更新国内镜像源
国内速度较快的常用更新源如下：
[root@greymouster ~]# cd /etc/yum.repos.d/ [root@greymouster yum.repos.d]# ll total 16 -rw-r--r--. 1 root root 1926 Nov 27 2013 CentOS-Base.repo -rw-r--r--. 1 root root 638 Nov 27 2013 CentOS-Debuginfo.repo -rw-r--r--. 1 root root 630 Nov 27 2013 CentOS-Media.repo -rw-r--r--. 1 root root 3664 Nov 27 2013 CentOS-Vault.repo [root@greymouster yum.repos.d]# cp CentOS-Base.repo CentOS-Base.repo.ori [root@greymouster yum.repos.d]# wget http://mirrors.163.com/.help/CentOS6-Base-163.repo [root@greymouster yum.repos.d]# cp CentOS6-Base-163.repo CentOS-Base.repo
安装必要的软件包
yum install tree telnet dos2unix sysstat lrzsz -y
yumupdate 把系统的更新到最新
yumgrouplist 查看系统都安装了那些安装包
安装后的基本调优及安全设置
1.关闭selinux
2.设定runlevel为3
[root@greymouster ~]# grep 3:initdefault /etc/inittab id:3:initdefault: [root@greymouster ~]# init 3
3.精简开机系统启动的服务为：
[root@greymouster ~]# LANG=en
[root@greymouster ~]# chkconfig --list|grep "3:on"
[root@greymouster ~]# for test in `chkconfig --list|grep "3:on"|awk '{print $1}'`;do chkconfig $test off;done
[root@greymouster ~]# for test in crond network rsyslog sshd;do chkconfig $test on;done
[root@greymouster ~]# chkconfig --list|grep "3:on"
或者
[root@greymouster ~]# for test in `chkconfig --list|grep "3:on"|awk '{print $1}'|grep -vE"crond|network|rsyslog|sshd"`;do chkconfig $test off;done
4.更改ssh服务远程登录的配置
[root@greymouster ~]# cp /etc/ssh/sshd_config /etc/ssh/sshd_config.ori [root@greymouster ~]# vi /etc/ssh/sshd_config
#Port 22 #ssh连接默认端口22 #PermitRootLogin no # root用户是否禁止远程登录 #PermitEmptyPasswords no #禁止空密码登录 #UseDNS no #不使用DNS #GSSAPIAuthentication no #让ssh连接更快 [root@greymouster ~]# /etc/init.d/sshd restart
[root@greymouster ~]# /etc/init.d/iptables stop //临时关闭防火墙
5.将普通帐号加入到sudo管理
[root@greymouster ~]# visudo 98gg //定位到98行 root ALL=(ALL) ALL greymouster ALL=(ALL) /usr/sbin/useradd
或者这样修改：拥有全部的权限但不需要密码
greymouster ALL=(ALL) NOPASSWD:ALL
%用户组 机器=（授权那个角色的权利） /usr/sbin/useradd
[root@greymouster ~]# su - greymouster [greymouster@greymouster ~]$ useradd kkk -bash: /usr/sbin/useradd: Permission denied [greymouster@greymouster ~]$ sudo useradd kkk [sudo] password for greymouster: [greymouster@greymouster ~]$ tail -1 /etc/passwd kkk:x:502:502::/home/kkk:/bin/bash
[greymouster@greymouster ~]$ netstat -lntup|grep ssh
(No info could be read for "-p": geteuid()=501 but you should be root.)
[greymouster@greymouster ~]$ sudo netstat -lntup|grep ssh
tcp 0 0 0.0.0.0:60222 0.0.0.0:* LISTEN 28683/sshd
tcp 0 0 :::60222 :::* LISTEN 28683/sshd
[greymouster@greymouster ~]$
6.修改中文显示
7.服务器时间同步
[root@greymouster ~]# /usr/sbin/ntpdate time.nist.gov 25 Mar 15:19:50 ntpdate[29421]: step time server 128.138.141.172 offset 248182.140419 sec [root@greymouster ~]# date 2017年 03月 25日 星期六 15:20:07 CST [root@greymouster ~]# echo '#time sync by greymouster at 2017-3-25' >> /var/spool/cron/root [root@greymouster ~]# echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1'>>/var/spool/cron/root [root@greymouster ~]# crontab -l #time sync by greymouster at 2017-3-25 */5 * * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1
8.加大服务器的文件描述符
9.调整内核参数文件 /etc/sysctl.conf
vim /etc/sysctl.conf shift+g 切换到底部添加
net.ipv4.tcp_fin_timeout = 2 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_keepalive_time = 600 net.ipv4.ip_local_port_range = 4000 65000 net.ipv4.tcp_max_syn_backlog = 16384 net.ipv4.tcp_max_tw_buckets = 36000 net.ipv4.route.gc_timeout = 100 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_synack_retries = 1 net.core.somaxconn = 16384 net.core.netdev_max_backlog = 16384 net.ipv4.tcp_max_orphans = 16384
防火墙的优化则添加以下，在6.4上是，如下：
net.nf_conntrack_max = 25000000 net.netfilter.nf_conntrack_max = 25000000 net.netfilter.nf_conntrack_tcp_timeout_established = 180 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
[root@greymouster ~]# sysctl -p //生效
10、锁定关键文件系统
[root@greymouster ~]# chattr +i /etc/passwd [root@greymouster ~]# chattr +i /etc/inittab [root@greymouster ~]# chattr +i /etc/group [root@greymouster ~]# chattr +i /etc/shadow [root@greymouster ~]# chattr +i /etc/gshadow
使用chattr命令后，为了安全我们需要将其改名
[root@greymouster ~]# /bin/mv /usr/bin/chattr /usr/bin/任意名称
查看枷锁：lsattr /etc/passwd
11、去除系统及内核版本登录前的屏幕显示
[root@greymouster ~]# /etc/redhat-release [root@greymouster ~]# cat /dev/null >/etc/issue