CentOS7 初始化脚本 1.0
内容导读
互联网集市收集整理的这篇技术教程文章主要介绍了CentOS7 初始化脚本 1.0,小编现在分享给大家,供广大互联网技能从业者学习和参考。文章包含12014字,纯文字阅读大概需要18分钟。
内容图文
![CentOS7 初始化脚本 1.0](/upload/InfoBanner/zyjiaocheng/1335/87d91030c1ec439eb1426b346e1d7fea.jpg)
1 #!/bin/bash 2################################################# 3 # --Info 4 # Initialization CentOS 7.x script 5################################################# 6# Auther: shaonbean@qq.com 7# Changelog: 8 # 20180710 wanghui initial create 9################################################# 10 # Check if user is root 11# 12if [ $(id -u) != "0" ]; then 13 echo "Error: You must be root to run this script, please use root to initialization OS." 14 exit 1 15fi 16 17 echo "+------------------------------------------------------------------------+" 18 echo "| To initialization the system for security and performance |" 19 echo "+------------------------------------------------------------------------+" 20 21# add yunwei user 22user_add() 23{ 24 # add yunwei for jumpserver 25 id -u yunwei 26if [ $? -eq 0 ];then 27 useradd -s /bin/bash -d /home/yunwei -m yunwei && echo password | passwd --stdin yunwei && echo "yunwei ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/yunwei 28else 29 echo "yunwei user is exist." 30 fi 31} 32 33 # update system & install pakeage 34system_update(){ 35 echo "*** Starting update system && install tools pakeage... ***" 36 yum install epel-release -y && yum -y update 37 yum clean all && yum makecache 38 yum -y install rsync wget vim openssh-clients iftop htop iotop sysstat lsof telnet traceroute tree man iptraf lrzsz net-tools dstat tree ntpdate dos2unix net-tools git egrep 39 [ $? -eq 0 ] && echo "System upgrade && install pakeages complete." 40} 41 42# Set timezone synchronization 43timezone_config() 44{ 45 echo "Setting timezone..." 46 /usr/bin/timedatectl | grep "Asia/Shanghai" 47if [ $? -eq 0 ];then 48 echo "System timezone is Asia/Shanghai." 49else 50 timedatectl set-local-rtc 0 && timedatectl set-timezone Asia/Shanghai 51 fi 52 # config chrony 53 yum -y install chrony && systemctl start chronyd.service && systemctl enable chronyd.service 54 sed -i ‘$a 192.168.0.205 time.aniu.so‘ /etc/hosts 55 sed -i ‘s/server 0.centos.pool.ntp.org iburst/server time.aniu.so iburst/g‘ /etc/chrony.conf 56 [ $? -eq 0 ] && echo "Setting timezone && Sync network time complete." 57} 58 59# disable selinux 60selinux_config() 61{ 62 sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/g‘ /etc/selinux/config 63 setenforce 0 64 echo "Dsiable selinux complete." 65} 66 67# ulimit comfig 68ulimit_config() 69{ 70 echo "Starting config ulimit..." 71 cat >> /etc/security/limits.conf <<EOF 72 * soft nproc 8192 73 * hard nproc 8192 74 * soft nofile 8192 75 * hard nofile 8192 76EOF 77 78 [ $? -eq 0 ] && echo "Ulimit config complete!" 79 80} 81 82# sshd config 83sshd_config(){ 84 echo "Starting config sshd..." 85 sed -i ‘/^#Port/s/#Port 22/Port 54077/g‘ /etc/ssh/sshd_config 86 #sed -i "$ a\ListenAddress 0.0.0.0:21212\nListenAddress 0.0.0.0:22 " /etc/ssh/sshd_config 87 sed -i ‘/^#UseDNS/s/#UseDNS yes/UseDNS no/g‘ /etc/ssh/sshd_config 88 systemctl restart sshd 89 #sed -i ‘s/#PermitRootLogin yes/PermitRootLogin no/g‘ /etc/ssh/sshd_config 90 #sed -i ‘s/#PermitEmptyPasswords no/PermitEmptyPasswords no/g‘ /etc/ssh/sshd_config 91 [ $? -eq 0 ] && echo "SSH config complete." 92} 93 94# firewalld config 95disable_firewalld(){ 96 echo "Starting disable firewalld..." 97 rpm -qa | grep firewalld >> /dev/null 98if [ $? -eq 0 ];then 99 systemctl stop firewalld && systemctl disable firewalld 100 [ $? -eq 0 ] && echo "Dsiable firewalld complete."101else102 echo "Firewalld not install."103 fi 104} 105106# vim config 107vim_config() { 108 echo "Starting vim config..."109 /usr/bin/egrep pastetoggle /etc/vimrc >> /dev/null110if [ $? -eq 0 ];then 111 echo "vim already config"112else113 sed -i ‘$ a\set bg=dark\nset pastetoggle=<F9>‘ /etc/vimrc 114 fi 115116} 117118# sysctl config 119120config_sysctl() { 121 echo "Staring config sysctl..."122 /usr/bin/cp -f /etc/sysctl.conf /etc/sysctl.conf.bak 123 cat > /etc/sysctl.conf << EOF 124 vm.swappiness = 0125 vm.dirty_ratio = 80126 vm.dirty_background_ratio = 5127 fs.file-max = 2097152128 fs.suid_dumpable = 0129 net.core.somaxconn = 65535130 net.core.netdev_max_backlog = 262144131 net.core.optmem_max = 25165824132 net.core.rmem_default = 31457280133 net.core.rmem_max = 67108864134 net.core.wmem_default = 31457280135 net.ipv4.tcp_syncookies = 1136 net.ipv4.conf.all.rp_filter = 1137 net.ipv4.icmp_echo_ignore_all = 0138 net.ipv4.icmp_echo_ignore_broadcasts = 0139 net.ipv4.conf.all.log_martians = 1140 net.ipv4.conf.all.accept_source_route = 0141 net.ipv4.conf.all.accept_redirects = 0142EOF 143144 # eg:https://www.vultr.com/docs/securing-and-hardening-the-centos-7-kernel-with-sysctl145 # set kernel parameters work 146 /usr/sbin/sysctl -p 147 [ $? -eq 0 ] && echo "Sysctl config complete."148} 149150# ipv6 config 151disable_ipv6() { 152 echo "Starting disable ipv6..."153 sed -i ‘$ a\net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1‘ /etc/sysctl.conf 154 sed -i ‘$ a\AddressFamily inet‘ /etc/ssh/sshd_config 155 systemctl restart sshd 156 /usr/sbin/sysctl -p 157} 158159# password config 160password_config() { 161 # /etc/login.defs 162 sed -i ‘s/PASS_MIN_LEN 5/PASS_MIN_LEN 8/g‘ /etc/login.defs 163 authconfig --passminlen=8 --update 164 authconfig --enablereqlower --update 165 [ $? -eq 0 ] && echo "Config password rule complete."166} 167168# disable no use service 169disable_serivces() { 170 systemctl stop postfix && systemctl disable postfix 171 [ $? -eq 0 ] && echo "Disable postfix service complete."172} 173174#main function 175main(){ 176 user_add 177 system_update 178 timezone_config 179 selinux_config 180 ulimit_config 181 sshd_config 182 disable_firewalld 183 vim_config 184 config_sysctl 185 disable_ipv6 186 password_config 187 disable_serivces 188} 189# execute main functions 190main 191 echo "+------------------------------------------------------------------------+"192 echo "| To initialization system all completed !!! |"193 echo "+------------------------------------------------------------------------+"194———————————————— 195 版权声明:本文为CSDN博主「诸葛冰玄」的原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接及本声明。 196 原文链接:https://blog.csdn.net/embrace99999/article/details/81132443
#!/bin/bash################################################## --Info# Initialization CentOS 7.x script################################################## Auther: shaonbean@qq.com# Changelog:# 20180710 wanghui initial create################################################## Check if user is root#if [ $(id -u) != "0" ]; then echo "Error: You must be root to run this script, please use root to initialization OS." exit 1fi
echo "+------------------------------------------------------------------------+"echo "| To initialization the system for security and performance |"echo "+------------------------------------------------------------------------+"
# add yunwei useruser_add(){ # add yunwei for jumpserver id -u yunwei if [ $? -eq 0 ];then useradd -s /bin/bash -d /home/yunwei -m yunwei && echo password | passwd --stdin yunwei && echo "yunwei ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/yunwei else echo "yunwei user is exist." fi }
# update system & install pakeagesystem_update(){ echo "*** Starting update system && install tools pakeage... ***" yum install epel-release -y && yum -y update yum clean all && yum makecache yum -y install rsync wget vim openssh-clients iftop htop iotop sysstat lsof telnet traceroute tree man iptraf lrzsz net-tools dstat tree ntpdate dos2unix net-tools git egrep [ $? -eq 0 ] && echo "System upgrade && install pakeages complete."}
# Set timezone synchronizationtimezone_config(){ echo "Setting timezone..." /usr/bin/timedatectl | grep "Asia/Shanghai" if [ $? -eq 0 ];then echo "System timezone is Asia/Shanghai." else timedatectl set-local-rtc 0 && timedatectl set-timezone Asia/Shanghai fi # config chrony yum -y install chrony && systemctl start chronyd.service && systemctl enable chronyd.service sed -i ‘$a 192.168.0.205 time.aniu.so‘ /etc/hosts sed -i ‘s/server 0.centos.pool.ntp.org iburst/server time.aniu.so iburst/g‘ /etc/chrony.conf [ $? -eq 0 ] && echo "Setting timezone && Sync network time complete."}
# disable selinuxselinux_config(){ sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/g‘ /etc/selinux/config setenforce 0 echo "Dsiable selinux complete."}
# ulimit comfigulimit_config(){echo "Starting config ulimit..."cat >> /etc/security/limits.conf <<EOF* soft nproc 8192* hard nproc 8192* soft nofile 8192* hard nofile 8192EOF
[ $? -eq 0 ] && echo "Ulimit config complete!"
