后面繼續(xù)添加優(yōu)化
１．修改主機(jī)名
#方便標(biāo)識(shí)主機(jī)
hostnamectl set-hostname newname
２．Yum源更換為國(guó)內(nèi)阿里源
yum install wget telnet -y
?。v /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
#添加阿里的epel源
#add the epel
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
# rpm -ivh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm
3.安裝必要的軟件
yum -y install wget net-tools screen lsof tcpdump nc mtr openssl-devel vim bash-completion lrzsz nmap telnet tree ntpdate
4．禁用selinux
sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
setenforce 0
5.修改網(wǎng)卡eth0
?? 5.1修改網(wǎng)卡配置參數(shù)
NAME=eth0
DEVICE=eth0
5.2修改網(wǎng)卡配置文件名稱
cp /etc/sysconfig/network-scripts/ifcfg-ens3 /etc/sysconfig/network-scripts/ifcfg-eth0
5.3 禁用該可預(yù)測(cè)命名規(guī)則:net.ifnames=0??? biosdevname=0?
???????? # vim /etc/default/grub
?????????? GRUB_TIMEOUT=5
?????????? GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
?????????? GRUB_DEFAULT=saved
?????????? GRUB_DISABLE_SUBMENU=true
?????????? GRUB_TERMINAL_OUTPUT="console"
?????????? GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=centos/root net.ifnames=0??? biosdevname=0? rd.lvm.lv=centos/swap rhgb quiet"
??????????? GRUB_DISABLE_RECOVERY="true"
??????? #grub2-mkconfig -o /boot/grub2/grub.cfg
??????? #reboot
6. 最大進(jìn)程數(shù)和最大文件打開數(shù)
6.1 查看
[root@tomcatweb01 ~]# ulimit -u
3882 ＃最大文件打開數(shù)
[root@tomcatweb01 ~]# ulimit -n
1024?。Ｗ畲筮M(jìn)程數(shù)
6.2 修改 /etc/security/limits.conf
#vim /etc/security/limits.conf
* soft nofile 1024000
* hard nofile 1024000
* soft nproc? 1024000
* hard nproc? 1024000
說明：
? '*'? ? ? ? 代表針對(duì)所有用戶?
? noproc? ? 是代表最大進(jìn)程數(shù)?
? nofile? ? 是代表最大文件打開數(shù)
6.3 修改vim /etc/security/limits.d/20-nproc.conf
#vim /etc/security/limits.d/20-nproc.conf
? ? ? ? ? ? ? ??* soft nproc 1024000
??????????????? * hard nproc? 1024000
7.修改sshd默認(rèn)端口和禁止root遠(yuǎn)程登陸
1、首先修改ssh的默認(rèn)端口
# sed -i "s#\#Port 22#Port 23451#g" /etc/ssh/sshd_config
#端口可以改成任意端口，建議改成較大的端口，因?yàn)橐蝗f以內(nèi)的端口常用的服務(wù)有占用，防止沖突（需要注意的是：這個(gè)端口要記住，否則連接不上服務(wù)器）
2、禁止root用戶遠(yuǎn)程登陸 a）：添加一個(gè)普通用戶并設(shè)置密碼（注：這一步必須執(zhí)行，否則將造成遠(yuǎn)程連接不上服務(wù)器）
# useradd xxx #添加xxx用戶
# echo "pass" | passwd --stdin xxx
#給xxx用戶設(shè)置密碼為passb)：修改ssh服務(wù)配置文件并撐起服務(wù)
# sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
# systemctl restart sshd
3.防火墻開放端口
firewall-cmd?--permanent --add-port=23451/tcp?
firewall-cmd?--reload??
firewall-cmd?--permanent --query-port=23451/tcp?
4.利用其他客戶端口嘗試遠(yuǎn)程連接
8.優(yōu)化內(nèi)核參數(shù)??????
