vim /etc/sysctl.conf 来改内核参数。
优化内核参数
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time =600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
以下参数是对iptables防火墙的优化,防火墙不开会有提示,可以忽略不理。
net.ipv4.ip_conntrack_max = 25000000
net.ipv4.netfilter.ip_conntrack_max = 25000000
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 180
net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait = 120
net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait = 60
net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait = 120
sysctl -p命令可以使改过的内容生效
隐藏linux系统版本号
>/etc/issue 或 cat /dev/null >/etc/issue
锁定关键系统文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
解锁关键系统文件
chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab
查看内容是否加锁了
lsattr /路径