1. #!/bin/bash
    3. # init centos7  ./centos7-init.sh 主机名
    5. # 检查是否为root用户，脚本必须在root权限下运行
    7. if [[ "$(whoami)" != "root" ]]; then
    8.     echo "please run this script as root !" >&2
    9.     exit 1
    10. fi
    11. echo -e "\033[31m the script only Support CentOS_7 x86_64 \033[0m"
    12. echo -e "\033[31m system initialization script, Please Seriously. press ctrl+C to cancel \033[0m"
    14. # 检查是否为64位系统，这个脚本只支持64位脚本
    16. platform=`uname -i`
    17. if [ $platform != "x86_64" ];then
    18.     echo "this script is only for 64bit Operating System !"
    19.     exit 1
    20. fi
    22. if [ "$1" == "" ];then
    23.     echo "The host name is empty."
    24.     exit 1
    25. else
    26.     hostnamectl  --static set-hostname  $1
    27.     hostnamectl  set-hostname  $1
    28. fi
    30. cat << EOF
    31. +---------------------------------------+
    32. |   your system is CentOS 7 x86_64      |
    33. |           start optimizing            |
    34. +---------------------------------------+
    35. EOF
    36. sleep 1
    38. # 安装必要支持工具及软件工具
    40. yum_update(){
    41. yum update -y
    42. yum install -y nmap unzip wget vim lsof xz net-tools iptables-services ntpdate ntp-doc psmisc
    43. }
    45. # 设置时间同步 set time
    47. zone_time(){
    48. timedatectl set-timezone Asia/Shanghai
    49. /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1
    50. /usr/sbin/hwclock --systohc
    51. /usr/sbin/hwclock -w
    52. cat > /var/spool/cron/root << EOF
    53. 10 0 * * * /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1
    55. * * * * */1 /usr/sbin/hwclock -w > /dev/null 2>&1
    56.         EOF
    57.         chmod 600 /var/spool/cron/root
    58.         /sbin/service crond restart
    59.         sleep 1
    60.         }
    62. # 修改文件打开数 set the file limit
    64. limits_config(){
    65. cat > /etc/rc.d/rc.local << EOF
    66. #!/bin/bash
    68. touch /var/lock/subsys/local
    69. ulimit -SHn 1024000
    70. EOF
    72. sed -i "/^ulimit -SHn.*/d" /etc/rc.d/rc.local
    73. echo "ulimit -SHn 1024000" >> /etc/rc.d/rc.local
    75. sed -i "/^ulimit -s.*/d" /etc/profile
    76. sed -i "/^ulimit -c.*/d" /etc/profile
    77. sed -i "/^ulimit -SHn.*/d" /etc/profile
    79. cat >> /etc/profile << EOF
    80. ulimit -c unlimited
    81. ulimit -s unlimited
    82. ulimit -SHn 1024000
    83. EOF
    85. source /etc/profile
    86. ulimit -a
    87. cat /etc/profile | grep ulimit
    89. if [ ! -f "/etc/security/limits.conf.bak" ]; then
    90.     cp /etc/security/limits.conf /etc/security/limits.conf.bak
    91. fi
    93. cat > /etc/security/limits.conf << EOF
    95. * soft nofile 1024000
    96. * hard nofile 1024000
    97. * soft nproc  1024000
    98. * hard nproc  1024000
    99.   hive   - nofile 1024000
    100.   hive   - nproc  1024000
    101.   EOF
    103. if [ ! -f "/etc/security/limits.d/20-nproc.conf.bak" ]; then
    104.     cp /etc/security/limits.d/20-nproc.conf /etc/security/limits.d/20-nproc.conf.bak
    105. fi
    107. cat > /etc/security/limits.d/20-nproc.conf << EOF
    109. *          soft    nproc     409600
    110.            root       soft    nproc     unlimited
    111.            EOF
    113. sleep 1
    114. }
    116. # 优化内核参数 tune kernel parametres
    118. sysctl_config(){
    119. if [ ! -f "/etc/sysctl.conf.bak" ]; then
    120.     cp /etc/sysctl.conf /etc/sysctl.conf.bak
    121. fi
    123. #add
    124. cat > /etc/sysctl.conf << EOF
