centos7 安裝後需要做的事情
阿新 • • 發佈：2017-11-13
bucket login timewait rec 長度 install fire 修改主機名 之前
安裝centos 7 系統之後要做的幾件事 #修改主機名 hostnamectl --static set-hostname xd-1 #下面是使用iptables systemctl stop firewalld.service systemctl disable firewalld.service yum -y install iptables-services adduser wwwad passwd wwwad vim /etc/ssh/sshd_config Port 10999 PermitRootLogin no systemctl restart sshd.services visudo wwwad ALL = (root) NOPASSWD: WWWAD Cmnd_Alias WWWAD = ALL #加大打開文件數的限制（open files） ulimit -n ulimit -a vi /etc/security/limits.conf 最後添加 * soft nofile 1024000 * hard nofile 1024000 hive - nofile 1024000 hive - nproc 1024000 用戶進程限制 [root@hequan ~]# sed -i ‘s#4096#65535#g‘ /etc/security/limits.d/20-nproc.conf #加大普通用戶限制 也可以改為unlimited [root@hequan ~]# egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf * soft nproc 65535 root soft nproc unlimited reboot vim /etc/sysctl.conf #CTCDN系統優化參數 #關閉ipv6 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 #決定檢查過期多久鄰居條目 net.ipv4.neigh.default.gc_stale_time=120 #使用arp_announce / arp_ignore解決ARP映射問題 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.conf.lo.arp_announce=2 # 避免放大攻擊 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 開啟惡意icmp錯誤消息保護 net.ipv4.icmp_ignore_bogus_error_responses = 1 #關閉路由轉發 net.ipv4.ip_forward = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 #開啟反向路徑過濾 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 #處理無源路由的包 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 #關閉sysrq功能 kernel.sysrq = 0 #core文件名中添加pid作為擴展名 kernel.core_uses_pid = 1 # 開啟SYN洪水攻擊保護 net.ipv4.tcp_syncookies = 1 #修改消息隊列長度 kernel.msgmnb = 65536 kernel.msgmax = 65536 #設置最大內存共享段大小bytes kernel.shmmax = 68719476736 kernel.shmall = 4294967296 #timewait的數量，默認180000 net.ipv4.tcp_max_tw_buckets = 6000 net.ipv4.tcp_sack = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_rmem = 4096 87380 4194304 net.ipv4.tcp_wmem = 4096 16384 4194304 net.core.wmem_default = 8388608 net.core.rmem_default = 8388608 net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 #每個網絡接口接收數據包的速率比內核處理這些包的速率快時，允許送到隊列的數據包的最大數目 net.core.netdev_max_backlog = 262144 #限制僅僅是為了防止簡單的DoS 攻擊 net.ipv4.tcp_max_orphans = 3276800 #未收到客戶端確認信息的連接請求的最大值 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 #內核放棄建立連接之前發送SYNACK 包的數量 net.ipv4.tcp_synack_retries = 1 #內核放棄建立連接之前發送SYN 包的數量 net.ipv4.tcp_syn_retries = 1 #啟用timewait 快速回收 net.ipv4.tcp_tw_recycle = 1 #開啟重用。允許將TIME-WAIT sockets 重新用於新的TCP 連接 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 #當keepalive 起用的時候，TCP 發送keepalive 消息的頻度。缺省是2 小時 net.ipv4.tcp_keepalive_time = 1800 net.ipv4.tcp_keepalive_probes = 3 net.ipv4.tcp_keepalive_intvl = 15 #允許系統打開的端口範圍 net.ipv4.ip_local_port_range = 1024 65000 #修改防火墻表大小，默認65536 net.netfilter.nf_conntrack_max=655350 net.netfilter.nf_conntrack_tcp_timeout_established=1200 # 確保無人能修改路由表 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 sysctl -p # 同步時間 ntpdate time.nist.gov hwclock -w #先同步一遍時間到硬件時間
centos7 安裝後需要做的事情