#關(guān)閉ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# 避免放大攻擊
#
net.ipv4.icmp_echo_ignore_broadcasts = 1
#
# # 開啟惡意icmp錯(cuò)誤消息保護(hù)
#
net.ipv4.icmp_ignore_bogus_error_responses = 1
#
# #關(guān)閉路由轉(zhuǎn)發(fā)
#
net.ipv4.ip_forward = 0
#
net.ipv4.conf.all.send_redirects = 0
#
net.ipv4.conf.default.send_redirects = 0
#
# #開啟反向路徑過濾
#
net.ipv4.conf.all.rp_filter = 1
#
net.ipv4.conf.default.rp_filter = 1
#
# #處理無源路由的包
#
net.ipv4.conf.all.accept_source_route = 0
#
net.ipv4.conf.default.accept_source_route = 0
#
# #關(guān)閉sysrq功能
#
kernel.sysrq = 0
#
# #core文件名中添加pid作為擴(kuò)展名
#
kernel.core_uses_pid = 1
#
# # 開啟SYN洪水攻擊保護(hù)
#
net.ipv4.tcp_syncookies = 1
#
# #修改消息隊(duì)列長(zhǎng)度
#
kernel.msgmnb = 65536
#
kernel.msgmax = 65536
#
# #設(shè)置最大內(nèi)存共享段大小bytes
#
kernel.shmmax = 68719476736
#
kernel.shmall = 4294967296
#
# #timewait的數(shù)量，默認(rèn)180000
#
net.ipv4.tcp_max_tw_buckets = 6000
#
net.ipv4.tcp_sack = 1
#
net.ipv4.tcp_window_scaling = 1
#
net.ipv4.tcp_rmem = 4096? ? ? ? 87380? 4194304
#
net.ipv4.tcp_wmem = 4096? ? ? ? 16384? 4194304
#
net.core.wmem_default = 8388608
#
net.core.rmem_default = 8388608
#
net.core.rmem_max = 16777216
#
net.core.wmem_max = 16777216
#
# #每個(gè)網(wǎng)絡(luò)接口接收數(shù)據(jù)包的速率比內(nèi)核處理這些包的速率快時(shí)，允許送到隊(duì)列的數(shù)據(jù)包的最大數(shù)目
#
net.core.netdev_max_backlog = 262144
#
# #限制僅僅是為了防止簡(jiǎn)單的DoS 攻擊
#
net.ipv4.tcp_max_orphans = 3276800
#
# #未收到客戶端確認(rèn)信息的連接請(qǐng)求的最大值
#
net.ipv4.tcp_max_syn_backlog = 262144
#
net.ipv4.tcp_timestamps = 0
#
# #內(nèi)核放棄建立連接之前發(fā)送SYNACK 包的數(shù)量
#
net.ipv4.tcp_synack_retries = 1
#
# #內(nèi)核放棄建立連接之前發(fā)送SYN 包的數(shù)量
#
net.ipv4.tcp_syn_retries = 1
#
# #啟用timewait 快速回收
#
net.ipv4.tcp_tw_recycle = 1
#
# #開啟重用。允許將TIME-WAIT sockets 重新用于新的TCP 連接
#
net.ipv4.tcp_tw_reuse = 1
#
net.ipv4.tcp_mem = 94500000 915000000 927000000
#
net.ipv4.tcp_fin_timeout = 1
#
# #當(dāng)keepalive 起用的時(shí)候，TCP 發(fā)送keepalive 消息的頻度。缺省是2 小時(shí)
#
net.ipv4.tcp_keepalive_time = 30
#
# #允許系統(tǒng)打開的端口范圍
#
net.ipv4.ip_local_port_range = 1024? ? 65000
#
# #修改防火墻表大小，默認(rèn)65536
#
net.netfilter.nf_conntrack_max=655350
#
net.netfilter.nf_conntrack_tcp_timeout_established=1200
#
# # 確保無人能修改路由表
#
net.ipv4.conf.all.accept_redirects = 0
#
net.ipv4.conf.default.accept_redirects = 0
#
net.ipv4.conf.all.secure_redirects = 0
#
net.ipv4.conf.default.secure_redirects = 0
執(zhí)行:sysctl -p生效
