系统是centos7.2,安装完成的基本操作
3.10.0-327.18.2.el7.x86_64
1 修改网卡为eth0
2 更新系统
3 给/etc/rc.local添加执行权限
4 添加用户hequan
5 禁用selinux
6 关闭防火墙安装iptables
7 修改主机名
8 查看并管理服务
9 设置字符集
10 yum
11 配置sshd
12 加大打开文件数的限制（open files）
13 优化内核
14 时间设置
15 man 中文版
16 vim基本设置
1 修改网卡为eth0
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
cd /etc/sysconfig/network-scripts/vim ifcfg-eno16777729TYPE=EthernetBOOTPROTO=staticIPADDR=192.168.1.201NETMASK=255.255.255.0GATEWAY=192.168.1.1DEFROUTE=yesPEERDNS=yesPEERROUTES=yesIPV4_FAILURE_FATAL=noNAME=eth0UUID=efd17b9a-a5ab-4c94-be62-d2c32eb48a7eDEVICE=eth0ONBOOT=yesDNS1=202.106.0.20 |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
mv ifcfg-eno16777729 ifcfg-eth0vi /etc/sysconfig/grubGRUB_TIMEOUT=5GRUB_DISTRIBUTOR="$(sed ‘s, release .*$,,g‘ /etc/system-release)"GRUB_DEFAULT=savedGRUB_DISABLE_SUBMENU=trueGRUB_TERMINAL_OUTPUT="console"GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0 rhgb quiet" #添加 net.ifnames=0 biosdevname=0GRUB_DISABLE_RECOVERY="true"grub2-mkconfig -o /boot/grub2/grub.cfg #生成启动菜单Generating grub configuration file ...Found linux image: /boot/vmlinuz-3.10.0-327.el7.x86_64Found initrd image: /boot/initramfs-3.10.0-327.el7.x86_64.imgFound linux image: /boot/vmlinuz-0-rescue-e8675ae79abd41309dac42388f8d9116Found initrd image: /boot/initramfs-0-rescue-e8675ae79abd41309dac42388f8d9116.imgrebootip addr 或者yum install net-tools #默认centos7不支持ifconfig 需要看装net-tools包ifconfig eth0 #再次查看网卡信息 |
2 更新系统
|
1
|
yum update -y |
3 给/etc/rc.local添加执行权限
|
1
2
3
4
5
|
[root@bogon ~]# ll /etc/rc.locallrwxrwxrwx. 1 root root 13 Feb 6 07:28 /etc/rc.local -> rc.d/rc.local[root@bogon ~]# ll /etc/rc.d/rc.local-rw-r--r--. 1 root root 473 May 12 2016 /etc/rc.d/rc.local[root@bogon ~]# chmod +x /etc/rc.d/rc.local |
4 添加用户hequan
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
[root@bogon ~]# useradd hequan[root@bogon ~]# echo 123456 | passwd --stdin hequanChanging password for user hequan.passwd: all authentication tokens updated successfully.[root@bogon ~]# usermod -G wheel hequan[root@bogon ~]# sed -i ‘6s/^#//g‘ /etc/pam.d/su[root@bogon ~]# grep wheel /etc/pam.d/su #只有WHEEL组的可以su# Uncomment the following line to implicitly trust users in the "wheel" group.#auth sufficient pam_wheel.so trust use_uid# Uncomment the following line to require a user to be in the "wheel" group.auth required pam_wheel.so use_uid 扩展:为用户hequan添加sudo，除关机外的其他所有操作：[root@www ~]# visudoCmnd_Alias SHUTDOWN = /sbin/halt, /sbin/shutdown, /sbin/poweroff, /sbin/reboot, /sbin/inithequan ALL=(ALL) ALL,!SHUTDOWN%wheel ALL=(ALL) ALL,!SHUTDOWN #修改wheel组的权限，禁止关机Defaults logfile=/var/log/sudo.log |
5 禁用selinux
|
1
2
3
4
5
6
7
8
9
10
|
[root@bogon ~]# grep -i ^selinux /etc/selinux/configSELINUX=enforcingSELINUXTYPE=targeted[root@bogon ~]# sed -i ‘/^SELINUX/s/enforcing/disabled/g‘ /etc/selinux/config[root@bogon ~]# grep -i ^selinux /etc/selinux/configSELINUX=disabledSELINUXTYPE=targeted[root@bogon ~]# getenforceEnforcing[root@bogon ~]# reboot |
6 关闭防火墙安装iptables
|
1
2
3
|
systemctl stop firewalld.service systemctl disable firewalld.serviceyum install iptables-services -y #安装 |
