Linux system optimization and security settings

1. Turn off SELinux function

SELinux (security-enhanced Linux) is the implementation of the U.S. National Security Agency (NSA) for mandatory access control.

Recommended to close, as for security issues, you can find another way.

Check the SELinux under/etc/selinux/config first

[email protected] ~]# cat /etc/selinux/config

# This file controls the state of the SELinux on the system.
# selinux= can take one of these three values:
# Enforcing-selinux security policy is enforced.
# Permissive-selinux Prints warnings instead of enforcing.
# disabled-no SELinux policy is loaded.
SELinux=enforcing The current SELinux value is enforcing high security level
# selinuxtype= can take one of these the values:
# targeted-targeted processes is protected,
# Mls-multi level Security protection.
selinuxtype=targeted
[Email protected] ~]#

To make a backup before you modify it:

cp/etc/selinux/config/etc/selinux/config.oldboy.20150519

Modification Method:

• Modify with VI Editor
• Sed–i ' S#selinux=enforcing#selinux=disabled#g '/etc/selinux/config

Post-modification check:

grep =disabled/etc/selinux/config

After the change has not been effective, can only restart the server, but in some special occasions can not restart the server, it is possible to operate as follows:

[[email protected] ~]# getenforce check selinux status
Enforcing
[[email protected] ~]# Setenforce set status
Usage:setenforce [Enforcing | Permissive | 1 | 0] 1 Enable 0 warning not enabled
[Email protected] ~]# Setenforce 0
[Email protected] ~]# Getenforce
Permissive
[Email protected] ~]#

2. Set the run level to 3 (text mode)

Set RunLevel to 3, that is, to use the text command mode to manage Linux, if you follow my previous installation method installed Linux, you do not need to set up, check.

/etc/inittab

[Email protected] ~]# Tail/etc/inittab
# Default RunLevel. The runlevels used is:
# 0-halt (do not set Initdefault to this) shutdown state
# 1-single User Mode single
# 2-multiuser, without NFS (the same as 3, if you don't have networking) multiuser mode without network NFS

# 3-full Multiuser mode full multi-user modes in text mode
# 4–unused reserved for no users
# 5–x11 Desktop mode
# 6-reboot (do not set Initdefault to this) reboot
#
Id:3:initdefault:
[Email protected] ~]#

Check command: runlevel

[Email protected] ~]# RunLevel
N 3 3 Mode full-text mode multi-user mode
[Email protected] ~]#

Switch Operation Basic:

init 6 is equivalent to shutting down the machine

3. Streamlined Boot system startup

As with the windous system, there will be a lot of useless software running on the Linux server by default, which takes up a lot of system resources and poses a security risk, so you can choose to shut down. So, in the enterprise production scenario of the Linux host need to keep what boot-start services?

3.1 Important start-up services

The following is a 51CTO old boy teacher's years of experience, the enterprise environment after the newly installed Linux system is necessary to retain the boot start service has 5, as follows:

• Sshd

A service program that is needed to connect to a Linux server remotely, so it must be turned on, otherwise it cannot be connected remotely to a Linux server

• Rsyslog

is a mechanism provided by the operating system, the system daemon usually uses Rsyslog to write various kinds of information into the system log file, CentOS6 formerly the name of this service is syslog.

• Network

If you want to activate/deactivate each network interface when the system starts, you should (must) consider turning it on.

• Crond

This service is used for periodic execution of system and user-configured task schedules. There are periodic tasks to be started, this service is almost a production scenario must use a software, such as scheduled tasks, do a daily backup.

• Sysstat

is a software package that contains a set of tools to monitor the performance and efficiency of the system, which is useful for recording system performance data, such as CPU usage, hard disk and network throughput data, which can be used to determine whether the system is functioning properly, so it improves the system's operational efficiency. Assistant to run the service safely.

The main tools for Sysstat package integration are:

1. Iostat tool provides data for CPU utilization and drive throughput efficiency;

2. The Mpstat tool provides data related to single or multiple processors;

3. The SAR tool is responsible for collecting, reporting and storing system-active information;

3.2 Common ways to set up start-up services

1. Execute the command and select the processing method manually

Linux system optimization and security settings