简单优化 ,未涉及安全优化,如有需求请自行修改脚本实现
1 #!/bin/bash
2 SysVer=`cat /etc/redhat-release | awk -F'release' '{print $2}' | awk -F'[ .]+' '{print $2}'`
3 NetCnf=`ls /etc/sysconfig/network-scripts/ | grep if | head -1`
4 NetName=`ls /etc/sysconfig/network-scripts/ | grep if | head -1 | awk -F'-' '{print $2}'`
5 NetPath="/etc/sysconfig/network-scripts/"
6 clear
7 echo "#####################################"
8 echo "###### 1、配置网络 ######"
9 echo "###### 2、优化系统 ######"
10 echo "###### 3、命令审计 ######"
11 echo "###### 4、其他功能 ######"
12 echo "#####################################"
13 read -p "Please Input Number (1/2/3) :" Nmb
14 if [ ! $Nmb == 1 ] && [ ! $Nmb == 2 ] && [ ! $Nmb == 3 ]
15 then
16 echo -e "\033[41;33;5m Input ERROR,you Can only enter 1 or 2 or 3 \033[0m"
17 exit 110
18 fi
19
20 Jdt(){
21 echo "准备中..."
22 i=0
23 str=""
24 arr=("|" "/" "-" "\\")
25 while [ $i -le 20 ]
26 do
27 let index=i%4
28 let indexcolor=i%8
29 let color=30+indexcolor
30 let NUmbER=$i*5
31 printf "\e[0;$color;1m[%-20s][%d%%]%c\r" "$str" "$NUmbER" "${arr[$index]}"
32 sleep 0.1
33 let i++
34 str+='+'
35 done
36 printf "\n"
37 echo "正在执行...稍候！"
38 }
39
40 PanDuan(){
41 if [ ! $? -eq 0 ]
42 then
43 echo -e "\033[41;33;5m ERROR,Please To Check \033[0m"
44 exit 110
45 fi
46 }
47
48 C6NetWork(){
49 cat > $NetPath$NetCnf << END
50 DEVICE=$NetName
51 TYPE=Ethernet
52 ONBOOT=yes
53 NM_CONTROLLED=yes
54 BOOTPROTO=static
55 IPADDR=$Ipa
56 NETMASK=$Ntm
57 GATEWAY=$Gtw
58 DNS1=114.114.114.114
59 DNS2=223.5.5.5
60
61 END
62
63 service NetworkManager stop >/dev/null 2>&1
64 chkconfig NetworkManager off >/dev/null 2>&1
65 chkconfig network on >/dev/null 2>&1
66 Jdt
67 echo -e "\033[46;35;5m[ ## Network configuration succeeded ## ]\033[0m"
68 echo -e "\033[46;35;5m[ ##### Please restart the server ##### ]\033[0m"
69 }
70
71 C7NetWork(){
72 cat > $NetPath$NetCnf << EOF
73 TYPE=Ethernet
74 PROXY_METHOD=none
75 BROWSER_ONLY=no
76 BOOTPROTO=static
77 DEFROUTE=yes
78 IPV4_FAILURE_FATAL=no
79 NAME=$NetName
80 DEVICE=$NetName
81 ONBOOT=yes
82 IPADDR=$Ipa
83 NETMASK=$Ntm
84 GATEWAY=$Gtw
85 DNS1=223.5.5.5
86 DNS2=114.114.114.114
87
88 EOF
89
90 systemctl stop NetworkManager >/dev/null 2>&1
91 systemctl disable NetworkManager >/dev/null 2>&1
92 systemctl enable network.service >/dev/null 2>&1
93 Jdt
94 echo -e "\033[40;35;5m[ ## Network configuration succeeded ## ]\033[0m"
95 echo -e "\033[40;35;5m[ ##### Please restart the server ##### ]\033[0m"
96 }
97
98 OptSSH(){
99 echo "#########################################################"
100 echo -e "\033[40;34;5m[ 配置SSH 端口 关闭DNS 反向解析 ]\033[0m"
101 echo -e "\033[40;34;5m[ 关闭此终端后 请使用新SSH端口:$Pt 进行登陆 原端口失效 ]\033[0m"
102 read -p "Please enter the SSH port :" Pt
103 Jdt
104 sed -i 's/^GSSAPIAuthentication yes$/GSSAPIAuthentication no/' /etc/ssh/sshd_config
105 sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
106 sed -i "s/#Port 22/Port $Pt/" /etc/ssh/sshd_config
107 sed -i "s/^Port.*/Port $Pt/g" /etc/ssh/sshd_config
