#! /bin/sh
################################################
#Author:rolin
# qqinfo:992975991
# Date: 2021-1122
#version:1.0
#实现功能：一键系统优化17项脚本，适用于Centos8.x
################################################
#ConfigYum #配置阿里云YUM源
#initTools #安装常用工具
#installManChinese #安装man中文版本
#initCN_UTF8 #设置语言为中文
#initFirewall #关闭selinux,安装iptables
#initService #精简化开机启动
#initSsh #ssh安全设置
#addSAUser #增加管理员用户
#syncSystemTime #同步系统时间加入定时任务
#initHistory #指定历史记录条数
#initChattr #锁定文件系统
#openFiles #修改文件打开数
#optimizationKernel #优化系统内核参数
#init_safe #ctrl+alt+del 取消重启
#init_rc_local #centos7 rc.local文件执行权限设置
#disableIPV6 #关闭IPV6
#swapoff #关闭交换分区
#set env
export PATH=$PATH:/bin:/sbin:/usr/sbin
export LANG=zh_CN.UTF-8
echo "welcome to server" >/etc/issue
#Require root to run this scripts.
if [[ "$(whoami)" != "root" ]]; then
echo "Please run this scripts as root." >&2
exit 1
fi
#define cmd var
SERVICE=`which service`
CHKCONFIG=`which chkconfig`
#Source function library
. /etc/rc.d/init.d/functions
#Config Yum CentOS-Base.repo and epel-release
ConfigYum(){
echo "####开始指定yum源####"
cd /etc/yum.repos.d/
\cp CentOS-Base.repo CentOS-Base.repo.$(date +%F)
ping -c 1 baidu.com >/dev/null
[ ! $? -eq 0 ] && echo $"Networking not configured - exiting" && exit 1
wget -O /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo
>/dev/null 2>&1
yum -y install epel-release >/dev/null 2>&1
yum clean all >/dev/null 2>&1
yum makecache >/dev/null 2>&1
sleep 1
}
#Install Init Packages
initTools(){
echo "#####安装系统补装工具(选择最小化安装minimal)#####"
ping -c 2 mirrors.aliyun.com
sleep 2
yum install tree nmap sysstat lrzsz dos2unix ipvsadm conntrack-tools libseccomp libtool-ltdl -y
sleep 2
rpm -qa tree nmap sysstat lrzsz dos2unix
sleep 2
action "安装系统补装工具(选择最小化安装minimal)" /bin/true
echo "================================================="
echo ""
sleep 2
}
#Install man chinese Packages
installManChinese(){
echo "###安装中文语言包###"
yum install man-pages-zh-CN.noarch -y >/dev/null 2>&1
[ $? -eq 0 ]&&action $"安装中文语言包:" /bin/true||action $"Install man chinese Packages:" /bin/false
sleep 1
}
#Set Charset CN_UTF8
initCN_UTF8(){
echo "####设置utf8 LANG="zh_CN.UTF-8"####"
\cp /etc/locale.conf /etc/locale.conf.$(date +%F)
sed -i 's#LANG="en_US.UTF-8"#LANG="zh_CN.UTF-8"#' /etc/locale.conf
source /etc/locale.conf
[ `grep zh_CN.UTF-8 /etc/locale.conf|wc -l` -eq 1 ]&&action $"设置utf8 Set Charset CN_UTF8:" /bin/true||action $"Set Charset CN_UTF8:" /bin/false
sleep 1
}
#Close Selinux and Iptables
initFirewall(){
echo "####关闭selinux和防火墙####"
\cp /etc/selinux/config /etc/selinux/config.`date +"%Y-%m-%d_%H:%M:%S"`
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
setenforce 0
systemctl stop firewalld.service
systemctl disable firewalld.service
systemctl stop iptables.service
systemctl status iptables.service
grep SELINUX=disabled /etc/selinux/config
echo "关闭selinux和防火墙完成!!!"
