#!/bin/bash
cat << EOF
+---------------------------------------------------------------------------+
| Initialize for the CentOS 6_installed. |
+---------------------------------------------------------------------------+
EOF
function format() {
#sleep 1 #echo -e "\033[42;37m ########### Finished ########### \033[0m\n" echo -e "\033[32m Install Success!!!\033[0m\n"}
########################################################################### Set time 时区/时间同步设置echo "Set time."/bin/cp -f /usr/share/zoneinfo/Asia/Shanghai /etc/localtime &> /dev/nullyum -y install ntpdate &> /dev/nullntpdate 0.centos.pool.ntp.org &> /dev/nullhwclock -w
format
########################################################################### Create Log 创建该脚本运行记录日志echo "Create log file."DATE1=`date +"%F %H:%M"`
LOG=/var/log/sysinitinfo.log
echo $DATE1 >> $LOG
echo "------------------------------------------" >> $LOG
format
###########################################################################
# Disabled Selinux 禁用Selinux
echo "Disabled SELinux."
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/sysconfig/selinux
format
############################################################################ Stop iptables 禁用iptables#echo "Stop iptables."#service iptables stop &> /dev/null#chkconfig --level 235 iptables off#format ###########################################################################
# Disable ipv6 禁用IPV6
echo "Disable ipv6."
cat << EOF > /etc/modprobe.conf
alias net-pf-10 off
alias ipv6 off
EOF
chkconfig --level 2235 ip6tables off
format
##########################################################################
#Set history commands 设置命令历史记录参数
echo "Set history commands."
sed -i 's/HISTSIZE=100/HISTSIZE=1000/' /etc/profile
grep 'HISTFILESIZE' /etc/bashrc &>/dev/null
if [ $? -ne 0 ]
then
cat << EOF >> /etc/bashrc
HISTFILESIZE=4000
HISTSIZE=4000
HISTTIMEFORMAT='%F/%T'
EOF
fi
source /etc/bashrc
format
# Epel 升级epel源
echo "Install epel"
yum install epel-release
format
##########################################################################
#Yum install Development tools 安装开发包组及必备软件
echo "Install Development tools(It will be a moment)"
yum groupinstall -y "Development tools" &> /dev/null
yum install -y bind-utils lrzsz wget gcc gcc-c++ vim htop &>/dev/null
format
##########################################################################
#Yum install aliyun repo 更改阿里云源
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
format
############################################################################ Set ssh 设置ssh登录策略echo "Set sshd."sed -i "s/^#PermitEmptyPasswords/PermitEmptyPasswords/" /etc/ssh/sshd_config
sed -i "s/^#LoginGraceTime 2m/LoginGraceTime 6m/" /etc/ssh/sshd_config
grep "UseDNS no" /etc/ssh/sshd_config &>/dev/nullif [ $? -ne 0 ]then echo "UseDNS no" >> /etc/ssh/sshd_config
fi#禁止 root 使用 ssh 登入sed -i "s/^#PermitRootLogin yes/PermitRootLogin no/" /etc/ssh/sshd_config#修改sshd默认端口read -p "输入ssh端口:" ssh_port
sed -i "s/^#Port 22/Port $ssh_port/" /etc/ssh/sshd_config
iptables -I INPUT -m state --state NEW -m tcp -dport $ssh_port -j ACCEPET
service iptables save
format
###########################################################################
# Set default init 3 设置系统默认初始化
echo "Default init 3."
sed -i 's/^id:5:initdefault:/id:3:initdefault:/' /etc/inittab
format
###########################################################################echo "Tunoff services." for i in `ls /etc/rc3.d/S*`do servers=`echo $i|cut -c15-`
echo $servers
case $servers in crond | irqbalance | microcode_ctl | network | random | postfix | sshd | rsyslog | local | smart | cpuspeed | mysqld | httpd | ntpd | php-fpm | nginx)
echo -e "\033[31m Base services, Skip!\033[0m" ;;
*)
echo -e "\033[31m change $servers to off\033[0m" chkconfig --level 235 $servers off service $servers stop
;;
esac
done
format
###########################################################################
# Del unnecessary users 删除不必要的用户
echo "Del unnecessary users."
