centos7作为web服务器优化
1、关闭firewalld:
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动
2、安装iptables防火墙
yum install iptables-services #安装
iptables -nvL #查看信息
3、加大打开文件数的限制(open files)
vi /etc/security/limits.conf
* soft nofile 1024000
* hard nofile 1024000
* soft nproc 1024000
* hard nproc 1024000
- 1
- 2
- 3
- 4
说明:
'*' 代表针对所有用户
noproc 是代表最大进程数
nofile 是代表最大文件打开数
还需要修改/etc/security/limits.d下面的conf文件(会覆盖前面的配置信息),我的是20-nproc.conf
- 1
- 2
- 3
- 4
- 5
- 6
# cat /etc/security/limits.d/20-nproc.conf
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.
* soft nproc 4096
root soft nproc unlimited
- 1
- 2
- 3
- 4
- 5
- 6
- 7
修改为:
- 1
- 2
# cat /etc/security/limits.d/20-nproc.conf
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.
* soft nproc 1024000
* hard nproc 1024000
此步骤需要重启机器生效,可以设置完后再重启
4、网络线程优化
vi /etc/sysctl.conf
加入下面几行
# Disable IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# Determines how often to check for stale neighbor entries.
net.ipv4.neigh.default.gc_stale_time=120
# Using arp_announce/arp_ignore to solve the ARP Problem
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.all.arp_announce=2
vm.swappiness = 0
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
执行下面命令生效
/sbin/sysctl -p
5.时间校对
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate us.pool.ntp.org
crontab -e
0-59/10 * * * * /usr/sbin/ntpdate us.pool.ntp.org | logger -t NTP
service crond restart
6.关闭root登录并修改ssh端口
添加普通用户
groupadd test
useradd -d /home/www/ -g test test1
passwd test1
iptables 开启6666端口 此步骤须先于下面步骤,否则会造成ssh连不上的
vi /etc/sysconfig/iptables
添加
-A INPUT -p tcp -m state --state NEW -m tcp --dport 6666 -j ACCEPT
修改ssh端口
vi /etc/ssh/sshd_config
找到#Port 22一段,这里是标识默认使用22端口,修改为如下:
#Port 22
Port 6666
关闭root登录权限
把
PermitRootLogin yes
改为
PermitRootLogin no
保存退出
测试新用户能正常登录后方可以在iptables 禁用22端口了
7.禁止开启ping
禁止
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
开启
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
#永久保存
vi /etc/rc.d/rc.local
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
8.网络命令ifconfig
bash: ifconfig: 未找到命令
yum -y install net-tools