优化内容:
(1.设置history历史记录
(2.添加普通用户,设置sudo权限
(3.禁止root远程用户登录
(4.修改远程端口
(5.精简开机启动服务器
(6.关闭selinux
(7.配置iptables
(8.修改最大连接数 ulimit
(9.禁止使用Ctrl+Alt+Del快捷键重启服务器
(10.修改默认DNS
(11.安装必要软件,更新yum源 [epel源] 
(12.更新内核和软件到最新版本
(13.优化内核参数 [根据实际情况调整]
(14.去除上次登录的信息
(15.关闭开机显示内核信息
 
1.设置history历史记录
echo ‘
export HISTFILE=$HOME/.bash_history
export HISTSIZE=2000
export HISTFILESIZE=2000
export HISTTIMEFORMAT=”%F %T `whoami` “
export PROMPT_COMMAND=”history -a; history -c; history -r;”
shopt -s histappend
typeset -r PROMPT_COMMAND
typeset -r HISTTIMEFORMAT ‘ > /etc/profile.d/history.sh
source /etc/profile

2.添加普通用户,设置sudo权限
username=’dyt’
password=’dyt2015′
useradd $username ; echo $password | passwd –stdin $username
sed -i “98 a$username    ALL=(ALL)       NOPASSWD: ALL” /etc/sudoers

3.禁止root远程用户登录 
sed -i ‘s/#PermitRootLogin yes/PermitRootLogin no/’ /etc/ssh/sshd_config

4.修改远程端口
sed -i ‘s/#Port 22/Port 9527/’ /etc/ssh/sshd_config
/etc/init.d/sshd restart

5.精简开机启动服务器 
for server in `chkconfig –list|egrep -v ‘crond|network|rsyslog|sshd|iptables’|awk ‘{print $1}’`;do chkconfig $server off; done

6.关闭selinux
sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/’ /etc/selinux/config
setenforce 0

7.配置iptables
/etc/init.d/iptables restart
iptables -F
iptables -X
iptables -Z
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

#允许某个IP段远程访问ssh
iptables -A INPUT -p tcp -m tcp –dport 9527 -s 192.168.64.0/24 -j ACCEPT

#开启80端口
iptables -A INPUT -P tcp -m tcp –dropt 80 -j ACCEPT

#允许某个IP的所有请求
iptables -A INPUT -p all -s 124.43.56.90/30 -j ACCEPT
iptables -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
/etc/init.d/iptables save
/etc/init.d/iptables restart

8.修改最大连接数 ulimit 
#方法有很多,未必就这一种
echo ‘*  -  noproc  65535′ >> /etc/security/limits.conf
echo ‘*  -  nofile  65535′ >> /etc/security/limits.conf

9.禁止使用Ctrl+Alt+Del快捷键重启服务器
sed -i “s/start on control-alt-delete/#start on control-alt-delete/g” /etc/init/control-alt-delete.conf

10.修改默认DNS
echo “nameserver 8.8.8.8″ > /etc/resolv.conf
echo “nameserver 8.8.4.4″ >> /etc/resolv.conf

11.安装必要软件,更新yum源 [epel源] 
#根据个人公司情况,这里只列举了自己常用的软件和yum源,根据实际情况更改yum源
yum -y install gcc gcc-c++ openssl-devel openssh-clients wget make lrzsz unzip zip xz ntpdate lsof telnet epel-release vim tree kernel-devel kernel

12.更新内核和软件到最新版本
yum -y upgrade

13.优化内核参数 [根据实际情况调整]
echo -e “net.core.somaxconn = 262144″ >> /etc/sysctl.conf
echo -e “net.core.netdev_max_backlog = 262144″ >> /etc/sysctl.conf
echo -e “net.core.wmem_default = 8388608″ >> /etc/sysctl.conf
echo -e “net.core.rmem_default = 8388608″ >> /etc/sysctl.conf
echo -e “net.core.rmem_max = 16777216″ >> /etc/sysctl.conf
echo -e “net.core.wmem_max = 16777216″ >> /etc/sysctl.conf
echo -e “net.ipv4.route.gc_timeout = 20″ >> /etc/sysctl.conf
echo -e “net.ipv4.ip_local_port_range = 1024 65535″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_retries2 = 5″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_fin_timeout = 30″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_syn_retries = 1″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_synack_retries = 1″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_timestamps = 0″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_tw_recycle = 1″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_tw_reuse = 1″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_keepalive_time = 120″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_keepalive_probes = 3″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_keepalive_intvl = 15″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_max_tw_buckets = 36000″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_max_orphans = 3276800″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_max_syn_backlog = 262144″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_wmem = 8192 131072 16777216″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_rmem = 32768 131072 16777216″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_mem = 94500000 915000000 927000000″ >> /etc/sysctl.conf
echo -e “net.ipv4.tcp_slow_start_after_idle = 0″ >> /etc/sysctl.conf
echo -e “vm.swappiness = 0″ >> /etc/sysctl.conf
echo -e “kernel.panic = 5″ >> /etc/sysctl.conf
echo -e “kernel.panic_on_oops = 1″ >> /etc/sysctl.conf  
echo -e “kernel.core_pipe_limit = 0″ >> /etc/sysctl.conf

#iptables 防火墙
echo -e “net.nf_conntrack_max = 25000000″ >> /etc/sysctl.conf
echo -e “net.netfilter.nf_conntrack_max = 25000000″ >> /etc/sysctl.conf
echo -e “net.netfilter.nf_conntrack_tcp_timeout_established = 180″ >> /etc/sysctl.conf
echo -e “net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120″ >> /etc/sysctl.conf
echo -e “net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60″ >> /etc/sysctl.conf
echo -e “net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120″ >> /etc/sysctl.confo

15.去除上次登录的信息 
touch ~/.hushlogin

 

http://blog.itpub.net/9034054/viewspace-2073312/