centos6系统初始化脚本

qianby

centos6系统初始化脚本，仅供交流，高手勿喷！

centos6系统初始化脚本

1. #!/bin/bash
   
2. 
   
3. #written:51clocker
   
4. #date:2015-07-18
   
5. #email:admin@51clocker.com
   
6. #web:http://www.51clocker.com
   
7. 
   
8. echo -e "\033[31m 这个是系统初始化脚本，请慎重运行！ press ctrl+C to cancel \033[0m"
   
9. sleep 5
   
10. 
    
11. yum_update(){
    
12.     yum -y install wget
    
13.     cd /etc/yum.repos.d/
    
14.     mkdir bak
    
15.     mv ./*.repo bak
    
16.     wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
    
17.     wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo
    
18.     yum clean all && yum makecache
    
19.     yum -y install vim unzip  openssl-client gcc gcc-c++ ntp
    
20. }
    
21. 
    
22. # /etc/hosts
    
23. #[ "$(hostname -i)" != "127.0.0.1" ] && sed -i "s@^127.0.0.1\(.*\)@127.0.0.1   `hostname` \1@" /etc/hosts
    
24. 
    
25. #关闭SEKINUX
    
26. selinux(){
    
27. sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux
    
28. setenforce 0
    
29. }
    
30. 
    
31. #修改文件打开数
    
32. # /etc/security/limits.conf
    
33. limits_config(){
    
34. cat >> /etc/security/limits.conf <<EOF
    
35. * soft nproc 65535
    
36. * hard nproc 65535
    
37. * soft nofile 65535
    
38. * hard nofile 65535
    
39. EOF
    
40. echo "ulimit -SH 65535" >> /etc/rc.local
    
41. }
    
42. #优化内核参数
    
43. sysctl_config(){
    
44. sed -i 's/net.ipv4.tcp_syncookies.*$/net.ipv4.tcp_syncookies = 1/g' /etc/sysctl.conf
    
45. cat >> /etc/sysctl.conf << ENDF
    
46. net.ipv4.tcp_max_syn_backlog = 65536
    
47. net.core.netdev_max_backlog =  32768
    
48. net.core.somaxconn = 32768
    
49. net.core.wmem_default = 8388608
    
50. net.core.rmem_default = 8388608
    
51. net.core.rmem_max = 16777216
    
52. net.core.wmem_max = 16777216
    
53. net.ipv4.tcp_timestamps = 0
    
54. net.ipv4.tcp_synack_retries = 2
    
55. net.ipv4.tcp_syn_retries = 2
    
56. net.ipv4.tcp_tw_recycle = 1
    
57. #net.ipv4.tcp_tw_len = 1
    
58. net.ipv4.tcp_tw_reuse = 1
    
59. net.ipv4.tcp_mem = 94500000 915000000 927000000
    
60. net.ipv4.tcp_max_orphans = 3276800
    
61. net.ipv4.ip_local_port_range = 1024  65535
    
62. ENDF
    
63. sysctl -p
    
64. }
    
65. 
    
66. #关闭系统不用的服务
    
67. stop_server(){
    
68. for server in `chkconfig --list |grep 3:on|awk '{ print $1}'`
    
69. do
    
70.     chkconfig --level 3 $server off
    
71. done
    
72. 
    
73. for server in crond network rsyslog sshd
    
74. do
    
75.    chkconfig --level 3 $server on
    
76. done
    
77. }
    
78. 
    
79. 
    
80. #language..
    
81. inittab(){
    
82. if [ -z "$(cat /etc/redhat-release | grep '6\.')" ];then
    
83.     sed -i 's/3:2345:respawn/#3:2345:respawn/g' /etc/inittab
    
84.     sed -i 's/4:2345:respawn/#4:2345:respawn/g' /etc/inittab
    
85.     sed -i 's/5:2345:respawn/#5:2345:respawn/g' /etc/inittab
    
86.     sed -i 's/6:2345:respawn/#6:2345:respawn/g' /etc/inittab
    
87.     sed -i 's/ca::ctrlaltdel/#ca::ctrlaltdel/g' /etc/inittab
    
88.     sed -i 's@LANG=.*$@LANG="en_US.UTF-8"@g' /etc/sysconfig/i18n
    
89. else
    
90.     sed -i 's@^ACTIVE_CONSOLES.*@ACTIVE_CONSOLES=/dev/tty[1-2]@' /etc/sysconfig/init
    
91.     sed -i 's@^start@#start@' /etc/init/control-alt-delete.conf
    
92. fi
    
93. /sbin/init q
    
94. }
    
95. #设置时间时区同步
    
96. zone_time(){
    
97.     rm -rf /etc/localtime
    
98.     ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
    
99. 
    
100.     # Update time
     
101.     /usr/sbin/ntpdate pool.ntp.org
     
102.     echo '*/5 * * * * /usr/sbin/ntpdate pool.ntp.org > /dev/null 2>&1' > /var/spool/cron/root;chmod 600 /var/spool/cron/root
     
103.     /sbin/service crond restart
     
104. }
     
105. 
     
