系统下载

可以使用最小化的,也可以使用dvd版(CentOS-6.7-x86_64-bin-DVD1.iso),其中dvd版方便安装过程中选包.

一. 系统安装

1,时区选择

2,磁盘分区

boot	保持默认200M
swap	1024M
/	剩余空间
备注: 其中3个分区都force be a primary partion

参考:生产场景不同角色linux服务器分区案例分享

注意: raid之后的空间超过2T,fdisk就无法使用.改用parted

参考: linuxMBR分区

3.安装选包

选包参考: 运维老鸟教你安装centos6.5如何选择安装包

   Base

   Compatibility libraries

   Debugging Tools

   Development tools

1、根据经验，选择安装包时应该按最小化原则，即不需要的或者不确定是否需要的就不安装，这样可以最大程度上确保系统安全。

2、如果安装过程落了部分包组或者其他伙伴安装时没选，再安装后可以按如下方式补上安装时未安装的包组：

yum groupinstall "Compatibility libraries" "Base" "Development tools"

yum groupinstall "debugging Tools" "Dial-up Networking Support"

可以通过yum groupinfo 包组查看具体安装的组件。

3、下面安装6.5后登陆系统的时候查看选包的情况：

yum grouplist:  #前4个都需要有

Installed Groups:

   Base

   Compatibility libraries

   Debugging Tools

   Development tools

   E-mail server

   Graphical Administration Tools

   Hardware monitoring utilities

   Legacy UNIX compatibility

   Networking Tools

   Performance Tools

   Perl Support

   Scientific support

   Security Tools

*可以看到除了我们选择的外，系统还是默认安装了一些额外的软件包组。

注意：不要使用yum的删除功能删除软件，会删除相关依赖，导致意外问题。

如果centos6系统已安装,如何补救没有安装的包?以及初始化安装时选包注意事项.

4.linux忘记密码处理(进单用户[启动级别为1]的模式去处理)

开机按e键,

输入户single,单用户模式启动(级别)

$ cat /etc/inittab

...

#   0 - halt (Do NOT set initdefault to this)

#   1 - Single user mode

#   2 - Multiuser, without NFS (The same as 3, if you do not have networking)

#   3 - Full multiuser mode

#   4 - unused

#   5 - X11

#   6 - reboot (Do NOT set initdefault to this)

passwd root # 更新密码并重启即可.

5.centos6-系统优化

优化小结:
一清：定时清理日志/var/spool/clientsqueue
一精：精简开机启动服务
一增：增大文件描述符
两优： linux内核参数的优化、yum源优化
四设：设置系统的字符集、设置ssh登录限制、设置开机的提示信息与内核信息、设置block的大小
七其他：文件系统优化、sync数据同步写入磁盘、不更新时间戳、锁定系统关键文件、时间同步、sudo集权管理、关闭防火墙和selinux

本文 centos 6.5 优化的项有18处:
1、CentOS6.5最小化安装后启动网卡
2、ifconfig查询IP进行SSH链接
3、更新系统源并且升级系统
4、系统时间更新和设定定时任
5、修改ip地址、网关、主机名、DNS
6、关闭seLinux，清空iptables
7、创建普通用户并进行sudo授权管理
8、修改SSH端口号和屏蔽root账号远程登陆
9、锁定关键文件系统（禁止非授权用户获得权限）
10、精简开机自启动服务
11、调整系统文件描述符大小
12、设置系统字符集
13、清理登陆的时候显示的系统及内核版本
14、内核参数优化
15、定时清理/var/spool/clientmqueue
16、删除不必要的系统用户和群组
17、关闭重启ctl-alt-delete组合键
18、设置一些全局变量

https://raw.githubusercontent.com/lannyMa/scripts/master/utils/centos6_one_key_optimize.sh

#!/bin/sh

################################################

# this script is created by lanny

# version:1.2

################################################

#Source function library.

