#!/bin/bash

# 描述: CentOS  初始化脚本

# 加载配置文件

if [ -n "${1}" ];then

    /bin/sh ${}

fi

# 可接受配置(shell 变量格式)

# INIT_HOSTNAME         主机名, 默认为 localhost

# INIT_NTPSERVER        ntp 服务器, 默认为 ntp1.aliyun.com

# INIT_DNS1             dns 服务器

# INIT_DNS2

# INIT_DNS3

# INIT_ZABBIX_AGENT     是否安装 zabbix agent, 默认为 yes

# INIT_ZAB_VERSION      zabbix agent 的版本, 默认为 3.4.

# INIT_ZAB_SERVER       zabbix server 的地址, 默认为 192.168.0.112

# INIT_ZAB_DOWNLOAD     zabbix agent 的下载地址, 默认为阿里的 yum 仓库

# INIT_SSH_PORT             ssh 监听端口, 默认

# INIT_SSH_DNS              是否启用 ssh dns 反解, 默认 no

# INIT_SSH_ROOT_LOGIN       是否允许 root 用户登录, 默认 yes

HOSTNAME=${INIT_HOSTNAME:-'localhost'}

NTPSERVER=${INIT_NTPSERVER:-'ntp1.aliyun.com'}

DNS1=${INIT_DNS1:-'114.114.114.114'}

DNS2=${INIT_DNS2:-'223.5.5.5'}

DNS3=${INIT_DNS3:-'8.8.8.8'}

ZABBIX_AGENT=${INIT_ZABBIX_AGENT:-'yes'}

ZABBIX_SERVER=${INIT_ZABBIX_SERVER:-'192.168.0.112'}

ZABBIX_VERSION=${INIT_ZABBIX_VERSION:-'3.4.11'}

ZABBIX_DOWNLOAD=${INIT_ZABBIX_DOWNLOAD:-'https://mirrors.aliyun.com/zabbix/zabbix/'}

SSH_PORT=${INIT_SSH_PORT:-''}

SSH_DNS=${INIT_SSH_DNS:-'no'}

SSH_ROOT_LOGIN=${INIT_SSH_ROOT_LOGIN:-'yes'}

ping -c  -w  114.114.114.114 &> /dev/null

if [ ${?} -ne  ];then

    echo "系统初始化必须能够连接 Internet 网络"

    exit

else

    echo "nameserver 114.114.114.114" > /etc/resolv.conf

    echo -e "\033[31m正在更新软件包\033[0m"

    yum -y update &> /dev/null

    yum -y install wget &> /dev/null

    if [ ${?} -ne  ];then

        echo -e "\033[31m安装wget失败， 退出${0}\033[0m"

        exit

    fi

fi

set_service() {

    setenforce

    sed -i 's#^SELINUX=.*#SELINUX=disabled#' /etc/sysconfig/selinux

    sed -i 's#^SELINUX=.*#SELINUX=disabled#' /etc/selinux/config

    systemctl disable firewalld postfix acpid ip6tables mcelogd mdmonitor rpcbind rpcgssd &> /dev/null

    systemctl disable rpcidmapd auditd haldaemon lldpad atd kdump netfs nfslock openct &> /dev/null

    systemctl enable sshd crond &> /dev/null

}

install_package() {

    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.back

    wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo &> /dev/null

    wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo &> /dev/null

    echo -e "\033[31m正在安装常用软件包\033[0m"

    yum -y install vim lsof zip strace openssl openssl-devel gcc gcc-c++ cmake bind-utils libxml2-devel net-tools sysstat &> /dev/null

    yum -y install ntpdate curl telnet lbzip2 bzip2 bzip2-devel pcre pcre-devel zlib-devel python-devel lrzsz man &> /dev/null

}

install_zabbix_agent() {

    [ ${ZABBIX_AGENT} != 'yes' ] && return 

    echo -e "\033[31m正在安装zabbix-agent\033[0m"

    cd /tmp/

    ZAB_DOWNLOAD=${ZABBIX_DOWNLOAD}

    ZAB_VERSION=${ZABBIX_VERSION}

    VERSION=$(echo "${ZAB_VERSION}"|cut -c-)

    wget ${ZAB_DOWNLOAD}${VERSION}/rhel//x86_64/zabbix-agent-${ZAB_VERSION}-.el7.x86_64.rpm &> /dev/null

    yum -y localinstall zabbix-agent-${ZAB_VERSION}-.el7.x86_64.rpm &> /dev/null

    rm -f zabbix-agent-${ZAB_VERSION}-.el7.x86_64.rpm

    sed -i "s#^Server=.*#Server=${ZABBIX_SERVER}#" /etc/zabbix/zabbix_agentd.conf

    sed -i "s#^ServerActive=.*#ServerActive=${ZABBIX_SERVER}#" /etc/zabbix/zabbix_agentd.conf

    systemctl enable zabbix-agent &> /dev/null

    systemctl start zabbix-agent &> /dev/null || echo -e "\033[31m安装zabbix-agent失败\033[0m"