sleep 1
}
#Init Auto Startup Service
initService(){
echo "===============精简开机自启动===================="
export LANG="en_US.UTF-8"
for A in `chkconfig --list |grep 3:on |awk '{print $1}' `;do chkconfig $A off;done
for B in rsyslog network sshd crond;do chkconfig $B on;done
echo '+--------which services on---------+'
chkconfig --list |grep 3:on
echo '+----------------------------------+'
export LANG="zh_CN.UTF-8"
echo "精简开机自启动完成"
echo "================================================="
echo ""
sleep 2
}
#setting history and login timeout
initHistory(){
echo "======设置默认历史记录数和连接超时时间======"
echo "TMOUT=300" >>/etc/profile
echo "HISTSIZE=5" >>/etc/profile
echo "HISTFILESIZE=5" >>/etc/profile
tail -3 /etc/profile
source /etc/profile
action "设置默认历史记录数和连接超时时间" /bin/true
echo "================================================="
echo ""
sleep 2
}
initSsh(){
echo "####初始化sshConfig配置####"
\cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%F%T)
sed -i 's%#Port 22%Port 51020%' /etc/ssh/sshd_config
sed -i 's%#PermitRootLogin yes%PermitRootLogin no%' /etc/ssh/sshd_config
sed -i 's%#PermitEmptyPasswords no%PermitEmptyPasswords no%' /etc/ssh/sshd_config
sed -i 's%#UseDNS yes%UseDNS no%' /etc/ssh/sshd_config
sed -i 's/^GSSAPIAuthentication yes$/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
egrep "UseDNS|1020|^PermitRootLogin|^PermitEmptyPasswords" /etc/ssh/sshd_config
systemctl restart sshd && action $"--sshConfig--" /bin/true||action $"--sshConfig--" /bin/false
sleep 1
}
#add user and give sudoers
addSAUser(){
echo "===================新建用户======================"
#add user
while true
do
read -p "请输入新用户名:" name
NAME=`awk -F':' '{print $1}' /etc/passwd|grep -wx $name 2>/dev/null|wc -l`
if [ ${#name} -eq 0 ];then
echo "用户名不能为空，请重新输入。"
continue
elif [ $NAME -eq 1 ];then
echo "用户名已存在，请重新输入。"
continue
fi
useradd $name
break
done
#create password
while true
do
read -p "为 $name 创建一个密码:" pass1
if [ ${#pass1} -eq 0 ];then
echo "密码不能为空，请重新输入。"
continue
fi
read -p "请再次输入密码:" pass2
if [ "$pass1" != "$pass2" ];then
echo "两次密码输入不相同，请重新输入。"
continue
fi
echo "$pass2" |passwd --stdin $name
break
done
sleep 1
#add visudo
echo "#####add visudo#####"
\cp /etc/sudoers /etc/sudoers.$(date +%F)
SUDO=`grep -w "$name" /etc/sudoers |wc -l`
if [ $SUDO -eq 0 ];then
echo "$name ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
echo '#tail -1 /etc/sudoers'
grep -w "$name" /etc/sudoers
sleep 1
fi
action "创建用户$name并将其加入visudo完成" /bin/true
echo "================================================="
echo ""
sleep 2
}
syncSystemTime(){
echo "####同步系统时间####"
if [ `grep /usr/sbin/ntpdate /var/spool/cron/root |grep -v grep |wc -l` -lt 1 ]; then
echo "*/5 * * * * /sbin/ntpdate cn.pool.ntp.org >/dev/null 2>&1" >> /var/spool/cron/root
fi
}
openFiles(){
echo "####设置打开文件数限制####"
\cp /etc/security/limits.conf /etc/security/limits.conf.$(date +%F_%T)
if [ `grep -P "\*\t\t-\tnofile\t\t65535" /etc/security/limits.conf|wc -l` -lt 1 ]; then
sed -i '/# End of file/i\*\t\t-\tnofile\t\t65535' /etc/security/limits.conf
ulimit -HSn 65535
fi
echo "set maxnum openfiles successful"
sleep 1
}
#chattr file system
initChattr(){
echo "======锁定关键文件系统======"
chattr +i /etc/passwd
chattr +i /etc/inittab
chattr +i /etc/group
chattr +i /etc/shadow
chattr +i /etc/gshadow
/bin/mv /usr/bin/chattr /usr/bin/lock
action "锁定关键文件系统" /bin/true
echo "================================================="
echo ""
sleep 2
}
#OPT system kernel
optimizationKernel(){
echo "####优化系统内核####"
\cp /etc/sysctl.conf /etc/sysctl.conf.$(date +%F_%T)
if [ `grep "net.ipv4.ip_local_port_range = 1024 65535" /etc/sysctl.conf |wc -l` -lt 1 ]; then
cat >>/etc/sysctl.conf <<EOF
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_max_orphans = 3276800
net.core.wmem_default = 8288608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.netdev_max_backlog = 32768
net.core.somaxconn = 32768
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
