Linux: Basic optimization of the system

Preface, in the possession of a server, first thing will be based on their own needs for the initial optimization (installed system), the following is about the basic optimization of Linux systems, content sources and networks, their own collation of the following, forget from which URL,

CentOS System Optimization
1. Kernel parameter optimization
[Email protected] ~]# vi/etc/sysctl.conf #末尾添加如下参数
net.ipv4.tcp_syncookies = 1 #1是开启SYN cookies, when there is a SYN wait queue overflow, enable Cookies to be located, to prevent a small number of SYN attacks, the default is 0 off
Net.ipv4.tcp_tw_reuse = 1 #1是开启重用, allow time_ait sockets to be re-used for new TCP connections, default is 0 off
Net.ipv4.tcp_tw_recycle = 1 #TCP失败重传次数, default is 15, reduce the number of times to release kernel resources
Net.ipv4.ip_local_port_range = 4096 65000 #应用程序可使用的端口范围
Net.ipv4.tcp_max_tw_buckets = #系统同时保持TIME_WAIT套接字的最大数量, if this number is exceeded, the Time_wati socket is immediately cleared and the warning message is printed, default 180000
Net.ipv4.tcp_max_syn_backlog = 4096 #进入SYN宝的最大请求队列, default is 1024
Net.core.netdev_max_backlog = 10240 #允许送到队列的数据包最大设备队列, default 300
Net.core.somaxconn = 2048 #listen挂起请求的最大数量, default 128
Net.core.wmem_default = 8388608 #发送缓存区大小的缺省值
Net.core.rmem_default = 8388608 #接受套接字缓冲区大小的缺省值 (in bytes)
Net.core.rmem_max = 16777216 #最大接收缓冲区大小的最大值
Net.core.wmem_max = 16777216 #发送缓冲区大小的最大值
Net.ipv4.tcp_synack_retries = 2 #SYN-ack handshake State Retry count, default 5
Net.ipv4.tcp_syn_retries = 2 #向外SYN握手重试次数, default 4
net.ipv4.tcp_tw_recycle = 1 #开启TCP连接中TIME_WAIT sockets fast recovery, default is 0 off
Net.ipv4.tcp_max_orphans = 3276800 #系统中最多有多少个TCP套接字不被关联到任何一个用户文件句柄上, if this number is exceeded, the orphan connection will immediately reset and print the warning message
Net.ipv4.tcp_mem = 94500000 915000000 927000000
NET.IPV4.TCP_MEM[0]: Below this value, TCP has no memory pressure;
NET.IPV4.TCP_MEM[1]: Under this value, enter the memory pressure phase;
NET.IPV4.TCP_MEM[2]: Above this value, TCP refuses to allocate the socket. The memory unit is the page, can adjust according to the physical memory size, if the memory is large enough, it can be raised appropriately. The above memory units are pages, not bytes.
2. Synchronization system Time
[Email protected] ~]# Cp/usr/share/zoneinfo/asia/shanghai/etc/localtime #设置Shanghai时区
[Email protected] ~]# ntpdate cn.pool.ntp.org; hwclock–w #同步时间并写入blos硬件时间
[Email protected] ~]# crontab–e #设置任务计划每天零点同步一次
0 * * * */usr/sbin/ntpdate cn.pool.ntp.org; Hwclock-w
3. Revise history record
[Email protected] ~]# Vi/etc/profile #修改记录10个
histsize=10
4. Removal of system-related information
[[email protected] ~]# echo "Welcome to Server" >/etc/issue
[[email protected] ~]# echo "Welcome to Server" >/etc/redhat-release
5. adjust file descriptor size
[Email protected] ~]# ulimit–n #默认是1024-u max process
1024
[Email protected] ~]# echo "Ulimit-shn 102400" >>/etc/rc.local #设置开机自动生效
Table 1. Ulimit parameter Description
option [options] meaning example
-H sets the hard resource limit once the setting cannot be increased. ULIMIT–HS 64; Limit hard resources, thread stack size is 64K.
-S sets the soft resource limit, which can be increased after setup, but cannot exceed the hard resource settings. ULIMIT–SN 32; Restrict soft resources, 32 file descriptors.
-a displays all current limit information. Ulimit–a; Displays all current limit information.
-c the size of the largest core file, in blocks. Ulimit–c Unlimited; the size of the resulting core file is not limited.
The size of the largest data segment of the-D process, in Kbytes. Ulimit-d Unlimited; The data segment size of the process is not limited.
The-f process can create a maximum value for the file, in blocks. ulimit–f 2048; Limit the maximum file size that a process can create to 2048 blocks.
-L maximum lockable memory size, in Kbytes. Ulimit–l 32; Limit maximum lockable memory size to Kbytes.
-m maximum memory size, in Kbytes units. Ulimit–m Unlimited; No limit on maximum memory.
-N to open the maximum number of file descriptors. Ulimit–n 128; Limit the maximum number of 128 file descriptors that can be used.
The size of the-p pipe buffer, in Kbytes. Ulimit–p 512; Limit the size of the pipe buffer to Kbytes.
