Centos7_系统初始优化配置

根据各环境，选择所需的优化策略进行配置

• 关闭selinux

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

• 关闭防火墙

systemctl stop firewalld
systemctl disable firewalld
systemctl stop iptables
systemctl disable iptables

• 关闭network管理系统

systemctl stop NetworkManager
systemctl disable NetworkManager

• 配置DNS

sed -i '1i\nameserver 223.5.5.5' /etc/resolv.conf
sed -i '2i\nameserver 1.2.4.8' /etc/resolv.conf

• 安装依赖插件

yum -y install epel-release wget
mkdir -p /etc/yum.repos.d/bak
mv /etc/yum.repos.d/* /etc/yum.repos.d/bak
wget http://mirrors.aliyun.com/repo/Centos-7.repo -P /etc/yum.repos.d/
wget http://mirrors.aliyun.com/repo/epel-7.repo -P /etc/yum.repos.d/
yum -y install wget vim ntp unzip zip net-snmp* telnet sysstat gcc gcc-c++ make openssl* perl ncurses* nethogs lsof lrzsz libselinux-python bash-completion net-tools setuptool system-config-network-tui ntsysv expat-devel psmisc nmap fping traceroute python2-pip readline-devel cpp cmake bison libaio-devel ncurses-devel perl-DBD-MySQL perl-Time-HiRes openssh-clients libaio zlib-devel libssl.so.6 numactl jemalloc compat-readline5-devel

• 修改时区

timedatectl set-timezone Asia/Shanghai
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

• 禁止使用Ctrl+Alt+Del重启

mv /usr/lib/systemd/system/ctrl-alt-del.target /usr/lib/systemd/system/ctrl-alt-del.target.bak
init q

• 修改字符编码

echo 'LANG="en_US.UTF-8"
SUPPORTED="zh_CN.GB18030:zh_CN:zh:en_US.UTF-8:en_US:en"
SYSFONT="latarcyrheb-sun16"' > /etc/locale.conf

• 配置同步时间

systemctl stop ntpd
systemctl disable ntpd
###可访问外网配置
ntpdate ntp1.aliyun.com
echo '*/5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com > /dev/null 2>&1' >> /var/spool/cron/root
###仅可访问阿里云内网配置
ntpdate ntp7.cloud.aliyuncs.com
echo '*/5 * * * * /usr/sbin/ntpdate ntp7.cloud.aliyuncs.com > /dev/null 2>&1' >> /var/spool/cron/root

• 修改ssh策略

###配置ssh禁用反向解析
echo 'UseDNS=no' >> /etc/ssh/sshd_config
###配置ssh-server侦听端口
echo 'Port 22' >> /etc/ssh/sshd_config
###禁止root用户通过ssh远程登录
echo 'PermitRootLogin no' >> /etc/ssh/sshd_config

systemctl restart sshd

• 优化tcp连接数

###可打开的文件描述符的最大数
###用户可用的最大进程数量
cat >> /etc/security/limits.conf << EOF
* soft nproc 65536
* hard nproc 65536
* soft nofile 65536
* hard nofile 65536
EOF

###Linux最大进程数
cat >> /etc/security/limits.d/20-nproc.conf << EOF
* soft nproc unlimited
* hard nproc unlimited
EOF

cat >> /etc/pam.d/login << EOF
session required /lib/security/pam_limits.so
session required pam_limits.so
EOF

###系统所有进程共计可以打开的文件数量
cat >> /etc/sysctl.conf << EOF
fs.file-max = 65535
EOF

###用户登录系统后打开文件数量
cat >> /etc/profile << EOF
ulimit -HSn 65535
EOF

source /etc/profile

• 配置密码策略

#设置密码强度
#设置密码长度不低于8位
authconfig --passminlen=8 --update
#设置密码中连续字符最大数目3个
authconfig --passmaxclassrepeat=3 --update
#密码需包含小写，大写，数字，特殊字符
authconfig --enablereqlower --update
authconfig --enablerequpper --update
authconfig --enablereqdigit --update
authconfig --enablereqother --update
#检查配置成功
#cat /etc/security/pwquality.conf
#' 密码长度 = minlen  /
#  连续数目 = maxclassrepeat   /
#  小写 = lcredit  /
#  大写 = ucredit  /
#  数字 = dcredit  /
#  特殊字符 = ocredit'

• 设置ssh登录超时

#设置20分钟登录无操作自动退出,服务器每120秒心跳包测试客户端，三次不成功断开
echo 'export TMOUT=1200' >> /etc/profile
source /etc/profile
echo 'ClientAliveInterval 120
ClientAliveCountMax 3' >> /etc/ssh/sshd_config
systemctl restart sshd

• 设置用户登录记录

echo '#!/bin/bash
loginFile="/var/log/sshd/sshlogin.log"
user=$USER
ip=${SSH_CLIENT%% *}
#if [ "$user" != "root" ] || [ "$ip" != "192.168.2.88" ]
 #then
echo "LoginUser:"$user"--IP:"$ip"--LoginTime:"`date "+%Y-%m-%d %H:%M:%S"` >> "$loginFile";
#fi' >> /etc/ssh/sshrc
mkdir /var/log/sshd
touch /var/log/sshd/sshlogin.log
chmod -R 777 /var/log/sshd
chmod +x /etc/ssh/sshrc

• 查看历史操作记录，并加时间戳

echo 'export HISTTIMEFORMAT="%F %T `whoami` "' >> /etc/profile
source /etc/profile

• 系统启动配置文件赋权

chmod +x /etc/rc.d/rc.local