linux系统调优指南(centos7.X)

关闭不必要的服务(如打印服务等)

1. for owelinux in `chkconfig --list | grep "3:on" | awk '{print $1}'`; do chkconfig $owelinux off; done

2. for owelinux in crond network sshd rsyslog sysstat iptables; do chkconfig $owelinux on; done

关闭不需要的tty

1. \cp /etc/securetty /etc/securetty.bak

2. >/etc/securetty

3. echo "tty1" >>/etc/securetty

4. echo "tty2" >>/etc/securetty

5. echo "tty3" >>/etc/securetty

调整linux 文件描述符大小

1. \cp /etc/security/limits.conf /etc/security/limits.conf.$(date +%F)

2. ulimit -HSn 65535

3. echo -ne "

4. * soft nofile 65535

5. * hard nofile 65535

6. " >>/etc/security/limits.conf

7. echo "ulimit -c unlimited" >> /etc/profile

8. source /etc/profile

修改shell命令的history 记录个数和连接超时时间

1. echo "export HISTCONTROL=ignorespace" >>/etc/profile

2. echo "export HISTCONTROL=erasedups" >>/etc/profile

3. echo "HISTSIZE=500" >> /etc/profile

4.  

5. #修改帐户TMOUT值，设置自动注销时间

6. echo "export TMOUT=300" >>/etc/profile

7. echo "set autologout=300" >>/etc/csh.cshrc

8. source /etc/profile

清空系统版本信息加入登录警告

1. >/etc/motd

2. >/etc/issue

3. >/etc/redhat-release

4. echo "Authorized uses only. All activity may be monitored and reported." >>/etc/motd

5. echo "Authorized uses only. All activity may be monitored and reported." >> /etc/issue

6. echo "Authorized uses only. All activity may be monitored and reported." >> /etc/issue.net

7. chown root:root /etc/motd /etc/issue /etc/issue.net

8. chmod 644 /etc/motd /etc/issue /etc/issue.net

优化内核TCP参数

1. cat >>/etc/sysctl.conf<<EOF

2. net.ipv4.tcp_fin_timeout = 1

3. net.ipv4.tcp_keepalive_time = 1200

4. net.ipv4.tcp_mem = 94500000 915000000 927000000

5. net.ipv4.tcp_tw_reuse = 1

6. net.ipv4.tcp_timestamps = 0

7. net.ipv4.tcp_synack_retries = 1

8. net.ipv4.tcp_syn_retries = 1

9. net.ipv4.tcp_tw_recycle = 1

10. net.core.rmem_max = 16777216

11. net.core.wmem_max = 16777216

12. net.core.netdev_max_backlog = 262144

13. net.ipv4.tcp_max_orphans = 3276800

14. net.ipv4.tcp_max_syn_backlog = 262144

15. net.core.wmem_default = 8388608

16. net.core.rmem_default = 8388608

17. EOF

18. /sbin/sysctl -p

登录机器发邮件告警

1. yum -y install mailx

2. cat >>/root/.bashrc << EOF

3. echo 'ALERT - Root Shell Access (Server Name) on:' \`date\`\`who\`\`hostname\` | mail -s "Alert:Root Access from \`who | cut -d "(" -f2 | cut -d ")" #-f1\`" blue.yunwei@bluepay.asia

4. EOF

定时校正服务器时间

1. echo '0 * * * * /usr/sbin/ntpdate -u 0.cn.pool.ntp.org;/sbin/hwclock -w > /dev/null 2>&1' >> /var/spool/cron/root

2. /usr/sbin/ntpdate -u 0.cn.pool.ntp.org;/sbin/hwclock -w

3. systemctl restart crond

停止ipv6

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6

修改yum源

1. mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup

2. wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

3. yum -y reinstall epel-release

4. yum clean all

5. yum makecache

关闭Selinux

1. setenforce 0

2. sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

安装必要的服务，更新系统软件

1. yum -y groupinstall "Development tools"

2. yum -y install ntpdate sysstat lrzsz wget nmap tree curl epel-release lsof nano bash-completion net-tools lsof vim-enhanced

ssh优化，加快连接速度

1. #1、配置空闲登出的超时间隔:

2. #2、禁用 .rhosts 文件

3. #3、禁用基于主机的认证

4. #4、禁止 root 帐号通过 SSH 登录

5. #5、用警告的 Banner

6. #6、iptables防火墙处理 SSH 端口22123

7. #7、修改 SSH 端口和限制 IP 绑定：

8. #8、禁用空密码：

9. #9、记录日志：

10.  

