作为运维人员，经常会初始化系统，系统在安装过程中基本都会选择最小化安装，这样安装好的系统里会缺少很多环境。
下面分享一个系统安装后的初始化脚本：
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
#!/bin/bash
#系统时最小化安装的，这里要安装系统的软件库
yum groupinstall -y
"development tools"
#创建目录
[ ! -d
/server/tools
] &&
mkdir
-p
/server/tools
[ ! -d
/application
] &&
mkdir
-p
/application
[ ! -d
/data
] &&
mkdir
-p
/data
[ ! -d
/app/logs
] &&
mkdir
-p
/app/logs
[ ! -d
/server/backup
] &&
mkdir
-p
/server/backup
[ ! -d
/delete
] &&
mkdir
-p
/delete
#每周六凌晨1点0分更新服务器系统时间
echo
"############### auto update time ###############"
>>
/var/spool/cron/root
echo
"00 01 * * * /usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1"
>>
/var/spool/cron/root
[ `
grep
ntpdate
/var/spool/cron/root
|
wc
-l` -
ne
0 ] && action
"uptime set"
/bin/true
|| action
"uptime set"
/bin/false
#配置yum源
wget -P
/etc/yum
.repos.d/ http:
//mirrors
.163.com/.help
/CentOS6-Base-163
.repo
#下载配置文件
/bin/mv
/etc/yum
.repos.d
/CentOS-Base
.repo
/etc/yum
.repos.d
/CentOS-Base
.repo.bak
/bin/cp
/etc/yum
.repos.d
/CentOS6-Base-163
.repo
/etc/yum
.repos.d
/CentOS-Base
.repo
[ `
grep
163.com
/etc/yum
.repos.d
/CentOS-Base
.repo |
wc
-l` -
ne
0 ] && action
"yum set"
/bin/true
|| action
"yum set"
/bin/false
#关闭SELINUX及iptables
/bin/cp
/etc/selinux/config
/etc/selinux/config
.bak
sed
-i
's/SELINUX=enforcing/SELINUX=disabled/'
/etc/selinux/config
2>&1
/etc/init
.d
/iptables
stop >
/dev/null
chkconfig iptables off >
/dev/null
[ `chkconfig --list |
grep
iptables|
grep
3:on|
wc
-l` -
eq
0 -a `
grep
"SELINUX=enforcing"
/etc/selinux/config
|
wc
-l` -
eq
0 ] && action
"iptables and selinux close"
/bin/true
|| action
"iptables and selinux close"
/bin/false
#调整文件描述符数量
/bin/cp
/etc/security/limits
.conf
/etc/security/limits
.conf.bak
echo
'* - nofile 65535'
>>
/etc/security/limits
.conf
[ `
tail
-1
/etc/security/limits
.conf|
grep
65535|
wc
-l` -
eq
1 ] && action
"limit set"
/bin/true
|| action
"limit set"
/bin/false
#更改字符集
/bin/cp
/etc/sysconfig/i18n
/etc/sysconfig/i18n
.bak
echo
'LANG="en_US.UTF-8"'
>
/etc/sysconfig/i18n
#定时清理/var/spool/clientmqueue/目录下的垃圾文件，防止inodes节点被占满
##创建脚本目录
[ ! -d
/server/scripts
] &&
mkdir
-p
/server/scripts
if
[ `rpm -qa sendmail |
wc
-l` -
ne
0 ];
then
##创建查找删除脚本
echo
>
/server/scripts/del
.sh<<EOF
#!/bin/bash
find
/var/spool/clientmqueue/
-
type
f|
xargs
rm
-f >
/dev/null
2>&1
EOF
##添加到定时任务，每周一凌晨0点0分执行
echo
'################ clean /var/spool/clientmqueue/ ################'
>>
/var/spool/cron/root
echo
'00 00 * * 1 /bin/sh /server/scripts/del.sh >/dev/null 2>&1'
>>
/var/spool/cron/root
[
"$?"
