CentOS优化笔记
设置固定IP
vi /etc/sysconfig/network-scripts/ifcfg-eth0
ONBOOT=yes
BOOTPROTO=none
DNS1=202.96.209.133
IPADDR=192.168.159.68
PREFIX=24
GATEWAY=192.168.159.2
修改yum源
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
同步时间
yum install ntpdate
#修改时区立即生效
cp /usr/share/zoneinfo/UTC /etc/localtime
#cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
#修改时间
date -s "12/24/16 18:05:00"
hwclock -w
#hwclock -s (--hctosys)
#查看时间
date
date "+%Y-%m-%d %H:%M:%S"
#UTC时间
date -u
hwclock
#同步时间
ntpdate time.nist.gov
crontab -e
*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1
关闭selinux和iptables
#临时生效
getenforce
setenforce 0
service iptables stop
#永久生效
vi /etc/selinux/config
SELINUX=disabled
chkconfig iptables off
chkconfig --list iptables
修改文件描述符数量
ulimit -n
ulimit -HSn 65535
vi /etc/security/limits.conf
* - nofile 65535
中文字符集
vi /etc/sysconfig/i18n
LANG="en_US.UTF-8"
#LANG="zh_CN.UTF-8"
source /etc/sysconfig/i18n
>/etc/issue
内核参数优化
vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
sysctl -p
精简自启服务
for ser in `chkconfig --list | grep "3:on"|awk '{print $1}'`; do chkconfig $ser off; done
for ser in crond network sshd rsyslog ;do chkconfig $ser on; done
使用普通用户
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
强化SSH配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
vi /etc/sysconfig/network-scripts/ifcfg-eth0
ONBOOT=yes
BOOTPROTO=none
DNS1=202.96.209.133
IPADDR=192.168.159.68
PREFIX=24
GATEWAY=192.168.159.2
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
同步时间
yum install ntpdate
#修改时区立即生效
cp /usr/share/zoneinfo/UTC /etc/localtime
#cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
#修改时间
date -s "12/24/16 18:05:00"
hwclock -w
#hwclock -s (--hctosys)
#查看时间
date
date "+%Y-%m-%d %H:%M:%S"
#UTC时间
date -u
hwclock
#同步时间
ntpdate time.nist.gov
crontab -e
*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1
关闭selinux和iptables
#临时生效
getenforce
setenforce 0
service iptables stop
#永久生效
vi /etc/selinux/config
SELINUX=disabled
chkconfig iptables off
chkconfig --list iptables
修改文件描述符数量
ulimit -n
ulimit -HSn 65535
vi /etc/security/limits.conf
* - nofile 65535
中文字符集
vi /etc/sysconfig/i18n
LANG="en_US.UTF-8"
#LANG="zh_CN.UTF-8"
source /etc/sysconfig/i18n
>/etc/issue
内核参数优化
vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
sysctl -p
精简自启服务
for ser in `chkconfig --list | grep "3:on"|awk '{print $1}'`; do chkconfig $ser off; done
for ser in crond network sshd rsyslog ;do chkconfig $ser on; done
使用普通用户
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
强化SSH配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
yum install ntpdate
#修改时区立即生效
cp /usr/share/zoneinfo/UTC /etc/localtime
#cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
#修改时间
date -s "12/24/16 18:05:00"
hwclock -w
#hwclock -s (--hctosys)
#查看时间
date
date "+%Y-%m-%d %H:%M:%S"
#UTC时间
date -u
hwclock
#同步时间
ntpdate time.nist.gov
crontab -e
*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1
#临时生效
getenforce
setenforce 0
service iptables stop
#永久生效
vi /etc/selinux/config
SELINUX=disabled
chkconfig iptables off
chkconfig --list iptables
修改文件描述符数量
ulimit -n
ulimit -HSn 65535
vi /etc/security/limits.conf
* - nofile 65535
中文字符集
vi /etc/sysconfig/i18n
LANG="en_US.UTF-8"
#LANG="zh_CN.UTF-8"
source /etc/sysconfig/i18n
>/etc/issue
内核参数优化
vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
sysctl -p
精简自启服务
for ser in `chkconfig --list | grep "3:on"|awk '{print $1}'`; do chkconfig $ser off; done
for ser in crond network sshd rsyslog ;do chkconfig $ser on; done
使用普通用户
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
强化SSH配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
ulimit -n
ulimit -HSn 65535
vi /etc/security/limits.conf
* - nofile 65535
vi /etc/sysconfig/i18n
LANG="en_US.UTF-8"
#LANG="zh_CN.UTF-8"
source /etc/sysconfig/i18n
>/etc/issue
内核参数优化
vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
sysctl -p
精简自启服务
for ser in `chkconfig --list | grep "3:on"|awk '{print $1}'`; do chkconfig $ser off; done
for ser in crond network sshd rsyslog ;do chkconfig $ser on; done
使用普通用户
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
强化SSH配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
vi /etc/sysctl.conf
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
sysctl -p
for ser in `chkconfig --list | grep "3:on"|awk '{print $1}'`; do chkconfig $ser off; done
for ser in crond network sshd rsyslog ;do chkconfig $ser on; done
使用普通用户
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
强化SSH配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
useradd naitcn
passwd naitcn
visudo
naitcn ALL=(ALL) NOPASSWD: ALL
sudo su -
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori
vi /etc/ssh/sshd_config
Port 55522
PermitEmptyPasswords no
#PermitRootLogin no
GSSAPIAuthentication no
UseDNS no
service sshd restart
锁定提权文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
lsattr /etc/passwd
mv /usr/bin/chattr /opt/hello
本文永久更新链接地址:http://www.linuxidc.com/Linux/2016-12/138994.htm