11. mv /etc/ssh/ /etc/sshbak

12. mkdir -p /application/tools

13. cd /application/tools

14. yum -y install wget C gcc cc

15. wget https://openbsd.hk/pub/OpenBSD/OpenSSH/portable/openssh-7.6p1.tar.gz

16. tar -zxf openssh-7.6p1.tar.gz

17. cd openssh-7.6p1

18. yum install -y zlib-devel openssl-devel pam pam-devel

19. ./configure --prefix=/usr --sysconfdir=/etc/ssh --without-zlib-version-check --with-pam

20. chmod 600 /etc/ssh/*_key

21. make -j4

22. rpm -e --nodeps `rpm -qa | grep openssh`

23. make install

24. ssh -V

25. cp contrib/redhat/sshd.init /etc/init.d/sshd

26. chkconfig --add sshd

27.  

28. mv /etc/ssh/sshd_config /etc/ssh/sshd_config_`date +%F`

29. cat >/etc/ssh/sshd_config<<EOF

30. Port 22123

31. PidFile /var/run/sshd.pid

32. SyslogFacility AUTH

33. LogLevel INFO

34. LoginGraceTime 30

35. PermitRootLogin no

36. StrictModes yes

37. MaxAuthTries 3

38. MaxSessions 15

39. #AllowUsers root lovelinux

40. PubkeyAuthentication yes

41. AuthorizedKeysFile .ssh/authorized_keys

42. PasswordAuthentication yes

43. PermitEmptyPasswords no

44. ChallengeResponseAuthentication yes

45. GSSAPIAuthentication no

46. GSSAPICleanupCredentials yes

47. UsePAM no

48. ClientAliveInterval 0

49. ClientAliveCountMax 3

50. UseDNS no

51. Subsystem sftp /usr/lib/ssh/sftp-server

52. Ciphers aes128-ctr,aes192-ctr,aes256-ctr

53. Macs hmac-sha2-256,hmac-sha2-512

54. EOF

55.  

56. echo "#save sshd messages also to sshd.log" >>/etc/rsyslog.conf

57. echo "local5.* /var/log/sshd.log" >>/etc/rsyslog.conf

58. systemctl restart rsyslog

59. systemctl stop sshd && systemctl start sshd

60. systemctl reload sshd

删除系统不需要的用户和用户组

1. for i in adm lp sync shutdown halt news uucp operator games gopher

2. do

3. userdel $i 2>/dev/null

4. done && action "delete user: " /bin/true || action "delete user: " /bin/false

5.  

6. for i in adm news uucp games dip pppusers popusers slipusers

7. do

8. groupdel $i 2>/dev/null

9. done

修改密码认证的复杂度，和过期时间

1. mv /etc/pam.d/system-auth /etc/pam.d/system-auth_`date +%F`

2. cat >/etc/pam.d/system-auth<<EOF

3. #%PAM-1.0

4. # This file is auto-generated.

5. # User changes will be destroyed the next time authconfig is run.

6. auth required pam_env.so

7. auth required pam_tally.so onerr=fail deny=6 unlock_time=1800

8. auth sufficient pam_unix.so nullok try_first_pass

9. auth requisite pam_succeed_if.so uid >= 500 quiet

10. auth required pam_deny.so

11. auth sufficient /lib/security/pam_unix.so likeauth nullok

12.  

13. account required pam_unix.so

14. account sufficient pam_localuser.so

15. account sufficient pam_succeed_if.so uid < 500 quiet

16. account required pam_permit.so

17.  

18. password requisite pam_cracklib.so try_first_pass retry=3 minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

19. password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok

20. password required pam_deny.so

21.  