. /etc/init.d/functions

#date

DATE=`date +"%Y-%m-%d %H:%M:%S"`

#ip

IPADDR=IPADDR=`ifconfig eth0|sed -n '2p'|awk -F ":" '{print $2}'|awk '{print $1}'`

#hostname

HOSTNAME=`hostname -s`

#user

USER=`whoami`

#disk_check

DISK_SDA=`df -h |grep -w "/" |awk '{print $5}'`

#cpu_average_check

cpu_uptime=`cat /proc/loadavg|awk '{print $1,$2,$3}'`

#set LANG

export LANG=zh_CN.UTF-8

#Require root to run this script.

uid=`id | cut -d\( -f1 | cut -d= -f2`

if [ $uid -ne 0 ];then

  action "Please run this script as root." /bin/false

  exit 1

fi

#"stty erase ^H"

\cp /root/.bash_profile  /root/.bash_profile_$(date +%F)

erase=`grep -wx "stty erase ^H" /root/.bash_profile |wc -l`

if [ $erase -lt 1 ];then

    echo "stty erase ^H" >>/root/.bash_profile

    source /root/.bash_profile

fi

#Config Yum CentOS-Bases.repo

configYum(){

echo "================更新为国内YUM源=================="

  cd /etc/yum.repos.d/

  \cp CentOS-Base.repo CentOS-Base.repo.$(date +%F)

  ping -c 2 mirrors.aliyun.com >/dev/null

  if [ $? -eq 0 ];then

  wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo

  wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo

  yum clean all && yum makecache

  else

    echo "无法连接网络。"

    exit $?

  fi

action "配置国内aliyun YUM完成"  /bin/true

echo "================================================="

echo ""

  sleep 2

}

#install tools

initTools(){

  echo "#####install tools#####"

  yum install lrzsz ntpdate sysstat dos2unix wget telnet vim-enhanced -y

  yum groupinstall base -y

  yum groupinstall core -y

  yum groupinstall development libs -y

  yum groupinstall development tools -y

  echo "install toos complete."

  sleep 1

}

initVim(){

cat >>/etc/vimrc<<EOF

set nu

set cursorline

set nobackup

set ruler

set autoindent

set vb t_vb=

set ts=4

set expandtab

EOF

source /etc/vimrc

}

#Charset zh_CN.UTF-8

initI18n(){

echo "================更改为中文字符集================="

  \cp /etc/sysconfig/i18n /etc/sysconfig/i18n.$(date +%F)

  echo "LANG="zh_CN.UTF-8"" >/etc/sysconfig/i18n

  source /etc/sysconfig/i18n

  echo '#cat /etc/sysconfig/i18n'

  grep LANG /etc/sysconfig/i18n

action "更改字符集zh_CN.UTF-8完成" /bin/true

echo "================================================="

echo ""

  sleep 2

}

#Close Selinux and Iptables

initFirewall(){

echo "============禁用SELINUX及关闭防火墙=============="

  \cp /etc/selinux/config /etc/selinux/config.$(date +%F)

  /etc/init.d/iptables stop

  sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

  setenforce 0

  /etc/init.d/iptables status

  echo '#grep SELINUX=disabled /etc/selinux/config '

  grep SELINUX=disabled /etc/selinux/config

  echo '#getenforce '

  getenforce

action "禁用selinux及关闭防火墙完成" /bin/true

echo "================================================="

echo ""

  sleep 2

}

#Init Auto Startup Service

initService(){

echo "===============精简开机自启动===================="

  export LANG="en_US.UTF-8"

  for A in `chkconfig --list |grep 3:on |awk '{print $1}' `;do chkconfig $A off;done

  for B in rsyslog network sshd crond;do chkconfig $B on;done

  echo '+--------which services on---------+'

  chkconfig --list |grep 3:on

  echo '+----------------------------------+'

  export LANG="zh_CN.UTF-8"

action "精简开机自启动完成" /bin/true

echo "================================================="

echo ""

  sleep 2

}

#Change sshd default port and prohibit user root remote login.

initSsh(){

echo "========修改ssh默认端口禁用root远程登录=========="

  \cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%F)

  sed -i 's/#Port 22/Port 52000/g' /etc/ssh/sshd_config

  sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config

  sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config

  sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config

  echo '+-------modify the sshd_config-------+'

  echo 'Port 52000'

  echo 'PermitEmptyPasswords no'

  echo 'PermitRootLogin no'

  echo 'UseDNS no'

  echo '+------------------------------------+'

