How to optimize CentOS (5.8/6.7) Linux production environment

How to optimize CentOS (5.8/6.7) Linux production environment

After the CentOS system is installed, it cannot be immediately used in the production environment. It usually needs to be optimized by our O & M personnel. Here are some basic optimization operations for Linux system installation. Note: This optimization is based on CentOS (5.8/6.7 ).

Next, I will briefly explain some basic optimization operations on Linux after installation.

Note: This optimization is based on CentOS (5.8/6.7 ). I will mention the minor differences between 5.8 and 6.7 During optimization.
Optimization entry:

1. Modify the IP address, gateway, host name, DNS, etc.
2. Disable selinux and clear iptables.
3. Add common users and perform sudo authorization management
4. Update yum source and necessary software installation
5. automatically update the server time on a regular basis
6. Streamline the Automatic startup Service
7. automatically clear/var/spool/clientmqueue/directory junk files at regular intervals, and place inode nodes fully occupied
8. Change the default ssh service port and disable remote connection from the root user.
9 Lock key file systems
10. Adjust the file descriptor size
11. Adjust the character set to support Chinese Characters
12 remove the screen display before system and kernel version Logon
13 Kernel Parameter Optimization

1. Modify the IP address, gateway, host name, DNS, etc.

1 [root @ localhost ~] # Vi/etc/sysconfig/network-scripts/ifcfg-eth0
2 DEVICE = eth0 # Nic name
3 BOOTPROTO = static # obtain the static IP address. For example, DHCP indicates that the IP address is automatically obtained.
4 IPADDR = 192.168.1.113 # IP Address
5 NETMASK = 255.255.255.0 # Subnet Mask
6 ONBOOT = yes # activate during boot
7 GATEWAY = 192.168.1.1
8 [root @ localhost ~] # Cat/etc/sysconfig/network-scripts/ifcfg-eth0
9 DEVICE = eth0
10 BOOTPROTO = static
11 IPADDR = 192.168.1.113
12 NETMASK = 255.255.255.0
13 ONBOOT = yes
14 GATEWAY = 192.168.1.1
15 [root @ localhost ~] # Vi/etc/sysconfig/network
16 HOSTNAME = c64 # modify the Host Name and restart it to take effect.
17 GATEWAY = 192.168.1.1 # modify the default GATEWAY. If no GATEWAY is configured in eth0, the GATEWAY here is used by default.
18 [root @ localhost ~] # Cat/etc/sysconfig/network
19 HOSTNAME = c64
20 GATEWAY = 192.168.1.1
21. You can also use hostnamec64 to temporarily modify the Host Name and log on again.
22. Modify DNS
23 [root @ localhost ~] # Vi/etc/resolv. conf # modify DNS information
24 nameserver 114.114.114.114
25 nameserver 8.8.8.8
26 [root @ localhost ~] # Cat/etc/resolv. conf # view the modified DNS information
27 nameserver 114.114.114.114
28 nameserver 8.8.8.8
29 [root @ localhost ~] # Service network restart # restart the NIC to take effect
30. You can also run the following command to restart the NIC:
31 [root @ localhost ~] #/Etc/init. d/network restart

2. Disable selinux and clear iptables.

1 [root @ server ~] # Sed-I's/SELINUX = enforcing/SELINUX = disabled/G'/etc/selinux/config # modifying the configuration file takes effect permanently, but the system must be restarted.
2 [root @ server ~] # Grep SELINUX = disabled/etc/selinux/config
3 SELINUX = disabled # view the changed result
4 [root @ server ~] # Setenforce 0 # temporary effective command
5 [root @ server ~] # Getenforce # view the current status of selinux
6 Permissive

Clear iptables

1 [root @ server ~] # Iptables-F # clear firewall rules
2 [root @ server ~] # Iptables-L # view firewall rules
3 Chain INPUT (policy ACCEPT)
4 target prot opt source destination
5 Chain FORWARD (policy ACCEPT)
6 target prot opt source destination
7 Chain OUTPUT (policy ACCEPT)
8 target prot opt source destination
9 [root @ server ~] #/Etc/init. d/iptables save # save firewall configuration information

3. Add common users and perform sudo authorization management

1 [root @ server ~] # Useradd sunsky
2 [root @ server ~] # Echo "123456" | passwd -- stdin sunsky & history-c
3 [root @ server ~] # Mongodo
4 Add the following content under the root ALL = (ALL) ALL row:
5 sunsky ALL = (ALL) ALL

4. Update yum source and necessary software installation

Yum install software. By default, the rpm package is obtained from the foreign official source and changed to the domestic source.
Two fast domestic sites: Sohu image site and Netease image site

Method 1: configure the source configuration file and upload it to linux.

