CentOS-6.5系統基礎最佳化附帶最佳化指令碼

CentOS-6.5系統基礎最佳化附帶最佳化指令碼

最佳化內容：

（1.設定history記錄

（2.添加普通使用者，設定sudo許可權

（3.禁止root遠端使用者登入

（4.修改遠程連接埠

（5.精簡開機啟動伺服器

（6.關閉selinux

（7.配置iptables

（8.修改最大串連數 ulimit

（9.禁止使用Ctrl+Alt+Del快速鍵重啟伺服器

（10.修改預設DNS

（11.安裝必要軟體,更新yum源 [epel源]

（12.更新核心和軟體到最新版本

（13.最佳化核心參數 [根據實際情況調整]

（14.去除上次登入的資訊

（15.關閉開機顯示核心資訊

1.設定history記錄

echo'exportHISTFILE=$HOME/.bash_historyexportHISTSIZE=2000exportHISTFILESIZE=2000exportHISTTIMEFORMAT="%F%T`whoami`"exportPROMPT_COMMAND="history-a;history-c;history-r;"shopt-shistappendtypeset-rPROMPT_COMMANDtypeset-rHISTTIMEFORMAT'>/etc/profile.d/history.shsource/etc/profile

2.添加普通使用者，設定sudo許可權

username='dyt'password='dyt2015'useradd$username;echo$password|passwd--stdin$usernamesed-i"98a$usernameALL=(ALL)NOPASSWD:ALL"/etc/sudoers

3.禁止root遠端使用者登入

sed-i's/#PermitRootLoginyes/PermitRootLoginno/'/etc/ssh/sshd_config

4.修改遠程連接埠

sed-i's/#Port22/Port9527/'/etc/ssh/sshd_config/etc/init.d/sshdrestart

5.精簡開機啟動伺服器

forserverin`chkconfig--list|egrep-v'crond|network|rsyslog|sshd|iptables'|awk'{print$1}'`;dochkconfig$serveroff;done

6.關閉selinux

sed-i's/SELINUX=enforcing/SELINUX=disabled/'/etc/selinux/configsetenforce0

7.配置iptables

/etc/init.d/iptablesrestartiptables-Fiptables-Xiptables-Ziptables-AINPUT-picmp-jACCEPTiptables-AINPUT-ilo-jACCEPT#允許某個IP段遠端存取sshiptables-AINPUT-ptcp-mtcp--dport9527-s192.168.64.0/24-jACCEPT#開啟80連接埠iptables-AINPUT-Ptcp-mtcp--dropt80-jACCEPT#允許某個IP的所有請求iptables-AINPUT-pall-s124.43.56.90/30-jACCEPTiptables-AINPUT-mstate--stateRELATED,ESTABLISHED-jACCEPTiptables-PINPUTDROPiptables-POUTPUTACCEPTiptables-PFORWARDDROP/etc/init.d/iptablessave/etc/init.d/iptablesrestart

8.修改最大串連數 ulimit

#方法有很多,未必就這一種echo'*-noproc65535'>>/etc/security/limits.confecho'*-nofile65535'>>/etc/security/limits.conf

9.禁止使用Ctrl+Alt+Del快速鍵重啟伺服器

sed-i"s/startoncontrol-alt-delete/#startoncontrol-alt-delete/g"/etc/init/control-alt-delete.conf

10.修改預設DNS

echo"nameserver8.8.8.8">/etc/resolv.confecho"nameserver8.8.4.4">>/etc/resolv.conf

11.安裝必要軟體,更新yum源 [epel源]

#根據個人公司情況,這裡只列舉了自己常用的軟體和yum源,根據實際情況更改yum源yum-yinstallgccgcc-c++openssl-developenssh-clientswgetmakelrzszunzipzipxzntpdatelsoftelnetepel-releasevimtreekernel-develkernel

12.更新核心和軟體到最新版本

yum-yupgrade

13.最佳化核心參數 [根據實際情況調整]

echo-e"net.core.somaxconn=262144">>/etc/sysctl.confecho-e"net.core.netdev_max_backlog=262144">>/etc/sysctl.confecho-e"net.core.wmem_default=8388608">>/etc/sysctl.confecho-e"net.core.rmem_default=8388608">>/etc/sysctl.confecho-e"net.core.rmem_max=16777216">>/etc/sysctl.confecho-e"net.core.wmem_max=16777216">>/etc/sysctl.confecho-e"net.ipv4.route.gc_timeout=20">>/etc/sysctl.confecho-e"net.ipv4.ip_local_port_range=102465535">>/etc/sysctl.confecho-e"net.ipv4.tcp_retries2=5">>/etc/sysctl.confecho-e"net.ipv4.tcp_fin_timeout=30">>/etc/sysctl.confecho-e"net.ipv4.tcp_syn_retries=1">>/etc/sysctl.confecho-e"net.ipv4.tcp_synack_retries=1">>/etc/sysctl.confecho-e"net.ipv4.tcp_timestamps=0">>/etc/sysctl.confecho-e"net.ipv4.tcp_tw_recycle=1">>/etc/sysctl.confecho-e"net.ipv4.tcp_tw_reuse=1">>/etc/sysctl.confecho-e"net.ipv4.tcp_keepalive_time=120">>/etc/sysctl.confecho-e"net.ipv4.tcp_keepalive_probes=3">>/etc/sysctl.confecho-e"net.ipv4.tcp_keepalive_intvl=15">>/etc/sysctl.confecho-e"net.ipv4.tcp_max_tw_buckets=36000">>/etc/sysctl.confecho-e"net.ipv4.tcp_max_orphans=3276800">>/etc/sysctl.confecho-e"net.ipv4.tcp_max_syn_backlog=262144">>/etc/sysctl.confecho-e"net.ipv4.tcp_wmem=819213107216777216">>/etc/sysctl.confecho-e"net.ipv4.tcp_rmem=3276813107216777216">>/etc/sysctl.confecho-e"net.ipv4.tcp_mem=94500000915000000927000000">>/etc/sysctl.confecho-e"net.ipv4.tcp_slow_start_after_idle=0">>/etc/sysctl.confecho-e"vm.swappiness=0">>/etc/sysctl.confecho-e"kernel.panic=5">>/etc/sysctl.confecho-e"kernel.panic_on_oops=1">>/etc/sysctl.confecho-e"kernel.core_pipe_limit=0">>/etc/sysctl.conf#iptables防火牆echo-e"net.nf_conntrack_max=25000000">>/etc/sysctl.confecho-e"net.netfilter.nf_conntrack_max=25000000">>/etc/sysctl.confecho-e"net.netfilter.nf_conntrack_tcp_timeout_established=180">>/etc/sysctl.confecho-e"net.netfilter.nf_conntrack_tcp_timeout_time_wait=120">>/etc/sysctl.confecho-e"net.netfilter.nf_conntrack_tcp_timeout_close_wait=60">>/etc/sysctl.confecho-e"net.netfilter.nf_conntrack_tcp_timeout_fin_wait=120">>/etc/sysctl.confo

15.去除上次登入的資訊

touch~/.hushlogin