  /etc/init.d/sshd reload && action "修改ssh默认参数完成" /bin/true || action "修改ssh参数失败" /bin/false

echo "================================================="

echo ""

  sleep 2

}

#time sync

syncSysTime(){

echo "================配置时间同步====================="

  \cp /var/spool/cron/root /var/spool/cron/root.$(date +%F) 2>/dev/null

  NTPDATE=`grep ntpdate /var/spool/cron/root 2>/dev/null |wc -l`

  if [ $NTPDATE -eq 0 ];then

    /bin/rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && /usr/sbin/ntpdate ntp1.aliyun.com

    echo "#times sync by lanny at $(date +%F)" >>/var/spool/cron/root

    echo "*/5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1" >> /var/spool/cron/root

  fi

  echo '#crontab -l'

  crontab -l

action "配置时间同步完成" /bin/true

echo "================================================="

echo ""

  sleep 2

}

initHistory(){

echo "================配置history显示格式====================="

    export HISTTIMEFORMAT="%F %T `whoami` "

    echo 'export HISTTIMEFORMAT="%F %T `whoami` ' >> /etc/profile

    echo '#grep HISTTIMEFORMAT /etc/profile '

    grep HISTTIMEFORMAT /etc/profile

action "配置history显示格式" /bin/true

echo "================================================="

echo ""

  sleep 2

}

initCADShutdown(){

echo "================关掉ctrl+alt+delete关机====================="

    \cp /etc/init/control-alt-delete.conf /etc/init/control-alt-delete.conf.bak

    sed -i 's#exec /sbin/shutdown -r now "Control-Alt-Deletepressed"#\#exec /sbin/shutdown -r now "Control-Alt-Deletepressed"#g' /etc/init/control-alt-delete.conf

action "关掉ctrl+alt+delete关机" /bin/true

echo "================================================="

echo ""

  sleep 2

}

#add user and give sudoers

addUser(){

echo "===================新建用户======================"

#add user

while true

do

    read -p "请输入新用户名:" name

    NAME=`awk -F':' '{print $1}' /etc/passwd|grep -wx $name 2>/dev/null|wc -l`

    if [ ${#name} -eq 0 ];then

       echo "用户名不能为空，请重新输入。"

       continue

    elif [ $NAME -eq 1 ];then

       echo "用户名已存在，请重新输入。"

       continue

    fi

useradd $name

break

done

#create password

while true

do

    read -p "为 $name 创建一个密码:" pass1

    if [ ${#pass1} -eq 0 ];then

       echo "密码不能为空，请重新输入。"

       continue

    fi

    read -p "请再次输入密码:" pass2

    if [ "$pass1" != "$pass2" ];then

       echo "两次密码输入不相同，请重新输入。"

       continue

    fi

echo "$pass2" |passwd --stdin $name

break

done

sleep 1

#add visudo

echo "#####add visudo#####"

\cp /etc/sudoers /etc/sudoers.$(date +%F)

SUDO=`grep -w "$name" /etc/sudoers |wc -l`

if [ $SUDO -eq 0 ];then

    echo "$name  ALL=(ALL)       NOPASSWD: ALL" >>/etc/sudoers

    echo '#tail -1 /etc/sudoers'

    grep -w "$name" /etc/sudoers

    sleep 1

fi

action "创建用户$name并将其加入visudo完成"  /bin/true

echo "================================================="

echo ""

sleep 2

}

#Adjust the file descriptor(limits.conf)

initLimits(){

echo "===============加大文件描述符===================="

  LIMIT=`grep nofile /etc/security/limits.conf |grep -v "^#"|wc -l`

  if [ $LIMIT -eq 0 ];then

  \cp /etc/security/limits.conf /etc/security/limits.conf.$(date +%F)

  echo '*                  -        nofile         65535'>>/etc/security/limits.conf

  fi

  echo '#tail -1 /etc/security/limits.conf'

  tail -1 /etc/security/limits.conf

  ulimit -HSn 65535

  echo '#ulimit -n'

  ulimit -n

action "配置文件描述符为65535" /bin/true

echo "================================================="

echo ""

sleep 2

}

#Optimizing the system kernel

initSysctl(){

echo "================优化内核参数====================="

