前言：
不管是什么部署，前期的准备工作通常都是比较繁琐的，但同时这些工作又具有程式化的特征，也就是说都是有一定的流程的，固定的步骤的。
OK，shell脚本处理这样的程式问题是非常合适的，下面就以一个操作系统初始化脚本为例，实现时区，文件打开数量，内核部分优化等等功能的shell脚本。
一，
脚本内容：
cat >> os7init.sh <EOF #!/bin/bash # init centos7 ./centos7-init.sh 主机名 # 检查是否为root用户，脚本必须在root权限下运行 if [[ "$(whoami)" != "root" ]]; then echo "please run this script as root !" >&2 exit 1 fi echo -e "\033[31m the script only Support CentOS_7 x86_64 \033[0m" echo -e "\033[31m system initialization script, Please Seriously. press ctrl+C to cancel \033[0m" # 检查是否为64位系统，这个脚本只支持64位脚本 platform=`uname -i` if [ $platform != "x86_64" ];then echo "this script is only for 64bit Operating System !" exit 1 fi if [ "$1" == "" ];then echo "The host name is empty." exit 1 else hostnamectl --static set-hostname $1 hostnamectl set-hostname $1 fi cat << EOF +---------------------------------------+ | your system is CentOS 7 x86_64 | | start optimizing | +---------------------------------------+ EOF sleep 1 # 安装必要支持工具及软件工具 yum_update(){ yum update -y yum install -y nmap unzip wget vim lsof xz net-tools iptables-services ntpdate ntp-doc psmisc } # 设置时间同步 set time zone_time(){ timedatectl set-timezone Asia/Shanghai /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1 /usr/sbin/hwclock --systohc /usr/sbin/hwclock -w cat > /var/spool/cron/root << EOF 10 0 * * * /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1 * * * * */1 /usr/sbin/hwclock -w > /dev/null 2>&1 EOF chmod 600 /var/spool/cron/root /sbin/service crond restart sleep 1 } # 修改文件打开数 set the file limit limits_config(){ cat > /etc/rc.d/rc.local << EOF #!/bin/bash touch /var/lock/subsys/local ulimit -SHn 1024000 EOF sed -i "/^ulimit -SHn.*/d" /etc/rc.d/rc.local echo "ulimit -SHn 1024000" >> /etc/rc.d/rc.local sed -i "/^ulimit -s.*/d" /etc/profile sed -i "/^ulimit -c.*/d" /etc/profile sed -i "/^ulimit -SHn.*/d" /etc/profile cat >> /etc/profile << EOF ulimit -c unlimited ulimit -s unlimited ulimit -SHn 1024000 EOF source /etc/profile ulimit -a cat /etc/profile | grep ulimit if [ ! -f "/etc/security/limits.conf.bak" ]; then cp /etc/security/limits.conf /etc/security/limits.conf.bak fi cat > /etc/security/limits.conf << EOF * soft nofile 1024000 * hard nofile 1024000 * soft nproc 1024000 * hard nproc 1024000 hive - nofile 1024000 hive - nproc 1024000 EOF if [ ! -f "/etc/security/limits.d/20-nproc.conf.bak" ]; then cp /etc/security/limits.d/20-nproc.conf /etc/security/limits.d/20-nproc.conf.bak fi cat > /etc/security/limits.d/20-nproc.conf << EOF * soft nproc 409600 root soft nproc unlimited EOF sleep 1 } # 优化内核参数 tune kernel parametres sysctl_config(){ if [ ! -f "/etc/sysctl.conf.bak" ]; then cp /etc/sysctl.conf /etc/sysctl.conf.bak fi #add cat > /etc/sysctl.conf << EOF net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_synack_retries = 1 net.ipv4.tcp_keepalive_time = 600 net.ipv4.tcp_keepalive_probes = 3 net.ipv4.tcp_keepalive_intvl =15 net.ipv4.tcp_retries1 = 3 net.ipv4.tcp_retries2 = 5 net.ipv4.tcp_fin_timeout = 10 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_max_tw_buckets = 60000 net.ipv4.tcp_max_orphans = 32768 net.ipv4.tcp_max_syn_backlog = 16384 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_wmem = 4096 16384 13107200 net.ipv4.tcp_rmem = 4096 87380 17476000 net.ipv4.ip_local_port_range = 1024 65000 net.ipv4.ip_forward = 1 net.ipv4.route.gc_timeout = 100 net.core.somaxconn = 32768 net.core.netdev_max_backlog = 32768 net.nf_conntrack_max = 6553500 net.netfilter.nf_conntrack_max = 6553500 net.netfilter.nf_conntrack_tcp_timeout_established = 180 vm.overcommit_memory = 1 vm.swappiness = 1 fs.file-max = 1024000 EOF #reload sysctl /sbin/sysctl -p sleep 1 } # 设置UTF-8 LANG="zh_CN.UTF-8" LANG_config(){ echo "LANG=\"en_US.UTF-8\"">/etc/locale.conf source /etc/locale.conf } #关闭SELINUX disable selinux selinux_config(){ sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config setenforce 0 sleep 1 } #日志处理 log_config(){ setenforce 0 systemctl start systemd-journald systemctl status systemd-journald } # 关闭防火墙 firewalld_config(){ /usr/bin/systemctl stop firewalld.service /usr/bin/systemctl disable firewalld.service } # SSH配置优化 set sshd_config sshd_config(){ if [ ! -f "/etc/ssh/sshd_config.bak" ]; then cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak fi cat >/etc/ssh/sshd_config<<EOF Port 22 AddressFamily inet ListenAddress 0.0.0.0 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key SyslogFacility AUTHPRIV PermitRootLogin yes MaxAuthTries 6 RSAAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication yes ChallengeResponseAuthentication no UsePAM yes UseDNS no X11Forwarding yes UsePrivilegeSeparation sandbox AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS Subsystem sftp /usr/libexec/openssh/sftp-server EOF /sbin/service sshd restart } # 关闭ipv6 disable the ipv6 ipv6_config(){ echo "NETWORKING_IPV6=no">/etc/sysconfig/network echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6 echo "127.0.0.1 localhost localhost.localdomain">/etc/hosts #sed -i 's/IPV6INIT=yes/IPV6INIT=no/g' /etc/sysconfig/network-scripts/ifcfg-enp0s8 for line in $(ls -lh /etc/sysconfig/network-scripts/ifcfg-* | awk -F '[ ]+' '{print $9}') do if [ -f $line ] then sed -i 's/IPV6INIT=yes/IPV6INIT=no/g' $line echo $i fi done } # 设置历史命令记录格式 history history_config(){ export HISTFILESIZE=10000000 export HISTSIZE=1000000 export PROMPT_COMMAND="history -a" export HISTTIMEFORMAT="%Y-%m-%d_%H:%M:%S " ##export HISTTIMEFORMAT="{\"TIME\":\"%F %T\",\"HOSTNAME\":\"\$HOSTNAME\",\"LI\":\"\$(who -u am i 2>/dev/null| awk '{print \$NF}'|sed -e 's/[()]//g')\",\"LU\":\"\$(who am i|awk '{print \$1}')\",\"NU\":\"\${USER}\",\"CMD\":\"" cat >>/etc/bashrc<<EOF alias vi='vim' HISTDIR='/var/log/command.log' if [ ! -f \$HISTDIR ];then touch \$HISTDIR chmod 666 \$HISTDIR fi export HISTTIMEFORMAT="{\"TIME\":\"%F %T\",\"IP\":\"\$(ip a | grep -E '192.168|172' | head -1 | awk '{print \$2}' | cut -d/ -f1)\",\"LI\":\"\$(who -u am i 2>/dev/null| awk '{print \$NF}'|sed -e 's/[()]//g')\",\"LU\":\"\$(who am i|awk '{print \$1}')\",\"NU\":\"\${USER}\",\"CMD\":\"" export PROMPT_COMMAND='history 1|tail -1|sed "s/^[ ]\+[0-9]\+ //"|sed "s/$/\"}/">> /var/log/command.log' EOF source /etc/bashrc } # 服务优化设置 service_config(){ /usr/bin/systemctl enable NetworkManager-wait-online.service /usr/bin/systemctl start NetworkManager-wait-online.service /usr/bin/systemctl stop postfix.service /usr/bin/systemctl disable postfix.service chmod +x /etc/rc.local chmod +x /etc/rc.d/rc.local #ls -l /etc/rc.d/rc.local } # VIM设置 vim_config(){ cat > /root/.vimrc << EOF set history=1000 EOF #autocmd InsertLeave * se cul #autocmd InsertLeave * se nocul #set nu #set bs=2 #syntax