见故障排查包括0xC004F074错误码处理、DNS SRV记录配置验证KMS Batch Activation — KMS hosts for enterprise auto-activation (2012-2025). Troubleshooting: 0xC004F074 errors and DNS SRV validation

点击查看详细技术笔记Click for detailed technical notes

🐧 Linux 系统管理Linux System Administration

主要使用CentOS 7/8、AlmaLinux 9和Ubuntu Server，负责Linux服务器的标准化部署、网络配置、磁盘管理与故障排查。Primarily working with CentOS 7/8, AlmaLinux 9, and Ubuntu Server for standardized deployment, networking, disk management, and troubleshooting.

网络配置 — nmcli网卡管理、双网卡路由配置、网卡UUID生成、IPv6配置与禁用策略Networking — nmcli NIC management, dual-NIC routing, UUID generation, IPv6 configuration
自动化部署 — 使用Packer构建标准化镜像（CentOS/AlmaLinux），配合Kickstart实现全自动安装Automated Deployment — Build standardized images with Packer (CentOS/AlmaLinux) using Kickstart
磁盘与存储 — LVM磁盘扩容、RAID阵列配置（通过ssacli/storcli命令行工具管理HPE/LSI阵列卡）Disk & Storage — LVM expansion, RAID configuration via ssacli/storcli CLI tools for HPE/LSI controllers
故障排查 — WRITE SAME错误处理、单用户模式密码重置、Crontab定时任务调试Troubleshooting — WRITE SAME errors, single-user mode password reset, crontab debugging

点击查看详细技术笔记Click for detailed technical notes

☁️ 虚拟化平台Virtualization Platforms

深度使用VMware vSphere/ESXi、Microsoft Hyper-V及KVM三大虚拟化平台，在企业环境中管理大规模虚拟化集群。Deep experience with VMware vSphere/ESXi, Microsoft Hyper-V, and KVM for managing large-scale virtualization clusters in enterprise environments.

VMware vSphere — VCSA部署与迁移、ESXi密码策略管理、静态MAC地址配置、Syslog日志转发、V2V迁移（ESXi到KVM）VMware vSphere — VCSA deployment & migration, ESXi password policies, static MAC config, Syslog forwarding, V2V migration
Hyper-V — 虚拟交换机配置、调度程序类型优化、实时迁移配置与故障排查Hyper-V — Virtual switch configuration, scheduler type optimization, live migration setup
KVM — 多VLAN网络配置、虚拟机冷迁移与热迁移、Windows 10/11虚拟机部署、virsh命令行管理KVM — Multi-VLAN networking, cold/hot migration, Windows 10/11 VM deployment, virsh CLI management

点击查看详细技术笔记Click for detailed technical notes

⚙️ 自动化运维Automation & DevOps

通过Packer镜像构建、PowerShell/Python脚本、Nginx反向代理等工具，构建高效的自动化运维体系。Building efficient automation systems through Packer image building, PowerShell/Python scripting, and Nginx reverse proxy.

Packer — 基于Packer构建Windows/Linux标准化镜像，集成到CI/CD流水线（GitLab CI），实现操作系统镜像的版本化管理与自动发布Packer — Standardized Windows/Linux images with Packer, integrated into GitLab CI for versioned image management
脚本自动化 — PowerShell批量密码轮换、Python运维脚本、WinRM远程管理Scripting — PowerShell batch password rotation, Python ops scripts, WinRM remote management
Web服务 — Nginx基础配置与反向代理、Django部署Web Services — Nginx configuration & reverse proxy, Django deployment
监控 — Zabbix监控部署与配置、服务器硬件状态监控Monitoring — Zabbix deployment, server hardware monitoring

点击查看详细技术笔记Click for detailed technical notes

🔐 安全加固与合规Security Hardening & Compliance

曾负责服务器安全基线制定与合规审计，参与国家级网络安全护网行动保障。Responsible for server security baseline and compliance audit in enterprise environments, participating in national cybersecurity defense initiatives.