}
# sshd configsshd_config(){ echo "Starting config sshd..." sed -i ‘/^#Port/s/#Port 22/Port 54077/g‘ /etc/ssh/sshd_config #sed -i "$ a\ListenAddress 0.0.0.0:21212\nListenAddress 0.0.0.0:22 " /etc/ssh/sshd_config sed -i ‘/^#UseDNS/s/#UseDNS yes/UseDNS no/g‘ /etc/ssh/sshd_config systemctl restart sshd #sed -i ‘s/#PermitRootLogin yes/PermitRootLogin no/g‘ /etc/ssh/sshd_config #sed -i ‘s/#PermitEmptyPasswords no/PermitEmptyPasswords no/g‘ /etc/ssh/sshd_config [ $? -eq 0 ] && echo "SSH config complete."}
# firewalld configdisable_firewalld(){ echo "Starting disable firewalld..." rpm -qa | grep firewalld >> /dev/null if [ $? -eq 0 ];then systemctl stop firewalld && systemctl disable firewalld [ $? -eq 0 ] && echo "Dsiable firewalld complete." else echo "Firewalld not install." fi}
# vim config vim_config() { echo "Starting vim config..." /usr/bin/egrep pastetoggle /etc/vimrc >> /dev/null if [ $? -eq 0 ];then echo "vim already config" else sed -i ‘$ a\set bg=dark\nset pastetoggle=<F9>‘ /etc/vimrc fi
}
# sysctl config
config_sysctl() { echo "Staring config sysctl..." /usr/bin/cp -f /etc/sysctl.conf /etc/sysctl.conf.bak cat > /etc/sysctl.conf << EOFvm.swappiness = 0vm.dirty_ratio = 80vm.dirty_background_ratio = 5fs.file-max = 2097152fs.suid_dumpable = 0net.core.somaxconn = 65535net.core.netdev_max_backlog = 262144net.core.optmem_max = 25165824net.core.rmem_default = 31457280net.core.rmem_max = 67108864net.core.wmem_default = 31457280net.ipv4.tcp_syncookies = 1net.ipv4.conf.all.rp_filter = 1net.ipv4.icmp_echo_ignore_all = 0net.ipv4.icmp_echo_ignore_broadcasts = 0net.ipv4.conf.all.log_martians = 1net.ipv4.conf.all.accept_source_route = 0net.ipv4.conf.all.accept_redirects = 0EOF
# eg:https://www.vultr.com/docs/securing-and-hardening-the-centos-7-kernel-with-sysctl# set kernel parameters work /usr/sbin/sysctl -p [ $? -eq 0 ] && echo "Sysctl config complete."}
# ipv6 configdisable_ipv6() { echo "Starting disable ipv6..." sed -i ‘$ a\net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1‘ /etc/sysctl.conf sed -i ‘$ a\AddressFamily inet‘ /etc/ssh/sshd_config systemctl restart sshd /usr/sbin/sysctl -p}
# password configpassword_config() { # /etc/login.defs sed -i ‘s/PASS_MIN_LEN 5/PASS_MIN_LEN 8/g‘ /etc/login.defs authconfig --passminlen=8 --update authconfig --enablereqlower --update [ $? -eq 0 ] && echo "Config password rule complete."}
# disable no use servicedisable_serivces() { systemctl stop postfix && systemctl disable postfix [ $? -eq 0 ] && echo "Disable postfix service complete."}
#main functionmain(){ user_add system_update timezone_config selinux_config ulimit_config sshd_config disable_firewalld vim_config config_sysctl disable_ipv6 password_config disable_serivces}# execute main functionsmainecho "+------------------------------------------------------------------------+"echo "| To initialization system all completed !!! |"echo "+------------------------------------------------------------------------+"————————————————版权声明:本文为CSDN博主「诸葛冰玄」的原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接及本声明。原文链接:https://blog.csdn.net/embrace99999/article/details/81132443
原文:https://www.cnblogs.com/dinghailong128/p/12194933.html
内容总结
以上是互联网集市为您收集整理的CentOS7 初始化脚本 1.0全部内容,希望文章能够帮你解决CentOS7 初始化脚本 1.0所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错,欢迎将互联网集市网站推荐给程序员好友。
内容备注
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 gblab@vip.qq.com 举报,一经查实,本站将立刻删除。
内容手机端
扫描二维码推送至手机访问。