linux系統優化配置

更新國內鏡像源

 國內速度較快的常用更新源如下：

         http://mirrors.sohu.com

         http://mirrors.163.com

[root@greymouster ~]# cd /etc/yum.repos.d/
[root@greymouster yum.repos.d]# ll
total 16
-rw-r--r--. 1 root root 1926 Nov 27  2013 CentOS-Base.repo
-rw-r--r--. 1 root root  638 Nov 27  2013 CentOS-Debuginfo.repo
-rw-r--r--. 1 root root  630 Nov 27  2013 CentOS-Media.repo
-rw-r--r--. 1 root root 3664 Nov 27  2013 CentOS-Vault.repo
[root@greymouster yum.repos.d]# cp CentOS-Base.repo  CentOS-Base.repo.ori
[root@greymouster yum.repos.d]# wget http://mirrors.163.com/.help/CentOS6-Base-163.repo
[root@greymouster yum.repos.d]# cp CentOS6-Base-163.repo CentOS-Base.repo

安裝必要的軟件包

yum install tree telnet dos2unix sysstat lrzsz -y

yumupdate 把系統的更新到最新  

yumgrouplist 查看系統都安裝了那些安裝包

安裝后的基本調優及安全設置

1.關閉selinux

2.設定runlevel為3

[root@greymouster ~]# grep 3:initdefault /etc/inittab
id:3:initdefault:
[root@greymouster ~]# init 3

3.精簡開機系統啟動的服務為：

[root@greymouster ~]# LANG=en
[root@greymouster ~]# chkconfig --list|grep "3:on"
[root@greymouster ~]# for test in `chkconfig --list|grep "3:on"|awk '{print $1}'`;do chkconfig $test off;done
[root@greymouster ~]# for test in crond network rsyslog sshd;do chkconfig $test on;done
[root@greymouster ~]# chkconfig --list|grep "3:on" 
或者
[root@greymouster ~]# for test in `chkconfig --list|grep "3:on"|awk '{print $1}'|grep -vE"crond|network|rsyslog|sshd"`;do chkconfig $test off;done

 4.更改ssh服務遠程登錄的配置

[root@greymouster ~]# cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
[root@greymouster ~]# vi /etc/ssh/sshd_config

 #Port 22  #ssh連接默認端口22

 #PermitRootLogin no # root用戶是否禁止遠程登錄

 #PermitEmptyPasswords no #禁止空密碼登錄

 #UseDNS no    #不使用DNS

 #GSSAPIAuthentication no #讓ssh連接更快

 [root@greymouster ~]# /etc/init.d/sshd restart

 [root@greymouster ~]# /etc/init.d/iptables stop //臨時關閉防火牆

 

5.將普通帳號加入到sudo管理

 

[root@greymouster ~]# visudo
98gg   //定位到98行

root    ALL=(ALL)       ALL
greymouster ALL=(ALL)   /usr/sbin/useradd
或者這樣修改：擁有全部的權限但不需要密碼
greymouster ALL=(ALL) NOPASSWD:ALL

%用戶組  機器=（授權那個角色的權利） /usr/sbin/useradd

[root@greymouster ~]# su - greymouster
[greymouster@greymouster ~]$ useradd kkk
-bash: /usr/sbin/useradd: Permission denied
[greymouster@greymouster ~]$ sudo useradd kkk
[sudo] password for greymouster: 
[greymouster@greymouster ~]$ tail -1 /etc/passwd
kkk:x:502:502::/home/kkk:/bin/bash

[greymouster@greymouster ~]$ netstat -lntup|grep ssh
(No info could be read for "-p": geteuid()=501 but you should be root.)
[greymouster@greymouster ~]$ sudo netstat -lntup|grep ssh
tcp 0 0 0.0.0.0:60222 0.0.0.0:* LISTEN 28683/sshd
tcp 0 0 :::60222 :::* LISTEN 28683/sshd
[greymouster@greymouster ~]$

6.修改中文顯示

7.服務器時間同步

 

[root@greymouster ~]# /usr/sbin/ntpdate time.nist.gov
25 Mar 15:19:50 ntpdate[29421]: step time server 128.138.141.172 offset 248182.140419 sec
[root@greymouster ~]# date
2017年 03月 25日 星期六 15:20:07 CST
[root@greymouster ~]# echo '#time sync by greymouster at 2017-3-25' >> /var/spool/cron/root
[root@greymouster ~]# echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1'>>/var/spool/cron/root
[root@greymouster ~]# crontab -l
#time sync by greymouster at 2017-3-25
*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1

 8.加大服務器的文件描述符

 

9.調整內核參數文件 /etc/sysctl.conf

vim /etc/sysctl.conf  shift+g 切換到底部添加

net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000  65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
防火牆的優化則添加以下，在6.4上是，如下：

net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
[root@greymouster ~]# sysctl -p   //生效

10、鎖定關鍵文件系統

[root@greymouster ~]# chattr +i /etc/passwd
[root@greymouster ~]# chattr +i  /etc/inittab
[root@greymouster ~]# chattr +i /etc/group
[root@greymouster ~]# chattr +i /etc/shadow
[root@greymouster ~]# chattr +i /etc/gshadow 

使用chattr命令后，為了安全我們需要將其改名

[root@greymouster ~]# /bin/mv /usr/bin/chattr   /usr/bin/任意名稱

查看枷鎖：lsattr  /etc/passwd

11、去除系統及內核版本登錄前的屏幕顯示

[root@greymouster ~]# /etc/redhat-release
[root@greymouster ~]#  cat /dev/null >/etc/issue