1. #!/bin/bash
    2. # Control switch
    3. [[ "$1" != "" ]] && CentOS_ver="$1" || CentOS_ver='7'
    4. [[ "$2" != "" ]] && iptables_yn="$2" || iptables_yn='n'
    5. # Close SELINUX
    6. setenforce 0
    7. sed -i 's/^SELINUX=.*$/SELINUX=disabled/' /etc/selinux/config
    8. # Custom profile
    9. cat > /etc/profile.d/boge.sh << EOF
    10. HISTSIZE=10000
    11. PS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h \[\e[35;40m\]\W\[\e[0m\]]\\\\$ "
    12. HISTTIMEFORMAT="%F %T \$(whoami) "
    13. alias l='ls -AFhlt'
    14. alias lh='l | head'
    15. GREP_OPTIONS="--color=auto"
    16. alias grep='grep --color'
    17. alias egrep='egrep --color'
    18. alias fgrep='fgrep --color'
    19. EOF
    20. [ -z "$(grep ^'PROMPT_COMMAND=' /etc/bashrc)" ] && cat >> /etc/bashrc << EOF
    21. PROMPT_COMMAND='{ msg=\$(history 1 | { read x y; echo \$y; });logger "[euid=\$(whoami)]":\$(who am i):[\`pwd\`]"\$msg"; }'
    22. EOF
    23. # Change apt-get source list
    24. # https://developer.aliyun.com/mirror/
    25. yum install wget -y
    26. cd /etc/yum.repos.d/
    27. mkdir bak
    28. mv *.repo bak
    29. wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-${CentOS_ver}.repo
    30. wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-${CentOS_ver}.repo
    31. yum clean all
    32. yum makecache
    33. # Install package
    34. yum groupinstall -y "base"
    35. yum groupinstall -y "compatibility libraries"
    36. yum groupinstall -y "debuging tools"
    37. yum groupinstall -y "development tools"
    38. yum install -y deltarpm gcc gcc-c++ make cmake autoconf libjpeg libjpeg-devel libpng libpng-devel freetype freetype-devel libxml2 libxml2-devel zlib zlib-devel glibc glibc-devel glib2 glib2-devel bzip2 bzip2-devel ncurses ncurses-devel libaio readline-devel curl curl-devel e2fsprogs e2fsprogs-devel krb5-devel libidn libidn-devel openssl openssl-devel libxslt-devel libicu-devel libevent-devel libtool libtool-ltdl bison gd-devel vim-enhanced pcre-devel zip unzip ntpdate patch bc expect rsync git lsof vim telnet tree nmap sysstat lrzsz dos2unix iotop iftop nethogs nload net-tools bash-completion sshpass
    39. #yum  update -y
    40. # clean yum installd cache
    41. #find  /var/cache/yum/ -type f -exec rm {} \;
    42. cd -
    43. # /etc/security/limits.conf
    44. [ -e /etc/security/limits.d/*nproc.conf ] && rename nproc.conf nproc.conf_bk /etc/security/limits.d/*nproc.conf
    45. sed -i '/^# End of file/,$d' /etc/security/limits.conf
    46. cat >> /etc/security/limits.conf <<EOF
    47. # End of file
    48. * soft nproc 1000000
    49. * hard nproc 1000000
    50. * soft nofile 1000000
    51. * hard nofile 1000000
    52. EOF
    53. ulimit -SHn 1000000
    54. # /etc/hosts
    55. [ "$(hostname -i | awk '{print $1}')" != "127.0.0.1" ] && sed -i "s@127.0.0.1.*localhost@&\n127.0.0.1 $(hostname)@g" /etc/hosts
    56. # Set timezone
    57. rm -rf /etc/localtime
    58. ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
    59. # Set DNS
    60. #cat > /etc/resolv.conf << EOF
    61. #nameserver 114.114.114.114
    62. #nameserver 8.8.8.8
    63. #EOF
    64. # ip_conntrack table full dropping packets
    65. [ ! -e "/etc/sysconfig/modules/iptables.modules" ] && { echo -e "modprobe nf_conntrack\nmodprobe nf_conntrack_ipv4" > /etc/sysconfig/modules/iptables.modules; chmod +x /etc/sysconfig/modules/iptables.modules; }
    66. modprobe nf_conntrack
    67. modprobe nf_conntrack_ipv4
    68. echo options nf_conntrack hashsize=131072 > /etc/modprobe.d/nf_conntrack.conf
    69. # /etc/sysctl.conf
    70. [ ! -e "/etc/sysctl.conf_bk" ] && /bin/mv /etc/sysctl.conf{,_bk}
    71. cat > /etc/sysctl.conf << EOF
    72. fs.file-max=1000000
    73. net.ipv4.tcp_max_tw_buckets = 6000
    74. net.ipv4.tcp_sack = 1
    75. net.ipv4.tcp_window_scaling = 1
    76. net.ipv4.tcp_rmem = 4096 87380 4194304
    77. net.ipv4.tcp_wmem = 4096 16384 4194304
    78. net.ipv4.tcp_max_syn_backlog = 16384
    79. net.core.netdev_max_backlog = 32768
    80. net.core.somaxconn = 32768
    81. net.core.wmem_default = 8388608
    82. net.core.rmem_default = 8388608
    83. net.core.rmem_max = 16777216
    84. net.core.wmem_max = 16777216
    85. net.ipv4.tcp_timestamps = 1
    86. net.ipv4.tcp_fin_timeout = 20