22. session optional pam_keyinit.so revoke

23. session required pam_limits.so

24. session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

25. session required pam_unix.soetc/pam.d/system-auth

26. EOF

27. cat >/etc/pam.d/sshd<<EOF

28. #%PAM-1.0

29. #auth required pam_google_authenticator.so nullok

30. auth required pam_sepermit.so

31. auth substack password-auth

32. auth include postlogin

33. # Used with polkit to reauthorize users in remote sessions

34. -auth optional pam_reauthorize.so prepare

35. account required pam_nologin.so

36. account include password-auth

37. password include password-auth

38. # pam_selinux.so close should be the first session rule

39. session required pam_selinux.so close

40. session required pam_loginuid.so

41. # pam_selinux.so open should only be followed by sessions to be executed in the user context

42. session required pam_selinux.so open env_params

43. session required pam_namespace.so

44. session optional pam_keyinit.so force revoke

45. session include password-auth

46. session include postlogin

47. # Used with polkit to reauthorize users in remote sessions

48. -session optional pam_reauthorize.so prepare

49. EOF

使用noatime文件系统挂载选项

删除CentOS自带的sendmail，改用postfix

增加SWAP分区大小（一般是内存的2倍）

1. dd if=/dev/zero of=/mnt/swapfile bs=4M count=1024

2. mkswap /mnt/swapfile

3. swapon /mnt/swapfile

4. echo "/mnt/swapfile swap swap defaults 0 0" >>/etc/fstab

5. mount -a

6. free -m | grep -i swap

使用iptables关闭不需要对外开放的端口

1. systemctl disable firewalld

2. systemctl stop firewalld

3.  

4. yum -y install iptables-services

5. systemctl start iptables

6. systemctl start ip6tables

7. systemctl enable iptables

8. systemctl enable ip6tables

9.  