安全基线 — 基于Microsoft Security Baseline制定企业级Windows安全配置标准，覆盖端口管控、协议禁用（NetBIOS/LLMNR）、RDP凭据保护等Security Baselines — Enterprise Windows security standards based on Microsoft Security Baseline, covering port control, protocol disabling (NetBIOS/LLMNR), RDP protection
合规审计 — VMware SOC合规报告审核、年度内外部安全审计执行与整改跟踪Compliance — VMware SOC report review, annual internal/external security audit and remediation tracking
事件登录审计 — Windows安全日志分析（登录类型解析）、异常访问行为检测Event Auditing — Windows security log analysis (login type parsing), anomalous access detection

点击查看详细技术笔记Click for detailed technical notes

🤖 AI 与大语言模型应用AI & Large Language Model Applications

在IT运维和日常工作中深度探索AI大语言模型的实际应用场景，从代码生成到运维自动化，充分发挥AI作为「智能副驾驶」的生产力价值。Deeply exploring practical AI/LLM applications in IT operations — from code generation to ops automation, leveraging AI as an intelligent copilot for productivity.

Claude / ChatGPT 运维助手 — 利用大语言模型辅助编写PowerShell/Python运维脚本、排查复杂故障、生成配置模板与文档Claude / ChatGPT Ops Assistant — LLM-assisted script writing, troubleshooting, config template and documentation generation
AI驱动的代码审查 — 使用Claude Code进行代码审查、安全漏洞检测、性能优化建议AI-Powered Code Review — Claude Code for code review, security vulnerability detection, performance optimization
RAG知识库应用 — 基于检索增强生成(RAG)构建内部IT知识库，实现智能化故障排查指引RAG Knowledge Base — RAG for internal IT knowledge base with intelligent troubleshooting guides
MCP协议与工具集成 — 通过Model Context Protocol (MCP)将AI与日历、邮件、数据库等工具集成，构建智能工作流MCP Protocol & Tool Integration — MCP for integrating AI with calendars, email, databases — building intelligent workflows
本地AI部署 — 使用Ollama在本地运行开源LLM（Llama、Qwen等），保护数据隐私Local AI Deployment — Run open-source LLMs locally via Ollama (Llama, Qwen), ensuring data privacy

点击查看详细技术笔记Click for detailed technical notes

🐳 容器化与基础设施即代码Containers & Infrastructure as Code

在企业运维和家庭实验室中广泛使用Docker容器化部署，结合docker-compose编排和GitLab CI/CD流水线，实现服务的标准化交付与自动化管理。Extensive Docker containerization in enterprise ops and home lab, with docker-compose orchestration and GitLab CI/CD for standardized delivery.

Docker实战 — 在群晖NAS上运行20+容器化服务（HA、Scrypted、UniFi Controller、AdGuard等），统一通过docker-compose管理Docker in Practice — 20+ containerized services on Synology NAS, all managed via docker-compose
镜像构建流水线 — 基于Packer + GitLab CI构建OS镜像自动化流水线Image Pipeline — Packer + GitLab CI for automated OS image pipeline
Nginx反向代理 — 为所有内部Web服务配置统一入口，集中SSL证书管理Nginx Reverse Proxy — Unified entry for all internal web services with centralized SSL
配置即代码 — 所有容器配置、compose文件存储在Git仓库中进行版本控制Config as Code — All configs and compose files version-controlled in Git

点击查看详细技术笔记Click for detailed technical notes

🐧 Linux 系统管理 — 深度详解Linux System Administration — Deep Dive

网络配置进阶

nmcli实战 — 使用nmcli con mod配置静态IP、DNS、网关，nmcli dev status快速查看网卡状态
双网卡路由 — 通过策略路由（ip rule/ip route）实现管理网与业务网分离，避免默认路由冲突
网卡UUID — 克隆虚拟机后需重新生成UUID：uuidgen并更新/etc/sysconfig/network-scripts/ifcfg-*
IPv6管理 — 企业环境中选择性禁用IPv6：通过sysctl参数或grub启动参数ipv6.disable=1