108 sed -i 's/#PrintMotd yes/PrintMotd yes/' /etc/ssh/sshd_config
109 case $SysVer in
110 6)
111 service sshd restart >/dev/null 2>&1
112 PanDuan
113 ;;
114 7)
115 systemctl restart sshd >/dev/null 2>&1
116 PanDuan
117 ;;
118 *)
119 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
120 exit 110
121 ;;
122 esac
123 }
124
125
126 OffIPv6(){
127 clear
128 echo "####################################"
129 echo -e "\033[46;34;5m[ Shutdown IpV6 关闭IPv6 ]\033[0m"
130 Jdt
131 sed -i '/.*net-pf-10.*/d' /etc/modprobe.conf
132 sed -i '/.*ipv6.*/d' /etc/modprobe.conf
133 echo "alias net-pf-10 off" >> /etc/modprobe.conf
134 echo "alias ipv6 off" >> /etc/modprobe.conf
135 }
136
137
138 OffSE(){
139 clear
140 echo "####################################"
141 echo -e "\033[40;34;5m[ Shutdown selinux ]\033[0m"
142 Jdt
143 sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
144 setenforce 0 >/dev/null 2>&1
145 }
146
147
148 OFFfirewalld(){
149 clear
150 echo "####################################"
151 echo -e "\033[40;34;5m[ Shutdown Firewalld ]\033[0m"
152 Jdt
153
154 case $SysVer in
155 6)
156 service iptables stop >/dev/null 2>&1
157 chkconfig iptables off >/dev/null 2>&1
158 ;;
159 7)
160 systemctl stop firewalld >/dev/null 2>&1
161 systemctl disable firewalld >/dev/null 2>&1
162 ;;
163 *)
164 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
165 exit 110
166 ;;
167 esac
168 }
169
170
171 TimeLock(){
172 clear
173 echo "####################################"
174 echo -e "\033[40;34;5m[ Configure TimeLock ]\033[0m"
175 Jdt
176 sed -i '/.*ntpdate.*/d' /var/spool/cron/root
177 echo "*/5 * * * * /usr/sbin/ntpdate 202.112.31.197 > /dev/null 2>&1" >> /var/spool/cron/root
178 case $SysVer in
179 6)
180 service crond restart >/dev/null 2>&1
181 ;;
182 7)
183 systemctl restart crond >/dev/null 2>&1
184 ;;
185 *)
186 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
187 exit 110
188 ;;
189 esac
190 }
191
192
193 FileLimitsConf(){
194 cat >> /etc/security/limits.conf << COMMENTBLOCK
195 * soft nofile 102400
196 * hard nofile 102400
197 * soft nproc 102400
198 * hard nproc 102400
199 COMMENTBLOCK
200 }
201
202 LimitsFile(){
203 clear
204 echo "#####################################"
205 echo -e "\033[40;34;5m[ Configure LimitNumber ]\033[0m"
206 Jdt
207 shu1=`cat /etc/rc.local | grep ulimit | wc -l`
208 shu2=`cat /etc/security/limits.conf | grep nofile | wc -l`
209 if [ $shu1 -lt 1 ]
210 then
211 echo "ulimit -SHn 102400" >> /etc/rc.local
212 fi
213
214 if [ $shu2 -lt 2 ]
215 then
216 FileLimitsConf
217 fi
218
219 case $SysVer in
220 6)
221 sed -i 's/1024$/102400/' /etc/security/limits.d/20-nproc.conf
222 ;;
223 7)
224 sed -i 's/4096$/20480/' /etc/security/limits.d/20-nproc.conf
225 sed -i 's/^#DefaultLimitNOFILE=.*/DefaultLimitNOFILE=100000/g' /etc/systemd/system.conf
226 sed -i 's/^#DefaultLimitNPROC=.*/DefaultLimitNPROC=100000/g' /etc/systemd/system.conf
227 ;;
228 *)
229 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
