centos7---环境优化

第一季 概念

在做任何操作或排查问题前,先把基础环境排查完再检查问题。
不要忙乎一整天才发现防火墙没关，哭晕在厕所。

第二季 行动

1、当前版本

[root@x ~]# cat /etc/redhat-release 
CentOS Linux release 7.9.2009 (Core)
[root@x ~]# uname -r
3.10.0-1160.25.1.el7.x86_64

2、常规操作

#安装常用工具
yum install wget net-tools vim lrzsz telnet ntpdate dos2unix curl bash-completion.noarch -y

#更换yum源为阿里源
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum clean all
yum makecache

#时间同步
cat /etc/localtime
\cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime -rf
cat /etc/localtime
ntpdate -u ntp.api.bz
echo "*/5 * * * * ntpdate time7.aliyun.com >/dev/null 2>&1" >> /etc/crontab
systemctl restart crond
systemctl enable crond
systemctl status crond

#关闭防火墙
systemctl status firewalld
systemctl stop firewalld
systemctl disable firewalld
systemctl status firewalld

#关闭SElinux
getenforce
setenforce 0
getenforce
cat /etc/selinux/config
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
cat /etc/selinux/config

#SSH优化
cat /etc/ssh/sshd_config|grep UseDNS
cat /etc/ssh/sshd_config|grep GSSAPIAuthentication
sed -i 's#\#UseDNS yes#UseDNS no#g' /etc/ssh/sshd_config
sed -i 's#GSSAPIAuthentication yes#GSSAPIAuthentication no#g' /etc/ssh/sshd_config
cat /etc/ssh/sshd_config|grep UseDNS
cat /etc/ssh/sshd_config|grep GSSAPIAuthentication
systemctl restart sshd 

3、内核调优

#调整vm.max_map_count的大小
#查看
sysctl -a|grep vm.max_map_count
#临时
sysctl -w vm.max_map_count=262144
#永久
echo '#x' >>/etc/sysctl.conf
echo 'vm.max_map_count=262144' >>/etc/sysctl.conf
sysctl -p

#修改文件句柄数
#查看
ulimit -a（open files）
#临时
ulimit -n 4096
#永久
echo '#x' >>/etc/security/limits.conf
echo '* - nofile 65536' >>/etc/security/limits.conf

#路由转发
#临时
#sysctl -w net.ipv4.ip_forward=1
#永久
echo '#x' >>/etc/sysctl.conf
echo 'net.ipv4.ip_forward = 1' >>/etc/sysctl.conf
sysctl -p

第三季 善后

#所有节点设置主机名
hostnamectl set-hostname x
reboot

以下为生产环境实际优化脚本

#!/bin/bash

#iso
#https://mirrors.aliyun.com/centos/7.9.2009/isos/x86_64/CentOS-7-x86_64-Minimal-2009.iso
#install minimal.iso
#Debugging Tools
#Compatibility Libraries
#Development Tools
#close kdump
#security policy

#before
#mkdir -p /home/systemusers/.ssh
#echo "ssh-rsa

#env
wlanName=ens33
dnsIp=
yumIp=

#network eth0
sed -i s/GRUB_CMDLINE_LINUX/#GRUB_CMDLINE_LINUX/ /etc/default/grub
echo 'GRUB_CMDLINE_LINUX="rd.lvm.lv=centos/root rhgb quiet ipv6.disable=1 net.ifnames=0 biosdevname=0"' >>/etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg
mv /etc/sysconfig/network-scripts/ifcfg-${wlanName} /etc/sysconfig/network-scripts/ifcfg-eth0
sed -i s/${wlanName}/eth0/g /etc/sysconfig/network-scripts/ifcfg-eth0
#vim /etc/sysconfig/network-scripts/ifcfg-eth0 
#BOOTPROTO="static"
#NAME="eth0"
#DEVICE="eth0"
#ONBOOT="yes"
#IPADDR=10.0.0.1
#NETMASK=255.255.255.0
#GATEWAY=10.0.0.254
#DNS1=114.114.114.114
#DNS2=8.8.8.8
#systemctl restart network
#reboot
#tag: network eth0 This step can be optimized to templates

#dns
#vi /etc/resolv.conf
#nameserver 8.8.8.8
#nameserver 114.114.114.114
#nameserver 4.2.2.2
#nameserver 172.19.0.6
echo "nameserver        ${dnsIp}" > /etc/resolv.conf

