centos 6.9版本虛擬機器模版製作

1、掛載本地ios映象檔案作為yum源

（1）、連線虛擬機器的ios資料檔案

（2）、建立目錄/mnt/cdrom

	`mkdir /mnt/cdrom`

（3）、掛載光碟

    `mount /dev/sr0 /mnt/cdrom`

（4）、編輯yum檔案

cd /etc/yum.repo.d
rm -rf *
vi default.repo

新增：

[local]
name=localyum
baseurl=file:///mnt/cdrom/
gpgcheck=0
enabled=1

2、安裝依賴包

yum install -y zlib-devel gcc telnet lrzsz pam-devel

3、升級openssh7.6p1

（1）、上傳安裝包

cd /usr/local
rz 選中openssh-7.6p1.tar.gz  openssl-1.0.2n.tar.gz

（2）、升級openssl

解除安裝舊版本的openssl：
rpm -e openssl-1.0.1e-57.el6.x86_64 --nodeps
解壓：
tar -zxvf openssl-1.0.2n.tar.gz
進入目錄：
cd openssl-1.0.2n
編譯

	./config shared zlib --prefix=/usr/local/openssl
	make
	make test
	make install
 

修改配置庫檔案搜尋路徑
vi /etc/ld.so.conf
新增：/usr/local/openssl/lib
重新整理快取: ldconfig -v

	cd /usr/local/openssl/lib
	cp libssl.so.1.0.0 /usr/lib64
	cp libcrypto.so.1.0.0 /usr/lib64/
	chmod 555 /usr/lib64/libssl.so.1.0.0
	chmod 555 /usr/lib64/libcrypto.so.1.0.0
	ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so.10
	ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so.10
	ln -s /usr/lib64/libcrypto.so.1.0.0 /usr/lib64/libcrypto.so
	ln -s /usr/lib64/libssl.so.1.0.0 /usr/lib64/libssl.so
 

修改環境變數
vi /etc/profile
新增：

	PATH=/usr/local/openssl/bin:$PATH
	export PATH

生效 source /etc/profile
檢視openssl版本是否正確 openssl version -a

（3）升級openssh

停止ssh服務：service sshd stop
解除安裝舊版本的openssh：

	[[email protected] openssl-1.0.2n]# rpm -qa |grep openssh
	openssh-5.3p1-122.el6.x86_64
	openssh-clients-5.3p1-122.el6.x86_64
	openssh-server-5.3p1-122.el6.x86_64
	openssh-askpass-5.3p1-122.el6.x86_64

解除安裝：

	rpm -e --nodeps openssh-askpass-5.3p1-122.el6.x86_64
	rpm -e --nodeps openssh-server-5.3p1-122.el6.x86_64
	rpm -e --nodeps openssh-clients-5.3p1-122.el6.x86_64
	rpm -e --nodeps openssh-5.3p1-122.el6.x86_64

備份配置檔案：mv /etc/ssh/ /etc/ssh.old/
解壓 tar zxvf openssh-7.6p1.tar.gz
進入目錄 cd openssh-7.6p1
編譯

	./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-ssl-dir=/usr/local/openssl --with-md5-passwords --mandir=/usr/share/man
	make
	make install

新增啟動指令碼

	cp ./contrib/redhat/sshd.init /etc/init.d/sshd
	chmod +x /etc/init.d/sshd
	chkconfig --add sshd

重啟ssh
service sshd start
確認ssh openssl版本
ssh -V
顯示OpenSSH_7.6p1, OpenSSL 1.0.2n 7 Dec 2017即完成升級

編輯sshd配置檔案：
vi /etc/ssh/sshd_config
新增：

X11Forwarding yes
PermitRootLogin yes

修改#UsePAM no為UsePAM yes

增加pam模組認證檔案

cd /etc/pam.d/	
vi sshd

新增：

					#%PAM-1.0
					auth            include         system-auth
					account         required        pam_nologin.so
					account         include         system-auth
					password        include         system-auth
					session         optional        pam_keyinit.so force revoke
					session         include         system-auth
					session         required        pam_loginuid.so

