#!/bin/bash
usage() {cat <<EOFI
Usage: $0 [OPTION]
OPTION:all (expcet net_config)      #执行所有disable_selinux              #禁用selinuxuseless_user                 #删除无用账号ulimit_config                #修改ulimit限制disable_ipv6                 #禁用IPV6useless_service              #优化服务sysctl_config                #优化内核参数sshd_config                  #配置SSHDyum_config                   #配置YUM源yum_update                   #安全的自动更新软件包vim_config                   #配置VIM编辑器install_docker               #安装并配置dockerntpdate_config               #设置时间同步
EOFI
}
#禁用selinux
disable_selinux() {if grep -q '^SELINUX' /etc/selinux/config;thensed -ri '/^SELINUX/s/(SELINUX=)(.*)/\1disabled/' /etc/selinux/configelseecho "SELINUX=disabled" >>/etc/selinux/configfi
}
#删除无用账号
useless_user() {for u in lp shutdown halt news uucp operator games gopherdouserdel -r $udonefor g in lp news uucp games didogroupdel $gdone
}
#修改ulimit限制
ulimit_config() {cat > /etc/security/limits.d/30-nofile.conf << EOFI
*          soft    nofile    102400
*          hard    nofile    102400
EOFIcat > /etc/security/limits.d/20-nproc.conf << EOFI
*          soft    nproc     102400
*          hard    nproc     102400
EOFI
}
#禁用IPv6
disable_ipv6() {grep '^GRUB_CMDLINE_LINUX' /etc/default/grub|grep -q 'ipv6.disable=1'if [ $? -ne 0 ];thensed -ri '/^GRUB_CMDLINE_LINUX/s/(.*)(rhgb.*)/\1ipv6.disable=1 \2/' /etc/default/grubgrub2-mkconfig -o /boot/grub2/grub.cfgfi
}
#优化服务
useless_service() {yum remove -y postfixyum remove -y firewalld-*yum remove -y NetworkManager-*grep '^After' /etc/systemd/system/multi-user.target.wants/sshd.service|grep -q 'network.service'if [ $? -ne 0 ];thensed -ri '/^After/s/(.*)/\1 network.service/' /etc/systemd/system/multi-user.target.wants/sshd.servicefi
}
#内核参数优化
sysctl_config() {cat > /etc/sysctl.conf << EOFI
#消息队列
kernel.msgmnb = 65536
kernel.msgmax = 65536
#共享内存
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
#网络参数优化
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 65535
net.core.optmem_max = 81920
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.send_redirects = 0
#redis参数
vm.overcommit_memory = 1
vm.swappiness = 0
#IO参数优化
vm.dirty_background_ratio = 5
vm.dirty_ratio = 20
#LVS忽略VIP的arp请求
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
EOFIsysctl -p
}
#修改sshd配置
sshd_config() {sed -i 's/^#AddressFamily any$/AddressFamily inet/' /etc/ssh/sshd_configsed -i 's/^GSSAPIAuthentication yes$/GSSAPIAuthentication no/' /etc/ssh/sshd_configsed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_configgrep -q 'pam_tally2.so' /etc/pam.d/sshdif [ $? -ne 0 ];thensed -i '/pam_sepermit/a\auth       required     pam_tally2.so onerr=fail deny=3 unlock_time=60 even_deny_root root_unlock_time=180' \/etc/pam.d/sshdfi
}
#yum源配置
yum_config() {yum install -y wget epel-releasewget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.reposed -i '/aliyuncs/d' /etc/yum.repos.d/CentOS-Base.repowget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.reposed -i '/aliyuncs/d' /etc/yum.repos.d/epel.repoyum clean allyum makecache
}
#自动安全的更新
yum_update() {yum install -y yum-cronsed -i 's/update_cmd = default/update_cmd = security/' /etc/yum/yum-cron.confsed -i 's/apply_updates = no/apply_updates = yes/' /etc/yum/yum-cron.confsystemctl enable yum-cron.servicesystemctl restart yum-cron.service
}
#配置VIM编辑器
vim_config() {yum install -y vim-en*grep -q 'set tabstop' /etc/vimrcif [ $? -ne 0 ];thensed -i '/set ruler/a\set tabstop=2' /etc/vimrcfi
}
#安装并配置docker-ce
install_docker() {yum install -y yum-utils device-mapper-persistent-data lvm2yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.reposed -i 's#download.docker.com#mirrors.aliyun.com/docker-ce#' /etc/yum.repos.d/docker-ce.repoyum makecache fastyum -y install docker-cesystemctl start docker.servicecat > /etc/docker/daemon.json <<EOFI
{"registry-mirrors": ["https://bm5sgu8k.mirror.aliyuncs.com"]
}
EOFIsystemctl daemon-reloadsystemctl restart docker.service
}
#时间同步
ntpdate_config() {yum  install -y  ntpdatetimedatectl set-timezone Asia/Shanghaigrep -q '/usr/sbin/ntpdate' /var/spool/cron/rootif [ $? -ne 0 ];thenecho "11 */1 * * * /usr/sbin/ntpdate -s ntp1.aliyun.com" >>/var/spool/cron/rootfi
}
if [ -z $1 ];thenusage
fi
if [ "$1" == "all" ];thendisable_selinuxuseless_userulimit_configdisable_ipv6useless_servicesysctl_configsshd_configyum_configyum_updatevim_configinstall_dockerntpdate_config
else$1
fi