    125. net.ipv6.conf.all.disable_ipv6 = 1
    126. net.ipv6.conf.default.disable_ipv6 = 1
    127. net.ipv4.tcp_syn_retries = 1
    128. net.ipv4.tcp_synack_retries = 1
    129. net.ipv4.tcp_keepalive_time = 600
    130. net.ipv4.tcp_keepalive_probes = 3
    131. net.ipv4.tcp_keepalive_intvl =15
    132. net.ipv4.tcp_retries1 = 3
    133. net.ipv4.tcp_retries2 = 5
    134. net.ipv4.tcp_fin_timeout = 10
    135. net.ipv4.tcp_tw_recycle = 1
    136. net.ipv4.tcp_tw_reuse = 1
    137. net.ipv4.tcp_syncookies = 1
    138. net.ipv4.tcp_window_scaling = 1
    139. net.ipv4.tcp_max_tw_buckets = 60000
    140. net.ipv4.tcp_max_orphans = 32768
    141. net.ipv4.tcp_max_syn_backlog = 16384
    142. net.ipv4.tcp_mem = 94500000 915000000 927000000
    143. net.ipv4.tcp_wmem = 4096 16384 13107200
    144. net.ipv4.tcp_rmem = 4096 87380 17476000
    145. net.ipv4.ip_local_port_range = 1024 65000
    146. net.ipv4.ip_forward = 1
    147. net.ipv4.route.gc_timeout = 100
    148. net.core.somaxconn = 32768
    149. net.core.netdev_max_backlog = 32768
    150. net.nf_conntrack_max = 6553500
    151. net.netfilter.nf_conntrack_max = 6553500
    152. net.netfilter.nf_conntrack_tcp_timeout_established = 180
    153. vm.overcommit_memory = 1
    154. vm.swappiness = 1
    155. fs.file-max = 1024000
    156. EOF
    158. #reload sysctl
    159. /sbin/sysctl -p
    160. sleep 1
    161. }
    163. # 设置UTF-8   LANG="zh_CN.UTF-8"
    165. LANG_config(){
    166. echo "LANG=\"en_US.UTF-8\"">/etc/locale.conf
    167. source  /etc/locale.conf
    168. }
    171. #关闭SELINUX disable selinux
    172. selinux_config(){
    173. sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    174. setenforce 0
    175. sleep 1
    176. }
    178. #日志处理
    179. log_config(){
    180. setenforce 0
    181. systemctl start systemd-journald
    182. systemctl status systemd-journald
    183. }
    186. # 关闭防火墙
    188. firewalld_config(){
    189. /usr/bin/systemctl stop  firewalld.service
    190. /usr/bin/systemctl disable  firewalld.service
    191. }
    194. # SSH配置优化 set sshd_config
    196. sshd_config(){
    197. if [ ! -f "/etc/ssh/sshd_config.bak" ]; then
    198.     cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
    199. fi
    201. cat >/etc/ssh/sshd_config<<EOF
    202. Port 22
    203. AddressFamily inet
    204. ListenAddress 0.0.0.0
    205. Protocol 2
    206. HostKey /etc/ssh/ssh_host_rsa_key
    207. HostKey /etc/ssh/ssh_host_ecdsa_key
    208. HostKey /etc/ssh/ssh_host_ed25519_key
    209. SyslogFacility AUTHPRIV
    210. PermitRootLogin yes
    211. MaxAuthTries 6
    212. RSAAuthentication yes
    213. PubkeyAuthentication yes
    214. AuthorizedKeysFile    .ssh/authorized_keys
    215. PasswordAuthentication yes
    216. ChallengeResponseAuthentication no
    217. UsePAM yes
    218. UseDNS no
    219. X11Forwarding yes
    220. UsePrivilegeSeparation sandbox
    221. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
    222. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    223. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
    224. AcceptEnv XMODIFIERS
    225. Subsystem       sftp    /usr/libexec/openssh/sftp-server
    226. EOF
    227. /sbin/service sshd restart
    228. }
    231. # 关闭ipv6  disable the ipv6
    233. ipv6_config(){
    234. echo "NETWORKING_IPV6=no">/etc/sysconfig/network
    235. echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