}

init_system() {

    hostnamectl set-hostname ${HOSTNAME}

    timedatectl set-timezone Asia/Shanghai

    echo "* * * * * /usr/sbin/ntpdate ${NTPSERVER}" > /var/spool/cron/root

    echo "nameserver ${DNS1}" > /etc/resolv.conf

    echo "nameserver ${DNS2}" >> /etc/resolv.conf

    echo "nameserver ${DNS3}" >> /etc/resolv.conf

    chattr +i /etc/resolv.conf

    echo 'LANG="en_US.UTF-8"' > /etc/locale.conf

    echo 'export LANG="en_US.UTF-8"' >> /etc/profile.d/custom.sh

}

set_kernel_parameter() {

cat > /etc/sysctl.conf << EOF

fs.file-max =

kernel.sysrq =

kernel.core_uses_pid =

kernel.msgmnb =

kernel.msgmax =

kernel.shmmax =

kernel.shmall =

net.ipv6.conf.all.disable_ipv6 =

net.ipv6.conf.default.disable_ipv6 =

net.ipv4.icmp_echo_ignore_broadcasts =

net.ipv4.icmp_ignore_bogus_error_responses =

net.ipv4.ip_forward =

net.ipv4.conf.all.send_redirects =

net.ipv4.conf.default.send_redirects =

net.ipv4.conf.all.rp_filter =

net.ipv4.conf.default.rp_filter =

net.ipv4.conf.all.accept_source_route =

net.ipv4.conf.default.accept_source_route =

net.ipv4.tcp_syncookies =

net.ipv4.tcp_max_tw_buckets =

net.ipv4.tcp_sack =

net.ipv4.tcp_window_scaling =

net.ipv4.tcp_rmem =

net.ipv4.tcp_wmem =

net.ipv4.tcp_max_orphans =

net.ipv4.tcp_max_syn_backlog =

net.ipv4.tcp_timestamps =

net.ipv4.tcp_synack_retries =

net.ipv4.tcp_syn_retries =

net.ipv4.tcp_tw_recycle =

net.ipv4.tcp_tw_reuse =

net.ipv4.tcp_mem =

net.ipv4.tcp_fin_timeout =

net.ipv4.tcp_keepalive_time =

net.ipv4.ip_local_port_range =

net.ipv4.conf.all.accept_redirects =

net.ipv4.conf.default.accept_redirects =

net.ipv4.conf.all.secure_redirects =

net.ipv4.conf.default.secure_redirects =

net.core.wmem_default =

net.core.rmem_default =

net.core.rmem_max =

net.core.wmem_max =

net.core.netdev_max_backlog =

EOF

}

set_system_limit() {

cat >> /etc/security/limits.conf <<EOF

* soft nproc

* hard nproc

* soft nofile

* hard nofile

EOF

}

set_history() {

cat >> /etc/profile.d/custom.sh <<EOF

USER_IP=$(who -u am i >/dev/null| awk '{print $NF}'|sed -e 's/[()]//g')

[ -z ${USER_IP} ] && USER_IP=${hostname}

export HISTTIMEFORMAT="%F %T ${USER_IP} "

shopt -s histappend

export PROMPT_COMMAND="history -a; history -c; history -r; ${PROMPT_COMMAND}"

EOF

}

# 如果升级失败造成的影响较大, 建议管理员手动升级

# update_openssh() {

#     [ ${UPDATE_OPENSSH} == 'no' ] && return

#     cd /tmp/

#     yum -y install cmake gcc zlib-devel openssl-devel pam-devel wget

#     cp /etc/ssh/sshd_config /etc/ssh/sshd_config.back

#     wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.5p1.tar.gz

#     tar xf openssh-.5p1.tar.gz && cd openssh-.5p1

#     ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-md5-passwords --with-pam \

#       --with-zlib --with-openssl-includes=/usr --with-privsep-path=/var/lib/sshd

#     [ ${?} -ne  ] && echo "升级 openssh 失败" >> system_init.log && return

#     make || echo "升级 openssh 失败" >> system_init.log && return

#     make install || echo "升级 openssh 失败" >> system_init.log

#     cp /etc/ssh/sshd_config /etc/ssh/sshd_config.back2

#     echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config

#     echo "PermitRootLogin yes" >> /etc/ssh/sshd_config

#     sed -i 's#GSSAPIAuthentication.*##' /etc/ssh/sshd_config

#     sed -i 's#GSSAPICleanupCredentials.*##' /etc/ssh/sshd_config

# }

set_openssh() {

    echo "Port ${SSH_PORT}" >> /etc/ssh/sshd_config

    [ ${SSH_DNS} != 'yes' ] && echo "UseDNS no" >> /etc/ssh/sshd_config

    [ ${SSH_ROOT_LOGIN} == 'no' ] && sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

}

set_nic() {

    grub_cinfig='GRUB_CMDLINE_LINUX="crashkernel=auto ipv6.disable=1 net.ifnames=0 rd.lvm.lv=centos/root rd.lvm.lv=centos/swap rhgb quiet"'

    sed -i "s#GRUB_CMDLINE_LINUX.*#${grub_cinfig}#" /etc/default/grub

    grub2-mkconfig -o /boot/grub2/grub.cfg &> /dev/null || echo -e "\033[31m修改grub失败\033[0m"

}

set_service

install_package

install_zabbix_agent

init_system

set_kernel_parameter

set_system_limit

set_history

set_openssh

set_nic

echo -e "\033[32m${0} 执行完毕, 请确认无误之后执行 reboot 重启系统\033[0m"