后面继续添加优化
１．修改主机名
#方便标识主机
hostnamectl set-hostname newname
２．Yum源更换为国内阿里源
yum install wget telnet -y
＃mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
#添加阿里的epel源
#add the epel
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
# rpm -ivh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm
3.安装必要的软件
yum -y install wget net-tools screen lsof tcpdump nc mtr openssl-devel vim bash-completion lrzsz nmap telnet tree ntpdate
4．禁用selinux
sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
setenforce 0
5.修改网卡eth0
5.1修改网卡配置参数
NAME=eth0
DEVICE=eth0
5.2修改网卡配置文件名称
cp /etc/sysconfig/network-scripts/ifcfg-ens3 /etc/sysconfig/network-scripts/ifcfg-eth0
5.3 禁用该可预测命名规则:net.ifnames=0 biosdevname=0
# vim /etc/default/grub
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=centos/root net.ifnames=0 biosdevname=0 rd.lvm.lv=centos/swap rhgb quiet"
GRUB_DISABLE_RECOVERY="true"
#grub2-mkconfig -o /boot/grub2/grub.cfg
#reboot
6. 最大进程数和最大文件打开数
6.1 查看
[root@tomcatweb01 ~]# ulimit -u
3882 ＃最大文件打开数
[root@tomcatweb01 ~]# ulimit -n
1024 ＃最大进程数
6.2 修改 /etc/security/limits.conf
#vim /etc/security/limits.conf
* soft nofile 1024000
* hard nofile 1024000
* soft nproc 1024000
* hard nproc 1024000
说明：
'*' 代表针对所有用户
noproc 是代表最大进程数
nofile 是代表最大文件打开数
6.3 修改vim /etc/security/limits.d/20-nproc.conf
#vim /etc/security/limits.d/20-nproc.conf
* soft nproc 1024000
* hard nproc 1024000
7.修改sshd默认端口和禁止root远程登陆
1、首先修改ssh的默认端口
# sed -i "s#\#Port 22#Port 23451#g" /etc/ssh/sshd_config
#端口可以改成任意端口，建议改成较大的端口，因为一万以内的端口常用的服务有占用，防止冲突（需要注意的是：这个端口要记住，否则连接不上服务器）
2、禁止root用户远程登陆 a）：添加一个普通用户并设置密码（注：这一步必须执行，否则将造成远程连接不上服务器）
# useradd xxx #添加xxx用户
# echo "pass" | passwd --stdin xxx
#给xxx用户设置密码为passb)：修改ssh服务配置文件并撑起服务
# sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
# systemctl restart sshd
3.防火墙开放端口
firewall-cmd --permanent --add-port=23451/tcp
firewall-cmd --reload
firewall-cmd --permanent --query-port=23451/tcp
4.利用其他客户端口尝试远程连接
8.优化内核参数
#关闭ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# 避免放大攻击
#
net.ipv4.icmp_echo_ignore_broadcasts = 1
#
# # 开启恶意icmp错误消息保护
#
net.ipv4.icmp_ignore_bogus_error_responses = 1
#
# #关闭路由转发
#
net.ipv4.ip_forward = 0
#
net.ipv4.conf.all.send_redirects = 0
#
net.ipv4.conf.default.send_redirects = 0
#
# #开启反向路径过滤
#
net.ipv4.conf.all.rp_filter = 1
#
net.ipv4.conf.default.rp_filter = 1
#
# #处理无源路由的包
#
net.ipv4.conf.all.accept_source_route = 0
#
net.ipv4.conf.default.accept_source_route = 0
#
# #关闭sysrq功能
#
kernel.sysrq = 0
#
# #core文件名中添加pid作为扩展名
#
kernel.core_uses_pid = 1
#
# # 开启SYN洪水攻击保护
#
net.ipv4.tcp_syncookies = 1
#
# #修改消息队列长度
#
kernel.msgmnb = 65536
#
kernel.msgmax = 65536
#
# #设置最大内存共享段大小bytes
#
kernel.shmmax = 68719476736
#
kernel.shmall = 4294967296
#
# #timewait的数量，默认180000
#
net.ipv4.tcp_max_tw_buckets = 6000
#
net.ipv4.tcp_sack = 1
#
net.ipv4.tcp_window_scaling = 1
#
net.ipv4.tcp_rmem = 4096 87380 4194304
#
net.ipv4.tcp_wmem = 4096 16384 4194304
#
net.core.wmem_default = 8388608
#
net.core.rmem_default = 8388608
#
net.core.rmem_max = 16777216
#
net.core.wmem_max = 16777216
#
# #每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目
#
net.core.netdev_max_backlog = 262144
#
# #限制仅仅是为了防止简单的DoS 攻击
#
net.ipv4.tcp_max_orphans = 3276800
#
# #未收到客户端确认信息的连接请求的最大值
#
net.ipv4.tcp_max_syn_backlog = 262144
#
net.ipv4.tcp_timestamps = 0
#
# #内核放弃建立连接之前发送SYNACK 包的数量
#
net.ipv4.tcp_synack_retries = 1
#
# #内核放弃建立连接之前发送SYN 包的数量
#
net.ipv4.tcp_syn_retries = 1
#
# #启用timewait 快速回收
#
net.ipv4.tcp_tw_recycle = 1
#
# #开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接
#
net.ipv4.tcp_tw_reuse = 1
#
net.ipv4.tcp_mem = 94500000 915000000 927000000
#
net.ipv4.tcp_fin_timeout = 1
#
# #当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时
#
net.ipv4.tcp_keepalive_time = 30
#
# #允许系统打开的端口范围
#
net.ipv4.ip_local_port_range = 1024 65000
#
# #修改防火墙表大小，默认65536
#
net.netfilter.nf_conntrack_max=655350
#
net.netfilter.nf_conntrack_tcp_timeout_established=1200
#
# # 确保无人能修改路由表
#
net.ipv4.conf.all.accept_redirects = 0
#
net.ipv4.conf.default.accept_redirects = 0
#
net.ipv4.conf.all.secure_redirects = 0
#
net.ipv4.conf.default.secure_redirects = 0
执行:sysctl -p生效
网友评论