10. iptables -F

11. iptables -A INPUT -i lo -j ACCEPT

12. iptables -A INPUT -p tcp --dport 22123 -j ACCEPT

13. iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

14. iptables -A INPUT -p icmp -j ACCEPT

15. iptables -A INPUT -j DROP

16. service iptables save

启动系统审计服务

1. yum install audit*.* -y

2. cat >>/etc/audit/audit.rules<<EOF

3. -w /var/log/audit/ -k LOG_audit

4. -w /etc/audit/ -p wa -k CFG_audit

5. -w /etc/sysconfig/auditd -p wa -k CFG_auditd.conf

6. -w /etc/libaudit.conf -p wa -k CFG_libaudit.conf

7. -w /etc/audisp/ -p wa -k CFG_audisp

8. -w /etc/cups/ -p wa -k CFG_cups

9. -w /etc/init.d/cups -p wa -k CFG_initd_cups

10. -w /etc/netlabel.rules -p wa -k CFG_netlabel.rules

11. -w /etc/selinux/mls/ -p wa -k CFG_MAC_policy

12. -w /usr/share/selinux/mls/ -p wa -k CFG_MAC_policy

13. -w /etc/selinux/semanage.conf -p wa -k CFG_MAC_policy

14. -w /usr/sbin/stunnel -p x

15. -w /etc/security/rbac-self-test.conf -p wa -k CFG_RBAC_self_test

16. -w /etc/aide.conf -p wa -k CFG_aide.conf

17. -w /etc/cron.allow -p wa -k CFG_cron.allow

18. -w /etc/cron.deny -p wa -k CFG_cron.deny

19. -w /etc/cron.d/ -p wa -k CFG_cron.d

20. -w /etc/cron.daily/ -p wa -k CFG_cron.daily

21. -w /etc/cron.hourly/ -p wa -k CFG_cron.hourly

22. -w /etc/cron.monthly/ -p wa -k CFG_cron.monthly

23. -w /etc/cron.weekly/ -p wa -k CFG_cron.weekly

24. -w /etc/crontab -p wa -k CFG_crontab

25. -w /var/spool/cron/root -k CFG_crontab_root

26. -w /etc/group -p wa -k CFG_group

27. -w /etc/passwd -p wa -k CFG_passwd

28. -w /etc/gshadow -k CFG_gshadow

29. -w /etc/shadow -k CFG_shadow

30. -w /etc/security/opasswd -k CFG_opasswd

31. -w /etc/login.defs -p wa -k CFG_login.defs

32. -w /etc/securetty -p wa -k CFG_securetty

33. -w /var/log/faillog -p wa -k LOG_faillog

34. -w /var/log/lastlog -p wa -k LOG_lastlog

35. -w /var/log/tallylog -p wa -k LOG_tallylog

36. -w /etc/hosts -p wa -k CFG_hosts

37. -w /etc/sysconfig/network-scripts/ -p wa -k CFG_network

38. -w /etc/inittab -p wa -k CFG_inittab

39. -w /etc/rc.d/init.d/ -p wa -k CFG_initscripts

40. -w /etc/ld.so.conf -p wa -k CFG_ld.so.conf

41. -w /etc/localtime -p wa -k CFG_localtime

42. -w /etc/sysctl.conf -p wa -k CFG_sysctl.conf

43. -w /etc/modprobe.conf -p wa -k CFG_modprobe.conf

44. -w /etc/pam.d/ -p wa -k CFG_pam

45. -w /etc/security/limits.conf -p wa -k CFG_pam

46. -w /etc/security/pam_env.conf -p wa -k CFG_pam

47. -w /etc/security/namespace.conf -p wa -k CFG_pam

48. -w /etc/security/namespace.init -p wa -k CFG_pam

49. -w /etc/aliases -p wa -k CFG_aliases

50. -w /etc/postfix/ -p wa -k CFG_postfix

51. -w /etc/ssh/sshd_config -k CFG_sshd_config

52. -w /etc/vsftpd.ftpusers -k CFG_vsftpd.ftpusers

53. -a exit,always -F arch=b32 -S sethostname

54. -w /etc/issue -p wa -k CFG_issue

55. -w /etc/issue.net -p wa -k CFG_issue.net

56. EOF

57. systemctl enable auditd

58. service auditd restart

部署完整性检查工具软件

1. yum -y install aide

2.  

3. #1）执行初始化，建立第一份样本库

4. aide -i

5. mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

6.  

7. #2）更新到样本库

8. aide -u

9. cd /var/lib/aide/

10. mv aide.db.new.gz aide.db.gz

11.  

12. #3）定期执行***检测，并发送报告

13. # crontab -e

14. #45 17 * * * /usr/sbin/aide -C -V4 | /bin/mail -s ”AIDE REPORT $（date +%Y%m%d）” abcdefg#163.com

15. echo '45 23 * * * aide -C >> /var/log/aide/`date +%Y%m%d`_aide.log' >> /var/spool/cron/root

16.  

17. #记录aide可执行文件的md5 checksum：

18. md5sum /usr/sbin/aide

关闭ctrl+alt+del重启机器

1. rm -f /usr/lib/systemd/system/ctrl-alt-del.targe && init q

2. #恢复 ln -s /usr/lib/systemd/system/reboot.target /usr/lib/systemd/system/ctrl-alt-del.target

文件加锁及修改默认权限

1. #1、限制 at/cron给授权的用户:

2. rm -f /etc/cron.deny /etc/at.deny

3. echo root >/etc/cron.allow

4. echo root >/etc/at.allow

5. chown root:root /etc/cron.allow /etc/at.allow

6. chmod 400 /etc/cron.allow /etc/at.allow

7.  

8. #2、Crontab文件限制访问权限:

9. chown root:root /etc/crontab

10. chmod 400 /etc/crontab

11. chown -R root:root /var/spool/cron

12. chmod -R go-rwx /var/spool/cron

13. chown -R root:root /etc/cron.*

14. chmod -R go-rwx /etc/cron.*

15.  

16. #3、加锁重要口令文件和组文件

17. chattr +i /etc/passwd

18. chattr +i /etc/shadow

19. chattr +i /etc/group

20. chattr +i /etc/gshadow

21. chattr +i /etc/xinetd.conf

22. chattr +i /etc/services