CentOS7系统初始化脚本

系统初始化主要包括：iptables初始化、sshd服务初始化、添加Zabbix监控、添加密钥、关闭SELinux、安装deny_host等

#!/bin/bash
###Initialization

###key add
add_key()
{   
    mkdir -p /root/.ssh && chmod 700 /root/.ssh  && \
    wget -P /root/.ssh/ -N http://192.168.1.105/yunwei/authorized_keys && chmod 600 /root/.ssh/authorized_keys
    if [ $? -eq 0 ]
    then
        printf "Key Set Successful\n"
    else
        printf "Key Set Faild\n"
    fi
}



###Synchronization Time
syn_time()
{
    echo '###Time Synchronization' > /etc/cron.d/ntpdate
    echo '*/10 * * * * root (/usr/sbin/ntpdate 192.168.1.46;/usr/sbin/hwclock -w) >> /var/log/ntp.log 2>&1' >> /etc/cron.d/ntpdate
    if [ $? -eq 0 ]
    then
        printf "Set Ntpdate Successful\n"
    else
        printf "Set Ntpdate  Faild\n"
    fi
}

###close SELINUX
close_selinux()
{
    setenforce 0
    sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
    if [ "`awk -F'=' '/^SELINUX=/ {print $2}' /etc/selinux/config`" = "disabled" ]
    then
        printf "Set Selinux Successful\n"
    else
        printf "Set Selinux Faild\n"
    fi
}


###change ulimit
chang_ulimit()
{
    MOD_DATE=`date +%Y%m%d-%H:%M:%S`
    cp /etc/security/limits.conf /etc/security/limits.conf_$MOD_DATE
    if [ -z "`grep -P \"(\*.*soft.*nofile.*655350|\*.*hard.*nproc.*655350)\" /etc/security/limits.conf`" ]
    then
        printf "*\tsoft\tnofile\t655350\n*\thard\tnofile\t655350\n*\tsoft\tnproc\t655350\n*\thard\tnproc\t655350\n"\
    >> /etc/security/limits.conf
    fi
    sed -i 's/4096/655350/' /etc/security/limits.d/20-nproc.conf
    if [ ! -z "`grep -P \"(\*.*soft.*nofile.*655350|\*.*hard.*nproc.*655350)\" /etc/security/limits.conf`" ]
    then
        printf "Set Ulimit Successful\n"
    else
        printf "Set Ulimit Faild\n"
    fi
}


###forbid root login,forbid no password
forbid_root()
{
    sed -i "s/^#PermitRootLogin.*/PermitRootLogin without-password/g" /etc/ssh/sshd_config
    sed -i 's/^#PermitEmptyPasswords.*/PermitEmptyPasswords\tno/g' /etc/ssh/sshd_config
    sed -i 's/^#UseDNS.*/UseDNS\tno/g' /etc/ssh/sshd_config
    epnum=`grep -P "^PermitEmptyPasswords\tno" /etc/ssh/sshd_config|wc -l`
    permnum=`grep -P "^PermitRootLogin without-password" /etc/ssh/sshd_config|wc -l`
    UseDNSnum=`grep -P "^UseDNS\tno" /etc/ssh/sshd_config|wc -l`
    if [[ $epnum -eq 1 ]] && [[ $permnum -eq 1 ]] && [[ $UseDNSnum -eq 1 ]]
    then
        printf "Set sshd Config Successful\n"
    else
        printf "Set sshd Config Faild\n"
    fi
}

####iptables rule add
iptables_rule()
{
    sed -i '/22 -j ACCEPT/a\-A INPUT -s 118.144.xxx.8/29 -p tcp -j ACCEPT\n-A INPUT -s 118.144.xxx.128/26 -p tcp -j ACCEPT\n-A INPUT -s 118.144.xxx.0/25 -p tcp -j ACCEPT\n-A INPUT -s 118.144.xxx.0/28 -p tcp -j ACCEPT\n-A INPUT -s 118.144.xxx.38 -p udp --dport 161 -j ACCEPT' /etc/sysconfig/iptables
        if [ $? -eq 0 ]
        then
                printf "Set Iptables Successful\n"
        else
                printf "Set Iptables Faild\n"
        fi
}

