echo '
export HISTFILE=$HOME/.bash_history
export HISTSIZE=
2000
export HISTFILESIZE=
2000
export HISTTIMEFORMAT=
"%F %T `whoami` "
export PROMPT_COMMAND=
"history -a; history -c; history -r;"
shopt -s histappend
typeset -r PROMPT_COMMAND
typeset -r HISTTIMEFORMAT ' > /etc/profile.d/history.sh
source /etc/profile
|
username=
'dyt'
password=
'dyt2015'
useradd $username ; echo $password | passwd --stdin $username
sed -i
"98 a$username ALL=(ALL) NOPASSWD: ALL"
/etc/sudoers
|
sed -i
's/#PermitRootLogin yes/PermitRootLogin no/'
/etc/ssh/sshd_config
|
sed -i
's/#Port 22/Port 9527/'
/etc/ssh/sshd_config
/etc/init.d/sshd restart
|
for
server
in
`chkconfig --list|egrep -v
'crond|network|rsyslog|sshd|iptables'
|awk
'{print $1}'
`;
do
chkconfig $server off; done
|
sed -i
's/SELINUX=enforcing/SELINUX=disabled/'
/etc/selinux/config
setenforce
0
|
/etc/init.d/iptables restart
iptables -F
iptables -X
iptables -Z
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
#允许某个IP段远程访问ssh
iptables -A INPUT -p tcp -m tcp --dport
9527
-s
192.168
.
64.0
/
24
-j ACCEPT
#开启
80
端口
iptables -A INPUT -P tcp -m tcp --dropt
80
-j ACCEPT
#允许某个IP的所有请求
iptables -A INPUT -p all -s
124.43
.
56.90
/
30
-j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
/etc/init.d/iptables save
/etc/init.d/iptables restart
|
#方法有很多,未必就这一种
echo
'* - noproc 65535'
>> /etc/security/limits.conf
echo
'* - nofile 65535'
>> /etc/security/limits.conf
|
sed -i
"s/start on control-alt-delete/#start on control-alt-delete/g"
/etc/init/control-alt-
delete
.conf
|
echo
"nameserver 8.8.8.8"
> /etc/resolv.conf
echo
"nameserver 8.8.4.4"
>> /etc/resolv.conf
|
#根据个人公司情况,这里只列举了自己常用的软件和yum源,根据实际情况更改yum源
yum -y install gcc gcc-c++ openssl-devel openssh-clients wget make lrzsz unzip zip xz ntpdate lsof telnet epel-release vim tree kernel-devel kernel
|
yum -y upgrade
|
echo -e
"net.core.somaxconn = 262144"
>> /etc/sysctl.conf
echo -e
"net.core.netdev_max_backlog = 262144"
>> /etc/sysctl.conf
echo -e
"net.core.wmem_default = 8388608"
>> /etc/sysctl.conf
echo -e
"net.core.rmem_default = 8388608"
>> /etc/sysctl.conf
echo -e
"net.core.rmem_max = 16777216"
>> /etc/sysctl.conf
echo -e
"net.core.wmem_max = 16777216"
>> /etc/sysctl.conf
echo -e
"net.ipv4.route.gc_timeout = 20"
>> /etc/sysctl.conf
echo -e
"net.ipv4.ip_local_port_range = 1024 65535"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_retries2 = 5"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_fin_timeout = 30"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_syn_retries = 1"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_synack_retries = 1"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_timestamps = 0"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_tw_recycle = 1"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_tw_reuse = 1"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_keepalive_time = 120"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_keepalive_probes = 3"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_keepalive_intvl = 15"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_max_tw_buckets = 36000"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_max_orphans = 3276800"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_max_syn_backlog = 262144"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_wmem = 8192 131072 16777216"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_rmem = 32768 131072 16777216"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_mem = 94500000 915000000 927000000"
>> /etc/sysctl.conf
echo -e
"net.ipv4.tcp_slow_start_after_idle = 0"
>> /etc/sysctl.conf
echo -e
"vm.swappiness = 0"
>> /etc/sysctl.conf
echo -e
"kernel.panic = 5"
>> /etc/sysctl.conf
echo -e
"kernel.panic_on_oops = 1"
>> /etc/sysctl.conf
echo -e
"kernel.core_pipe_limit = 0"
>> /etc/sysctl.conf
#iptables 防火墙
echo -e
"net.nf_conntrack_max = 25000000"
>> /etc/sysctl.conf
echo -e
"net.netfilter.nf_conntrack_max = 25000000"
>> /etc/sysctl.conf
echo -e
"net.netfilter.nf_conntrack_tcp_timeout_established = 180"
>> /etc/sysctl.conf
echo -e
"net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120"
>> /etc/sysctl.conf
echo -e
"net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60"
>> /etc/sysctl.conf
echo -e
"net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120"
>> /etc/sysctl.confo
|
touch ~/.hushlogin
|
另:
修改用户密码:
passwd
修改linux主机名
vi/etc/sysconfig/network
vim/etc/host
主机名立即生效
hostname
selinux和防火墙
Redhat使用了SELinux来增强安全,关闭的办法为:
1.永久有效
修改/etc/selinux/config文件中的SELINUX=""为disabled,然后重启。
2.即时生效
setenforce 0
关闭防火墙的方法为:
1.永久性生效
开启:chkconfig iptables on
关闭:chkconfig iptables off
2.即时生效,重启后失效
开启:service iptables start
关闭:service iptables stop
配置nameserver,确保能连接网络
ping www.baidu.com
ping 202.108.22.5
vi/etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
配置163的yum源
yum -y install wget
cd /etc/yum.repos.d/
wget http://mirrors.163.com/.help/CentOS6-Base-163.repo
重启linux
reboot
安装scp,vim命名
yum -y install openssh-clients vim
需要说明的是对于Linux下的其它服务都可以用以上命令执行开启和关闭操作
补充:
a.防火墙还需要关闭ipv6的防火墙:
chkconfig ip6tables off
并且可以通过如下命令查看状态:
chkconfig--list iptables
b.selinux状态可以通过以下命令查看:
sestatus
passwd
修改linux主机名
vi/etc/sysconfig/network
vim/etc/host
主机名立即生效
hostname
selinux和防火墙
Redhat使用了SELinux来增强安全,关闭的办法为:
1.永久有效
修改/etc/selinux/config文件中的SELINUX=""为disabled,然后重启。
2.即时生效
setenforce 0
关闭防火墙的方法为:
1.永久性生效
开启:chkconfig iptables on
关闭:chkconfig iptables off
2.即时生效,重启后失效
开启:service iptables start
关闭:service iptables stop
配置nameserver,确保能连接网络
ping www.baidu.com
ping 202.108.22.5
vi/etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
配置163的yum源
yum -y install wget
cd /etc/yum.repos.d/
wget http://mirrors.163.com/.help/CentOS6-Base-163.repo
重启linux
reboot
安装scp,vim命名
yum -y install openssh-clients vim
需要说明的是对于Linux下的其它服务都可以用以上命令执行开启和关闭操作
补充:
a.防火墙还需要关闭ipv6的防火墙:
chkconfig ip6tables off
并且可以通过如下命令查看状态:
chkconfig--list iptables
b.selinux状态可以通过以下命令查看:
sestatus