1. yum 源優(yōu)化
1.1 Base源 和 epel源
# 01. 備份原來(lái)的 repo 文件
mkdir -p /etc/yum.repos.d/backup
mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup/
# 02. 配置阿里源
## 原始配置
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
curl -o /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo
## 經(jīng)過(guò)優(yōu)化
cat >/etc/yum.repos.d/CentOS-Base.repo <<'EOF'
[base]
name=CentOS-$releasever - Base - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
[updates]
name=CentOS-$releasever - Updates - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
[extras]
name=CentOS-$releasever - Extras - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/$releasever/extras/$basearch/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
EOF
cat >/etc/yum.repos.d/epel.repo <<'EOF'
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
baseurl=http://mirrors.aliyun.com/epel/7/$basearch
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
EOF
1.2 docker 源 和 k8s源
# 01. docker 源
curl -o /etc/yum.repos.d/docker-ce.repo https://download.docker.com/linux/centos/docker-ce.repo
sed -i 's+download.docker.com+mirrors.tuna.tsinghua.edu.cn/docker-ce+' /etc/yum.repos.d/docker-ce.repo
# 可查看所有版本 并指定 版本安裝
yum list docker-ce --showduplicates
yum -y install docker-ce-19.03.8 docker-ce-cli-19.03.8
# 02. k8s 源
cat > /etc/yum.repos.d/kubernetes.repo <<'EOF'
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
EOF
# 查看所有版本 并 指定版本安裝
yum -y list kubeadm --showduplicates | sort -r
yum -y install kubeadm-1.18.0-0 kubelet-1.18.0-0 kubectl-1.18.0-0
2. 安全優(yōu)化
2.1 關(guān)閉安全設(shè)備
# 關(guān)閉防火墻
systemctl stop firewalld
systemctl disable firewalld
# 關(guān)閉 selinux
setenforce 0
sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
# 檢查
systemctl status firewalld
getenforce
grep SELINUX /etc/selinux/config
2.2 開(kāi)啟防火墻
# firewalld 系列
firewall-cmd --zone=public --add-port=$port/tcp --permanent && firewall-cmd --reload
# 配置文件
cat /etc/firewalld/zones/public.xml
# iptables 系列
iptables -I INPUT -s 0.0.0.0/0 -p tcp --dport $port -j ACCEPT && /etc/init.d/iptables save >/dev/null 2>&1
# 7版本需要安裝
yum install iptables-services -y
systemctl start iptables
# 加載防火墻內(nèi)核
## 防火墻相關(guān)模塊 加載到內(nèi)核中
## 寫(xiě)入到 開(kāi)機(jī)自啟動(dòng)
cat >> /etc/rc.local <<EOF
modprobe ip_tables
modprobe iptables_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_state
EOF
# 檢查加載的內(nèi)容
lsmod | grep -E 'filter|nat|ipt'
[root@lb01 ~]# lsmod | grep -E 'filter|nat|ipt'
nf_nat_ftp 12809 0
nf_conntrack_ftp 18478 1 nf_nat_ftp
iptable_nat 12875 0
nf_nat_ipv4 14115 1 iptable_nat
nf_nat 26583 2 nf_nat_ftp,nf_nat_ipv4
ipt_REJECT 12541 2
nf_reject_ipv4 13373 1 ipt_REJECT
iptable_filter 12810 1
nf_conntrack 139264 8 nf_nat_ftp,ip_vs,nf_nat,xt_state,nf_nat_ipv4,xt_conntrack,nf_conntrack_ftp,nf_conntrack_ipv4
ip_tables 27126 2 iptable_filter,iptable_nat
libcrc32c 12644 4 xfs,ip_vs,nf_nat,nf_conntrack
# 保存輸出到屏幕
iptables-save
# 保存至文件(可自定義文件)
iptables-save > /etc/sysconfig/iptables
# 恢復(fù)
iptables-restore < /etc/sysconfig/iptables
3. 常用軟件優(yōu)化
yum install -y vim tree wget bash-completion bash-completion-extras lrzsz net-tools sysstat iotop iftop htop unzip nc nmap telnet bc psmisc httpd-tools bind-utils nethogs expect ntpdate
4. 優(yōu)化 ssh
sed -i -e 's/#UseDNS yes/UseDNS no/g' -e 's#GSSAPIAuthentication yes#GSSAPIAuthentication no#g' /etc/ssh/sshd_config
systemctl restart sshd
5. 配置時(shí)間同步
ntp1.aliyun.com
ntp2.aliyun.com
ntp1.tencent.com
ntp2.tencent.com
5.1 通過(guò)定時(shí)任務(wù)實(shí)現(xiàn)
# 編輯定時(shí)任務(wù)
crontab -e
# cron-id-001: sync the system time by yunxi
*/5 * * * * /sbin/ntpdate ntp1.aliyun.com &>/dev/null
5.2 通過(guò) chrony 服務(wù)實(shí)現(xiàn)
# 01. 安裝軟件
yum install chrony -y
# 02. 修改配置 (/etc/chrony.conf)
server ntp1.aliyun.com iburst
server ntp1.tencent.com iburst
# 03. 啟動(dòng)服務(wù)
systemctl enable --now chronyd
## 注意：時(shí)間異常之后妻导，需要重啟服務(wù)虎锚，才能同步
6. 網(wǎng)絡(luò)服務(wù)優(yōu)化
# 關(guān)閉 NetworkManager 服務(wù)
systemctl stop NetworkManager
systemctl disable NetworkManager
# 優(yōu)化網(wǎng)卡配置文件 eth0
cat >/etc/sysconfig/network-scripts/ifcfg-eth0 <<'EOF'
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
NAME=eth0
DEVICE=eth0
ONBOOT=yes
IPADDR=10.0.0.210
PREFIX=24
GATEWAY=10.0.0.2
DNS1=223.5.5.5
EOF
# 優(yōu)化網(wǎng)卡配置文件 eth1
cat >/etc/sysconfig/network-scripts/ifcfg-eth1 <<'EOF'
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=172.16.1.210
PREFIX=24
EOF
# 重啟網(wǎng)絡(luò)服務(wù)
systemctl restart network
7. 修改文件描述符
# 永久修改
echo "* - nofile 65535" >>/etc/security/limits.conf
# 臨時(shí)修改
ulimit -SHn 65535
8. 普通用戶提權(quán)
## 建議使用 密鑰認(rèn)證(沒(méi)有有效期)
# 創(chuàng)建普通用戶(CloudScope@110119)
useradd tadmin
echo '123456'|passwd --stdin tadmin
# 禁止root用戶遠(yuǎn)程登錄
sed -i.bak 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
systemctl restart sshd
# 配置sudo提權(quán)
cp -a /etc/sudoers{,.bak}
echo "tadmin ALL=(ALL) ALL" >> /etc/sudoers
visudo -c
# 密鑰對(duì)
.ssh/authorized_keys
9. 用戶登錄超時(shí)時(shí)間 配置
#設(shè)置登錄超時(shí)時(shí)間為15分鐘
echo "export TMOUT=900" >>/etc/profile
source /etc/profile
10. 修改賬號(hào)密碼 有效期
# 備份 /etc/login.defs 文件
cp /etc/login.defs{,.bak}
# 配置密碼有效期
sed -i -r 's/PASS_MAX_DAYS.*[0-9]+$/PASS_MAX_DAYS 90/g' /etc/login.defs
# 配置密碼最小長(zhǎng)度
sed -i -r 's/PASS_MIN_LEN.*[0-9]+$/PASS_MIN_LEN 12/g' /etc/login.defs