Method 2: Install the source configuration file using the yum configured on the Image site
1 [root @ server ~] # Cd/etc/yum. repos. d/
2 [root @ server yum. repos. d] #/bin/mv CentOS-Base.repo CentOS-Base.repo.bak
3 [root @ server yum. repos. d] # wget http://mirrors.163.com/.help/CentOS6-Base-163.repo

Run the following command to check whether yum is normal.

[Root @ server yum. repos. d] # yum clean all # Clear yum Cache

[Root @ server yum. repos. d] # yum makecache # create yum Cache

Run the following command to update the system to the latest version.

[Root @ server yum. repos. d] # rpm -- import/etc/pki/rpm-gpg/RPM-GPG-KEY * # import the signature KEY to RPM

[Root @ server yum. repos. d] # yum upgrade-y # update the system kernel to the latest version

Next we need to install several necessary software.

[Root @ server yum. repos. d] # yum install lrzsz ntpdate sysstat-y

Lrzsz is a software for uploading and downloading data.

Sysstat is a tool used to detect system performance and efficiency.

5. automatically update server time on a regular basis

1 [root @ server ~] # Echo '*/5 *****/usr/sbin/ntpdate time.windows.com>/dev/null 2> & 1'>/var/spool/cron/root
2 [root @ server ~] # Echo '*/10 *****/usr/sbin/ntpdate time.nist.gov>/dev/null 2> & 1'>/var/spool/cron/root

Tip: The time synchronization command paths for CentOS 6.7 are different.

6 is/usr/sbin/ntpdate
 

5 is/sbin/ntpdate

Extension: when the number of machines is small, the synchronization time of the above scheduled tasks is enough. If the number of machines is large, you can deploy another time synchronization Server NTP Server in the network. This is only mentioned here and is not deployed.
 
6. Streamline boot self-starting services

After the operating system is installed, only crond, network, syslog, and sshd services can be retained. (Centos6.7 is rsyslog)

1 [root @ server ~] # For sun in 'chkconfig -- list | grep 3: on | awk '{print $1} ''; do chkconfig -- level 3 $ sun off; done
2 [root @ server ~] # For sun in crond rsyslog sshd network; do chkconfig -- level 3 $ sun on; done
3 [root @ server ~] # Chkconfig -- list | grep 3: on
4 crond 0: off 1: off 2: on 3: on 4: on 5: on 6: off
5 network 0: off 1: off 2: on 3: on 4: on 5: on 6: off
6 rsyslog 0: off 1: off 2: on 3: on 4: on 5: on 6: off
7 sshd 0: off 1: off 2: on 3: on 4: on 5: on 6: off

7. automatically clear/var/spool/clientmqueue/directory junk files at regular intervals. inode nodes are fully occupied.

In this optimization point, you can ignore the unnecessary operation on 6.7!

1 [root @ server ~] # Mkdir/server/scripts-p
2 [root @ server ~] # Vi/server/scripts/spool_clean.sh
3 #! /Bin/sh
4 find/var/spool/clientmqueue/-typef-mtime + 30 | xargsrm-f

8. Change the default ssh service port and disable remote connection from the root user.

1 [root @ server ~] # Cp/etc/ssh/sshd_config/etc/ssh/sshd_config.bak
2 [root @ server ~] # Vim/etc/ssh/sshd_config
3 Port 52113 # Use ssh to connect to the default Port
4 PermitRootLogin no # the root user hacker knows that remote logon is prohibited.
5 PermitEmptyPasswords no # disable empty Password Logon
6 UseDNS no # Do not use DNS
7 [root @ server ~] #/Etc/init. d/sshd reload # reload Configuration
8 [root @ server ~] # Netstat-lnt # view port information
9 [root @ server ~] # Lsof-I tcp: 52113