####Cacti snmp config
snmpd_config()
{
    wget -P /etc/snmp/ -N http://192.168.1.105/yunwei/snmpd.conf
        if [ $? -eq 0 ]
        then
                printf "Set Snmp Successful\n"
        else
                printf "Set Snmp Faild\n"
        fi
}

####install_denyhosts
deny_hosts()
{
    wget -P /root/software/ -N http://192.168.1.105/yunwei/install_denyhost.sh && sh /root/software/install_denyhost.sh
        if [ $? -eq 0 ]
        then
                printf "Install Denyhosts Successful\n"
        else
                printf "Install Denyhosts Faild\n"
        fi
}

####install_zabbix_agentd
zabbix_agentd()
{
    wget -P /root/software/ -N http://192.168.1.105/yunwei/zabbix_agentd.sh && sh /root/software/zabbix_agentd.sh && echo "/usr/local/zabbix/sbin/zabbix_agentd" >> /etc/rc.d/rc.local
        if [ $? -eq 0 ]
        then
                printf "Install Zabbix_agentd Successful\n"
        else
                printf "Install Zabbix_agentd Faild\n"
        fi
}

####zabbix_tcp
zabbix_tcp()
{
        wget -P /usr/local/zabbix/etc/ -N http://192.168.1.105/yunwei/tcp_connections.sh && chown zabbix.zabbix /usr/local/zabbix/etc/tcp_connections.sh && chmod u+x /usr/local/zabbix/etc/tcp_connections.sh
        if [ $? -eq 0 ]
        then
                printf "Wget Zabbix_tcp Config Successful\n"
        else
                printf "Wget Zabbix_tcp Config Faild\n"
        fi
}

####zabbix_nginx
zabbix_nginx()
{
        wget -P /usr/local/zabbix/etc/ -N http://192.168.1.105/yunwei/nginx_status.sh && chown zabbix.zabbix /usr/local/zabbix/etc/nginx_status.sh && chmod u+x /usr/local/zabbix/etc/nginx_status.sh
        if [ $? -eq 0 ]
        then
                printf "Wget Zabbix_nginx Config Successful\n"
        else
                printf "Wget Zabbix_nginx Config Faild\n"
        fi
    IP=`ifconfig -a|grep inet|grep -v 127.0.0.1|grep -v 172|grep -v inet6|awk '{print $2}'|tr -d "addr:"`
    sed -i "s/118.144.155.105/$IP/g" /usr/local/zabbix/etc/nginx_status.sh
}

###mail.rc
mailx()
{
        wget -P /etc/ -N http://118.144.155.105/yunwei/mail.rc
    if [ $? -eq 0 ]
        then
                printf "Wget Mail Config Successful\n"
        else
                printf "Wget Mail Config Faild\n"
        fi
}

###exec function
    yum -y install epel-release
#   yum -y update
    yum -y install make vim net-tools gcc gcc-c++ rsync ntpdate lrzsz screen iptables-services iptables net-snmp net-snmp-devel wget traceroute iftop iptraf mailx unzip
        add_key
        syn_time
        close_selinux
        chang_ulimit
        forbid_root
        iptables_rule
        snmpd_config
        deny_hosts
        zabbix_agentd
        zabbix_tcp
        zabbix_nginx
        mailx

    service sshd restart
    service iptables restart
    service snmpd restart
    chkconfig sshd on
    chkconfig iptables on
    chkconfig snmpd on

    systemctl stop firewalld.service
    systemctl disable firewalld.service
    systemctl restart iptables.service
    systemctl enable iptables.service
    systemctl enable snmpd.service
    systemctl restart sshd
    systemctl restart snmpd
    chmod u+x /etc/rc.d/rc.local
    /usr/local/zabbix/sbin/zabbix_agentd restart
    echo -e "\033[47;31m 提醒：需要修改/etc/mail.rc文件的邮件发件人!!! \033[0m"