#yum
yum install -y wget
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
#ali
#wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
#wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
#wlan
wget -O /etc/yum.repos.d/CentOS-Base.repo http://${yumIp}/centos7/CentOS-Base.repo
wget -O /etc/yum.repos.d/epel.repo http://${yumIp}/epel7/epel.repo
yum clean all
yum makecache fast
#安装工具解决密钥问题
#cd /etc/pki/rpm-gpg
#wget https://archive.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
#yum update不升级内核
#yum --exclude=kernel* update

#tool
yum install wget net-tools vim lrzsz telnet ntpdate bash-completion.noarch unzip nslookup tree curl -y
yum install sysstat iotop iftop htop openssl-devel dos2unix -y mtr openssh
#yum install bridge-utils bind-utils nc stress bash-com* python-netaddr git tcpdump jq lsof strace ntsysv psmisc -y

#firewalld
#systemctl status firewalld
systemctl stop firewalld.service
systemctl disable firewalld.service

#iptables
iptables -F
#iptables -F && sudo iptables -X && sudo iptables -F -t nat && sudo iptables -X -t nat
#iptables -P FORWARD ACCEPT
#iptables-save

#selinux
#getenforce
setenforce 0
#cat /etc/selinux/config
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

#ulimit
#ulimit -a（open files）
ulimit -SHn 65535
echo '#j' >>/etc/security/limits.conf
echo '* - nofile 65536' >>/etc/security/limits.conf
sed -i 's#4096#65535#g' /etc/security/limits.d/20-nproc.conf

#postfix
#systemctl disable postfix
#systemctl stop postfix

#NetworkManager
systemctl disable postfix NetworkManager
systemctl stop postfix NetworkManager

#visudo

#time
#timedatectl status
timedatectl set-timezone Asia/Shanghai
#cat /etc/localtime
rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && ntpdate ntp1.aliyun.com
#ntpdate ntp.api.bz
systemctl enable ntpdate &&  systemctl start ntpdate
#crontab
echo '*/5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2 >&1' >>/var/spool/cron/root
#echo "*/5 * * * * ntpdate time7.aliyun.com >/dev/null 2>&1" >> /etc/crontab
#systemctl status crond
systemctl enable crond && systemctl restart crond

#ssh
\cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bakj
#cat /etc/ssh/sshd_config|grep UseDNS
sed -i 's#\#UseDNS yes#UseDNS no#g' /etc/ssh/sshd_config
#cat /etc/ssh/sshd_config|grep GSSAPIAuthentication
sed -i 's#GSSAPIAuthentication yes#GSSAPIAuthentication no#g' /etc/ssh/sshd_config
#sed -i 's#\#AddressFamily any#AddressFamily inet#g' /etc/ssh/sshd_config
systemctl restart sshd


###--------------------------------------------------------------
#调整vm.max_map_count的大小
#sysctl -a|grep vm.max_map_count
#sysctl -w vm.max_map_count=262144
#sysctl -w net.ipv4.ip_forward=1
#echo '#j' >>/etc/sysctl.conf
#echo 'vm.max_map_count=262144' >>/etc/sysctl.conf
#sysctl -p

vim /etc/sysctl.conf
#close ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
#避免放大***
net.ipv4.icmp_echo_ignore_broadcasts = 1
#开启恶意icmp错误消息保护
net.ipv4.icmp_ignore_bogus_error_responses = 1
#close route forward
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#开启反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
#处理无源路由的包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
#关闭sysrq功能
kernel.sysrq = 0
#core文件名中添加pid作为扩展名
kernel.core_uses_pid = 1
#开启SYN洪水***保护
net.ipv4.tcp_syncookies = 1
#修改消息队列长度
kernel.msgmnb = 65536
kernel.msgmax = 65536
#设置最大内存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
#timewait的数量，默认180000
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
#每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目
net.core.netdev_max_backlog = 262144
#限制仅仅是为了防止简单的DoS ***
net.ipv4.tcp_max_orphans = 3276800
#未收到客户端确认信息的连接请求的最大值
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
#内核放弃建立连接之前发送SYNACK 包的数量
net.ipv4.tcp_synack_retries = 1
#内核放弃建立连接之前发送SYN 包的数量
net.ipv4.tcp_syn_retries = 1
#启用timewait 快速回收
net.ipv4.tcp_tw_recycle = 1
#开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
#当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时
net.ipv4.tcp_keepalive_time = 30
#修改防火墙表大小，默认65536
#net.netfilter.nf_conntrack_max=655350
#net.netfilter.nf_conntrack_tcp_timeout_established=1200
#确保无人能修改路由表
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
sysctl -p

#所有节点设置主机名
hostnamectl set-hostname master-1


#hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
IP 主机名

#reboot