7修改主机名
|
1
2
3
|
[root@bogon ~]# hostnamectl set-hostname hequan.com[root@bogon ~]# hostnamehequan.com |
8 查看并管理服务
|
1
2
3
4
|
[root@hequan ~]# systemctl -t service[root@hequan ~]# systemctl list-unit-files -t serviceyum install -y bash-completion #补全服务名称，退出bash再进就可以 |
9 设置字符集
|
1
2
3
4
5
|
[root@hequan ~]# echo $LANGzh_CN.UTF-8[root@hequan ~]# vi /etc/locale.confLANG="en_US.UTF-8"[root@hequan ~]# source /etc/locale.conf |
10 yum
|
1
|
yum install gcc cmake bzip2-devel curl-devel db4-devel libjpeg-devel libpng-devel freetype-devel libXpm-devel gmp-devel libc-client-devel openldap-devel unixODBC-devel postgresql-devel sqlite-devel aspell-devel net-snmp-devel libxslt-devel libxml2-devel pcre-devel mysql-devel pspell-devel libmemcached libmemcached-devel zlib-devel vim wget lrzsz tree |
|
1
2
3
4
5
6
|
安装163源mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backupcd /etc/yum.repos.d/wget http://mirrors.163.com/.help/CentOS7-Base-163.repoyum clean allyum makecache |
其他
|
1
2
3
4
5
6
7
8
9
|
yum -y install yum-plugin-priorities ##安装优先级插件sed -i -e "s/\]$/\]\npriority=1/g" /etc/yum.repos.d/CentOS-Base.repo ##设置基本yum源的优先级为1yum -y install epel-release ##安装epel源sed -i -e "s/\]$/\]\npriority=5/g" /etc/yum.repos.d/epel.repo ##设置优先级为5sed -i -e "s/enabled=1/enabled=0/g" /etc/yum.repos.d/epel.repo ##禁用epel源yum -y install http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm ##安装rpmforge的源sed -i -e "s/\]$/\]\npriority=10/g" /etc/yum.repos.d/rpmforge.repo ##设置优先级为10sed -i -e "s/enabled = 1/enabled = 0/g" /etc/yum.repos.d/rpmforge.repo ##禁用yum源使用方法：yum --enablerepo=rpmforge install [Package] |
11 配置sshd
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
sed -i -e ‘49s/^#//g‘ /etc/ssh/sshd_config ##启用49行配置sed -i -e ‘49s/yes/no/g‘ /etc/ssh/sshd_config ##禁止root使用ssh登录sed -i -e ‘129s/#/ /g‘ /etc/ssh/sshd_config ##禁止UseDNS sed -i -e ‘129s/yes$/no/g‘ /etc/ssh/sshd_configsed -i ‘/^GSS/s/yes/no/g‘ /etc/ssh/sshd_config ##禁用GSSAPI认证加快登录速度 systemctl restart sshd ##重新启动服务systemctl enable sshd ##设置为开机启动systemctl status sshd ##查看状态● sshd.service - OpenSSH server daemon Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled) Active: active (running) since 一 2016-06-06 00:16:26 CST; 1min 3s ago |
12 加大打开文件数的限制（open files）
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
ulimit -nulimit -avi /etc/security/limits.conf最后添加* soft nofile 1024000* hard nofile 1024000hive - nofile 1024000hive - nproc 1024000用户进程限制[root@hequan ~]# sed -i ‘s#4096#65535#g‘ /etc/security/limits.d/20-nproc.conf #加大普通用户限制 也可以改为unlimited[root@hequan ~]# egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf * soft nproc 65535root soft nproc unlimitedreboot |
13 优化内核
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