on #set laststatus=2 #set tabstop=4 #set go= #set ruler #set showcmd #set cmdheight=1 #hi CursorLine cterm=NONE ctermbg=blue ctermfg=white guibg=blue guifg=white #set hls #set cursorline #set ignorecase #set hlsearch #set incsearch #set helplang=cn } # done done_ok(){ touch /var/log/init-ok cat << EOF +-------------------------------------------------+ | optimizer is done | | it's recommond to restart this server ! | | Please Reboot system | +-------------------------------------------------+ EOF } # main main(){ yum_update zone_time limits_config sysctl_config LANG_config selinux_config log_config firewalld_config sshd_config ipv6_config history_config service_config vim_config done_ok } EOF
二，
脚本分析
基本都是函数模块化，比如脚本运行完毕后，将会调用done函数，使得脚本看起来比较美观：
done_ok(){ touch /var/log/init-ok cat << EOF +-------------------------------------------------+ | optimizer is done | | it's recommond to restart this server ! | | Please Reboot system | +-------------------------------------------------+ EOF }
yum安装的函数模块；
需要安装什么修改以下内容即可
# 安装必要支持工具及软件工具 yum_update(){ yum update -y yum install -y nmap unzip wget vim lsof xz net-tools iptables-services ntpdate ntp-doc psmisc }
时间同步模块：
这个模块比较生硬，建议还是手动搭建ntp时间服务器
# 设置时间同步 set time zone_time(){ timedatectl set-timezone Asia/Shanghai /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1 /usr/sbin/hwclock --systohc /usr/sbin/hwclock -w cat > /var/spool/cron/root << EOF 10 0 * * * /usr/sbin/ntpdate 0.cn.pool.ntp.org > /dev/null 2>&1 * * * * */1 /usr/sbin/hwclock -w > /dev/null 2>&1 EOF chmod 600 /var/spool/cron/root /sbin/service crond restart sleep 1 }
vim设置模块：
vim_config(){ cat > /root/.vimrc << EOF set history=1000 EOF #autocmd InsertLeave * se cul #autocmd InsertLeave * se nocul #set nu #set bs=2 #syntax on #set laststatus=2 #set tabstop=4 #set go= #set ruler #set showcmd #set cmdheight=1 #hi CursorLine cterm=NONE ctermbg=blue ctermfg=white guibg=blue guifg=white #set hls #set cursorline #set ignorecase #set hlsearch #set incsearch #set helplang=cn }
需要开启的功能注释解开，放到EOF上面即可，例如，set nu vim显示行号
当然，还有内核设置的函数，这里就不解释了，还是需要根据自己的需求做一些修改的：
比如，这里是hive用户，那要是MySQL部署，是不是得修改为mysql用户了？还有这些内核参数的值并不是特别准确，需要查询后适当调整。
# 修改文件打开数 set the file limit limits_config(){ cat > /etc/rc.d/rc.local << EOF #!/bin/bash touch /var/lock/subsys/local ulimit -SHn 1024000 EOF sed -i "/^ulimit -SHn.*/d" /etc/rc.d/rc.local echo "ulimit -SHn 1024000" >> /etc/rc.d/rc.local sed -i "/^ulimit -s.*/d" /etc/profile sed -i "/^ulimit -c.*/d" /etc/profile sed -i "/^ulimit -SHn.*/d" /etc/profile cat >> /etc/profile << EOF ulimit -c unlimited ulimit -s unlimited ulimit -SHn 1024000 EOF source /etc/profile ulimit -a cat /etc/profile | grep ulimit if [ ! -f "/etc/security/limits.conf.bak" ]; then cp /etc/security/limits.conf /etc/security/limits.conf.bak fi cat > /etc/security/limits.conf << EOF * soft nofile 1024000 * hard nofile 1024000 * soft nproc 1024000 * hard nproc 1024000 hive - nofile 1024000 hive - nproc 1024000 EOF if [ ! -f "/etc/security/limits.d/20-nproc.conf.bak" ]; then cp /etc/security/limits.d/20-nproc.conf /etc/security/limits.d/20-nproc.conf.bak fi cat > /etc/security/limits.d/20-nproc.conf << EOF * soft nproc 409600 root soft nproc unlimited EOF sleep 1 }
总的来说，脚本需要修改的地方还是比较多得，基本算是一个通用的脚本，适用于x86_64位的centos7操作系统
目前来说，我还是比较喜欢这个脚本的done函数，能够有效提升脚本的逼格，其它的模块不值一提吧~~~~~~~~~~
