001.linux的基础优化(期中架构方面的优化)

1. linux内核优化

第一步

cat >>/etc/sysctl.conf<<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
EOF

第二步：

sysctl -p

----可选的优化配置<如果开启防火墙可以使用>

iptables
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

2. 添加双网卡需要激活

*###setup的启动网卡配置中 Controlled by NetworkManager 如果无法访问网络可以尝试去掉这个选选项

3. 关闭防火墙(2步)

sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
/etc/init.d/iptables stop

4. 时间同步服务(2步)

\ntpdate -u cn.pool.ntp.org
hwclock -w \写入硬件时间
hwclock -r \查看当前硬件时间

配置时间同步任务
yum -y install ntp \安装时间同步工具

2. 同步时间的两种方法
-1.开机同步
vim /etc/rc.d/rc.local
/usr/sbin/ntpdate -u cn.pool.ntp.org >/dev/null 2>&1; /sbin/hwclock -w

-2.定时任务同步
vi /etc/crontab
*/10 * * * * /usr/sbin/ntpdate time.windows.com >/dev/null 2>&1;/sbin/hwclock -w #(更新时间同时写入硬件)

5.配置yum源添加eper源

更换yum源
-1. 清除yum源缓存
yum clean all
-2.备份yum源
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
-3.更换 centos 7源
下载新的源: wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
-4.添加epel源
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
-5.生成缓存
yum makecache

6.精简开机自启动

chkconfig|egrep -v "crond|sshd|network|rsyslog|sysstat"|awk '{print "chkconfig",$1,"off"}'|bash

7.字符集更改

cp /etc/sysconfig/i18n /etc/sysconfig/i18n.ori
echo 'LANG="en_US.UTF-8"' >/etc/sysconfig/i18n
source /etc/sysconfig/i18n
echo $LANG

8.历史命令,断开时间优化

echo 'export TMOUT=300' >>/etc/profile
echo 'export HISTSIZE=5' >>/etc/profile
echo 'export HISTFILESIZE=5' >>/etc/profile
tail -3 /etc/profile
. /etc/profile

9.下载安装系统基础软件

yum install lrzsz nmap tree dos2unix nc -y

10.配置hosts文件(非优化项目,仅为实验)

cat >/etc/hosts<<EOF
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.16.1.5 lb01
172.16.1.6 lb02
172.16.1.7 web01
172.16.1.8 web02
172.16.1.9 web03
172.16.1.51 db01
172.16.1.31 nfs01
172.16.1.41 backup
172.16.1.61 m01
172.16.1.62 jumpserver
EOF