centos 6.9版本vmware虚拟机模版制作
centos 6.9版本虚拟机模版制作
1、挂载本地ios镜像文件作为yum源
（1）、连接虚拟机的ios数据文件
（2）、创建目录/mnt/cdrom
`mkdir /mnt/cdrom`
（3）、挂载光盘
`mount /dev/sr0 /mnt/cdrom`
（4）、编辑yum文件
cd /etc/yum.repo.d
rm -rf *
vi default.repo
添加：
[local]
name=localyum
baseurl=file:///mnt/cdrom/
gpgcheck=0
enabled=1
2、安装依赖包
yum install -y zlib-devel gcc telnet lrzsz pam-devel
3、升级openssh7.6p1
（1）、上传安装包
cd /usr/local
rz 选中openssh-7.6p1.tar.gz openssl-1.0.2n.tar.gz
（2）、升级openssl
卸载旧版本的openssl：
rpm -e openssl-1.0.1e-57.el6.x86_64 --nodeps
解压：
tar -zxvf openssl-1.0.2n.tar.gz
进入目录：
cd openssl-1.0.2n
编译
./config shared zlib --prefix=/usr/local/openssl
make
make test
make install
修改配置库文件搜索路径
vi /etc/ld.so.conf
添加：/usr/local/openssl/lib
刷新缓存: ldconfig -v
cd /usr/local/openssl/lib
cp libssl.so.1.0.0 /usr/lib64
cp libcrypto.so.1.0.0 /usr/lib64/
chmod 555 /usr/lib64/libssl.so.1.0.0
chmod 555 /usr/lib64/libcrypto.so.1.0.0
ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10
ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so.10
ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so
ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so
修改环境变量
vi /etc/profile
添加：
PATH=/usr/local/openssl/bin:$PATH
export PATH
生效 source /etc/profile
查看openssl版本是否正确 openssl version -a
（3）升级openssh
停止ssh服务：service sshd stop
卸载旧版本的openssh：
[root@moban openssl-1.0.2n]# rpm -qa |grep openssh
openssh-5.3p1-122.el6.x86_64
openssh-clients-5.3p1-122.el6.x86_64
openssh-server-5.3p1-122.el6.x86_64
openssh-askpass-5.3p1-122.el6.x86_64
卸载：
rpm -e --nodeps openssh-askpass-5.3p1-122.el6.x86_64
rpm -e --nodeps openssh-server-5.3p1-122.el6.x86_64
rpm -e --nodeps openssh-clients-5.3p1-122.el6.x86_64
rpm -e --nodeps openssh-5.3p1-122.el6.x86_64
备份配置文件：mv /etc/ssh/ /etc/ssh.old/
解压 tar zxvf openssh-7.6p1.tar.gz
进入目录 cd openssh-7.6p1
编译
./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man
make
make install
添加启动脚本
cp ./contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig --add sshd
重启ssh
service sshd start
确认ssh openssl版本
ssh -V
显示OpenSSH_7.6p1, OpenSSL 1.0.2n 7 Dec 2017即完成升级
编辑sshd配置文件：
vi /etc/ssh/sshd_config
添加：
X11Forwarding yes
PermitRootLogin yes
修改#UsePAM no为UsePAM yes
增加pam模块认证文件
cd /etc/pam.d/
vi sshd
添加：
#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
重启ssh
service sshd restart
4、关闭不使用的服务
（1）、查看开启的服务列表
chkconfig --list |grep on
[root@moban pam.d]# chkconfig --list |grep on
abrt-ccpp 0:off 1:off 2:off 3:on 4:off 5:on 6:off
abrtd 0:off 1:off 2:off 3:on 4:off 5:on 6:off
acpid 0:off 1:off 2:on 3:on 4:on 5:on 6:off
atd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
auditd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
autofs 0:off 1:off 2:off 3:on 4:on 5:on 6:off
blk-availability 0:off 1:on 2:on 3:on 4:on 5:on 6:off
bluetooth 0:off 1:off 2:off 3:on 4:on 5:on 6:off
certmonger 0:off 1:off 2:off 3:on 4:on 5:on 6:off
cpuspeed 0:off 1:on 2:on 3:on 4:on 5:on 6:off
crond 0:off 1:off 2:on 3:on 4:on 5:on 6:off
cups 0:off 1:off 2:on 3:on 4:on 5:on 6:off
haldaemon 0:off 1:off 2:off 3:on 4:on 5:on 6:off
ip6tables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off
irqbalance 0:off 1:off 2:off 3:on 4:on 5:on 6:off
lvm2-monitor 0:off 1:on 2:on 3:on 4:on 5:on 6:off
mdmonitor 0:off 1:off 2:on 3:on 4:on 5:on 6:off
messagebus 0:off 1:off 2:on 3:on 4:on 5:on 6:off
netconsole 0:off 1:off 2:off 3:off 4:off 5:off 6:off
netfs 0:off 1:off 2:off 3:on 4:on 5:on 6:off
network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
nfslock 0:off 1:off 2:off 3:on 4:on 5:on 6:off
portreserve 0:off 1:off 2:on 3:on 4:on 5:on 6:off
postfix 0:off 1:off 2:on 3:on 4:on 5:on 6:off
rdma 0:off 1:on 2:on 3:on 4:on 5:on 6:off
restorecond 0:off 1:off 2:off 3:off 4:off 5:off 6:off
rpcbind 0:off 1:off 2:on 3:on 4:on 5:on 6:off
rpcgssd 0:off 1:off 2:off 3:on 4:on 5:on 6:off
rsyslog 0:off 1:off 2:on 3:on 4:on 5:on 6:off
spice-vdagentd 0:off 1:off 2:off 3:off 4:off 5:on 6:off
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
sysstat 0:off 1:on 2:on 3:on 4:on 5:on 6:off
udev-post 0:off 1:on 2:on 3:on 4:on 5:on 6:off
wdaemon 0:off 1:off 2:off 3:off 4:off 5:off 6:off
（2）、关闭服务
chkconfig bluetooth off；chkconfig ip6tables off;chkconfig iptables off；
service bluetooth stop;service ip6tables stop;service iptables stop;
5、优化
（1）、调整文件描述符大小
#查看文件描述符大小
ulimit -n
# 调整
vi /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535
* soft nproc 65535
* hard nproc 65535
* soft nofile 65535
* hard nofile 65535
（2）、内核参数优化
vi /etc/sysctl.conf
添加：
net.ipv4.tcp_max_syn_backlog = 65536
net.core.netdev_max_backlog = 32768
net.core.somaxconn = 32768
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_tw_buckets=10000
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_max_orphans = 3276800
生效：/sbin/sysctl -p
6、时间同步
crontab -e
# xxx为时间同步服务器地址
#*/5 * * * * /usr/sbin/ntpdate xxxx >/dev/null 2 >&1
7、修改网卡配置
（1）、删除网卡PCI记录
vi /etc/udev/rules.d/70-persistent-net.rules
删除：
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:50:56:be:00:5c", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"