-s thread stack size, in Kbytes units. Ulimit–s 512; The size of the limit line stacks is Kbytes.
-T maximum CPU elapsed time, in seconds. Ulimit–t Unlimited; There is no limit to the maximum CPU occupancy time.
The maximum number of processes available to the-u user. Ulimit–u 64; Limit the maximum number of users to use 64 processes.
The maximum available virtual memory for the-V process, in Kbytes. Ulimit–v 200000; Limit the maximum available virtual memory to 200000 Kbytes.
6. Turn off restart Ctl-alt-delete key combination
[Email protected] ~]# vi/etc/init/control-alt-delete.conf
#exec/sbin/shutdown-r Now "control-alt-deletepressed" #注释掉
7. Remove unnecessary system users
8. Turn off unnecessary boot service
Chkconfig--list | grep 3:on# View Start-up service
Chkconfig Service name off #关闭自动的服务
9. Disable root Telnet
[[Email protected]~]# vi/etc/ssh/sshd_config
Permitrootloginno
Permitemptypasswords No #禁止空密码登录
Usednsno #关闭DNS查询
10, add ordinary users and sudo authorization management
[[Email protected]~]# useradd User
[Email protected]~]# echo "123456" | passwd--stdin User #设置密码
[[Email protected]~]# vi/etc/sudoers #或visudo打开, add all user rights
Root all= (All) all
User all= (All) all
11. Clear the firewall and set the rules
[Email protected]~]# iptables-f #清楚防火墙规则
[Email protected]~]# iptables-l #查看防火墙规则
[[Email protected]~]# iptables-a input-p TCP--dport 80-j ACCEPT
[[Email protected]~]# iptables-a input-p TCP--dport 22-j ACCEPT
[[Email protected]~]# iptables-a input-p TCP--dport 53-j ACCEPT
[[Email protected]~]# iptables-a input-p UDP--dport 53-j ACCEPT
[[Email protected]~]# iptables-a input-p UDP--dport 123-j ACCEPT
[Email protected]~]# iptables-a input-p icmp-j ACCEPT
[Email protected]~]# iptables-p INPUT DROP
[Email protected]~]#/etc/init.d/iptables Save
12. Turn off SELinux
[[Email protected]~]# vi/etc/selinux/config
Selinux=disabled
[Email protected]~]# setenforce #临时生效
[Email protected]~]# getenforce #查看selinux状态
13. Host Name setting
[[Email protected]~]# vi/etc/sysconfig/network
Hostname=test.com
[Email protected]~]# hostname test.com #临时生效
14. Prohibition of useless services
#! /bin/bash
Service Acpid off
Service ATD Stop
Service AUDITD Stop
Service Avahi-daemon Stop
Service AVAHI-DNSCONFD Stop
Service Bluetooth stop
Service Conman Stop
Service Cpuspeed Stop
Service cups stop
Service DNSMASQ Stop
Service Dund Stop
Service Firstboot Stop
Service Hidd Stop
Service httpd Stop
Service Ibmasm Stop
Service Ip6tables Stop
Service IrDA Stop
Service Kdump Stop
Service Lm_sensors Stop
Service Mcstrans Stop
Service Messagebus Stop
Service Microcode_ctl Stop
Service Netconsole Stop
Service Netfs Stop
Service NETPLUGD Stop
Service NFS Stop
Service Nfslock Stop
Service NSCD Stop
Service NTPD Stop
Service ODDJOBD Stop
Service Pand Stop
Service PCSCD Stop
Service Portmap Stop
Service Psacct Stop
Service Rdisc Stop
Service Restorecond Stop
Service RPCGSSD Stop
Service RPCIDMAPD Stop
Service RPCSVCGSSD Stop
Service SASLAUTHD Stop
Service SendMail Stop
Service Setroubleshoot Stop
Service SMB Stop
Service Vncserver Stop
Service Winbind Stop
Service Wpa_supplicant Stop
Service XFS Stop
Service Ypbind Stop
Service YUM-UPDATESD Stop
Chkconfig Acpid off
Chkconfig ATD Off
Chkconfig AUDITD off
Chkconfig Avahi-daemon off
Chkconfig AVAHI-DNSCONFD off
Chkconfig bluetooth off
Chkconfig conman off
Chkconfig Cpuspeed off
Chkconfig cups off
Chkconfig DNSMASQ off
Chkconfig Dund off
Chkconfig Firstboot off
Chkconfig Hidd off
Chkconfig httpd off
Chkconfig ibmasm off
Chkconfig Ip6tables off
Chkconfig IrDA off
Chkconfig Kdump off
Chkconfig lm_sensors off
Chkconfig Mcstrans off
Chkconfig Messagebus off
Chkconfig Microcode_ctl off
Chkconfig Netconsole off
Chkconfig Netfs off
Chkconfig Netplugd off
Chkconfig NFS Off
Chkconfig Nfslock off
Chkconfig NSCD off
Chkconfig ntpd off
Chkconfig ODDJOBD off
Chkconfig Pand off
Chkconfig PCSCD off
Chkconfig Portmap off
Chkconfig Psacct off
Chkconfig Rdisc off
Chkconfig Restorecond off
Chkconfig RPCGSSD off
Chkconfig RPCIDMAPD off
Chkconfig RPCSVCGSSD off
Chkconfig SASLAUTHD off
Chkconfig SendMail off
Chkconfig Setroubleshoot off
Chkconfig SMB off
Chkconfig Vncserver off
Chkconfig Winbind off
Chkconfig wpa_supplicant off
Chkconfig XFS off
Chkconfig Ypbind off
Chkconfig yum-updatesd off

Linux: Basic optimization of the system