1、配置網絡yum源
# 1 yum 調整
mkdir /etc/yum.repos.d/bak -p
mv /etc/yum.repos.d/* /etc/yum.repos.d/bak
cat > /etc/yum.repos.d/CentOS-Base.repo << EOF
[base]
name=CentOS-\$releasever - Base - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/\$releasever/os/\$basearch/
http://mirrors.aliyuncs.com/centos/\$releasever/os/\$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=\$releasever&arch=\$basearch&repo=os
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
#released updates
[updates]
name=CentOS-\$releasever - Updates - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/\$releasever/updates/\$basearch/
http://mirrors.aliyuncs.com/centos/\$releasever/updates/\$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=\$releasever&arch=\$basearch&repo=updates
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
#additional packages that may be useful
[extras]
name=CentOS-\$releasever - Extras - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/\$releasever/extras/\$basearch/
http://mirrors.aliyuncs.com/centos/\$releasever/extras/\$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=\$releasever&arch=\$basearch&repo=extras
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-\$releasever - Plus - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/\$releasever/centosplus/\$basearch/
http://mirrors.aliyuncs.com/centos/\$releasever/centosplus/\$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=\$releasever&arch=\$basearch&repo=centosplus
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
#contrib - packages by Centos Users
[contrib]
name=CentOS-\$releasever - Contrib - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/\$releasever/contrib/\$basearch/
http://mirrors.aliyuncs.com/centos/\$releasever/contrib/\$basearch/
#mirrorlist=http://mirrorlist.centos.org/?release=\$releasever&arch=\$basearch&repo=contrib
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-6
EOF
cat > /etc/yum.repos.d/epel.repo << EOF
[epel]
name=Extra Packages for Enterprise Linux 6 - \$basearch
baseurl=http://mirrors.aliyun.com/epel/6/\$basearch
http://mirrors.aliyuncs.com/epel/6/\$basearch
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=\$basearch
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
[epel-debuginfo]
name=Extra Packages for Enterprise Linux 6 - \$basearch - Debug
baseurl=http://mirrors.aliyun.com/epel/6/\$basearch/debug
http://mirrors.aliyuncs.com/epel/6/\$basearch/debug
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-debug-6&arch=\$basearch
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
gpgcheck=0
[epel-source]
name=Extra Packages for Enterprise Linux 6 - \$basearch - Source
baseurl=http://mirrors.aliyun.com/epel/6/SRPMS
http://mirrors.aliyuncs.com/epel/6/SRPMS
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-source-6&arch=\$basearch
failovermethod=priority
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
gpgcheck=0
EOF
2、關閉selinux
#查看selinux的狀態
cat /etc/selinux/config | grep "SELINUX=" | egrep -v "^#"
SELINUX=enforcing
#關閉selinux，將狀態改爲disabled
[root@MyLinux-6 ~]# sed -i "s#SELINUX=enforcing#SELINUX=disabled#g" /etc/selinux/config
[root@MyLinux-6 ~]# getenforce 在命令行下查看selinux的狀態
Enforcing
[root@MyLinux-6 ~]# setenforce 0 讓selinux的狀態在命令行下生效
[root@MyLinux-6 ~]# getenforce 再次查看selinux的狀態
Permissive
3、關閉沒有用的開機起動項
#CentOS 6的使用方法
for oldboy in `chkconfig --list|grep 3:on|awk '{print $1}'`;do chkconfig --level 3 $oldboy off;done
for oldboy in crond network rsyslog sshd;do chkconfig --level 3 $oldboy on;done
chkconfig --list | grep 3:on
#CentOS 5的使用方法
for oldboy in `chkconfig --list|grep 3:on|awk '{print $1}'`;do chkconfig --level 3 $oldboy off;done
for oldboy in crond network syslog sshd;do chkconfig --level 3 $oldboy on;done
chkconfig --list | grep 3:on
4、關閉iptables防火牆
[root@MyLinux-6 ~]# /etc/init.d/iptables stop
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
[root@MyLinux-6 ~]# /etc/init.d/iptables status
iptables: Firewall is not running.
