ubuntu 22操作系统模板定制

#!/bin/bash

#配置ssh
sed -i 's/#MaxStartups 10:30:100/MaxStartups 100:50:100/g' /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config
echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config

systemctl restart sshd


#设置password过期策略
sed -i  '/PASS_MAX_DAYS/s/99999/90/' /etc/login.defs
sed -i  '/PASS_MIN_DAYS/s/0/7/' /etc/login.defs
sed -i  '/PASS_WARN_AGE/s/7/0/'  /etc/login.defs


#关闭防火墙
systemctl stop ufw
systemctl disable ufw


#配置dns
mv /etc/resolv.conf /tmp/resolv.conf.bak
ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
cat > /etc/systemd/resolved.conf << EOF
[Resolve]
DNS=223.5.5.5
EOF

systemctl restart systemd-resolved


#配置apt软件包下载源
cat > /etc/apt/sources.list << EOF
deb https://mirrors.aliyun.com/ubuntu/ jammy main restricted universe multiverse
deb-src https://mirrors.aliyun.com/ubuntu/ jammy main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ jammy-security main restricted universe multiverse
deb-src https://mirrors.aliyun.com/ubuntu/ jammy-security main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ jammy-updates main restricted universe multiverse
deb-src https://mirrors.aliyun.com/ubuntu/ jammy-updates main restricted universe multiverse
EOF

apt update


#配置ntp服务器
apt-get install chrony -y
cat > /etc/chrony/chrony.conf << EOF
server ntp1.aliyun.com  iburst
server ntp2.aliyun.com  iburst
server ntp3.tencent.com  iburst
server ntp4.tencent.com  iburst
driftfile /var/lib/chrony/drift
makestep 1 -1
rtcsync
logdir /var/log/chrony
EOF

timedatectl set-timezone Asia/Shanghai

systemctl restart chronyd
systemctl enable chronyd


#配置操作系统参数
echo "net.ipv4.tcp_fin_timeout = 6" >> /etc/sysctl.conf
sysctl -p

cat > /etc/security/limits.d/20-nproc.conf << EOF
*          soft    nproc     10240
*          hard    nproc     65535
*          hard    nofile    65535
*          soft    nofile    65535
root          soft    nproc     10240
root          hard    nproc     65535
root          hard    nofile    65535
root          soft    nofile    65535
EOF




#syslog config
echo "*.* @xx.xx.xx.xx:514" >> /etc/rsyslog.conf
systemctl restart rsyslog


echo 'export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S  `whoami` "' >> /etc/profile
. /etc/profile


#升级pam
apt-get install libpam-cracklib -y
sed -i '/password.*requisite.*pam_cracklib\.so/s/^/#&/' /etc/pam.d/common-password
sed -i '/password.*requisite.*pam_cracklib\.so/a password        requisite                       pam_cracklib.so retry=3 minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1' /etc/pam.d/common-password
systemctl restart systemd-logind

# 关闭登录提示语
vi /etc/pam.d/sshd
#session    optional     pam_motd.so  motd=/run/motd.dynamic
#session    optional     pam_motd.so noupdate

#配置grub开机倒计时，必要时可进入救援模式
sed -i 's/GRUB_TIMEOUT_STYLE/#GRUB_TIMEOUT_STYLE/g' /etc/default/grub
sed -i 's/GRUB_TIMEOUT=0/GRUB_TIMEOUT=5/g' /etc/default/grub
update-grub

#关闭自动更新
systemctl disable --now unattended-upgrades.service

#安装qemu agent （虚拟机使用，可通过宿主机改配虚拟机等）
apt install qemu-guest-agent -y
systemctl enable --now qemu-guest-agent

#安装常用工具包
apt install tmpreaper tree net-tools unzip telnet -y