for USERS in adm lp sync shutdown halt mail news uucp operator games gopher
do
grep $USERS /etc/passwd &>/dev/null
if [ $? -eq 0 ]
then
userdel $USERS &> /dev/null
fi
done
format
############################################################################ Del unnecessary groups 删除不必要的用户组echo "Del unnecessary groups."for GRP in adm lp mail news uucp games gopher mailnull floppy dip pppusers popusers slipusers daemondo grep $GRP /etc/group &> /dev/null if [ $? -eq 0 ]
then groupdel $GRP &> /dev/null fi
done
format
###########################################################################
# Disabled reboot by keys ctlaltdelete 禁用ctlaltdelete重启功能
echo "Disabled reboot by keys ctlaltdelete"
sed -i 's/^exec/#exec/' /etc/init/control-alt-delete.conf
format
############################################################################ Set ulimit 设置文件句柄数echo "Set ulimit 1000000"
cat << EOF > /etc/security/limits.conf
* soft nofile 1000000* hard nofile 1000000* soft nproc 102400* hard nproc 102400EOF
sed -i 's/1024/1000000/' /etc/security/limits.d/90-nproc.conf
format
###########################################################################
# Record SUID and SGID files
DATE2=`date +"%F"`
echo "Record SUID and SGID files."
echo "SUID --- " > /var/log/SuSg_"$DATE2".log
find / -path '/proc' -prune -o -perm -4000 >> /var/log/SuSg_"$DATE2".log
echo "------------------------------------------------------ " >> /var/log/SuSg_"$DATE2".log
echo "SGID --- " >> /var/log/SuSg_"$DATE2".log
find / -path '/proc' -prune -o -perm -2000 >> /var/log/SuSg_"$DATE2".log
format
############################################################################ Disabled crontab send mail 禁用执行任务计划时向root发送邮件echo "Disable crontab send mail."sed -i 's/^MAILTO=root/MAILTO=""/' /etc/crontab
sed -i 's/^mail\.\*/mail\.err/' /etc/rsyslog.conf
format
###########################################################################
# Set ntp client 设置时间服务客户端
echo "Set ntp client."
SED() {
cp -p /etc/ntp.conf /etc/ntp.conf.bak
sed -i '/^server/d' /etc/ntp.conf
sed -i '/^includefile/ i\server 0.centos.pool.ntp.org iburst' /etc/ntp.conf
sed -i '/0.centos.pool.ntp.org/ a\server 1.centos.pool.ntp.org iburst' /etc/ntp.conf
sed -i '/1.centos.pool.ntp.org/ a\server 2.centos.pool.ntp.org iburst' /etc/ntp.conf
sed -i '/2.centos.pool.ntp.org/ a\server 3.centos.pool.ntp.org iburst' /etc/ntp.conf
chkconfig --level 35 ntpd on &> /dev/null
}
rpm -q ntp &> /dev/null
if [ $? -eq 0 ]
then
SED
else
yum -y install ntp &> /dev/null
SED
fi
format
############################################################################ Set sysctl.conf 设置内核参数echo "Set sysctl.conf"#web应用中listen函数的backlog默认会将内核参数的net.core.somaxconn限制到128，而nginx定义的NGX_LISTEN_BACKLOG默认是511，所以必须调整,一般调整为2048cat << EOF > /etc/sysctl.conf
net.core.somaxconn = 2048net.core.wmem_default = 262144net.core.rmem_max = 16777216net.core.wmem_max = 16777216net.ipv4.tcp_rmem = 4096 4096 16777216net.ipv4.tcp_wmem = 4096 4096 16777216net.ipv4.tcp_mem = 786432 2097152 3145728net.ipv4.tcp_max_syn_backlog = 16384net.core.netdev_max_backlog = 20000net.ipv4.tcp_fin_timeout = 15net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_tw_recycle = 1net.ipv4.tcp_max_orphans = 131072net.ipv4.ip_local_port_range = 1024 65535net.ipv4.ip_forward = 0net.ipv4.conf.default.rp_filter = 1net.ipv4.conf.default.accept_source_route = 0kernel.sysrq = 0kernel.core_uses_pid = 1net.ipv4.tcp_syncookies = 1net.bridge.bridge-nf-call-ip6tables = 0net.bridge.bridge-nf-call-iptables = 0net.bridge.bridge-nf-call-arptables = 0kernel.msgmnb = 65536kernel.msgmax = 65536kernel.shmmax = 4294967295kernel.shmall = 26843545EOF
#modprobe bridge > /dev/null/sbin/sysctl -p > /dev/nullformat