本文共 9673 字，大约阅读时间需要 32 分钟。
系统是centos7.2,安装完成的基本操作
3.10.0-327.18.2.el7.x86_64
1 修改网卡为eth0
2 更新系统
3 给/etc/rc.local添加执行权限
4 添加用户hequan
5 禁用selinux
6 关闭防火墙安装iptables
7 修改主机名
8 查看并管理服务
9 设置字符集
10 yum
11 配置sshd
12 加大打开文件数的限制（open files）
13 优化内核
14 时间设置
15 man 中文版
16 vim基本设置
1 修改网卡为eth0
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | cd /etc/sysconfig/network-scripts/ vim ifcfg-eno16777729 TYPE=Ethernet BOOTPROTO=static IPADDR=192.168.1.201 NETMASK=255.255.255.0 GATEWAY=192.168.1.1 DEFROUTE= yes PEERDNS= yes PEERROUTES= yes IPV4_FAILURE_FATAL=no NAME=eth0 UUID=efd17b9a-a5ab-4c94-be62-d2c32eb48a7e DEVICE=eth0 ONBOOT= yes DNS1=202.106.0.20 |
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | mv ifcfg-eno16777729 ifcfg-eth0 vi /etc/sysconfig/grub GRUB_TIMEOUT=5 GRUB_DISTRIBUTOR= "$(sed 's, release .*$,,g' /etc/system-release)" GRUB_DEFAULT=saved GRUB_DISABLE_SUBMENU= true GRUB_TERMINAL_OUTPUT= "console" GRUB_CMDLINE_LINUX= "net.ifnames=0 biosdevname=0 rhgb quiet" #添加 net.ifnames=0 biosdevname=0 GRUB_DISABLE_RECOVERY= "true" grub2-mkconfig -o /boot/grub2/grub .cfg #生成启动菜单 Generating grub configuration file ... Found linux image: /boot/vmlinuz-3 .10.0-327.el7.x86_64 Found initrd image: /boot/initramfs-3 .10.0-327.el7.x86_64.img Found linux image: /boot/vmlinuz-0-rescue-e8675ae79abd41309dac42388f8d9116 Found initrd image: /boot/initramfs-0-rescue-e8675ae79abd41309dac42388f8d9116 .img reboot ip addr 或者 yum install net-tools #默认centos7不支持ifconfig 需要看装net-tools包 ifconfig eth0 #再次查看网卡信息 |
2 更新系统
| 1 | yum update -y |
3 给/etc/rc.local添加执行权限
| 1 2 3 4 5 | [root@bogon ~] # ll /etc/rc.local lrwxrwxrwx. 1 root root 13 Feb 6 07:28 /etc/rc . local -> rc.d /rc . local [root@bogon ~] # ll /etc/rc.d/rc.local -rw-r--r--. 1 root root 473 May 12 2016 /etc/rc .d /rc . local [root@bogon ~] # chmod +x /etc/rc.d/rc.local |
4 添加用户hequan
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | [root@bogon ~] # useradd hequan [root@bogon ~] # echo 123456 | passwd --stdin hequan Changing password for user hequan. passwd : all authentication tokens updated successfully. [root@bogon ~] # usermod -G wheel hequan [root@bogon ~] # sed -i '6s/^#//g' /etc/pam.d/su [root@bogon ~] # grep wheel /etc/pam.d/su #只有WHEEL组的可以su # Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid # Uncomment the following line to require a user to be in the "wheel" group. auth required pam_wheel.so use_uid 扩展:为用户hequan添加 sudo ，除关机外的其他所有操作： [root@www ~] # visudo Cmnd_Alias SHUTDOWN = /sbin/halt , /sbin/shutdown , /sbin/poweroff , /sbin/reboot , /sbin/init hequan ALL=(ALL) ALL,!SHUTDOWN %wheel ALL=(ALL) ALL,!SHUTDOWN #修改wheel组的权限，禁止关机 Defaults logfile= /var/log/sudo .log |
5 禁用selinux
| 1 2 3 4 5 6 7 8 9 10 | [root@bogon ~] # grep -i ^selinux /etc/selinux/config SELINUX=enforcing SELINUXTYPE=targeted [root@bogon ~] # sed -i '/^SELINUX/s/enforcing/disabled/g' /etc/selinux/config [root@bogon ~] # grep -i ^selinux /etc/selinux/config SELINUX=disabled SELINUXTYPE=targeted [root@bogon ~] # getenforce Enforcing [root@bogon ~] # reboot |
6 关闭防火墙安装iptables