    236. echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6
    237. echo "127.0.0.1   localhost   localhost.localdomain">/etc/hosts
    238. #sed -i 's/IPV6INIT=yes/IPV6INIT=no/g' /etc/sysconfig/network-scripts/ifcfg-enp0s8
    241. for line in $(ls -lh /etc/sysconfig/network-scripts/ifcfg-* | awk -F '[ ]+' '{print $9}')
    242. do
    243. if [ -f  $line ]
    244.         then
    245.         sed -i 's/IPV6INIT=yes/IPV6INIT=no/g' $line
    246.                 echo $i
    247. fi
    248. done
    249. }
    252. # 设置历史命令记录格式 history
    254. history_config(){
    255. export HISTFILESIZE=10000000
    256. export HISTSIZE=1000000
    257. export PROMPT_COMMAND="history -a"
    258. export HISTTIMEFORMAT="%Y-%m-%d_%H:%M:%S "
    259. ##export HISTTIMEFORMAT="{\"TIME\":\"%F %T\",\"HOSTNAME\":\"\$HOSTNAME\",\"LI\":\"\$(who -u am i 2>/dev/null| awk '{print \$NF}'|sed -e 's/[()]//g')\",\"LU\":\"\$(who am i|awk '{print \$1}')\",\"NU\":\"\${USER}\",\"CMD\":\""
    260. cat >>/etc/bashrc<<EOF
    261. alias vi='vim'
    262. HISTDIR='/var/log/command.log'
    263. if [ ! -f \$HISTDIR ];then
    264. touch \$HISTDIR
    265. chmod 666 \$HISTDIR
    266. fi
    267. export HISTTIMEFORMAT="{\"TIME\":\"%F %T\",\"IP\":\"\$(ip a | grep -E '192.168|172' | head -1 | awk '{print \$2}' | cut -d/ -f1)\",\"LI\":\"\$(who -u am i 2>/dev/null| awk '{print \$NF}'|sed -e 's/[()]//g')\",\"LU\":\"\$(who am i|awk '{print \$1}')\",\"NU\":\"\${USER}\",\"CMD\":\""
    268. export PROMPT_COMMAND='history 1|tail -1|sed "s/^[ ]\+[0-9]\+  //"|sed "s/$/\"}/">> /var/log/command.log'
    269. EOF
    270. source /etc/bashrc
    271. }
    273. # 服务优化设置
    275. service_config(){
    276. /usr/bin/systemctl enable NetworkManager-wait-online.service
    277. /usr/bin/systemctl start NetworkManager-wait-online.service
    278. /usr/bin/systemctl stop postfix.service
    279. /usr/bin/systemctl disable postfix.service
    280. chmod +x /etc/rc.local
    281. chmod +x /etc/rc.d/rc.local
    282. #ls -l /etc/rc.d/rc.local
    283. }
    285. # VIM设置
    287. vim_config(){
    288. cat > /root/.vimrc << EOF
    289. set history=1000
    291. EOF
    293. #autocmd InsertLeave * se cul
    294. #autocmd InsertLeave * se nocul
    295. #set nu
    296. #set bs=2
    297. #syntax on
    298. #set laststatus=2
    299. #set tabstop=4
    300. #set go=
    301. #set ruler
    302. #set showcmd
    303. #set cmdheight=1
    304. #hi CursorLine   cterm=NONE ctermbg=blue ctermfg=white guibg=blue guifg=white
    305. #set hls
    306. #set cursorline
    307. #set ignorecase
    308. #set hlsearch
    309. #set incsearch
    310. #set helplang=cn
    311. }
    314. # done
    316. done_ok(){
    317. touch /var/log/init-ok
    318. cat << EOF
    319. +-------------------------------------------------+
    320. |               optimizer is done                 |
    321. |   it's recommond to restart this server !       |
    322. |             Please Reboot system                |
    323. +-------------------------------------------------+
    324. EOF
    325. }
    327. # main
    329. main(){
    330.     yum_update
    331.     zone_time
    332.     limits_config
    333.     sysctl_config
    334.     LANG_config
    335.     selinux_config
    336.     log_config
    337.     firewalld_config
    338.     sshd_config
    339.     ipv6_config
    340.     history_config
    341.     service_config
    342.     vim_config
    343.     done_ok
    344. }
    345. main