#!/bin/bash
#modify some service demeon   # 關閉不需要用到的一些服務
systemctl disable acpid
systemctl disable ip6tables
systemctl disable mcelogd
systemctl disable mdmonitor
systemctl disable netfs
systemctl disable nfslock
systemctl disable openct
systemctl disable postfix 
systemctl disable rpcbind
systemctl disable rpcgssd
systemctl disable rpcidmapd
systemctl disable auditd
systemctl disable haldaemon
systemctl disable lldpad
systemctl disable atd
systemctl disable kdump

#Close selinux  # 關閉selinux
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
sed -i ‘s/SELINUXTYPE=targeted/#&/‘ /etc/selinux/config
setenforce 0

#Create new partitions   # 創建分區，並格式化及掛載
NEWDISK="/dev/xvdb"
FDK=`fdisk -l $NEWDISK | grep $NEWDISK | wc -l`
if [ $FDK -eq 0 ] ; then
  echo "沒有$NEWDISK設備，無法創建分區!"
elif [ $FDK -eq 1 ] ; then
  fdisk $NEWDISK << EOF
n
p
1

w
EOF
  partprobe
  sleep 2
  file ${NEWDISK}1
  if [ $? -eq 0 ] ; then
    mkfs -t ext4 ${NEWDISK}1
    if [ $? -eq 0 ] && [ ! -d /data ] ; then
      mkdir /data
      mount ${NEWDISK}1 /data
      FST=`cat /etc/fstab | grep ${NEWDISK}1 | wc -l`
      if [ $FST -eq 0 ] ; then
        echo "${NEWDISK}1 /data ext4 defaults 0 0" >> /etc/fstab
        echo "成功創建${NEWDISK}1分區，已成功格式化，並已掛載至/data下，已添加至/etc/fstab開機掛載！"
      else
        echo "成功創建${NEWDISK}1分區，已成功格式化，並已掛載至/data下，請檢查/etc/fstab文件是否已添加開機掛載！"
      fi
    else
      echo "格式化${NEWDISK}1失敗；或者/data目錄已存在，掛載失敗！"
    fi
  else
    echo "沒有找到${NEWDISK}1分區，未格式化!"
  fi
else
  echo "${NEWDISK}1分區已存在，無須再創建!"
fi

#modify bashrc   # 設置一個ip命令別名，用於查看本地IP地址
cat << EOF >>/etc/bashrc
alias ip=‘/sbin/ifconfig | grep ‘\‘‘inet ‘\‘‘ | awk ‘\‘‘{print $2}‘\‘‘ | sed -e ‘\‘‘/127\.0\.0\.1/d‘\‘‘‘
EOF

#Create an ordinary user   # 創建一個xuad用戶，並允許其用sudo命令時不需要輸入密碼，並禁止root用戶登陸
NEWUSER="xuad"
PASS="JKbL*u#E%317Y8c"
id $NEWUSER
if [ $? -eq 0 ] ; then
  echo "$NEWUSER賬戶已存在，無法創建!"
else
  useradd $NEWUSER
  echo $PASS | passwd --stdin $NEWUSER
  if [ $? -eq 0 ] ; then
    echo "$NEWUSER賬戶創建成功！"
    sed -i "/^root/a\$NEWUSER\tALL=(ALL)\tNOPASSWD: ALL" /etc/sudoers
    sed -i ‘/^PermitRootLogin/s/^/#/g‘ /etc/ssh/sshd_config
    sed -i ‘/PermitRootLogin/a\PermitRootLogin no‘ /etc/ssh/sshd_config
  else
    echo "$NEWUSER賬戶創建失敗！"
  fi
fi

#system settings   # 修改limit參數
cat << EOF >>/etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535
EOF

#設置開機自動同步時間
cat << EOF >>/etc/rc.d/rc.local
/usr/sbin/ntpdate ntp.xuadup.net && hwclock -w
EOF

#modify ntp server   # 每天早上6點自動同步時間
echo "00 */6 * * * /usr/sbin/ntpdate ntp.xuadup.net && hwclock -w">/tmp/ntpcron.txt;crontab /tmp/ntpcron.txt

#modify ssh port   # 修改ssh端口號
sed -i ‘/Port 22/s/^/#/g‘ /etc/ssh/sshd_config
sed -i ‘/Port 22/a\Port 5210‘ /etc/ssh/sshd_config
sed -i ‘/^GSSAPI/s/^/#/g‘ /etc/ssh/sshd_config
sed -i ‘/GSSAPI options/a\GSSAPIAuthentication no‘ /etc/ssh/sshd_config

#service sshd restart   # 重啟sshd服務，並執行防火墻策略
if [ $? -eq 0 ] ; then
  systemctl restart sshd
  sh ./firewalld_linux
  echo "sshd服務重啟成功，遠程登陸端口已設置為55210"
else
  echo "sshd服務配置有問題，請檢查！"
fi
 

firewalld防火墻腳本如下：

#!/bin/bash
systemctl stop firewalld
\cp -p /usr/lib/firewalld/zones/drop.xml /etc/firewalld/zones/
systemctl start firewalld
firewall-cmd --set-default-zone=drop
firewall-cmd --permanent --zone=drop --change-interface=eth0
firewall-cmd --permanent --zone=drop --add-protocol=icmp
firewall-cmd --permanent --zone=drop --add-masquerade
firewall-cmd --permanent --zone=drop --add-rich-rule="rule family="ipv4" source address="192.168.2.208" port protocol="tcp" port="5210" accept"
firewall-cmd --permanent --zone=drop --add-rich-rule="rule family="ipv4" source address="192.168.2.206" port protocol="tcp" port="5210" accept"
firewall-cmd --permanent --zone=drop --add-rich-rule="rule family="ipv4" source address="116.226.230.115" port protocol="tcp" port="8023" accept"
firewall-cmd --reload
 

Centos 7初始化腳本