Advanced Network Configuration

nmcli Hands-on — nmcli con mod for static IP/DNS/gateway, nmcli dev status for quick NIC overview
Dual-NIC Routing — Policy routing (ip rule/ip route) for management and production network separation
NIC UUID — Regenerate UUID after VM cloning: uuidgen then update /etc/sysconfig/network-scripts/ifcfg-*
IPv6 Management — Selective IPv6 disabling: sysctl or grub parameter ipv6.disable=1

☁️ 虚拟化平台 — 深度详解Virtualization Platforms — Deep Dive

VMware vSphere 运维进阶

VCSA部署 — vCenter Server Appliance从OVA部署、从Windows vCenter迁移到VCSA的完整流程
ESXi密码策略 — 通过/etc/pam.d/passwd和Security.PasswordQualityControl高级设置自定义密码复杂度
Syslog配置 — 将ESXi日志转发到集中式日志服务器：esxcli system syslog config set --loghost=tcp://IP:514
V2V迁移 — 使用qemu-img convert将ESXi vmdk转换为KVM qcow2格式

VMware vSphere Advanced Operations

VCSA Deployment — Full workflow for OVA deployment and Windows vCenter to VCSA migration
ESXi Password Policy — Customize complexity via /etc/pam.d/passwd and Security.PasswordQualityControl
Syslog Config — Forward ESXi logs: esxcli system syslog config set --loghost=tcp://IP:514
V2V Migration — Convert ESXi vmdk to KVM qcow2 via qemu-img convert

⚙️ 自动化运维 — 深度详解Automation & DevOps — Deep Dive

Packer 镜像流水线

GitLab CI触发Packer构建 → 自动化测试 → 推送到镜像仓库 → 通知部署团队
支持Windows Server 2019/2022和CentOS/AlmaLinux多平台镜像
月度安全补丁自动集成，确保新部署服务器即时符合安全基线

Packer Image Pipeline

GitLab CI triggers Packer build → automated testing → push to image repo → notify deployment team
Supports Windows Server 2019/2022 and CentOS/AlmaLinux multi-platform images
Monthly security patches auto-integrated for immediate baseline compliance

🔐 安全加固与合规 — 深度详解Security Hardening & Compliance — Deep Dive

企业级安全基线体系

Windows安全基线 — 基于CIS Benchmark和Microsoft Security Baseline，覆盖200+配置项
Linux安全基线 — SSH加固（禁用root远程登录、禁用密码认证、限制密钥算法）、文件权限审计
自动化检查 — 定期扫描全量服务器的安全配置合规状态，自动生成偏差报告

Enterprise Security Baseline Framework

Windows Baseline — Based on CIS Benchmark and Microsoft Security Baseline, covering 200+ configuration items
Linux Baseline — SSH hardening (disable root login, password auth; restrict key algorithms), file permission audit
Auto-scan — Periodic full-fleet security config compliance scans with auto-generated deviation reports

🤖 AI 与大语言模型应用 — 深度详解AI & Large Language Model Applications — Deep Dive

AI 在 IT 运维中的实战应用

脚本生成与优化 — 描述需求即可生成PowerShell/Python运维脚本，效率提升5-10倍。例如批量密码轮换、资产审计报表、日志分析脚本等
故障排查辅助 — 将错误日志、堆栈跟踪粘贴给AI，快速定位根因并获得修复建议
文档与知识管理 — AI辅助撰写运维文档、SOP标准操作流程、变更管理记录
配置审查 — 审查Nginx/Apache配置、防火墙规则、GPO设置中的安全风险与最佳实践偏差

AI in IT Operations — Real-World Applications

Script Generation — Describe requirements to generate PowerShell/Python ops scripts, 5-10x efficiency gain
Troubleshooting — Paste error logs and stack traces to AI for rapid root cause analysis and fix recommendations
Documentation — AI-assisted ops documentation, SOPs, and change management records
Config Review — Review Nginx/Apache configs, firewall rules, GPO settings for security risks

回到顶部Back to top