5、修改ssh配置
cd /etc/ssh/
/bin/cp sshd_config sshd_config.rfjer.`date +%Y%m%d`
#修改遠程登陸端口
[root@MyLinux-6 ssh]# sed -i "s#\#Port 22#Port 52113#g" sshd_config
[root@MyLinux-6 ssh]# cat sshd_config | grep "Port"
#禁止root登陸
sed -i "s#\#PermitRootLogin yes#PermitRootLogin no#g" sshd_config
cat sshd_config | grep "PermitRootLogin"
#禁止空密碼登陸
sed -i "s#\#PermitEmptyPasswords no#PermitEmptyPasswords no#g" sshd_config
cat sshd_config | grep "PermitEmptyPasswords"
#不使用DNS
sed -i "s#\#UseDNS yes#UseDNS no#g" sshd_config
cat sshd_config | grep "UseDNS"
/etc/init.d/sshd restart
6、修改中文字符集
cp /etc/sysconfig/i18n /etc/sysconfig/i18n.rfjer.`date +%Y%m%d`
echo 'LANG="zh_CN.UTF-8"' > /etc/sysconfig/i18n
source /etc/sysconfig/i18n
7、時間同步
yum -y install wget unzip vim man bc gcc gcc-c++ openssl openssl-devel kernel kernel-devel kernel-headers rsync lftp bash bash-completion bash-argsparse ncurses ncurses-devel bison bison-devel openssh-clients automake autoconf cmake gd gd-devel curl curl-devel libxml2 libxml2-devel sysstat telnet net-snmp net-snmp-devel pcre pcre-devel mlocate libmcrypt libmcrypt-devel libxslt libxslt-devel lrzsz glibc ntpdate iftop lsof
\cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime -rf
echo '*/5 * * * * /usr/sbin/ntpdate ntp.sjtu.edu.cn' >> /var/spool/cron/root
echo 'TIMEZONE="Asia/Shanghai"' > /etc/sysconfig/clock
/usr/sbin/ntpdate ntp.sjtu.edu.cn
#CentOS 6
/usr/sbin/ntpdate time.nist.gov
echo '#time sync by rfjer at '`date +%Y%m%d` >> /var/spool/cron/root
echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1' >> /var/spool/cron/root
#CentOS 5
/sbin/ntpdate time.nist.gov
echo '#time sync by rfjer at '`date +%Y%m%d` >>/var/spool/cron/root
echo '*/5 * * * * /sbin/ntpdate time.nist.gov >/dev/null 2>&1' >> /var/spool/cron/root
8、加大文件描述符
echo '* - nofile 65535' >>/etc/security/limits.conf
6、調整內核參數
/bin/cp /etc/sysctl.conf /etc/sysctl.conf.rfjer.`date +%Y%m%d`
cat >>/etc/sysctl.conf<<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.ipv4.ip_conntrack_max = 25000000
net.ipv4.netfilter.ip_conntrack_max=25000000
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180
net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait=120
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait=120
EOF
[root@MyLinux-5 ssh]# sysctl -p
如果報以上錯誤，可以不用和，這是由於iptables關閉導致的
CentOS 5優化批處理腳本
cd /etc/yum.repos.d/
/bin/mv CentOS-Base.repo CentOS-Base.repo.rfjer.`date +%Y%m%d`
wget http://mirrors.sohu.com/help/CentOS-Base-sohu.repo
/bin/mv CentOS-Base-sohu.repo CentOS-Base.repo
yum makecache
yum -y install lrzsz sysstat
yum -y upgrade
sed -i "s#SELINUX=enforcing#SELINUX=disabled#g" /etc/selinux/config
setenforce 0
for oldboy in `chkconfig --list|grep 3:on|awk '{print $1}'`;do chkconfig --level 3 $oldboy off;done
for oldboy in crond network syslog sshd;do chkconfig --level 3 $oldboy on;done
chkconfig --list | grep 3:on
/etc/init.d/iptables stop
cd /etc/ssh/
/bin/cp sshd_config sshd_config.rfjer.`date +%Y%m%d`
sed -i "s#\#Port 22#Port 52113#g" sshd_config
