安装linux系统后调优及安全设置

[root@master1 ~]# sed -i 's#SELINUX=enforcing#SELINUX=disabled#'  /etc/selinux/config

[root@master1 ~]# grep SELINUX=disabled /etc/selinux/config

SELINUX=disabled

#注意：修改配置文件以后需要重启

[root@master1 ~]# setenforce

usage:  setenforce [ Enforcing | Permissive | 1 | 0 ]

[root@master1 ~]# setenforce 0

setenforce: SELinux is disabled

[root@master1 ~]# getenforce

Disabled

#注意：如果系统不能重启，则选择临时关闭

[root@dsf ~]# runlevel

N 3

[root@dsf ~]# grep 3:initdefault /etc/inittab

id:3:initdefault:

[root@dsf ~]# init 5

[root@dsf ~]# runlevel

3 5

[root@dsf ~]# LANG=en

[root@dsf ~]# for i in `chkconfig --list|grep "3:on"|awk '{print $1}'|grep -vE "crond|network|sshd|rsyslog|systat|mysqld|nginx|tomcat|redis"`;do chkconfig $i off;done

或者

[root@dsf ~]# chkconfig --list|grep "3:on"|awk '{print $1}'|grep -vE "crond|network|sshd|rsyslog|systat|mysqld|nginx|tomcat|redis"|awk '{print "chkconfig " $1 " off"}'|bash

[root@dsf ~]# chkconfig --list|grep 3:on

crond                0:off      1:off      2:on       3:on       4:on       5:on       6:off

mysqld              0:off      1:off      2:on       3:on       4:on       5:on       6:off

network              0:off      1:off      2:on       3:on       4:on       5:on       6:off

nginx                0:off      1:off      2:on       3:on       4:on       5:on       6:off

redis          0:off      1:off      2:on       3:on       4:on       5:on       6:off

redis-server       0:off      1:off      2:on       3:on       4:on       5:on       6:off

rsyslog        0:off      1:off      2:on       3:on       4:on       5:on       6:off

sshd                 0:off      1:off      2:on       3:on       4:on       5:on       6:off

tomcat               0:off      1:off      2:on       3:on       4:on       5:on       6:off

#!/bin/bash

#Author:

#Time:2017-07-11 00:40:21

#Name:chkconfig.sh

#Version:V1.0

####################################

for i in `systemctl list-unit-files |awk '{if ($2=="enabled") print $1}'`

do

systemctl disable $i &>/dev/null

done

cat >/tmp/log<< EOF

crond

dbus-org.freedesktop.NetworkManager.service

dbus-org.freedesktop.nm-dispatcher.service

getty@.service

irqbalance.service

NetworkManager-dispatcher.service

NetworkManager.service

rsyslog.service

sshd.service

systemd-readahead-collect.service

systemd-readahead-drop.service

systemd-readahead-replay.service

tuned.service

default.target

multi-user.target

remote-fs.target

EOF

while read line

do

systemctl enable $line &>/dev/null

done </tmp/log

rm /tmp/log -f

#如果是iptables

[root@master1 ~]# systemctl stop iptables.service

[root@master1 ~]# systemctl disable iptables.service

[root@master1 ~]# systemctl list-unit-files |grep iptables

如果是firewalld

[root@master1 ~]# systemctl stop firewalld

[root@master1 ~]# systemctl disable firewalld

[root@master1 ~]# systemctl list-unit-files |grep firewalld

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

useradd dsf

echo 123456|passwd --stdin dsf

\cp /etc/sudoers /etc/sudoers.ori

echo "dsf  ALL=(ALL) NOPASSWD: ALL " >>/etc/sudoers

tail -1 /etc/sudoers

visudo -c

vim /etc/ssh/sshd_config

Port 52013

systemctl reload sshd.service

sed -i.bak 's@#UseDNS yes@UseDNS no@g;s@^GSSAPIAuthentication yes@GSSAPIAuthentication no@g' /etc/ssh/sshd_config

systemctl reload sshd.service

vim /etc/ssh/sshd_config

PermitRootLogin no

#yes（默认）允许 ，no表示禁止

vim /etc/locale.conf

#LANG="en_US.UTF-8"

LANG="zh_CN.UTF-8"

[root@master1 ~]# echo $LANG

zh_CN.UTF-8

echo '#crond-id-001:time sync by dsf' >>/var/spool/cron/root

echo "*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1">>/var/spool/cron/root

crontab -l

echo '*               -       nofile          65535 ' >>/etc/security/limits.conf

tail -1 /etc/security/limits.conf

ulimit -SHn   65535

ulimit -n

cat >>/etc/sysctl.conf<<EOF

net.ipv4.tcp_fin_timeout = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_keepalive_time = 600

net.ipv4.ip_local_port_range = 4000    65000

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.route.gc_timeout = 100

net.ipv4.tcp_syn_retries = 1

net.ipv4.tcp_synack_retries = 1

net.core.somaxconn = 16384

net.core.netdev_max_backlog = 16384

net.ipv4.tcp_max_orphans = 16384

#以下参数是对iptables防火墙的优化，防火墙不开会提示，可以忽略不理。

net.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_tcp_timeout_established = 180

net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120

net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60

net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

net.core.wmem_default = 8388608

net.core.rmem_default = 8388608

net.core.wmem_max = 16777216

net.core.rmem_max = 16777216

EOF

sysctl -p

[root@master1 ~]# cat /etc/issue

\S

Kernel \r on an \m

[root@master1 ~]# cat /etc/issue.net

\S

Kernel \r on an \m

执行如下命令清除linux系统版本及内核信息

[root@master1 ~]# > /etc/issue

[root@master1 ~]# > /etc/issue.net

chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab

#上锁后，所有用户都不能对文件修改删除

解锁命令如下：

chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab

[root@master1 ~]# mv /usr/bin/chattr /usr/bin/dsf

[root@master1 ~]# dsf +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab

[root@master1 ~]# lsattr /etc/inittab   ##查看被上锁文件属性

----i----------- /etc/inittab

[root@master1 ~]# echo "net.ipv4.icmp_echo_ignore_all=1" >> /etc/sysctl.conf

[root@master1 ~]# tail -1 /etc/sysctl.conf

net.ipv4.icmp_echo_ignore_all=1

[root@master1 ~]# sysctl -p

#禁止ping后，我们自己也无法通过ping检查了。还原上述禁止ping 的操作，因为工作中用的比较少。命令如下：

删除/etc/sysctl.conf中的net.ipv4.icmp_echo_ignore_all=1，保存后，并执行如下命令

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

比较好的策略是通过iptables设置让特定的IP可以ping，如让内网用户ping。

iptables -t filter -I INPUT -p icmp --icmp-type 8 -i eth0 -s 10.0.0.0/24 -j ACCEPT

使10.0.0.0/24网段允许ping

echo "PS1='\[\e[32;1m\][\u@\h \W]\\$ \[\e[0m\]'"   >>/etc/profile && . /etc/profile