|
#!/bin/sh
#优化1 开机启动网卡
cat >/etc/sysconfig/network-scripts/ifcfg-eth0<<EOF
DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.122.147
NETMASK=255.255.255.0
GATEWAY=192.168.122.1
DNS1=192.168.122.1
DNS2=114.114.114.114
EOF
#优化2 更改hostname
sed -i 's#HOSTNAME=\(.*\)#HOSTNAME=kvm-demo#g' /etc/sysconfig/network
hostname kvm-demo
sed -i 's#127\(.*\)#127\1\ kvm-demo#g' /etc/hosts
/etc/init.d/network restart
#优化3 使用国内yum源和epel源安装软件
##最小化安装是没有wget工具的，必须先安装在修改源
yum -y install wget
/bin/mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.`date +%F`.bak
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.163.com/.help/CentOS6-Base-163.repo<br>rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
yum clean all
yum makecache
yum -y groupinstall "Base"
yum -y groupinstall "Compatibility libraries"
yum -y groupinstall "Debugging Tools"
yum -y groupinstall "Development tools"
yum -y install telnet dos2unix tree lftp
yum -y update
#优化4 关闭selinux
setenforce 0
sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
#优化5 清空iptables规则
iptables -F
/etc/init.d/iptables save
#优化6 精简开机启动服务
for service in `chkconfig --list|grep 3:on|awk '{print $1}'|grep -Ev "crond|network|rsyslog|sysstat|sshd|iptables|ip6tables"`
do chkconfig $service off
done
#优化7 更改ssh设置
sed -i 's/#Port\ 22/Port\ 52113/g' /etc/ssh/sshd_config
sed -i 's/#ListenAddress 0.0.0.0/ListenAddress\ 192.168.122.147/g' /etc/ssh/sshd_config
sed -i 's/#PermitRootLogin\ yes/PermitRootLogin\ no/g' /etc/ssh/sshd_config
sed -i 's/#GSSAPIAuthentication\ no/GSSAPIAuthentication\ no/g' /etc/ssh/sshd_config
sed -i 's/GSSAPIAuthentication\ yes/#GSSAPIAuthentication\ yes/g' /etc/ssh/sshd_config
sed -i 's/#UseDNS\ yes/UseDNS\ no/g' /etc/ssh/sshd_config
/etc/init.d/sshd restart
#优化8 添加普通用户
useradd badboy
echo "123456"|passwd --stdin badboy
history -c
#优化9 sudo授权普通用户
echo "badboy ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
#优化10 时间同步
echo "*/5 * * * * /usr/sbin/ntpdate ntp.api.bz >/dev/null 2>&1 && /sbin/hwclock -w" >>/var/spool/cron/root
#优化11 加大服务器文件描述符
echo '* - nofile 65535' >> /etc/security/limits.conf
#优化12 内核调优
echo "net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120" >>/etc/sysctl.conf
sysctl -p
#优化13 隐藏linux系统版本
:>/etc/issue
:>/etc/issue.net
#优化14 锁定系统关键文件
chattr +i /etc/passwd /etc/group /etc/shadow /etc/gshadow /etc/inittab
##将chattr改名
/bin/mv /usr/bin/chattr /usr/bin/badboy
#优化15 grub引导密码（防止单用户模式修改root密码）
##md5密码为123456 使用grub-md5-crypt工具生成为$1$/0gD5/$VjhsgnUx6uIn9qpbVZIlL1
sed -i '/hiddenmenu/a\password\ --md5\ \$1\$\/0gD5\/\$VjhsgnUx6uIn9qpbVZIlL1' /etc/grub.conf
#优化16 设置全局变量
##设置自动退出终端，防止非法关闭ssh客户端造成登录进程过多，可以设置大一些，单位为秒
echo "TMOUT=3600">> /etc/profile
##历史命令记录数量设置为10条
sed -i 's/HISTSIZE=1000/HISTSIZE=10/g' /etc/profile
##立即生效
source /etc/profile
#重启
shutdown -r now
|