sed -i "s#\#PermitRootLogin yes#PermitRootLogin no#g" sshd_config
sed -i "s#\#PermitEmptyPasswords no#PermitEmptyPasswords no#g" sshd_config
sed -i "s#\#UseDNS yes#UseDNS no#g" sshd_config
/etc/init.d/sshd restart
cp /etc/sysconfig/i18n /etc/sysconfig/i18n.rfjer.`date +%Y%m%d`
echo 'LANG="zh_CN.gb18030"' > /etc/sysconfig/i18n
source /etc/sysconfig/i18n
/sbin/ntpdate time.nist.gov
echo '#time sync by rfjer at '`date +%Y%m%d` >> /var/spool/cron/root
echo '*/5 * * * * /sbin/ntpdate time.nist.gov > /dev/null 2>&1' >>/var/spool/cron/root
echo '* - nofile 65535' >> /etc/security/limits.conf
/bin/cp /etc/sysctl.conf /etc/sysctl.conf.rfjer.`date +%Y%m%d`
cat >> /etc/sysctl.conf<<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.ipv4.ip_conntrack_max = 25000000
net.ipv4.netfilter.ip_conntrack_max=25000000
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180
net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait=120
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait=120
EOF
sysctl -p
useradd rfjer
echo 'junfeng' | passwd --stdin rfjer
sed -i `grep -n "^root" /etc/sudoers | cut -d ':' -f 1`'a rfjer ALL=(ALL) ALL' /etc/sudoers
history -c
CentOS 6優化批處理腳本
cd /etc/yum.repos.d/
/bin/mv CentOS-Base.repo CentOS-Base.repo.rfjer.`date +%Y%m%d`
wget http://mirrors.163.com/.help/CentOS6-Base-163.repo
/bin/mv CentOS6-Base-163.repo CentOS-Base.repo
yum makecache
yum -y install lrzsz sysstat
yum -y upgrade
sed -i "s#SELINUX=enforcing#SELINUX=disabled#g" /etc/selinux/config
setenforce 0
for oldboy in `chkconfig --list|grep 3:on|awk '{print $1}'`;do chkconfig --level 3 $oldboy off;done
for oldboy in crond network rsyslog sshd;do chkconfig --level 3 $oldboy on;done
chkconfig --list | grep 3:on
/etc/init.d/iptables stop
cd /etc/ssh/
/bin/cp sshd_config sshd_config.rfjer.`date +%Y%m%d`
sed -i "s#\#Port 22#Port 52113#g" sshd_config
sed -i "s#\#PermitRootLogin yes#PermitRootLogin no#g" sshd_config
sed -i "s#\#PermitEmptyPasswords no#PermitEmptyPasswords no#g" sshd_config
sed -i "s#\#UseDNS yes#UseDNS no#g" sshd_config
/etc/init.d/sshd restart
cp /etc/sysconfig/i18n /etc/sysconfig/i18n.rfjer.`date +%Y%m%d`
echo 'LANG="zh_CN.gb2312"' > /etc/sysconfig/i18n
source /etc/sysconfig/i18n
/usr/sbin/ntpdate time.nist.gov
echo '#time sync by rfjer at '`date +%Y%m%d` >> /var/spool/cron/root
echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1' >>/var/spool/cron/root
echo '* - nofile 65535' >> /etc/security/limits.conf
/bin/cp /etc/sysctl.conf /etc/sysctl.conf.rfjer.`date +%Y%m%d`
cat >> /etc/sysctl.conf<<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.ipv4.ip_conntrack_max = 25000000
net.ipv4.netfilter.ip_conntrack_max=25000000
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180
net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait=120
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait=120
EOF
sysctl -p
useradd rfjer
echo 'junfeng' | passwd --stdin rfjer
sed -i `grep -n "^root" /etc/sudoers | cut -d ':' -f 1`'a rfjer ALL=(ALL) ALL' /etc/sudoers
history -c