    87. net.ipv4.tcp_synack_retries = 2
    88. net.ipv4.tcp_syn_retries = 2
    89. net.ipv4.tcp_syncookies = 1
    90. #net.ipv4.tcp_tw_len = 1
    91. net.ipv4.tcp_tw_reuse = 1
    92. net.ipv4.tcp_mem = 94500000 915000000 927000000
    93. net.ipv4.tcp_max_orphans = 3276800
    94. net.ipv4.ip_local_port_range = 1024 65000
    95. net.nf_conntrack_max = 6553500
    96. net.netfilter.nf_conntrack_max = 6553500
    97. net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
    98. net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
    99. net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
    100. net.netfilter.nf_conntrack_tcp_timeout_established = 3600
    101. EOF
    102. sysctl -p
    103. if [ "${CentOS_ver}" == '5' ]; then
    104.   sed -i 's@^[3-6]:2345:respawn@#&@g' /etc/inittab
    105.   sed -i 's@^ca::ctrlaltdel@#&@' /etc/inittab
    106.   sed -i 's@LANG=.*$@LANG="en_US.UTF-8"@g' /etc/sysconfig/i18n
    107. elif [ "${CentOS_ver}" == '6' ]; then
    108.   sed -i 's@^ACTIVE_CONSOLES.*@ACTIVE_CONSOLES=/dev/tty[1-2]@' /etc/sysconfig/init
    109.   sed -i 's@^start@#start@' /etc/init/control-alt-delete.conf
    110.   sed -i 's@LANG=.*$@LANG="en_US.UTF-8"@g' /etc/sysconfig/i18n
    111. elif [ "${CentOS_ver}" == '7' ]; then
    112.   sed -i 's@LANG=.*$@LANG="en_US.UTF-8"@g' /etc/locale.conf
    113. fi
    114. # Update time
    115. ntpdate pool.ntp.org
    116. [ ! -e "/var/spool/cron/root" -o -z "$(grep 'ntpdate' /var/spool/cron/root)" ] && { echo "*/20 * * * * $(which ntpdate) pool.ntp.org > /dev/null 2>&1" >> /var/spool/cron/root;chmod 600 /var/spool/cron/root; }
    117. # iptables
    118. if [ "${iptables_yn}" == 'y' ]; then
    119.   if [ -e "/etc/sysconfig/iptables" ] && [ -n "$(grep '^:INPUT DROP' /etc/sysconfig/iptables)" -a -n "$(grep 'NEW -m tcp --dport 22 -j ACCEPT' /etc/sysconfig/iptables)" -a -n "$(grep 'NEW -m tcp --dport 80 -j ACCEPT' /etc/sysconfig/iptables)" ]; then
    120.     IPTABLES_STATUS=yes
    121.   else
    122.     IPTABLES_STATUS=no
    123.   fi
    124.   if [ "$IPTABLES_STATUS" == "no" ]; then
    125.     [ -e "/etc/sysconfig/iptables" ] && /bin/mv /etc/sysconfig/iptables{,_bk}
    126.     cat > /etc/sysconfig/iptables << EOF
    127. # Firewall configuration written by system-config-securitylevel
    128. # Manual customization of this file is not recommended.
    129. *filter
    130. :INPUT DROP [0:0]
    131. :FORWARD ACCEPT [0:0]
    132. :OUTPUT ACCEPT [0:0]
    133. :syn-flood - [0:0]
    134. -A INPUT -i lo -j ACCEPT
    135. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    136. -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    137. -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
    138. -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
    139. -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
    140. COMMIT
    141. EOF
    142.   fi
    143.   FW_PORT_FLAG=$(grep -ow "dport ${ssh_port}" /etc/sysconfig/iptables)
    144.   [ -z "${FW_PORT_FLAG}" -a "${ssh_port}" != "22" ] && sed -i "s@dport 22 -j ACCEPT@&\n-A INPUT -p tcp -m state --state NEW -m tcp --dport ${ssh_port} -j ACCEPT@" /etc/sysconfig/iptables
    145.   /bin/cp /etc/sysconfig/{iptables,ip6tables}
    146.   sed -i 's@icmp@icmpv6@g' /etc/sysconfig/ip6tables
    147.   iptables-restore < /etc/sysconfig/iptables
    148.   ip6tables-restore < /etc/sysconfig/ip6tables
    149.   service iptables save
    150.   service ip6tables save
    151.   chkconfig --level 3 iptables on
    152.   chkconfig --level 3 ip6tables on
    153. fi
    154. # sshd optimization
    155. \cp /etc/ssh/sshd_config /etc/ssh/sshd_config.BAK
    156. sed -i '/^AddressFamily.*/d' /etc/ssh/sshd_config
    157. num=$(grep -n "^#ListenAddress.*" /etc/ssh/sshd_config|awk -F: 'NR==1{print $1}')
    158. [[ -z `grep -n "^UseDNS.*" /etc/ssh/sshd_config` ]]&&sed -ir "${num} iUseDNS no" /etc/ssh/sshd_config||{
    159. sed -ri 's+^#UseDNS.*+UseDNS no+g' /etc/ssh/sshd_config
    160. }
    161. [[ -z `grep -n "^GSSAPIAuthentication.*" /etc/ssh/sshd_config` ]]&&sed -ir "${num} iGSSAPIAuthentication no" /etc/ssh/sshd_config||{
    162. sed -ri 's+^GSSAPIAuthentication .*+GSSAPIAuthentication no+g' /etc/ssh/sshd_config
    163. }

    service rsyslog restart
    service sshd restart
    . /etc/profile