| 1 2 3 | systemctl stop firewalld.service systemctl disable firewalld.service yum install iptables-services -y #安装 |
7修改主机名
| 1 2 3 | [root@bogon ~] # hostnamectl set-hostname hequan.com [root@bogon ~] # hostname hequan.com |
8 查看并管理服务
| 1 2 3 4 | [root@hequan ~] # systemctl -t service [root@hequan ~] # systemctl list-unit-files -t service yum install -y bash -completion #补全服务名称，退出bash再进就可以 |
9 设置字符集
| 1 2 3 4 5 | [root@hequan ~] # echo $LANG zh_CN.UTF-8 [root@hequan ~] # vi /etc/locale.conf LANG= "en_US.UTF-8" [root@hequan ~] # source /etc/locale.conf |
10 yum
| 1 | yum install gcc cmake bzip2 -devel curl-devel db4-devel libjpeg-devel libpng-devel freetype-devel libXpm-devel gmp-devel libc-client-devel openldap-devel unixODBC-devel postgresql-devel sqlite-devel aspell-devel net-snmp-devel libxslt-devel libxml2-devel pcre-devel mysql-devel pspell-devel libmemcached libmemcached-devel zlib-devel vim wget lrzsz tree |
| 1 2 3 4 5 6 | 安装163源 mv /etc/yum .repos.d /CentOS-Base .repo /etc/yum .repos.d /CentOS-Base .repo.backup cd /etc/yum .repos.d/ wget http: //mirrors .163.com/.help /CentOS7-Base-163 .repo yum clean all yum makecache |
其他
| 1 2 3 4 5 6 7 8 9 | yum -y install yum-plugin-priorities ##安装优先级插件 sed -i -e "s/\]$/\]\npriority=1/g" /etc/yum .repos.d /CentOS-Base .repo ##设置基本yum源的优先级为1 yum -y install epel-release ##安装epel源 sed -i -e "s/\]$/\]\npriority=5/g" /etc/yum .repos.d /epel .repo ##设置优先级为5 sed -i -e "s/enabled=1/enabled=0/g" /etc/yum .repos.d /epel .repo ##禁用epel源 yum -y install http: //pkgs .repoforge.org /rpmforge-release/rpmforge-release-0 .5.3-1.el7.rf.x86_64.rpm ##安装rpmforge的源 sed -i -e "s/\]$/\]\npriority=10/g" /etc/yum .repos.d /rpmforge .repo ##设置优先级为10 sed -i -e "s/enabled = 1/enabled = 0/g" /etc/yum .repos.d /rpmforge .repo ##禁用yum源 使用方法：yum --enablerepo=rpmforge install [Package] |
11 配置sshd
| 1 2 3 4 5 6 7 8 9 10 11 12 13 | sed -i -e '49s/^#//g' /etc/ssh/sshd_config ##启用49行配置 sed -i -e '49s/yes/no/g' /etc/ssh/sshd_config ##禁止root使用ssh登录 sed -i -e '129s/#/ /g' /etc/ssh/sshd_config ##禁止UseDNS sed -i -e '129s/yes$/no/g' /etc/ssh/sshd_config sed -i '/^GSS/s/yes/no/g' /etc/ssh/sshd_config ##禁用GSSAPI认证加快登录速度 systemctl restart sshd ##重新启动服务 systemctl enable sshd ##设置为开机启动 systemctl status sshd ##查看状态 ● sshd.service - OpenSSH server daemon Loaded: loaded ( /usr/lib/systemd/system/sshd .service; enabled; vendor preset: enabled) Active: active (running) since 一 2016-06-06 00:16:26 CST; 1min 3s ago |
12 加大打开文件数的限制（open files）
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | ulimit -n ulimit -a vi /etc/security/limits .conf 最后添加 * soft nofile 1024000 * hard nofile 1024000 hive - nofile 1024000 hive - nproc 1024000 用户进程限制 [root@hequan ~] # sed -i 's#4096#65535#g' /etc/security/limits.d/20-nproc.conf #加大普通用户限制 也可以改为unlimited [root@hequan ~] # egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf * soft nproc 65535 root soft nproc unlimited reboot |
13 优化内核
