CentOS7 初始化脚本 1.0

  1 #!/bin/bash
  2 #################################################
  3 #  --Info
  4 #         Initialization CentOS 7.x script
  5 #################################################
  6 #   Auther: [email protected]
  7 #   Changelog:
  8 #   20180710   wanghui  initial create
  9 #################################################
 10 # Check if user is root
 11 #
 12 if [ $(id -u) != "0" ]; then
 13     echo "Error: You must be root to run this script, please use root to initialization OS."
 14     exit 1
 15 fi
 16 
 17 echo "+------------------------------------------------------------------------+"
 18 echo "|       To initialization the system for security and performance        |"
 19 echo "+------------------------------------------------------------------------+"
 20 
 21 # add yunwei user
 22 user_add()
 23 {
 24   # add yunwei for jumpserver
 25   id -u yunwei
 26   if [ $? -eq 0 ];then
 27     useradd -s /bin/bash -d /home/yunwei -m yunwei && echo password | passwd --stdin yunwei && echo "yunwei ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/yunwei
 28     else
 29     echo "yunwei user is exist."
 30   fi    
 31 }
 32 
 33 # update system & install pakeage
 34 system_update(){
 35     echo "*** Starting update system && install tools pakeage... ***"
 36     yum install epel-release -y && yum -y update
 37     yum clean all && yum makecache
 38     yum -y install rsync wget vim openssh-clients iftop htop iotop sysstat lsof telnet traceroute tree man iptraf lrzsz  net-tools dstat tree ntpdate dos2unix net-tools git egrep
 39     [ $? -eq 0 ] && echo "System upgrade && install pakeages complete."
 40 }
 41 
 42 # Set timezone synchronization
 43 timezone_config()
 44 {
 45     echo "Setting timezone..."
 46     /usr/bin/timedatectl | grep "Asia/Shanghai"
 47     if [ $? -eq 0 ];then
 48        echo "System timezone is Asia/Shanghai."
 49        else
 50        timedatectl set-local-rtc 0 && timedatectl set-timezone Asia/Shanghai
 51     fi 
 52     # config chrony
 53     yum -y install chrony && systemctl start chronyd.service && systemctl enable chronyd.service
 54     sed -i '$a 192.168.0.205 time.aniu.so' /etc/hosts
 55     sed -i 's/server 0.centos.pool.ntp.org iburst/server time.aniu.so iburst/g' /etc/chrony.conf
 56     [ $? -eq 0 ] && echo "Setting timezone && Sync network time complete."
 57 }
 58 
 59 # disable selinux
 60 selinux_config()
 61 {
 62        sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
 63        setenforce 0
 64        echo "Dsiable selinux complete."
 65 }
 66 
 67 # ulimit comfig
 68 ulimit_config()
 69 {
 70 echo "Starting config ulimit..."
 71 cat >> /etc/security/limits.conf <<EOF
 72 * soft nproc 8192
 73 * hard nproc 8192
 74 * soft nofile 8192
 75 * hard nofile 8192
 76 EOF
 77 
 78 [ $? -eq 0 ] && echo "Ulimit config complete!"
 79 
 80 }
 81 
 82 # sshd config
 83 sshd_config(){
 84     echo "Starting config sshd..."
 85     sed -i '/^#Port/s/#Port 22/Port 54077/g' /etc/ssh/sshd_config
 86     #sed -i "$ a\ListenAddress 0.0.0.0:21212\nListenAddress 0.0.0.0:22 " /etc/ssh/sshd_config
 87     sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
 88     systemctl restart sshd
 89     #sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
 90     #sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
 91     [ $? -eq 0 ] && echo "SSH config complete."
 92 }
 93 
 94 # firewalld config
 95 disable_firewalld(){
 96    echo "Starting disable firewalld..."
 97    rpm -qa | grep firewalld >> /dev/null
 98    if [ $? -eq 0 ];then
 99       systemctl stop firewalld  && systemctl disable firewalld
100       [ $? -eq 0 ] && echo "Dsiable firewalld complete."
101       else
102       echo "Firewalld not install." 
103    fi
104 }
105 
106 # vim config 
107 vim_config() {
108     echo "Starting vim config..."
109     /usr/bin/egrep pastetoggle /etc/vimrc >> /dev/null 
110     if [ $? -eq 0 ];then
111        echo "vim already config"
112        else
113        sed -i '$ a\set bg=dark\nset pastetoggle=' /etc/vimrc 
114     fi
115 
116 }
117 
118 # sysctl config
119 
120 config_sysctl() {
121     echo "Staring config sysctl..."
