Linux Advanced application------system optimization

after installing the Linux system on the machine, we usually have system update, software installation, software update, system optimization and so on, this time we discuss the most easy to forget and ignore the system optimization.

The following is a list of optimization points for Linux and a list of optimization commands for each point (tested)

applies to (Centos/redhat/fedora 5-6 version)

1. Turn off SELinux function

Sed-i ' s/selinux=enforcing/selinux=disabled/'/etc/selinux/config

Setenforce 0 >/dev/null 2>&1

2. Set the run level to 3

Sed-i ' S#id:5:initdefault: #id: 3:initdefault:# '/etc/inittab

3. Thin Boot Boot

Method One:

lang=en && for name in ' Chkconfig--list | grep 3:on | awk ' {print '} ' | Grep-ev "Sshd|network|sysstat|crond|rsyslog"; Do chkconfig $name off; Done

Method Two:

lang=en && chkconfig--list | grep 3:on | Grep-ve "Crond|sshd|network|rsyslog|sysstat" | awk ' {print '} ' | Sed-r ' s# (. *) #chkconfig \1 off#g ' |bash

Method Three:

lang=en && chkconfig--list | grep 3:off | awk ' {print '} ' | Grep-ev "Sshd|network|sysstat|crond|rsyslog" | awk ' {print ' chkconfig ' off '} ' | Bash

4. Close the iptables firewall (there is an extranet IP to be cautious)

/etc/init.d/iptables Stop && chkconfig iptables off

5. SSH optimized shutdown userdns Check, change access port, prohibit null password login, disable root login, disable GSS check

sed-r-e ' s/#? Usedns yes/usedns no/' \

-E ' s/#+port 22/port 22/' \

-E ' s/#+permitemptypasswords no/permitemptypasswords no/' \

-E ' s/#+permitrootlogin yes/permitrootlogin no/' \

-E ' s/gssapiauthentication yes/gssapiauthentication no/' \

-i/etc/ssh/sshd_config

# #通过防火墙限制仅能使用内网IP连接服务器 (use with caution)

Iptables-i input-p TCP--dport 22-s 192.168.56.0/24-j ACCEPT

6. Sudo security management

Method One:

Visodu Manual Management

Method Two:

Sed-i "' Grep-en" ^root "/etc/sudoers| Awk-f ': ' {print $} ' aroot\tall= (All) \tnopasswd:all "/etc/sudoers && visudo-c

7. Chinese display first backup, then modify, the last comparison

Cp/etc/sysconfig/i18n/etc/sysconfig/i18n.ori && sed-i ' S#en_us. Utf-8#zh_cn. Utf-8#g '/etc/sysconfig/i18n && source/etc/sysconfig/i18n

8. Time synchronization

echo "#time sync by Cnlisea at ' date +%f" "%T" >>/var/spool/cron/root

echo "*/30 * * * * */usr/sbin/ntpdate pool.ntp.org >/dev/null 2>&1" >>/var/spool/cron/root Hwclock

9. System Usage Settings

Set Idle account timeout time

echo "Export tmout=300" >>/ETC/BASHRC

Set the number of history commands

echo "Export histsize=5" >>/ETC/BASHRC

Command data for History files

echo "Export histfilesize=5" >>/ETC/BASHRC

Source/etc/bashrc

10. Adjust the number of Linux system file descriptors

Echo-e "*\t\t-\tnofile\t\t65535" >>/etc/security/limits.conf

Source/etc/bashrc

Linux kernel parameter optimization

net.ipv4.tcp_fin_timeout = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syncookies = 1

Net.ipv4.tcp_keepalive_time =

net.ipv4.ip_local_port_range = 4000 65000

Net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.route.gc_timeout =

net_ipv4.tcp_syn_retries = 1

net.ipv4.tcp_synack_retries = 1

net.core.somaxconn = 16384

Net.core.netdev_max_backlog = 16384

Net.ipv4.tcp_max_orphans = 16384

//Is the optimization of the iptables firewall

Net.nf_conntrack_max = 25000000

Net.netfilter.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_tcp_timeout_established =

net.netfilter.nf_conntrack_tcp_timeout_time_wait =

net.netfilter.nf_conntrack_tcp_timeout_close_wait =

net.netfilter.nf_conntrack_tcp_timeout_fin_wait =

# #重新加载系统参数

sysctl-p

12. Hide Linux Version information

>/etc/issue

>/etc/issue.net

13. Lock Critical system files (use caution)

Locking Chattr +i/etc/passwd/etc/shadow/etc/group/etc/gshadow/etc/inittab

Unlock Chattr-i/etc/passwd/etc/shadow/etc/group/etc/gshadow/etc/inittab

Change the name of Chattr

Mv/usr/bin/chattr/usr/bin/lisea

14. Clear the redundant system virtual account

Clean up as needed.

15. Disable the system from being ping(use caution)

echo "Net.ipv4.icmp_echo_ignore_all = 1" >>/etc/sysctl.conf

sysctl-p

This article is from the "Sea" blog, be sure to keep this source http://lisea.blog.51cto.com/5491873/1843139

Linux Advanced application------system optimization