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 | cat /etc/sysctl .conf #CTCDN系统优化参数 #关闭ipv6 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 #决定检查过期多久邻居条目 net.ipv4.neigh.default.gc_stale_time=120 #使用arp_announce / arp_ignore解决ARP映射问题 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.conf.lo.arp_announce=2 # 避免放大攻击 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护 net.ipv4.icmp_ignore_bogus_error_responses = 1 #关闭路由转发 net.ipv4.ip_forward = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 #开启反向路径过滤 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 #处理无源路由的包 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 #关闭sysrq功能 kernel.sysrq = 0 #core文件名中添加pid作为扩展名 kernel.core_uses_pid = 1 # 开启SYN洪水攻击保护 net.ipv4.tcp_syncookies = 1 #修改消息队列长度 kernel.msgmnb = 65536 kernel.msgmax = 65536 #设置最大内存共享段大小bytes kernel.shmmax = 68719476736 kernel.shmall = 4294967296 #timewait的数量，默认180000 net.ipv4.tcp_max_tw_buckets = 6000 net.ipv4.tcp_sack = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_rmem = 4096 87380 4194304 net.ipv4.tcp_wmem = 4096 16384 4194304 net.core.wmem_default = 8388608 net.core.rmem_default = 8388608 net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 #每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目 net.core.netdev_max_backlog = 262144 #限制仅仅是为了防止简单的DoS 攻击 net.ipv4.tcp_max_orphans = 3276800 #未收到客户端确认信息的连接请求的最大值 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 #内核放弃建立连接之前发送SYNACK 包的数量 net.ipv4.tcp_synack_retries = 1 #内核放弃建立连接之前发送SYN 包的数量 net.ipv4.tcp_syn_retries = 1 #启用timewait 快速回收 net.ipv4.tcp_tw_recycle = 1 #开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 #当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时 net.ipv4.tcp_keepalive_time = 1800 net.ipv4.tcp_keepalive_probes = 3 net.ipv4.tcp_keepalive_intvl = 15 #允许系统打开的端口范围 net.ipv4.ip_local_port_range = 1024 65000 #修改防火墙表大小，默认65536 net.netfilter.nf_conntrack_max=655350 net.netfilter.nf_conntrack_tcp_timeout_established=1200 # 确保无人能修改路由表 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 本文出自 “兰芷” 博客，请务必保留此出处http: //7826443 .blog.51cto.com /7816443/1775248 sysctl -p #生效 |
14 时间设置
| 1 2 | ntpdate time .nist.gov hwclock -w #先同步一遍时间到硬件时间 |
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | yum install chrony vi /etc/chrony .conf server 0.centos.pool.ntp.org server 3.europe.pool.ntp.org systemctl enable chronyd.service systemctl start chronyd.service timedatectl set -timezone Asia /Shanghai timedatectl set - time "2015-01-21 11:50:00" （可以只修改其中一个）修改日期时间 timedatectl 查看时间状态 chronyc sources - v 查看时间同步源 chronyc sourcestats - v |
15 man中文版
| 1 2 3 | yum install man -pages-zh-CN.noarch -y man cp #测试, 想再换成中文版，yum卸载就行了 |
16 vim基本设置
| 1 | vim /root/ .vimrc |
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 | set history =1000 autocmd InsertLeave * se cul autocmd InsertLeave * se nocul set nu set bs=2 syntax on set laststatus=2 set tabstop=4 set go= set ruler set showcmd set cmdheight=1 hi CursorLine cterm=NONE ctermbg=blue ctermfg=white guibg=blue guifg=white set hls set cursorline set ignorecase set hlsearch set incsearch set helplang=cn inoremap ( ()<ESC>i inoremap [ []<ESC>i inoremap { {}<ESC>i inoremap < <><ESC>i inoremap " " "<ESC>i inoremap ' ' '<ESC>i |