122     /usr/bin/cp -f /etc/sysctl.conf /etc/sysctl.conf.bak
123     cat > /etc/sysctl.conf << EOF
124 vm.swappiness = 0
125 vm.dirty_ratio = 80
126 vm.dirty_background_ratio = 5
127 fs.file-max = 2097152
128 fs.suid_dumpable = 0
129 net.core.somaxconn = 65535
130 net.core.netdev_max_backlog = 262144
131 net.core.optmem_max = 25165824
132 net.core.rmem_default = 31457280
133 net.core.rmem_max = 67108864
134 net.core.wmem_default = 31457280
135 net.ipv4.tcp_syncookies = 1
136 net.ipv4.conf.all.rp_filter = 1
137 net.ipv4.icmp_echo_ignore_all = 0
138 net.ipv4.icmp_echo_ignore_broadcasts = 0
139 net.ipv4.conf.all.log_martians = 1
140 net.ipv4.conf.all.accept_source_route = 0
141 net.ipv4.conf.all.accept_redirects = 0
142 EOF
143 
144 # eg：https://www.vultr.com/docs/securing-and-hardening-the-centos-7-kernel-with-sysctl
145 # set kernel parameters work
146     /usr/sbin/sysctl -p
147     [ $? -eq 0 ] && echo "Sysctl config complete."
148 }
149 
150 # ipv6 config
151 disable_ipv6() {
152     echo "Starting disable ipv6..."
153     sed -i '$ a\net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1' /etc/sysctl.conf
154     sed -i '$ a\AddressFamily inet' /etc/ssh/sshd_config
155     systemctl restart sshd
156     /usr/sbin/sysctl -p
157 }
158 
159 # password config
160 password_config() {
161     # /etc/login.defs
162     sed -i 's/PASS_MIN_LEN    5/PASS_MIN_LEN    8/g' /etc/login.defs
163     authconfig --passminlen=8 --update
164     authconfig --enablereqlower --update
165     [ $? -eq 0 ] && echo "Config password rule complete."
166 }
167 
168 # disable no use service
169 disable_serivces() {
170     systemctl stop postfix && systemctl disable postfix
171     [ $? -eq 0 ] && echo "Disable postfix service complete."
172 }
173 
174 #main function
175 main(){
176     user_add
177     system_update
178     timezone_config
179     selinux_config
180     ulimit_config
181     sshd_config
182     disable_firewalld
183     vim_config
184     config_sysctl
185     disable_ipv6
186     password_config
187     disable_serivces
188 }
189 # execute main functions
190 main
191 echo "+------------------------------------------------------------------------+"
192 echo "|            To initialization system all completed !!!                  |"
193 echo "+------------------------------------------------------------------------+"
194 ————————————————
195 版权声明：本文为CSDN博主「诸葛冰玄」的原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接及本声明。
196 原文链接：https://blog.csdn.net/embrace99999/article/details/81132443

 

#!/bin/bash##################################################  --Info#         Initialization CentOS 7.x script##################################################   Auther: [email protected]#   Changelog:#   20180710   wanghui  initial create################################################## Check if user is root#if [ $(id -u) != "0" ]; then    echo "Error: You must be root to run this script, please use root to initialization OS."    exit 1fi
echo "+------------------------------------------------------------------------+"echo "|       To initialization the system for security and performance        |"echo "+------------------------------------------------------------------------+"
# add yunwei useruser_add(){  # add yunwei for jumpserver  id -u yunwei  if [ $? -eq 0 ];then    useradd -s /bin/bash -d /home/yunwei -m yunwei && echo password | passwd --stdin yunwei && echo "yunwei ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/yunwei    else    echo "yunwei user is exist."  fi    }
# update system & install pakeagesystem_update(){    echo "*** Starting update system && install tools pakeage... ***"    yum install epel-release -y && yum -y update    yum clean all && yum makecache    yum -y install rsync wget vim openssh-clients iftop htop iotop sysstat lsof telnet traceroute tree man iptraf lrzsz  net-tools dstat tree ntpdate dos2unix net-tools git egrep    [ $? -eq 0 ] && echo "System upgrade && install pakeages complete."}
# Set timezone synchronizationtimezone_config(){    echo "Setting timezone..."    /usr/bin/timedatectl | grep "Asia/Shanghai"    if [ $? -eq 0 ];then       echo "System timezone is Asia/Shanghai."       else       timedatectl set-local-rtc 0 && timedatectl set-timezone Asia/Shanghai    fi     # config chrony    yum -y install chrony && systemctl start chronyd.service && systemctl enable chronyd.service    sed -i '$a 192.168.0.205 time.aniu.so' /etc/hosts    sed -i 's/server 0.centos.pool.ntp.org iburst/server time.aniu.so iburst/g' /etc/chrony.conf    [ $? -eq 0 ] && echo "Setting timezone && Sync network time complete."}
# disable selinuxselinux_config(){       sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config       setenforce 0       echo "Dsiable selinux complete."}
# ulimit comfigulimit_config(){echo "Starting config ulimit..."cat >> /etc/security/limits.conf <[ $? -eq 0 ] && echo "Ulimit config complete!"