重啟ssh
service sshd restart

4、關閉不使用的服務

（1）、檢視開啟的服務列表

		chkconfig --list |grep on
		[[email protected] pam.d]# chkconfig --list |grep on
		abrt-ccpp       0:off   1:off   2:off   3:on    4:off   5:on    6:off
		abrtd           0:off   1:off   2:off   3:on    4:off   5:on    6:off
		acpid           0:off   1:off   2:on    3:on    4:on    5:on    6:off
		atd             0:off   1:off   2:off   3:on    4:on    5:on    6:off
		auditd          0:off   1:off   2:on    3:on    4:on    5:on    6:off
		autofs          0:off   1:off   2:off   3:on    4:on    5:on    6:off
		blk-availability        0:off   1:on    2:on    3:on    4:on    5:on    6:off
		bluetooth       0:off   1:off   2:off   3:on    4:on    5:on    6:off
		certmonger      0:off   1:off   2:off   3:on    4:on    5:on    6:off
		cpuspeed        0:off   1:on    2:on    3:on    4:on    5:on    6:off
		crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
		cups            0:off   1:off   2:on    3:on    4:on    5:on    6:off
		haldaemon       0:off   1:off   2:off   3:on    4:on    5:on    6:off
		ip6tables       0:off   1:off   2:on    3:on    4:on    5:on    6:off
		iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
		irqbalance      0:off   1:off   2:off   3:on    4:on    5:on    6:off
		lvm2-monitor    0:off   1:on    2:on    3:on    4:on    5:on    6:off
		mdmonitor       0:off   1:off   2:on    3:on    4:on    5:on    6:off
		messagebus      0:off   1:off   2:on    3:on    4:on    5:on    6:off
		netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off
		netfs           0:off   1:off   2:off   3:on    4:on    5:on    6:off
		network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
		nfslock         0:off   1:off   2:off   3:on    4:on    5:on    6:off
		portreserve     0:off   1:off   2:on    3:on    4:on    5:on    6:off
		postfix         0:off   1:off   2:on    3:on    4:on    5:on    6:off
		rdma            0:off   1:on    2:on    3:on    4:on    5:on    6:off
		restorecond     0:off   1:off   2:off   3:off   4:off   5:off   6:off
		rpcbind         0:off   1:off   2:on    3:on    4:on    5:on    6:off
		rpcgssd         0:off   1:off   2:off   3:on    4:on    5:on    6:off
		rsyslog         0:off   1:off   2:on    3:on    4:on    5:on    6:off
		spice-vdagentd  0:off   1:off   2:off   3:off   4:off   5:on    6:off
		sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
		sysstat         0:off   1:on    2:on    3:on    4:on    5:on    6:off
		udev-post       0:off   1:on    2:on    3:on    4:on    5:on    6:off
		wdaemon         0:off   1:off   2:off   3:off   4:off   5:off   6:off

（2）、關閉服務

		chkconfig bluetooth off；chkconfig ip6tables off;chkconfig iptables off；
		service bluetooth stop;service ip6tables stop;service iptables stop;

5、優化

（1）、調整檔案描述符大小

		#檢視檔案描述符大小
		ulimit -n
		# 調整
		vi /etc/security/limits.conf
		* soft nofile 65535
		* hard nofile 65535
		* soft nproc 65535
		* hard nproc 65535
		* soft nofile 65535
		* hard nofile 65535 

（2）、核心引數優化

		vi /etc/sysctl.conf
		新增：
		net.ipv4.tcp_max_syn_backlog = 65536
		net.core.netdev_max_backlog = 32768
		net.core.somaxconn = 32768

		net.core.wmem_default = 8388608
		net.core.rmem_default = 8388608
		net.core.rmem_max = 16777216
		net.core.wmem_max = 16777216

		net.ipv4.tcp_timestamps = 0
		net.ipv4.tcp_synack_retries = 2
		net.ipv4.tcp_syn_retries = 2

		net.ipv4.tcp_tw_reuse = 1
		net.ipv4.tcp_max_tw_buckets=10000
		net.ipv4.tcp_mem = 94500000 915000000 927000000
		net.ipv4.tcp_max_orphans = 3276800
		生效：/sbin/sysctl -p

6、時間同步

	crontab -e
	# xxx為時間同步伺服器地址
	#*/5 * * * * /usr/sbin/ntpdate xxxx  >/dev/null 2 >&1

7、修改網絡卡配置

（1）、刪除網絡卡PCI記錄

		vi /etc/udev/rules.d/70-persistent-net.rules
		刪除：
		SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:50:56:be:00:5c", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

（2）、刪除ip mac地址