#net.ipv4.tcp_tw_recycle = 1 #新版本内核不需要
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.ip_local_port_range = 10240 65000
#关于k8s
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables =1
net.bridge.bridge-nf-call-iptables =1
EOF
fi
modprobe bridge
echo "modprobe bridge" >> /etc/rc.local
#k8s需要开启
modprobe br_netfilter
modprobe ip_vs
modprobe ip_vs_rr
modprobe ip_vs_wrr
modprobe ip_vs_sh
modprobe nf_conntrack_ipv4
echo "modprobe br_netfilter" >> /etc/rc.local
echo "modprobe ip_vs" >> /etc/rc.local
echo "modprobe ip_vs_rr" >> /etc/rc.local
echo "modprobe ip_vs_wrr" >> /etc/rc.local
echo "modprobe ip_vs_sh" >> /etc/rc.local
echo "modprobe nf_conntrack_ipv4" >> /etc/rc.local
sysctl -p >/dev/null 2>&1
/sbin/sysctl -p && action $"Kernel OPT:" /bin/true ||action $"Kernel OPT:" /bin/false
sleep 1
}
init_safe(){
echo "####阻止ctrl+alt+del reboot system####"
\rm -f /usr/lib/systemd/system/ctrl-alt-del.target
/sbin/init q
[ $? -eq 0 ]&&action $"forbid ctrl+alt+del reboot system:" /bin/true||action $"forbid ctrl+alt+del reboot system" /bin/false
sleep 1
}
init_rc_local(){
echo "#####添加--to /etc/rc.local execute permissions---####"
chmod +x /etc/rc.d/rc.local
[ $? -eq 0 ]&&action $"to /etc/rc.local execute permissions:" /bin/true||action $"to /etc/rc.local execute permissions:" /bin/false
sleep 1
}
disableIPV6(){
echo "####禁止--forbid use IPV6--使用"
\cp /etc/sysctl.conf /etc/sysctl.conf.$(date +%F_%T)
cat >>/etc/sysctl.conf <<EOF
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
EOF
[ $? -eq 0 ]&&action $"forbid use IPV6:" /bin/true||action $"forbid use IPV6:" /bin/false
sysctl -p
sleep 1
}
disableSwap(){
echo "####关闭交换分区####"
swapoff -a
sed -ri '/^[^#]*swap/s@^@#@' /etc/fstab
}
cat <<EOF
----------------------------------------
|****Please Enter Your Choice:[0-100]****|
----------------------------------------
(1) 指定YUM源
(2) 初始化安装包
(3) 安装中文字符包
(4) 修改字符设置
(5) 关闭防火墙和禁用selinux
(6) 精简开机启动选项
(7) 修改历史保留记录
(8) 修改ssh设置
(9) 添加SA用户
(10) 添加时间同步
(11) 加大文件描述符
(12) 锁定文件系统
(13) 优化内核
(14) 防止误操作
(15) 添加rc.local执行权限
(16) 禁止IPV6
(17) 关闭交换分区
(100) 安装所有
EOF
read -p "Please enter your Choice[0-15]: " option
echo -e "\nyour choose is: $option\n"
echo "after 5s start install......"
sleep 5
case $option in
0)
clear
break
;;
1)
ConfigYum
;;
2)
initTools
;;
3)
installManChinese
;;
4)
initCN_UTF8
;;
5)
initFirewall
;;
6)
initService
;;
7)
initHistory
;;
8)
initSsh
;;
9)
addSAUser
;;
10)
syncSystemTime
;;
11)
openFiles
;;
12)
initChattr
;;
13)
optimizationKernel
;;
14)
init_safe
;;
15)
init_rc_local
;;
16)
disableIPV6
;;
17)
disableSwap
;;
100)
ConfigYum
initTools
installManChinese
initCN_UTF8
initFirewall
initService
initHistory
initSsh
addSAUser
syncSystemTime
openFiles
initChattr
optimizationKernel
init_safe
init_rc_local
disableIPV6
disableSwap
;;
Q|q)
exit
;;
*)
echo "Please input 1-100,thank you!"
exit 1
;;
esac
centos8 系统一键初始化
精选 原创
©著作权归作者所有：来自51CTO博客作者luoguo的原创作品，请联系作者获取转载授权，否则将追究法律责任
提问和评论都可以，用心的回复会被更多人看到
评论
发布评论
相关文章
-
centos7安装mysql8
centos7安装mysql8全过程
mysql Server MySQL -
centos8 修改 repo centos8 修改默认内核
因为配置了一台新电脑，用来做kvm服务器，本想着通过GPU Passthrough，利用上 GTX1060（6G）显卡来用于虚拟机的显卡，但是我的显卡是和CPU在一个总线上，分为了1个组，无法完成。 各种搜教程，看到高版本的内核可以支持直接映射，但是是4.7以上的kernel才行，所以为 centos8编译了最新的稳定版内核。1.最新版内核的下载、编译如何编译内核，有比较
centos8 修改 repo linux核心编译 启动内核顺序调整 CentOS8 RHEL8 编译系统内核 -
centos8 设置默认路由 centos 修改路由
Centos给网卡设置DNS 修改完配置文件会立即生效，这个时候可以测试一下连接，如果还不行可以在网卡配置文件中指定dns服务器
centos8 设置默认路由 运维 网络 操作系统 IP -
android根目录创建目录
一、settings.gradle结构分析项目根目录下的settings.gradle配置文件示例：pluginManagement { /** * The pluginManagement.repositories block configures the * repositories Gradle uses to search or download the Gr
android根目录创建目录 android settings.gradle build.gradle 结构分析 -
html5 排班系统
第12章 CSS3+HTML5网页排版【学习重点】正确使用HTML5结构标签正确使用HTML5语义元素能够设计符合标准的网页结构12.1 使用结构标签在制作网页时，不仅需要使用<div>标签来构建网页，还要使用下面几类标签完善网页结构：<h1>、<h2>、<h3>、<h4>、<h5>、<
html5 排班系统 javascript 人工智能 ViewUI HTML5