230 exit 110
231 ;;
232 esac
233
234 }
235
236
237 KernelFile(){
238 clear
239 echo "#####################################"
240 echo -e "\033[40;34;5m[ Optimize Kernel ]\033[0m"
241 Jdt
242 true > /etc/sysctl.conf
243 cat >> /etc/sysctl.conf << EIZ
244 net.ipv4.ip_forward = 0
245 net.ipv4.conf.default.rp_filter = 1
246 net.ipv4.conf.default.accept_source_route = 0
247 net.ipv4.conf.all.secure_redirects = 0
248 kernel.sysrq = 0
249 kernel.core_uses_pid = 1
250 net.ipv4.tcp_syncookies = 1
251 kernel.msgmnb = 65536
252 kernel.msgmax = 65536
253 kernel.shmmax = 68719476736
254 kernel.shmall = 4294967296
255 net.ipv4.tcp_max_tw_buckets = 6000
256 net.ipv4.tcp_sack = 1
257 net.ipv4.tcp_window_scaling = 1
258 net.ipv4.tcp_rmem = 4096 87380 4194304
259 net.ipv4.tcp_wmem = 4096 16384 4194304
260 net.core.wmem_default = 8388608
261 net.core.rmem_default = 8388608
262 net.core.rmem_max = 16777216
263 net.core.wmem_max = 16777216
264 net.core.netdev_max_backlog = 262144
265 net.core.somaxconn = 20480
266 net.ipv4.tcp_max_orphans = 3276800
267 net.ipv4.tcp_max_syn_backlog = 262144
268 net.ipv4.tcp_timestamps = 0
269 net.ipv4.tcp_synack_retries = 2
270 net.ipv4.tcp_syn_retries = 2
271 net.ipv4.tcp_tw_recycle = 0
272 net.ipv4.tcp_tw_reuse = 1
273 net.ipv4.tcp_mem = 94500000 915000000 927000000
274 net.ipv4.tcp_fin_timeout = 1
275 net.ipv4.tcp_keepalive_time = 30
276 net.ipv4.tcp_keepalive_probes=3
277 net.ipv4.tcp_orphan_retries=3
278 net.ipv4.ip_local_port_range = 1024 65500
279
280 EIZ
281
282 /sbin/sysctl -p
283 echo "内核优化的具体参数见上 如需修改请自行修改/etc/sysctl.conf文件"
284 echo "内核优化的具体参数见上 如需修改请自行修改/etc/sysctl.conf文件"
285 echo "内核优化的具体参数见上 如需修改请自行修改/etc/sysctl.conf文件"
286
287 }
288
289
290 RootEmail(){
291 clear
292 echo "#######################################################"
293 echo -e "\033[40;34;5m[ 禁止 You have new mail in /var/spool/mail/root 提示 ]\033[0m"
294 Jdt
295 sed -i '/.*MAILCHECK/d' /etc/profile
296 echo "unset MAILCHECK">> /etc/profile
297 source /etc/profile
298 }
299
300
301 #BieMing(){
302 #
303 #}
304
305 HisTory(){
306 #history modify
307 file_path="/var/log/Command"
308 file_name="Command.log"
309 ProFile=`cat /etc/profile | grep HISTORY_FILE | wc -l`
310 ComMand=`cat /var/spool/cron/root | grep history.sh | wc -l`
311
312 Group1(){
313 touch $file_path/$file_name
314 chown -R nobody:nobody $file_path
315 chmod 001 $file_path
316 chmod 002 $file_path/$file_name
317 chattr +a $file_path/$file_name
318 }
319 Group2(){
320 cat >> /etc/profile << EPP
321 export HISTORY_FILE=$file_path/$file_name
322 export PROMPT_COMMAND='{ date "+%y-%m-%d %T ## \$(who am i |awk "{print \\\$1,\\\$2,\\\$5}") ## \$(whoami) ## \$(history 1 | { read x cmd; echo "\$cmd"; })"; } >>\$HISTORY_FILE'
323 EPP
324 }
325
326 if [ ! -d $file_path ]
327 then
328 mkdir -p $file_path
329 Group1
330 else
331 if [ ! -f $file_path/$file_name ]
332 then
333 Group1
334 fi
335 fi
336 if [ $ProFile -lt 1 ]
337 then