9. Lock key file systems

1 [root @ server ~] # Chattr + I/etc/passwd
2 [root @ server ~] # Chattr + I/etc/inittab
3 [root @ server ~] # Chattr + I/etc/group
4 [root @ server ~] # Chattr + I/etc/shadow
5 [root @ server ~] # Chattr + I/etc/gshadow

After using the chattr command, we need to rename it for security purposes

[Root @ server ~] #/Bin/mv/usr/bin/chattr/usr/bin/any name

10. Adjust the file descriptor size

[Root @ localhost ~] # Ulimit-n # view file descriptor size

1024

[Root @ localhost ~] # Echo '*-nofile 65535'>/etc/security/limits. conf

After the configuration is complete, log on again to view it.

Tip: You can also add the ulimit-SHn 65535 command to/etc/rc. local, and the command will take effect after each restart.

1 [root @ server ~] # Cat>/etc/rc. local <EOF
2 # open files
(3) ulimit-HSn 65535
4 # stack size
5 ulimit-s 65535
6 EOF
Extension: file descriptor
The file descriptor is a non-negative integer in form. In fact, it is an index value that points to the record table for opening files for each process maintained by the kernel. When the program opens an existing file or creates a new file, the kernel returns a file descriptor to the process. In program design, some underlying programming is usually centered around the file descriptor. However, the file descriptor concept is often only applicable to operating systems such as Unix and Linux.
 

Traditionally, the file descriptor of the standard input is 0, the standard output is 1, and the standard error is 2. Although this habit is not a feature of the Unix kernel, many applications will not be able to use it because some shells and many applications use this habit.
11. Adjust the character set to support Chinese Characters

1 sed-I's # LANG = "en_US.UTF-8" # LANG = "zh_CN.GB18030" # '/etc/sysconfig/i18n

1 source/etc/sysconfig/i18n

Extended: What is a character set?
In short, it is a set of text symbols and Their encoding. Common Character sets include:
GBK fixed-length dual-byte is not an international standard and many support systems

UTF-8 non-fixed length 1-4 bytes widely supported, MYSQL also use UTF-8
12. Remove the screen display before system and kernel version Logon
1 [root @ server ~] #>/Etc/RedHat-release
1 [root @ server ~] #>/Etc/issue
13. Kernel Parameter Optimization
Note: This optimization is suitable for apache, nginx, squid, and other web applications. Special Services may need to be slightly adjusted.

1 [root @ server ~] # Vi/etc/sysctl. conf
2 # by sun 20131001
3 net. ipv4.tcp _ fin_timeout = 2
4 net. ipv4.tcp _ tw_reuse = 1
5 net. ipv4.tcp _ tw_recycle = 1
6. net. ipv4.tcp _ syncookies = 1
7 net. ipv4.tcp _ keepalive_time = 600
8 net. ipv4.ip _ local_port_range = 4000 65000
9 net. ipv4.tcp _ max_syn_backlog = 16384
10 net. ipv4.tcp _ max_tw_buckets = 36000
11 net. Route 4.route. gc_timeout = 100
12 net. ipv4.tcp _ syn_retries = 1
13 net. ipv4.tcp _ synack_retries = 1
14. net. core. somaxconn = 16384
15 net. core. netdev_max_backlog = 16384
16 net. ipv4.tcp _ max_orphans = 16384
17 # The following parameters are used to optimize the iptables firewall. If the firewall does not have a meeting, you can ignore them.
18 net. ipv4.ip _ conntrack_max = 25000000
19 net. ipv4.netfilter. ip_conntrack_max = 25000000
20 net. ipv4.netfilter. ip_conntrack_tcp_timeout_established = 180
21 net. ipv4.netfilter. ip_conntrack_tcp_timeout_time_wait = 120
22 net. ipv4.netfilter. ip_conntrack_tcp_timeout_close_wait = 60
23 net. ipv4.netfilter. ip_conntrack_tcp_timeout_fin_wait = 120
24 [root @ localhost ~] # Sysctl-p # prompt for the configuration file to take effect: Because the module name in CentOS6.X is not ip_conntrack, but nf_conntrack, it is in/etc/sysctl. net. ipv4.netfilter. change ip_conntrack_max to net. netfilter. nf_conntrack_max.
That is, to optimize the firewall, which is