-
eq
0 ] && action
"clean /var/spool/clientmqueue/ set"
/bin/true
|| action
"clean /var/spool/clientmqueue/ set"
/bin/false
else
action
"service sendmail is not installed,do not need set"
/bin/false
fi
#精简开机自启动服务（只启动crond,sshd,network,syslog)
##筛选出所有在运行级别3自启动的服务并关闭自启动
for
cgt
in
`chkconfig --list |
grep
3:on |
awk
'{print $1}'
`;
do
chkconfig --level 3 $cgt off;
done
##仅设置crond,sshd,network,syslog自启动
for
cgt
in
{crond,sshd,network,rsyslog};
do
chkconfig --level 3 $cgt on;
done
flag=0
[ `chkconfig --list|
grep
3:on|
wc
-l` -
eq
4 ] && action
"auto_start services set"
/bin/true
|| action
"auto_start services set"
/bin/false
#内核参数优化
[ -f
/etc/sysctl
.conf.bak ] &&
/bin/cp
/etc/sysctl
.conf.bak
/etc/sysctl
.conf.bak.$(
date
+%F-%H%M%S) ||
/bin/cp
/etc/sysctl
.conf
/etc/sysctl
.conf.bak
cat
>>
/etc/sysctl
.conf <<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
#以下参数是对iptables防火墙的优化，防火墙不开会提示，可以忽略不理。
#net.ipv4.ip_conntrack_max = 25000000
#net.ipv4.netfilter.ip_conntrack_max=25000000
#net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180
#net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait=120
#net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait=60
#net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait=120
#net.netfilter.nf_conntrack_max = 25000000
#net.netfilter.nf_conntrack_tcp_timeout_established = 180
#net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
#net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
#net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120'
EOF
sysctl -p >
/dev/null
2>&1
[ `
grep
"net.ipv4.tcp_max_orphans = 16384"
/etc/sysctl
.conf|
wc
-l` -
ne
0 ] && action
"kernel set"
/bin/true
|| action
"kernel set"
/bin/false
#更改默认的ssh服务端口，禁止root用户远程连接，禁止空密码连接
/bin/cp
/etc/ssh/sshd_config
/etc/ssh/sshd_config
.bak
#sed -i 's/\#Port 22/Port 52113/' /etc/ssh/sshd_config
sed
-i
's/\#PermitRootLogin yes/PermitRootLogin no/'
/etc/ssh/sshd_config
sed
-i
's/\#PermitEmptyPasswords no/PermitEmptyPasswords no/'
/etc/ssh/sshd_config
sed
-i
's/\#UseDNS yes/UseDNS no/'
/etc/ssh/sshd_config
#[ `grep "Port 52113" /etc/ssh/sshd_config |wc -l` -ne 0 -a `grep "PermitRootLogin no" /etc/ssh/sshd_config|wc -l` -ne 0 -a `grep "PermitEmptyPasswords no" /etc/ssh/sshd_config|wc -l` -ne 0 -a `grep "UseDNS no" /etc/ssh/sshd_config|wc -l` -ne 0 ] &&action "ssh set" /bin/true || action "ssh set" /bin/false
[ `
grep
"PermitRootLogin no"
/etc/ssh/sshd_config
|
wc
-l` -
ne
0 -a `
grep
"PermitEmptyPasswords no"
/etc/ssh/sshd_config
|
wc
-l` -
ne
0 -a `
grep
"UseDNS no"
/etc/ssh/sshd_config
|
wc
-l` -
ne
0 ] &&action
"ssh set"
/bin/true
|| action
"ssh set"
/bin/false
#锁定关键系统文件
chattr +ai
/etc/passwd
chattr +ai
/etc/shadow
chattr +ai
/etc/group
chattr +ai
/etc/gshadow
chattr +ai
/etc/inittab
#清空/etc/issue，去除系统及内核版本登陆前的屏幕显示
/bin/cp
/etc/issue
/etc/issue
.bak
>
/etc/issue
[ `
cat
/etc/issue
|
wc
-l` -
eq
0 ] && action
"/etc/issue set"
/bin/true
|| action
"/etc/issue set"
/bin/false
|
自己整理的服务器安装后的初始化脚本：
下载：https://pan.baidu.com/s/1caZ3GE
提取密码：nifa
***************当你发现自己的才华撑不起野心时，就请安静下来学习吧***************
分类:
常规运维实录
本文转自散尽浮华博客园博客，原文链接：http://www.cnblogs.com/kevingrace/p/5897424.html
，如需转载请自行联系原作者
