以下脚本 ，适用于刚刚安装的新Linux系统的第一次优化和调试 包括关闭ipv6、关闭防火墙、关闭selinux、优化内核等等   使用后需要重启  自动重启

 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

#!/bin/bash

#Created by weihaoxuan

cat << EOF

+------------------------------------------------+

|    = = welcome to cenros system init ==        |

+------------------------------------------------+

EOF


#set ntp

yum install -y ntp

echo "* 3 * * * /usr/sbin/ntpdate 210.72.145.44 > /dev/null 2>&1 " >> /etc/crontab

service crond restart


#set ulimit

echo "ulimit -SHn 102400" >> /etc/rc.local

true > /etc/sysctl.conf

cat >> /etc/sysctl.conf << EOF

net.ipv4.ip_forward = 0

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

net.ipv4.tcp_max_tw_buckets = 6000

net.ipv4.tcp_sack = 1

net.ipv4.tcp_window_scaling = 1

net.ipv4.tcp_rmem = 4096 87380 4194304

net.ipv4.tcp_wmem = 4096 16384 4194304

net.core.wmem_default = 8388608

net.core.rmem_default = 8388608

net.core.rmem_max = 16777216

net.core.wmem_max = 16777216

net.core.netdev_max_backlog = 262144

net.core.somaxconn = 262144

net.ipv4.tcp_max_orphans = 3276800

net.ipv4.tcp_max_syn_backlog = 262144

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_synack_retries = 1

net.ipv4.tcp_syn_retries = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_mem = 94500000 915000000 927000000

net.ipv4.tcp_fin_timeout = 1

net.ipv4.tcp_keepalive_time = 1200

net.ipv4.ip_local_port_range = 1024 65535

EOF

/sbin/sysctl -p

echo "sysctl set ok!!"


#set purview

chmod 600 /etc/passwd

chmod 600 /etc/shadow

chmod 600 /etc/group

chmod 600 /etc/gshadow


#disable ipv6

echo "alias net -pf -10 off" >> /etc/modprobe.conf

echo "alias ipv6 off" >> /etc/modprobe.conf

/sbin/chkconfig --level 35 ip6tables off

echo "ipv6 disables!!"


#disable selinux

sed -i '/SELINUX/s/ecforcing/disabled/' /etc/selinux/config

echo "setenforce 0" >> /etc/rc.local


reboot