作为运维人员,经常会初始化系统,系统在安装过程中基本都会选择最小化安装,这样安装好的系统里会缺少很多环境。
下面分享一个系统安装后的初始化脚本:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
#!/bin/bash #系统时最小化安装的,这里要安装系统的软件库 yum groupinstall -y "development tools"
#创建目录 [ ! -d /server/tools ] && mkdir -p /server/tools
[ ! -d /application ] && mkdir -p /application
[ ! -d /data ] && mkdir -p /data
[ ! -d /app/logs ] && mkdir -p /app/logs
[ ! -d /server/backup ] && mkdir -p /server/backup
[ ! -d /delete ] && mkdir -p /delete
#每周六凌晨1点0分更新服务器系统时间 echo "############### auto update time ###############" >> /var/spool/cron/root
echo "00 01 * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1" >> /var/spool/cron/root
[ ` grep ntpdate /var/spool/cron/root | wc -l` - ne 0 ] && action "uptime set" /bin/true || action "uptime set" /bin/false
#配置yum源 wget -P /etc/yum .repos.d/ http: //mirrors .163.com/.help /CentOS6-Base-163 .repo #下载配置文件
/bin/mv /etc/yum .repos.d /CentOS-Base .repo /etc/yum .repos.d /CentOS-Base .repo.bak
/bin/cp /etc/yum .repos.d /CentOS6-Base-163 .repo /etc/yum .repos.d /CentOS-Base .repo
[ ` grep 163.com /etc/yum .repos.d /CentOS-Base .repo | wc -l` - ne 0 ] && action "yum set" /bin/true || action "yum set" /bin/false
#关闭SELINUX及iptables /bin/cp /etc/selinux/config /etc/selinux/config .bak
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config 2>&1
/etc/init .d /iptables stop > /dev/null
chkconfig iptables off > /dev/null
[ `chkconfig --list | grep iptables| grep 3:on| wc -l` - eq 0 -a ` grep "SELINUX=enforcing" /etc/selinux/config | wc -l` - eq 0 ] && action "iptables and selinux close" /bin/true || action "iptables and selinux close" /bin/false
#调整文件描述符数量 /bin/cp /etc/security/limits .conf /etc/security/limits .conf.bak
echo '* - nofile 65535' >> /etc/security/limits .conf
[ ` tail -1 /etc/security/limits .conf| grep 65535| wc -l` - eq 1 ] && action "limit set" /bin/true || action "limit set" /bin/false
#更改字符集 /bin/cp /etc/sysconfig/i18n /etc/sysconfig/i18n .bak
echo 'LANG="en_US.UTF-8"' > /etc/sysconfig/i18n
#定时清理/var/spool/clientmqueue/目录下的垃圾文件,防止inodes节点被占满 ##创建脚本目录 [ ! -d /server/scripts ] && mkdir -p /server/scripts
if [ `rpm -qa sendmail | wc -l` - ne 0 ]; then
##创建查找删除脚本 echo > /server/scripts/del .sh<<EOF
#!/bin/bash find /var/spool/clientmqueue/ - type f| xargs rm -f > /dev/null 2>&1
EOF ##添加到定时任务,每周一凌晨0点0分执行 echo '################ clean /var/spool/clientmqueue/ ################' >> /var/spool/cron/root
echo '00 00 * * 1 /bin/sh /server/scripts/del.sh >/dev/null 2>&1' >> /var/spool/cron/root
[ "$?" - eq 0 ] && action "clean /var/spool/clientmqueue/ set" /bin/true || action "clean /var/spool/clientmqueue/ set" /bin/false
else action "service sendmail is not installed,do not need set" /bin/false
fi #精简开机自启动服务(只启动crond,sshd,network,syslog) ##筛选出所有在运行级别3自启动的服务并关闭自启动 for cgt in `chkconfig --list | grep 3:on | awk '{print $1}' `; do chkconfig --level 3 $cgt off; done
##仅设置crond,sshd,network,syslog自启动 for cgt in {crond,sshd,network,rsyslog}; do chkconfig --level 3 $cgt on; done
flag=0 [ `chkconfig --list| grep 3:on| wc -l` - eq 4 ] && action "auto_start services set" /bin/true || action "auto_start services set" /bin/false
#内核参数优化 [ -f /etc/sysctl .conf.bak ] && /bin/cp /etc/sysctl .conf.bak /etc/sysctl .conf.bak.$( date +%F-%H%M%S) || /bin/cp /etc/sysctl .conf /etc/sysctl .conf.bak
cat >> /etc/sysctl .conf <<EOF
net.ipv4.tcp_fin_timeout = 2 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_keepalive_time = 600 net.ipv4.ip_local_port_range = 4000 65000 net.ipv4.tcp_max_syn_backlog = 16384 net.ipv4.tcp_max_tw_buckets = 36000 net.ipv4.route.gc_timeout = 100 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_synack_retries = 1 net.core.somaxconn = 16384 net.core.netdev_max_backlog = 16384 net.ipv4.tcp_max_orphans = 16384 #以下参数是对iptables防火墙的优化,防火墙不开会提示,可以忽略不理。 #net.ipv4.ip_conntrack_max = 25000000 #net.ipv4.netfilter.ip_conntrack_max=25000000 #net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180 #net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait=120 #net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=60 #net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait=120 #net.netfilter.nf_conntrack_max = 25000000 #net.netfilter.nf_conntrack_tcp_timeout_established = 180 #net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 #net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 #net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120' EOF sysctl -p > /dev/null 2>&1
[ ` grep "net.ipv4.tcp_max_orphans = 16384" /etc/sysctl .conf| wc -l` - ne 0 ] && action "kernel set" /bin/true || action "kernel set" /bin/false
#更改默认的ssh服务端口,禁止root用户远程连接,禁止空密码连接 /bin/cp /etc/ssh/sshd_config /etc/ssh/sshd_config .bak
#sed -i 's/\#Port 22/Port 52113/' /etc/ssh/sshd_config sed -i 's/\#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/\#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sed -i 's/\#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
#[ `grep "Port 52113" /etc/ssh/sshd_config |wc -l` -ne 0 -a `grep "PermitRootLogin no" /etc/ssh/sshd_config|wc -l` -ne 0 -a `grep "PermitEmptyPasswords no" /etc/ssh/sshd_config|wc -l` -ne 0 -a `grep "UseDNS no" /etc/ssh/sshd_config|wc -l` -ne 0 ] &&action "ssh set" /bin/true || action "ssh set" /bin/false [ ` grep "PermitRootLogin no" /etc/ssh/sshd_config | wc -l` - ne 0 -a ` grep "PermitEmptyPasswords no" /etc/ssh/sshd_config | wc -l` - ne 0 -a ` grep "UseDNS no" /etc/ssh/sshd_config | wc -l` - ne 0 ] &&action "ssh set" /bin/true || action "ssh set" /bin/false
#锁定关键系统文件 chattr +ai /etc/passwd
chattr +ai /etc/shadow
chattr +ai /etc/group
chattr +ai /etc/gshadow
chattr +ai /etc/inittab
#清空/etc/issue,去除系统及内核版本登陆前的屏幕显示 /bin/cp /etc/issue /etc/issue .bak
> /etc/issue
[ ` cat /etc/issue | wc -l` - eq 0 ] && action "/etc/issue set" /bin/true || action "/etc/issue set" /bin/false
|
自己整理的服务器安装后的初始化脚本:
下载:https://pan.baidu.com/s/1caZ3GE
提取密码:nifa