Daily optimization of Linux services

Linux service before the installation of the optimization work.

2. echo ">/etc/udev/rules.d/70-persistent-net.rules" >/etc/rc.local boot automatic execution
   2. Turn off SELINUX sed-i ' s#selinux=enforcing#selinux=disabled#g '/etc/selinux/config
   Getenforce (view SELinux) Setenforce 0 (Allow) Setenforce 1 (Deny)
   3.chkconfig | Egrep-v "Crond|sshd|network|rsyslog|sysstat" | awk ' {print ' Chkconfig ', $, ' off '} ' | Bash (compact boot-up service)
   4. Clean up redundant users, add users, and add sudo authorization
   Useradd Zhou
   Cp/etc/sudoers/etc/sudoers.ori
   echo "Zhou All= (All) Nopasswd:all" >>/etc/sudoers
   Tail-1/etc/sudoers
   VISUDO-C (check syntax is correct)
   5. Chinese Character Set
   Cp/etc/sysconfig/i18n/etc/sysconfig/i18n.ori
   Echo ' lang= ' ZH_CN. Utf.8 "' >/etc/sysconfig/i18n
   source/etc/sysconfig/i18n (to make the above effective).
   Echo $LANG
4. Time synchronization
   echo "#time sync by Zhou at 2018-7-24" >>var/spool/cron/root
   echo "/5 */usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1" >>var/spool/cron/root
   Crontab-l (view) (Do you need to configure time synchronization server NTP)
6. Command-line Security
   echo "Export tmout=300" >>/etc/profile
   echo "Export histsize=5" >>/etc/profile
   echo "Histfilesize=5" >>/etc/profile
   Tail-3/etc/profile
   Source/etc/profile
8. Increase the file descriptor (the kernel uses the file descriptor to access the file.) When you open an existing file or create a new file, the kernel returns a file descriptor. Read-write files also need to use file descriptors to specify which files to read and write
   echo "*-Nofile 65535" >>/etc/security/limits.conf
   Tail-1/etc/security/limits.conf (need to enlarge file descriptor in high Concurrency environment)
9. Kernel Optimizations
   The optimization method is the cat >>vi/etc/sysctl.conf<<eof
   Net.ipv4.tcp_fin_timeout = 2
   Net.ipv4.tcp_tw_reuse = 1
   Net.ipv4.tcp_tw_recycle = 1
   Net.ipv4.tcp_syncookies = 1
   Net.ipv4.tcp_keepalive_time = 600
   Net.ipv4.ip_local_port_range = 4000 65000
   Net.ipv4.tcp_max_syn_backlog = 16384
   Net.ipv4.tcp_max_tw_buckets = 36000
   Net.ipv4.route.gc_timeout = 100
   Net.ipv4.tcp_syn_retries = 1
   Net.ipv4.tcp_synack_retries = 1
   Net.core.somaxconn = 16384
   Net.core.netdev_max_backlog = 16384
   Net.ipv4.tcp_max_orphans = 16384
   #以下参数是对防火墙的优化, the firewall does not meet the prompts, you can ignore the
   Net.nf_conntrack_max = 25000000
   Net.netfilter.nf_conntrack_max = 25000000
   net.netfilter.nf_conntrack_tcp_timeout_established = 180
   net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
   Net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
   net.netfilter.nf_conntrack_tcp_timeout_fine_wait = 120
   Eof
   10. Change the default remote link SSH service port, prohibit the root user to log on remotely, even change ssh
   Service only listens to intranet IP "vim/etc/ssh/sshd.conf (server Profile),/et/ssh/ssh.conf (Client Profile)"
   11. Configure the Yum update source to download the installation package from the domestic update source. "VIM/ETC/YUM.REPOS.D/CENTOS-BASE.REPOS.D (backup before modification) only modifies {BaseURL} {Addons}{extras}{centosplus} The BaseURL and Gpgkey in these items are the corresponding source addresses. After the modification is complete, empty the Yum cache and rebuild the Yum cache (Yum clean all &&yum clean &&yum cl) "
   "Domestic update Source 1. Shanghai Http://ftp.sjtu.edu.cn/centos
11. China University of Science and Technology http://centos.ustc.edu.cn
13. Sohu Open-source mirror server http://mirrors.sohu.com
15. NetEase's Open source server image: Http://mirrors.163.com/centos
    】
    12. Regular automatic cleanup of mail temporary directory junk files, to prevent the number of disk inodes by small files full (mail temporary storage location/var/spool/postfix/maildrop)
    13 Lock critical system files such as/etc/passwd/etc/shadow/etc/group/etc/gshadow/etc/inittab
    >/etc/issue (Hide system version information)
    15 Disable host is ping{iptables-a input-p icmp–icmp-type 8-j DROP
    Iptables-a input-p icmp–icmp-type 0-j ACCEPT
    Iptables-a input-p icmp–icmp-type 3-j ACCEPT
    Iptables-a input-p icmp-j DROP}
    16 patch upgrade software with known vulnerabilities

Daily optimization of Linux services