}
# sshd configsshd_config(){    echo "Starting config sshd..."    sed -i '/^#Port/s/#Port 22/Port 54077/g' /etc/ssh/sshd_config    #sed -i "$ a\ListenAddress 0.0.0.0:21212\nListenAddress 0.0.0.0:22 " /etc/ssh/sshd_config    sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config    systemctl restart sshd    #sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config    #sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config    [ $? -eq 0 ] && echo "SSH config complete."}
# firewalld configdisable_firewalld(){   echo "Starting disable firewalld..."   rpm -qa | grep firewalld >> /dev/null   if [ $? -eq 0 ];then      systemctl stop firewalld  && systemctl disable firewalld      [ $? -eq 0 ] && echo "Dsiable firewalld complete."      else      echo "Firewalld not install."    fi}
# vim config vim_config() {    echo "Starting vim config..."    /usr/bin/egrep pastetoggle /etc/vimrc >> /dev/null     if [ $? -eq 0 ];then       echo "vim already config"       else       sed -i '$ a\set bg=dark\nset pastetoggle=' /etc/vimrc     fi
}
# sysctl config
config_sysctl() {    echo "Staring config sysctl..."    /usr/bin/cp -f /etc/sysctl.conf /etc/sysctl.conf.bak    cat > /etc/sysctl.conf << EOFvm.swappiness = 0vm.dirty_ratio = 80vm.dirty_background_ratio = 5fs.file-max = 2097152fs.suid_dumpable = 0net.core.somaxconn = 65535net.core.netdev_max_backlog = 262144net.core.optmem_max = 25165824net.core.rmem_default = 31457280net.core.rmem_max = 67108864net.core.wmem_default = 31457280net.ipv4.tcp_syncookies = 1net.ipv4.conf.all.rp_filter = 1net.ipv4.icmp_echo_ignore_all = 0net.ipv4.icmp_echo_ignore_broadcasts = 0net.ipv4.conf.all.log_martians = 1net.ipv4.conf.all.accept_source_route = 0net.ipv4.conf.all.accept_redirects = 0EOF
# eg：https://www.vultr.com/docs/securing-and-hardening-the-centos-7-kernel-with-sysctl# set kernel parameters work    /usr/sbin/sysctl -p    [ $? -eq 0 ] && echo "Sysctl config complete."}
# ipv6 configdisable_ipv6() {    echo "Starting disable ipv6..."    sed -i '$ a\net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1' /etc/sysctl.conf    sed -i '$ a\AddressFamily inet' /etc/ssh/sshd_config    systemctl restart sshd    /usr/sbin/sysctl -p}
# password configpassword_config() {    # /etc/login.defs    sed -i 's/PASS_MIN_LEN    5/PASS_MIN_LEN    8/g' /etc/login.defs    authconfig --passminlen=8 --update    authconfig --enablereqlower --update    [ $? -eq 0 ] && echo "Config password rule complete."}
# disable no use servicedisable_serivces() {    systemctl stop postfix && systemctl disable postfix    [ $? -eq 0 ] && echo "Disable postfix service complete."}
#main functionmain(){    user_add    system_update    timezone_config    selinux_config    ulimit_config    sshd_config    disable_firewalld    vim_config    config_sysctl    disable_ipv6    password_config    disable_serivces}# execute main functionsmainecho "+------------------------------------------------------------------------+"echo "|            To initialization system all completed !!!                  |"echo "+------------------------------------------------------------------------+"————————————————版权声明：本文为CSDN博主「诸葛冰玄」的原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接及本声明。原文链接：https://blog.csdn.net/embrace99999/article/details/81132443