Linux 系统初始参数优化

CentOS 7.2

#set Host name
hostnamectl set-host hostname

#disable SElinux
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

#set admin sudo
sed -i '100 i admin    ALL=(ALL)       ALL' /etc/sudoers


#disable IPv6
#!/bin/bash
Net=eth0
sed -i 's/IPV6INIT=yes/IPV6INIT=no/' /etc/sysconfig/network-scripts/$Net
echo -e "net.ipv6.conf.all.disable_ipv6= 1" >> /etc/sysctl.conf
echo -e "NETWORKING_IPV6=no" >> /etc/sysconfig/network 

$ cat /etc/sysctl.conf
# System default settings live in /usr/lib/sysctl.d/00-system.conf.
# To override those settings, enter new settings here, or in an /etc/sysctl.d/<name>.conf file
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl =15
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.tcp_max_orphans = 32768
net.ipv4.tcp_wmem = 51200 131072 204800
net.ipv4.ip_local_port_range = 32768 65000
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
#
# # Controls IP packet forwarding
net.ipv4.ip_forward = 0
#
# # Controls source route verification
#
# # Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
#
# # Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
#
# # Controls whether core dumps will append the PID to the core filename.
# # Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
#
# # Controls the use of TCP syncookies
#
# # Disable netfilter on bridges.
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
#
# # Controls the default maxmimum size of a mesage queue
kernel.msgmnb = 65536
#
# # Controls the maximum size of a message, in bytes
kernel.msgmax = 65536
#
# # Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736
#
# # Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296
#
vm.swappiness = 0
net.ipv4.neigh.default.gc_stale_time=120
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.all.arp_announce=2
net.ipv4.tcp_synack_retries = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.tcp_syncookies = 1
# #表示开启SYN Cookies。当出现SYN等待队列溢出时，启用cookies来处理，可防范少量SYN攻击，默认为0，表示关闭；
net.ipv4.tcp_tw_reuse = 1
# ##表示开启重用。允许将TIME-WAIT sockets重新用于新的TCP连接，默认为0，表示关闭；
net.ipv4.tcp_tw_recycle = 1
# ##表示开启TCP连接中TIME-WAIT sockets的快速回收，默认为0，表示关闭；最低30s
net.ipv4.tcp_fin_timeout = 10
# ##修改系統默认的 TIMEOUT 时间。
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_timestamps = 1

# sysctl -p

# /etc/security/limits.conf

echo -e "* soft nproc unlimited" >> /etc/security/limits.conf
echo -e "* hard nproc unlimited" >> /etc/security/limits.conf
echo -e "* soft nofile 655350" >> /etc/security/limits.conf
echo -e "* hard nofile 655350" >> /etc/security/limits.conf

# /etc/proflie
echo -e "ulimit -SHn 655350" >> /etc/profile
echo -e "ulimit -SHu unlimited" >> /etc/profile
echo -e "ulimit -SHd unlimited" >> /etc/profile
echo -e "ulimit -SHm unlimited" >> /etc/profile
echo -e "ulimit -SHs unlimited" >> /etc/profile
echo -e "ulimit -SHt unlimited" >> /etc/profile
echo -e "ulimit -SHv unlimited" >> /etc/profile

# source /etc/profile
# ulimit -a