# 设置主机名，永久修改，再次登陆生效

hostnamectl set-hostname xxxxx 

# 安装eprl源，常用命令

yum install  -y wget && \

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo && \

yum -y install bash-completion  telnet nmap tree  net-tools  ntpdate && \

# 查看时区，同步时间

timedatectl set-timezone Asia/Shanghai   修改时区命令

ntpdate hk.ntp.org.cn    同步时间

# 优化文件描述符

cat >>/etc/security/limits.conf<<EOF

root     soft   nofile

root     hard   nofile

*        soft   nofile

*        hard   nofile

EOF

ulimit -n    # 查看

# 防火墙设置

 添加允许访问的端口

firewall-cmd  --zone=public --add-port=/tcp --permanent  

 添加允许访问的服务

firewall-cmd --permanent --add-service https

 对指定IP或某个网段开放端口，允许192.168.142.166和192.168.224./24访问5432端口

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.142.166" port protocol="tcp" port="" accept"

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.224.0/" port protocol="tcp" port="" accept"

 重新加载防火墙，防火墙规则生效

firewall-cmd --reload

# 关闭防火墙，如果需要

systemctl stop firewalld.service && systemctl disable firewalld.service 

# 关闭selinux

setenforce    && sed '7s#enforcing#disabled#g' /etc/selinux/config -i 

# 关闭ssh解析

sed -i.bak 's@#UseDNS yes@UseDNS no@g;s@^GSSAPIAuthentication yes@GSSAPIAuthentication no@g'  /etc/ssh/sshd_config

systemctl restart sshd 

# 目录规划

/server/scripts/   脚本存放目录

/server/tools/     安装包存放目录

/usr/local/        服务安装目录

/backup/           备份目录

# ssh 白名单规则

在 /etc/hosts.allow 设置,允许连接的IP

sshd:167.179.49.12

sshd:192.168.224.0/

在/etc/hosts.deny 设置,拒绝所有的连接

echo "sshd:all"  >> /etc/hosts.deny

#!/bin/bash

yum install  -y wget && \

wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo && \

yum -y install vim wget bash-completion lrzsz nmap tree nc net-tools htop iotop iftop psmisc ntpdate && \

systemctl stop firewalld.service && systemctl disable firewalld.service

#setenforce  0  && sed '7s#enforcing#disabled#g' /etc/selinux/config -i

#优化文件描述符

echo -e "* soft nofile 65535\n* hard nofile 65535" >> /etc/security/limits.conf

ulimit -n 65535

#内核优化

cat >>/etc/sysctl.conf<<EOF

net.ipv4.tcp_fin_timeout = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_keepalive_time = 600

net.ipv4.ip_local_port_range = 4000    65000

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.route.gc_timeout = 100

net.ipv4.tcp_syn_retries = 1

net.ipv4.tcp_synack_retries = 1

net.core.somaxconn = 16384

net.core.netdev_max_backlog = 16384

net.ipv4.tcp_max_orphans = 16384

EOF

sysctl -p

sed -i.bak 's@#UseDNS yes@UseDNS no@g;s@^GSSAPIAuthentication yes@GSSAPIAuthentication no@g'  /etc/ssh/sshd_config

systemctl restart sshd

echo '* * * * *  root /usr/sbin/ntpdate ntp1.aliyun.com' >>/etc/crontab