SYSCTL=`grep "net.ipv4.tcp" /etc/sysctl.conf |wc -l`

if [ $SYSCTL -lt 10 ];then

\cp /etc/sysctl.conf /etc/sysctl.conf.$(date +%F)

cat >>/etc/sysctl.conf<<EOF

net.ipv4.tcp_fin_timeout = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_keepalive_time = 600

net.ipv4.ip_local_port_range = 4000 65000

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.route.gc_timeout = 100

net.ipv4.tcp_syn_retries = 1

net.ipv4.tcp_synack_retries = 1

net.core.somaxconn = 16384

net.core.netdev_max_backlog = 16384

net.ipv4.tcp_max_orphans = 16384

net.netfilter.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_tcp_timeout_established = 180

net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120

net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60

net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

EOF

fi

  \cp /etc/rc.local /etc/rc.local.$(date +%F)

  modprobe nf_conntrack

  echo "modprobe nf_conntrack">> /etc/rc.local

  modprobe bridge

  echo "modprobe bridge">> /etc/rc.local

  sysctl -p

action "内核调优完成" /bin/true

echo "================================================="

echo ""

  sleep 2

}

#menu2

menu2(){

while true

do

clear

cat << EOF

----------------------------------------

|****Please Enter Your Choice:[0-9]****|

----------------------------------------

(1) 新建一个用户并将其加入visudo

(2) 配置为国内YUM源镜像

(3) 配置中文字符集

(4) 禁用SELINUX及关闭防火墙

(5) 精简开机自启动

(6) 修改ssh默认端口及禁用root远程登录

(7) 设置时间同步

(8) 加大文件描述符

(9) 内核调优

(0) 返回上一级菜单

EOF

read -p "Please enter your Choice[0-9]: " input2

case "$input2" in

  0)

  clear

  break

  ;;

  1)

  addUser

  ;;

  2)

  configYum

  ;;

  3)

  initI18n

  ;;

  4)

  initFirewall

  ;;

  5)

  initService

  ;;

  6)

  initSsh

  ;;

  7)

  syncSysTime

  ;;

  8)

  initLimits

  ;;

  9)

  initSysctl

  ;;

  *) echo "----------------------------------"

     echo "|          Warning!!!            |"

     echo "|   Please Enter Right Choice!   |"

     echo "----------------------------------"

     for i in `seq -w 3 -1 1`

       do

         echo -ne "\b\b$i";

  sleep 1;

     done

     clear

esac

done

}

#initTools

#menu

while true

do

clear

echo "========================================"

echo '          Linux Optimization            '

echo "========================================"

cat << EOF

|-----------System Infomation-----------

| DATE       :$DATE

| HOSTNAME   :$HOSTNAME

| USER       :$USER

| IP         :$IPADDR

| DISK_USED  :$DISK_SDA

| CPU_AVERAGE:$cpu_uptime

----------------------------------------

|****Please Enter Your Choice:[1-3]****|

----------------------------------------

(1) 一键优化

(2) 自定义优化

(3) 退出

EOF

#choice

read -p "Please enter your choice[0-3]: " input1

case "$input1" in

1)

  addUser

  configYum

  initTools

  initCADShutdown

  initI18n

  initFirewall

  initService

  initSsh

  syncSysTime

  initLimits

  initSysctl

  initVim

  ;;

2)

  menu2

  ;;

3)

  clear

  break

  ;;

*)

  echo "----------------------------------"

  echo "|          Warning!!!            |"

  echo "|   Please Enter Right Choice!   |"

  echo "----------------------------------"

  for i in `seq -w 3 -1 1`

      do

        echo -ne "\b\b$i";

        sleep 1;

  done

  clear

esac

done

centos6系列系统安装完毕后,一键优化脚本.

细节:http://oldboy.blog.51cto.com/2561410/1336488

网络状态优化:http://oldboy.blog.51cto.com/2561410/1184228

定时任务优化:http://oldboy.blog.51cto.com/2561410/1216730

一键脚本:

较简单: http://mofansheng.blog.51cto.com/8792265/1710247      http://www.chocolee.cn/archives/68

较健全: http://chocolee.blog.51cto.com/8158455/1424587

附: centos6一键优化脚本参考

巴特西

[svc]centos6系统安装(分区)及其18处调优调优最佳实战