此文檔還未完善，謹(jǐn)慎使用
!/bin/bash
Kernel_optimization(){
cat >/etc/sysctl.conf<<EOF
kernel_flag
關(guān)閉ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
避免放大攻擊
net.ipv4.icmp_echo_ignore_broadcasts = 1
開啟惡意icmp錯(cuò)誤消息保護(hù)
net.ipv4.icmp_ignore_bogus_error_responses = 1
關(guān)閉路由轉(zhuǎn)發(fā)
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
開啟反向路徑過濾
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
處理無源路由的包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
關(guān)閉sysrq功能
kernel.sysrq = 0
core文件名中添加pid作為擴(kuò)展名
kernel.core_uses_pid = 1
開啟SYN洪水攻擊保護(hù)
net.ipv4.tcp_syncookies = 1
修改消息隊(duì)列長度
kernel.msgmnb = 65536
kernel.msgmax = 65536
設(shè)置最大內(nèi)存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
timewait的數(shù)量篡帕，默認(rèn)180000
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
每個(gè)網(wǎng)絡(luò)接口接收數(shù)據(jù)包的速率比內(nèi)核處理這些包的速率快時(shí)，允許送到隊(duì)列的數(shù)據(jù)包的最大數(shù)目
net.core.netdev_max_backlog = 262144
限制僅僅是為了防止簡(jiǎn)單的DoS 攻擊
net.ipv4.tcp_max_orphans = 3276800
未收到客戶端確認(rèn)信息的連接請(qǐng)求的最大值
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
內(nèi)核放棄建立連接之前發(fā)送SYNACK 包的數(shù)量
net.ipv4.tcp_synack_retries = 1
內(nèi)核放棄建立連接之前發(fā)送SYN 包的數(shù)量
net.ipv4.tcp_syn_retries = 1
啟用timewait 快速回收
net.ipv4.tcp_tw_recycle = 1
開啟重用蹲嚣。允許將TIME-WAIT sockets 重新用于新的TCP 連接
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
當(dāng)keepalive 起用的時(shí)候，TCP 發(fā)送keepalive 消息的頻度。缺省是2 小時(shí)
net.ipv4.tcp_keepalive_time = 30
允許系統(tǒng)打開的端口范圍
net.ipv4.ip_local_port_range = 1024 65000
修改防火墻表大小吆视，默認(rèn)65536
net.netfilter.nf_conntrack_max=655350
net.netfilter.nf_conntrack_tcp_timeout_established=1200
確保無人能修改路由表
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
EOF
}
保留yum安裝的軟件包
sed -i "s#keepcache=0#keepcache=1#g" /etc/yum.conf
安裝常用軟件
yum install lrzsz ntpdate sysstat net-tools wget vim bash-completion dos2unix unzip tcpdump telnet lsof -y &>/dev/null
if [ $? -ne 0 ];then
echo "常用軟件安裝失斚Ａ５跛巍！颜武！"
fi
關(guān)閉selinux
SELINUX_status=2}')
sed -i 's/=enforcing/=disabled/' /etc/selinux/config
echo "SELINUX狀態(tài)為 ${SELINUX_status}"
修改yum源
\cp /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup && wget -O /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo &>/dev/null
備份/etc/ssh/sshd_conf
cp /etc/ssh/sshd_config{,.date +%F.bak}
[ -e "sshd_config{,.date +%F.bak}" ] || echo "sshd_config{,.date +%F.bak} 備份成功"
不允許基于GSSAPI的用戶認(rèn)證
sed -i 's/^GSSAPIAuthentication yes2}' /etc/ssh/sshd_config
不允許sshd對(duì)遠(yuǎn)程主機(jī)名進(jìn)行反向解析
sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
awk '/UseDNS/{print "sshd對(duì)遠(yuǎn)程主機(jī)名進(jìn)行反向解析",$2}' /etc/ssh/sshd_config
重啟sshd服務(wù)
systemctl restart sshd
if [ $? -ne 0 ];then
echo "sshd 未正常啟動(dòng)"
else
echo "sshd 已重啟"
fi
歷史記錄及登錄超時(shí)環(huán)境變量設(shè)置
設(shè)置閑置超時(shí)時(shí)間為300s
tmout=300
sed -i "/export TMOUT=/d" /etc/profile && echo "export TMOUT=${tmout}" >>/etc/profile
設(shè)置歷史記錄文件的命令數(shù)量為100
histfilesize=100
sed -i "/export HISTFILESIZE=/d" /etc/profile && echo "export HISTFILESIZE=${histfilesize}" >>/etc/profile
設(shè)置命令行的歷史記錄數(shù)量
histsize=100
sed -i "/export HISTSIZE=/d" /etc/profile && echo "export HISTSIZE=${histsize}" >>/etc/profile
格式化輸出歷史記錄(以年月日分時(shí)秒的格式輸出)
sed -i "/export HISTTIMEFORMAT=/d" /etc/profile && echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S"' >>/etc/profile
source /etc/profile
調(diào)整文件描述符
高并發(fā)的業(yè)務(wù)Linux服務(wù)器,調(diào)整系統(tǒng)文件描述符為65535(按照情況配置)
echo '* - nofile 65535' >>/etc/security/limits.conf
內(nèi)核優(yōu)化
Kernel_optimization
kernel_optimization_ver={kernel_optimization_ver} -eq 0 ];then
echo "內(nèi)核優(yōu)化配置失敗"
fi
開啟計(jì)劃任務(wù)時(shí)間同步
sed -i '//usr/sbin/ntpdate/d' /var/spool/cron/root && echo "*/5 * * * * /usr/sbin/ntpdate cn.pool.ntp.org > /dev/null 2>&1" >/var/spool/cron/root
創(chuàng)建回收站
[ -d /tmp/garbage_dir ] || mkdir /tmp/garbage_dir -p
禁用危險(xiǎn)命令 在非交互式模式下alias擴(kuò)展功能默認(rèn)是關(guān)閉的,需要source一下腳本
cat >/root/.bashrc<<EOF
.bashrc
User specific aliases and functions
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias rm=' ''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令璃搜！如需刪除無用文件或目錄請(qǐng)將文件或目錄移動(dòng)至/tmp/rm\033[0m \033[40;33;1m rm \033[0m "'''
alias shutdown='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令！\033[0m \033[40;33;1m shutdown \033[0m"'''
alias init='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令鳞上！\033[0m \033[40;33;1m init \033[0m"'''
alias reboot='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令这吻！\033[0m \033[40;33;1m reboot \033[0m"'''
alias halt='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令！\033[0m \033[40;33;1m halt \033[0m"'''
alias poweroff='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令篙议！\033[0m \033[40;33;1m poweroff \033[0m"'''
alias pkill='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令唾糯！\033[0m \033[40;33;1m pkill \033[0m"'''
alias killall='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令！\033[0m \033[40;33;1m killall \033[0m"'''
alias kill='''echo -e "\033[40;32;1m【運(yùn)維溫馨提示】\033[0m \033[40;31;1;5m請(qǐng)不要輕易運(yùn)行危險(xiǎn)命令！\033[0m \033[40;33;1m kill \033[0m"'''
change configuration
export HISTFILESIZE=100000
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S " ##（history 顯示時(shí)間）
export PS1='[\e[32;1m][[\e[36;1m]\u@\h [\e[33;1m]\w [\e[32;1m]\t [\e[34;1m]##[\e[32;1m]]\$ [\e[0;0m' ###（顯示主機(jī)名 目錄 時(shí)間）
ulimit -c unlimited
ulimit -HSn 1024000
echo "%e.core" > /proc/sys/kernel/core_pattern
Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
EOF