cat /etc/sysctl.conf#CTCDN系统优化参数#关闭ipv6net.ipv6.conf.all.disable_ipv6 = 1net.ipv6.conf.default.disable_ipv6 = 1#决定检查过期多久邻居条目net.ipv4.neigh.default.gc_stale_time=120#使用arp_announce / arp_ignore解决ARP映射问题net.ipv4.conf.default.arp_announce = 2net.ipv4.conf.all.arp_announce=2net.ipv4.conf.lo.arp_announce=2# 避免放大攻击net.ipv4.icmp_echo_ignore_broadcasts = 1# 开启恶意icmp错误消息保护net.ipv4.icmp_ignore_bogus_error_responses = 1#关闭路由转发net.ipv4.ip_forward = 0net.ipv4.conf.all.send_redirects = 0net.ipv4.conf.default.send_redirects = 0#开启反向路径过滤net.ipv4.conf.all.rp_filter = 1net.ipv4.conf.default.rp_filter = 1#处理无源路由的包net.ipv4.conf.all.accept_source_route = 0net.ipv4.conf.default.accept_source_route = 0#关闭sysrq功能kernel.sysrq = 0#core文件名中添加pid作为扩展名kernel.core_uses_pid = 1# 开启SYN洪水攻击保护net.ipv4.tcp_syncookies = 1#修改消息队列长度kernel.msgmnb = 65536kernel.msgmax = 65536#设置最大内存共享段大小byteskernel.shmmax = 68719476736kernel.shmall = 4294967296#timewait的数量，默认180000net.ipv4.tcp_max_tw_buckets = 6000net.ipv4.tcp_sack = 1net.ipv4.tcp_window_scaling = 1net.ipv4.tcp_rmem = 4096 87380 4194304net.ipv4.tcp_wmem = 4096 16384 4194304net.core.wmem_default = 8388608net.core.rmem_default = 8388608net.core.rmem_max = 16777216net.core.wmem_max = 16777216#每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目net.core.netdev_max_backlog = 262144#限制仅仅是为了防止简单的DoS 攻击net.ipv4.tcp_max_orphans = 3276800#未收到客户端确认信息的连接请求的最大值net.ipv4.tcp_max_syn_backlog = 262144net.ipv4.tcp_timestamps = 0#内核放弃建立连接之前发送SYNACK 包的数量net.ipv4.tcp_synack_retries = 1#内核放弃建立连接之前发送SYN 包的数量net.ipv4.tcp_syn_retries = 1#启用timewait 快速回收net.ipv4.tcp_tw_recycle = 1#开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_mem = 94500000 915000000 927000000net.ipv4.tcp_fin_timeout = 1#当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时net.ipv4.tcp_keepalive_time = 1800net.ipv4.tcp_keepalive_probes = 3net.ipv4.tcp_keepalive_intvl = 15#允许系统打开的端口范围net.ipv4.ip_local_port_range = 1024 65000#修改防火墙表大小，默认65536net.netfilter.nf_conntrack_max=655350net.netfilter.nf_conntrack_tcp_timeout_established=1200# 确保无人能修改路由表net.ipv4.conf.all.accept_redirects = 0net.ipv4.conf.default.accept_redirects = 0net.ipv4.conf.all.secure_redirects = 0net.ipv4.conf.default.secure_redirects = 0sysctl -p #生效 |
14 时间设置
|
1
2
|
ntpdate time.nist.govhwclock -w #先同步一遍时间到硬件时间 |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
yum install chronyvi /etc/chrony.confserver 0.centos.pool.ntp.orgserver 3.europe.pool.ntp.orgsystemctl enable chronyd.servicesystemctl start chronyd.servicetimedatectl set-timezone Asia/Shanghaitimedatectl set-time "2015-01-21 11:50:00"（可以只修改其中一个）修改日期时间timedatectl 查看时间状态chronyc sources -v 查看时间同步源chronyc sourcestats -v |
15 man中文版
|
1
2
3
|
yum install man-pages-zh-CN.noarch -yman cp #测试, 想再换成中文版，yum卸载就行了 |
16 vim基本设置
|
1
|
vim /root/.vimrc |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
set history=1000autocmd InsertLeave * se culautocmd InsertLeave * se noculset nuset bs=2syntax onset laststatus=2set tabstop=4set go=set rulerset showcmdset cmdheight=1hi CursorLine cterm=NONE ctermbg=blue ctermfg=white guibg=blue guifg=whiteset hlsset cursorlineset ignorecaseset hlsearchset incsearchset helplang=cninoremap ( ()<ESC>i inoremap [ []<ESC>iinoremap { {}<ESC>iinoremap < <><ESC>iinoremap " ""<ESC>iinoremap ‘ ‘‘<ESC>i |
原文：http://www.cnblogs.com/nulige/p/6871985.html