Linux Basic optimization

Linux Optimizations:

1) without root management, in the name of ordinary users through sudo authorization management.

(1) Visudo

Root all= (All) all

Weng all= (All) all,!/bin/su,!/bin/su-,!/bin/su root,!/bin/su-root #避免sudo su Command

2) Change the default remote connection SSH service port, prohibit the root user to connect remotely,

Even change to only listen to the intranet IP.

1. sshd configuration file: server:/etc/ssh/sshd_config

Client:/etc/ssh/ssh_config

2, modify the Sshd_config

#Port 22 Change to Port 33956 (1-65535)

IP address of listenaddress 192.168.1.1 IP Address Server Intranet

Protocol 2 Protocol 2 more secure

#UseDNS Yes to Usedns no not allowed by name link

#PermitRootLogin Yes to Permitrootlogin no does not allow root via shh link

Gssapiauthentication Yes to gssapiauthentication no fix link slow method

#PermitEmptyPasswords No to allow blank password login

3) Automatically update the server time to synchronize with the Internet time.

1. Installation time server:

Yum install-y ntpdate

2, Sync Beijing time:

Ntpdate asia.pool.ntp.org

3, set the daily 12-point timing synchronization Time:

Crontab-e

0 */12 * * * */usr/sbin/ntpdate asia.pool.ntp.org &>/dev/null

Note: This method is for a server synchronization, production environment, is selected 2 as the synchronization of the external network time server, and its servers are synchronized with the local area network of 2 time servers. Avoid increasing traffic at the same time.

4) Configure the Yum update source to download the installation package from the domestic update source.

Domestic yum sources mainly include: http://mirrors.aliyun.com

Http://mirrors.163.com

Http://mirrors.sohu.com

Select Help on the back of CentOS to access the documentation.

5) Turn off SELinux and iptables (in the work scenario, if there is an external IP normally open iptables, except for high concurrency).

To turn off SELinux:

1, temporarily shut down (do not restart the machine):

Setenforce 0 # #设置SELinux become permissive mode

# #setenforce 1 set SELinux to become enforcing mode

2. Modify the configuration file to restart the machine:

Modify/etc/selinux/config file, change selinux=enforcing to Selinux=disabled

Http://www.cnblogs.com/bangerlee/archive/2013/02/27/2935422.html

6) Adjust the number of file descriptors, process and file opening will consume the file descriptor.

File Descriptor Concepts:

1, the representation is an integer number, generally use (0-65535) range.

2, the process uses the time will occupy the file descriptor (identifies the open file)

Command: Ulimit-n #查看默认文件描述符

Ulimit-shn 65535 #修改软硬文件描述符

There are two ways to modify file descriptors:

Method One: (1) ulimit-shn 65535 #修改临时文件描述符:

(2) echo "ULIMIT-HSN 65536" >>/etc/rc.local #随系统启动时加载

Method Two:

(1) Adjust file descriptors

Echo ' * Soft nofile 65535 ' >>/etc/security/limits.conf

Echo ' * Hard nofile 65535 ' >>/etc/security/limits.conf

(2) modifying temporary file descriptors

Ulimit-shn 65535

7) regularly automatically clean up the Mail directory junk files to prevent the Inodes node from being fully occupied

(Note that the CENTOS6 and CENTOS5 directories are different).

8) Streamline and retain the necessary boot-up services (such as Crond, sshd, Network, Rsyslog, Sysstat).

For service_name in ' chkconfig--list|grep ' 3:on ' |awk ' {print '} ' |grep-ev ' Sshd|network|rsyslog|crond|sysstat ';

Do

Chkconfig $service _name off;

Done

9) Linux kernel parameter optimization/etc/sysctl.conf, execution sysctl-p effective.

10) Change the character set so that it supports Chinese, but it is recommended to use the English character set to prevent garbled problems.

11) lock critical system files such as (/etc/passwd/etc/shadow/etc/group/etc/gshadow/etc/inittab)

After processing the above content, Chattr, lsattr renamed to Oldboy, so it is much safer.

12) Clear the/etc/issue,/etc/issue.net, remove the system and the kernel version of the screen before the login display.

13) Clear the redundant system virtual account.

14) Add the password to the Grub menu.

15) forbidden to be ping

Forbidden to be ping

Echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

Open is Ping

echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all

16) Upgrade Vulnerability software

Yum Update-y

17) Lock Important files

This article is from the "Mk_linux" blog, make sure to keep this source http://wengmengkai.blog.51cto.com/9016647/1766930

Linux Basic optimization