1 net. ipv4.ip _ conntrack_max = 25000000
2 net. ipv4.netfilter. ip_conntrack_max = 25000000
3 net. ipv4.netfilter. ip_conntrack_tcp_timeout_established = 180
4 net. ipv4.netfilter. ip_conntrack_tcp_timeout_time_wait = 120
5 net. ipv4.netfilter. ip_conntrack_tcp_timeout_close_wait = 60
6. net. ipv4.netfilter. ip_conntrack_tcp_timeout_fin_wait = 120

1 net. ipv4.tcp _ syn_retries = 1
2 net. ipv4.tcp _ synack_retries = 1
3 net. ipv4.tcp _ keepalive_time = 600
4 net. ipv4.tcp _ keepalive_probes = 3
5 net. ipv4.tcp _ keepalive_intvl = 15
6. net. ipv4.tcp _ retries2 = 5
7 net. ipv4.tcp _ fin_timeout = 2
8 net. ipv4.tcp _ max_tw_buckets = 36000
9 net. ipv4.tcp _ tw_recycle = 1
10 net. ipv4.tcp _ tw_reuse = 1
11 net. ipv4.tcp _ max_orphans = 32768
12 net. ipv4.tcp _ syncookies = 1
13. net. ipv4.tcp _ max_syn_backlog = 16384
14 net. ipv4.tcp _ wmem = 8192 131072 16777216
15 net. ipv4.tcp _ rmem = 32768 131072 16777216
16 net. ipv4.tcp _ mem = 786432 1048576 1572864
17 net. ipv4.ip _ local_port_range = 1024 65000
18 net. ipv4.ip _ conntrack_max = 65536
19 net. ipv4.netfilter. ip_conntrack_max = 65536
20 net. ipv4.netfilter. ip_conntrack_tcp_timeout_established = 180
21. net. core. somaxconn = 16384
22. net. core. netdev_max_backlog = 16384. In addition, an error may occur during the optimization process:

1. In version 5.8

1 error: "net. ipv4.ip _ conntrack_max" is an unknown key
2 error: "net. ipv4.netfilter. ip_conntrack_max" is an unknown key
3 error: "net. ipv4.netfilter. ip_conntrack_tcp_timeout_established" is an unknown key
4 error: "net. ipv4.netfilter. ip_conntrack_tcp_timeout_time_wait" is an unknown key
5 error: "net. ipv4.netfilter. ip_conntrack_tcp_timeout_close_wait" is an unknown key
6 error: "net. ipv4.netfilter. ip_conntrack_tcp_timeout_fin_wait" is an unknown key

This error may be because your firewall is not enabled or the module ip_conntrack that can be loaded is not automatically loaded. solution 2: Enable the firewall and enable the module ip_conntrack.

Modprobe ip_conntrack

Echo "modprobe ip_conntrack">/etc/rc. local

2. version 6.7

1 error: "net. nf_conntrack_max" isan unknown key
2 error: "net. netfilter. nf_conntrack_max" isan unknown key
3 error: "net. netfilter. nf_conntrack_tcp_timeout_established" isan unknown key
4 error: "net. netfilter. nf_conntrack_tcp_timeout_time_wait" isan unknown key
5 error: "net. netfilter. nf_conntrack_tcp_timeout_close_wait" isan unknown key
6 error: "net. netfilter. nf_conntrack_tcp_timeout_fin_wait" isan unknown key3 and 6.7

1 error: "net. bridge. bridge-nf-call-ip6tables" isan unknown key
2 error: "net. bridge. bridge-nf-call-iptables" isan unknown key
3 error: "net. bridge. bridge-nf-call-arptables" isan unknown key

This error occurs because the system does not automatically load the loaded module. The solution is to automatically process the loaded module ip_conntrack.

Modprobe bridge

Echo "modprobe bridge">/etc/rc. local