106. #配置SSHD
     
107. sshd_config(){
     
108.     #sed -i '/^#Port/s/#Port 22/Port 65535/g' /etc/ssh/sshd_config
     
109.     sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
     
110.     #sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
     
111.     sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
     
112.     /etc/init.d/sshd restart
     
113. }
     
114. 
     
115. # iptables
     
116. iptables(){
     
117. cat > /etc/sysconfig/iptables << EOF
     
118. # Firewall configuration written by system-config-securitylevel
     
119. # Manual customization of this file is not recommended.
     
120. *filter
     
121. :INPUT DROP [0:0]
     
122. :FORWARD ACCEPT [0:0]
     
123. :OUTPUT ACCEPT [0:0]
     
124. :syn-flood - [0:0]
     
125. -A INPUT -i lo -j ACCEPT
     
126. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
     
127. -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
     
128. -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
     
129. -A INPUT -p icmp -m limit --limit 100/sec --limit-burst 100 -j ACCEPT
     
130. -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
     
131. -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn-flood
     
132. -A INPUT -j REJECT --reject-with icmp-host-prohibited
     
133. -A syn-flood -p tcp -m limit --limit 3/sec --limit-burst 6 -j RETURN
     
134. -A syn-flood -j REJECT --reject-with icmp-port-unreachable
     
135. COMMIT
     
136. EOF
     
137. /sbin/service iptables restart
     
138. source /etc/profile
     
139. }
     
140. other(){
     
141. # initdefault
     
142. sed -i 's/^id:.*$/id:3:initdefault:/' /etc/inittab
     
143. /sbin/init q
     
144. # PS1
     
145. echo 'PS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h \[\e[35;40m\]\W\[\e[0m\]]\\$ \[\e[33;40m\]"' >> /etc/profile
     
146. 
     
147. # Record command
     
148. sed -i 's/^HISTSIZE=.*$/HISTSIZE=100/' /etc/profile
     
149. echo "export PROMPT_COMMAND='{ msg=\$(history 1 | { read x y; echo \$y; });user=\$(whoami); echo \$(date \"+%Y-%m-%d %H:%M:%S\"):\$user:\`pwd\`/:\$msg ---- \$(who am i); } >> /tmp/\`hostname\`.\`whoami\`.history-timestamp'" >> /root/.bash_profile
     
150. 
     
151. # Wrong password five times locked 180s
     
152. sed -i '4a auth        required      pam_tally2.so deny=5 unlock_time=180' /etc/pam.d/system-auth
     
153. . /etc/profile
     
154. }
     
155. 
     
156. main(){
     
157.     yum_update
     
158.     selinux
     
159.     limits_config
     
160.     sysctl_config
     
161.     stop_server
     
162.     inittab
     
163.     zone_time
     
164.     sshd_config
     
165. #   iptables
     
166.     other
     
167. }
     
168. main

复制代码

Shell_HAT

sed -i 's/3:2345:respawn/#3:2345:respawn/g' /etc/inittab
sed -i 's/4:2345:respawn/#4:2345:respawn/g' /etc/inittab
sed -i 's/5:2345:respawn/#5:2345:respawn/g' /etc/inittab
sed -i 's/6:2345:respawn/#6:2345:respawn/g' /etc/inittab

可以考虑合并一下：

1. sed -i 's/[3-6]:2345:respawn/#&/' /etc/inittab

复制代码

dn833

这个脚本首先要满足网络是ok的。。。。。。
然后还有就是sshd你改了端口，iptables你写的不对会把自己墙外边的。。。。。。
另外你是不是觉得你默认都不开iptables那改这些防火墙有啥意义呢？？？？
还有就是你禁止了root，那你还得记住开个普通账号啊。。。。。。否则你拿啥ssh？？？

lolizeppelin

net.ipv4.ip_local_port_range = 1024  65535

又是这卵玩意

你们这乱初始化的到底懂不懂这些参数干什么的？

dn833

回复 4# lolizeppelin


    增加本地可用端口范围，当你的访问量达到一定程度的时候就有用了

reb00t

回复 4# lolizeppelin


很有用啊， 例如一些php-fpm， MySQL端口， 建议随机端口设置net.ipv4.ip_local_port_range = 10240   65535
防止10000以下端口冲突..

Shell_HAT

回复 4# lolizeppelin


    你给讲解一下给大家扫扫盲吧

聆雨淋夜

很好，希望大家多分享这样的脚本啊

lolizeppelin

这个值系统默认用30000 - 65535

除非你的服务器大量对外访问诸如
大量对外post、get(http服务被访问只会用80回数据根本不需要用到多余端口,mysql一般都有连接池也用不上那么多端口)
proxy_pass或fcgi_pass到127.0.0.1（其实访问本机器更应该用unix socket而不是用127.0.0.1）
否则根本不需要设置这个参数

降低这个参数会带来不必要的麻烦

例如很多程序很多都监听10000-30000端口
你动态端口降低反而用容易占用到需要监听的端口导致程序启动不了

会用到大量端口一般意味着有大量对外访问是短链接的
除了php之类的cgi方式的没法避免
java，libcurl，proxy_pass都支持http1.1，都有办法弄成长链接。



不知道是否有需要就这样设端口范围是非常不可取的，纯粹没事找事。