MB memory CentOS system VPS optimization process

CentOS is a Linux release built on the RedHatEnterpriseLinux (RHEL) source code. it is 100% compatible with the RHEL software package from a binary perspective, simply put, software packages that can run on RHEL can be directly installed and run on CentOS without compilation. In addition to a small amount of copyright information, CentOS and RHEL are basically the same. Ce

CentOS is a Linux release built on Red Hat Enterprise Linux (RHEL) source code. it is 100% compatible with the RHEL software package from a binary perspective, simply put, software packages that can run on RHEL can be directly installed and run on CentOS without compilation. In addition to a small amount of copyright information, CentOS and RHEL are basically the same. CentOS is free of charge and stable with RHEL. Therefore, it is well supported by various hosting service providers. almost all Linux VPS support CentOS.

In general, if the VPS configuration is high, I will select CentOS. if the configuration is low, I will select Debian. of course, this is my personal preference. most Linux VPS service providers will also provide Gentoo, but each installation program, compilation requires a lot of resources, which consumes a lot of time and does not significantly improve the performance. We do not recommend low-configuration VPS.

Generally, the VPS service provider provides the minimum or optimized operating system version. Each VPS service provider may provide different versions. the minimum requirement for CentOS system installation is at least 64 MB memory (text-only interface) and 1 GB hard disk space.

Install and upgrade the system

1. log on to VPS to install CentOS 5.
2. upgrade the entire system immediately after installation.

Yum update

With a clean system, Linux is enhanced and optimized.

Delete unnecessary software packages, services, users, files, etc.

3. delete unnecessary software packages.

Yum remove Deployment_Guide-en-US finger cups-libs cups
Bluez-libs desktop-file-utils ppp rp-pppoe wireless-tools irda-utils
Nfs-utils-lib rdate fetchmail eject ksh mkbootdisk mtools
Syslinux tcsh startup-notification talk apmd rmt dump setserial portmap yp-tools
Ypbind

Rpm-qa (list all installed packages)
Rpm-e package (delete a package)
Rpm-qi package (query a package)
Rpm-qf command (query the package name by program)
Rpm-ql package (query all the installation files of a package)

4. delete some insecure software packages and replace them with the appropriate security software, such as ssh/sftp/scp instead of telnet, rsh, ftp, and rcp.
Note:The system requires a default MTATo delete the Sendmail MTA, you must first install one, for example, Postfix.

Yum remove telnet rsh ftp rcp
Yum install Postfix
Yum remove Sendmail
/Sbin/chkconfig postfix off

5. stop and delete unnecessary xinetd services.

/Sbin/service xinetd stop;/sbin/chkconfig xinetd off
Rm-rf/etc/xinetd. d

6. Disable/etc/init. d/services not required below. For more information, see Understanding your (Red HatEnterprise Linux) daemons, by Len DiMaggio and Hardening Tips ForDefault Installation of Red Hat Enterprise Linux 5.

/Sbin/chkconfig -- list
For a in acpid anacron apmd atd autofs avahi-daemon bluetooth cpuspeed \
Cups firstboot gpm haldaemon hidd ip6tables irqbalance isdn kdump \
Kudzumcstrans messagebus microcode_ctl netfs nfs nfslock pcscd portmap \
Readahead_early readahead_later rpcgssd rpcidmapd sendmail \
Setroublesshoot smartd xfs xinetd yum-updatesd ;\
Do/sbin/chkconfig $ a off; done

7. after restarting the system, check the running services to see if they are all required.

Netstat-an | grep LISTEN
Netstat-atunp

8. to ensure security, delete unnecessary users.

Cp/etc/passwd. sav
Cp/etc/group. sav
For a in adm lp sync news uucp operator games gopher mailnull nscd rpc;
Do/usr/sbin/userdel $ a-f; done
For a in lp news uucp games gopher users floopy nscd rpc rpcuser nfsnobody;
Do/usr/sbin/groupdel $ a-f; done
Reinforce and optimize the system

9. open the firewall.

System-config-securitylevel-tui

10. check and disable globally writable SUID files.

Find/-perm + 4000-user root-type f-print
Find/-perm + 2000-group root-type f-print
Chmod u-s/full/path/to/filename
Chmod g-s/full/path/to/filename

11. only root users are allowed to log on to one terminal, for example, tty1.

Vi/etc/securetty

12. do not restart other users by pressing Ctrl + Alt + Del.

Vi/etc/inittab

Comment out
# Ca: ctrlaltdel:/sbin/shutdown-t3-r now

13. in/etc/security/console. apps/, delete all programs that can be run after the root user logs on to the console.
Rm-f/etc/security/console. apps /*

14. delete some logon information.

Vi/etc/issue (warning at login prompt)
Vi/etc/motd (warning after successful login)

15. run only one virtual terminal. if it is VPS, it is impossible for you to log on to the terminal physically, and you can disable it all.

Vi/etc/inittab
# Run gettys in standard runlevels
#1: 2345: respawn:/sbin/mingetty tty1
#2: 2345: respawn:/sbin/mingetty tty2
...

16. reinforce SSH security.

Vi/etc/ssh/sshd_config
Port 2222
Protocol 2
PermitRootLogin no
PermitEmptyPasswords no
X11Forwarding no
UsePAM no
UseDNS no
AllowUsers vpsee
Banner/etc/issue

17. install the Bastille software package to help reinforce the software.

Rpm-Uvh perl-Curses-1.15-1.el5.rf.i386.rpm
Rpm-ivh Bastille-3.0.9-1.0.noarch.rpm
/Usr/sbin/bastille-c

18. optimize the Linux kernel.

Vi/etc/sysctl. conf
Net. ipv4.conf. all. send_redirects = 0
Net. ipv4.conf. all. accept_redirects = 0
Customized Linux kernel

19. customize, compile, and install the Linux kernel.

Yum install rpm-build ncurses-devel
Rpm-ivh kernel-2.6.18-8.1.1.el5.src.rpm
Cd/usr/src/redhat/SPECS
Rpmbuild-bp -- target i686 kernel-2.6.spec
Cd/usr/src/redhat/BUILD/kernel-2.6.18/linux-2.6.18.i686
Sed-I's/EXTRAVERSION =-prep/EXTRAVERSION =-8.1.1.custom.el5/'makefile
Make menuconfig
Make rpm
Cd/usr/src/redhat/RPMS/i686
Rpm-ivh kernel-2.6.18prep-1.rpm
/Sbin/mkinitrd/boot/initrd-2.6.18-prep.img 2.6.18-prep (2.6.18-prep->/lib/modules)
Vi/boot/grub/menu.1st

20. modifyIptablesOnly the ssh, http, and https ports are allowed.

/Sbin/iptables-F
/Sbin/iptables-a input-I lo-j ACCEPT
/Sbin/iptables-a input-I! Lo-d 127.0.0.0/8-j REJECT