338 Group2
339 else
340 sed -i '/.*HISTORY_FILE.*/d' /etc/profile
341 Group2
342 fi
343 if [ ! -f $file_path/history.sh ]
344 then
345 cat >> $file_path/history.sh << EOF
346 #!/bin/bash
347
348 #Time=\`date +%Y%m%d%H -d '-1 hours'\`
349 Time=\`date +%Y%m%d%H\`
350 logs_path="$file_path/"
351 logs_name="$file_name"
352 new_file="\$logs_path\$logs_name-\$Time"
353 old_file=\`find \$logs_path -mtime +30 -type f -name "Command.*"\`
354 chattr -a \$logs_path\$logs_name
355 mv \$logs_path\$logs_name \$new_file
356 chattr +a \$new_file
357 touch \$logs_path\$logs_name
358 chown -R nobody:nobody \$logs_path\$logs_name
359 chmod -R 002 \$logs_path\$logs_name
360 chattr +a \$logs_path\$logs_name
361 if [ ! -z \$old_file ]
362 then
363 echo "delet \$old_file \$Time" >> /var/log/messages
364 chattr -a \$old_file
365 rm -rf \$old_file
366 fi
367 EOF
368 chmod 100 $file_path/history.sh
369 fi
370 if [ $ComMand -lt 1 ]
371 then
372 echo "30 10 * * 6 /bin/bash $file_path/history.sh > /dev/null 2>&1" >> /var/spool/cron/root
373 fi
374 case $SysVer in
375 6)
376 service crond restart >/dev/null 2>&1
377 ;;
378 7)
379 systemctl restart crond >/dev/null 2>&1
380 ;;
381 *)
382 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
383 exit 110
384 ;;
385 esac
386 source /etc/profile
387 if [ $? -eq 0 ]
388 then
389 echo "###########################################"
390 echo -e "\033[40;31;5m 配置完成 命令审计文件位于：/var/log/Command/Command.log \033[0m"
391 else
392 echo -e "\033[41;33;5m ERROR,Please To Check \033[0m"
393 exit 110
394 fi
395 }
396
397 case $Nmb in
398 1)
399 rm -rf /etc/udev/rules.d/70-persistent-net.rules >/dev/null 2>&1
400 echo "###########################################"
401 read -p "Please Input IPAddress :" Ipa
402 read -p "Please Input Netmask :" Ntm
403 read -p "Please Input Gateway :" Gtw
404 echo -e "\033[40;34;5m[ 配置中请稍候... 完成后请使用新地址 $Ipa 进行SSH登陆 ]\033[0m"
405 echo "###########################################"
406 case $SysVer in
407 6)
408 C6NetWork
409 ;;
410 7)
411 C7NetWork
412 ;;
413 *)
414 echo -e "\033[41;33;5m System Version Error,Scripts only apply to Centos 6 and 7 versions \033[0m"
415 exit 110
416 ;;
417 esac
418 ;;
419 2)
420 echo -e "\033[40;31;5m以下配置均可在进度条处 有10秒时间 按Ctrl+C结束 请按需优化\033[0m"
421 OptSSH
422 PanDuan
423 OffIPv6
424 PanDuan
425 OffSE
426 OFFfirewalld
427 PanDuan
428 TimeLock
429 PanDuan
430 LimitsFile
431 PanDuan
432 RootEmail
433 PanDuan
434 KernelFile
435 PanDuan
436 echo " #####################################"
437 echo " #####################################"
438 echo " 优化已完成 本次优化内容有："
439 echo " 1、优化SSH服务"
440 echo " 2、关闭IPv6服务"
441 echo " 3、关闭Selinux 机制"
442 echo " 4、关闭iptables/firewalld"
443 echo " 5、设置时间同步"
444 echo " 6、优化内核参数"
445 echo " 7、关闭邮件提示"
446 ;;
447 3)
448 echo -e "\033[46;31;5m 此审计会记录30天内所有终端执行过的所有命令 \033[0m"
449 Jdt
450 HisTory
451 ;;
452 *)
453 echo -e "\033[41;33;5m Error, please check the first line variable \033[0m"
454 exit 110
455 ;;
456 esac
