centos8系统初始化一键优化脚本

centos8/Rocky8系统初始化一键优化脚本

color () {
        RES_COL=60
        MOVE_TO_COL="echo -en \\033[${RES_COL}G"
        SETCOLOR_SUCCESS="echo -en \\033[1;32m"
        SETCOLOR_FAILURE="echo -en \\033[1;31m"
        SETCOLOR_WARNING="echo -en \\033[1;33m"
        SETCOLOR_NORMAL="echo -en \E[0m"
        echo -n "$1" && $MOVE_TO_COL
        echo -n "["
        if [ $2 = "success" -o $2 = 0 ] ;then
                ${SETCOLOR_SUCCESS}
                echo -n $" ok "
        elif [ $2 = "failure" -o $2 = "1" ] ;then
                ${SETCOLOR_FAILURE}
                echo -n $"FAILED"
        else    
                ${SETCOLOR_WARNING}
        fi
        ${SETCOLOR_NORMAL}
        echo -n "]"
        echo
}
 
disable_selinux () {
#关闭SELinux 
	sed -i '/^SELINUX=/c SELINUX=disabled' /etc/selinux/config
	color "SElinux已关闭" 0
}
 
#关闭防火墙
disable_firewall () {
systemctl disable --now firewalld 
color "防火墙已关闭" 0
}
 
set_hostname() {
echo "开始配置主机名"
echo "Rocky_100" > /etc/hostname
hostnamectl set-hostname "Rocky_100"
color "主机名配置已完成" 0
 
}
 
 
 
 
# 配置vimrc环境
set_vimrc() {
echo "开始配置vimrc环境"
cat>~/.vimrc<<EOF
set nu
set cul
set tabstop=2
set expandtab
set shiftwidth=2
set ai
set softtabstop=2
map <F2> :set paste <CR> o
map <F3> :set expandtab <CR> :%retab! <CR>  :wq! <CR>
map <F4> :set binary <CR> :set noendofline <CR>  :wq! <CR>
autocmd BufNewFile *.sh exec ":call SetTitle()"
function SetTitle()
        if expand("%:e") == 'sh'
        call setline(1,"#!/bin/bash")
        call setline(2,"#")
        call setline(3,"#********************************************************************")
        call setline(4,"#Author:                zhangxuelong")
        call setline(5,"#QQ:                    1024320609")
        call setline(6,"#Date:                  ".strftime("%Y-%m-%d"))
        call setline(7,"#FileName：             ".expand("%"))
        call setline(8,"#URL:                  	https://www.cnblogs.com/zxl1024320609/")
        call setline(9,"#Description：          For personal learning")
        call setline(10,"#Copyright (C):        ".strftime("%Y")." All rights reserved")
        call setline(11,"#********************************************************************")
        call setline(12,"")
        endif
endfunc
autocmd BufNewFile * normal G
EOF
 
color "配置vimrc环境已完成" 0
}
 
 
 
 
#rocky配置软件仓库
yum_rocky_config () {
	mkdir /etc/yum.repos.d/backup
	mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup
	cat > /etc/yum.repos.d/base.repo <<EOF
[BaseOS]
name=BaseOS
baseurl=https://mirror.nju.edu.cn/rocky/\$releasever/BaseOS/\$basearch/os/
gpgcheck=0
 
[AppStream]
name=AppStream
baseurl=https://mirror.nju.edu.cn/rocky/\$releasever/AppStream/\$basearch/os/
gpgcheck=0
 
[epel]
name=epel repo
baseurl=http://mirrors.aliyun.com/epel/\$releasever/Everything/\$basearch/
	https://mirrors.tuna.tsinghua.edu.cn/epel/\$releasever/Everything/\$basearch/
	https://mirrors.cloud.tencent.com/epel/\$releasever/Everything/\$basearch/
gpgcheck=0
 
[extras]
name=extras
baseurl=https://mirrors.nju.edu.cn/rocky/\$releasever/extras/\$basearch/os/
gpgcheck=0
EOF
	color "软件仓库配置完成" 0
}
 
#centos配置软件仓库
yum_centos_config () {
	mkdir /etc/yum.repos.d/backup
	mv /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup
	cat > /etc/yum.repos.d/base.repo <<EOF
[BaseOS]
name=BaseOS
baseurl=https://mirrors.cloud.tencent.com/centos/\$releasever/BaseOS/\$basearch/os/
gpgcheck=0
 
[AppStream]
name=AppStream
baseurl=https://mirrors.cloud.tencent.com/centos/\$releasever/AppStream/\$basearch/os/
gpgcheck=0
 
[epel]
name=epel repo
baseurl=http://mirrors.aliyun.com/epel/\$releasever/Everything/\$basearch/
	https://mirrors.tuna.tsinghua.edu.cn/epel/\$releasever/Everything/\$basearch/
	https://mirrors.cloud.tencent.com/epel/\$releasever/Everything/\$basearch/
gpgcheck=0
 
[extras]
name=extras
baseurl=https://mirrors.cloud.tencent.com/centos/\$releasever/extras/\$basearch/os/
gpgcheck=0
EOF
	color "软件仓库配置完成" 0
}
 
 
 
#修改网卡名称,配置IP地址
network_config () {
	sed -ri '/GRUB_CMDLINE_LINUX=/s#(.*)"$#\1 net.ifnames=0"#' /etc/default/grub
	grub2-mkconfig -o /boot/grub2/grub.cfg
	rm -f /etc/sysconfig/network-scripts/ifcfg-*
    cat > /etc/sysconfig/network-scripts/ifcfg-eth0 <<EOF
TYPE=Ethernet
BOOTPROTO=static
NAME=eth0
DEVICE=eth0
ONBOOT=yes
IPADDR=192.168.100.101
NETMASK=255.255.255.0
GATEWAY=192.168.100.2
DNS1=223.5.5.5
DNS2=114.114.114.114
EOF
nmcli connection reload
nmcli connection up eth0
color "网卡配置完成" 0
}
 
#最小化安装系统后，建议安装常用软件
install_packages () {
yum -y install autofs vim-enhanced tcpdump chrony lrzsz tree telnet ftp lftp redhat-lsb-core bash-completion net-tools postfix wget bzip2 zip unzip xz lsof mlocate man-pages rsync gcc gcc-c++ automake pcre pcre-devel openssl openssl-devel iproute iotop  
color "常用软件安装完成" 0
}
 
#支持光盘,/misc/cd对应就是光盘内容
set_cdrom () {
systemctl enable --now autofs
color "自动连接光盘已完成，访问路径：/misc/cd" 0
}
 
# 配置中文
set_chinese() {
echo "开始配置中文"
yum -y install langpacks-zh_CN
sed -i  's/^LANG="en_US.UTF-8"/LANG="zh_CN.UTF-8"/g' /etc/locale.conf
color "配置中文已完成" 0
}
 
 
set_env () {
	cat > /etc/profile.d/env.sh << EOF
PS1='\[\e[1;36m\][\u@\h \W]\\$\[\e[0m\]'
export EDITOR=vim
export HISTTIMEFORMAT="%F %T"
EOF
color "常用环境变量已配置" 0
}
 
set_limit() {
echo "开始优化系统资源限制"
cat > /etc/security/limits.conf <<'EOF'
root  soft  core      unlimited
root  hard  core      unlimited
root  soft  nproc     1000000
root  hard  nproc     1000000
root  soft  nofile    1000000
root  hard  nofile    1000000
root  soft  memlock   32000
root  hard  memlock   32000
root  soft  msgqueue  8192000
root  hard  msgqueue  8192000
*     soft  core      unlimited
*     hard  core      unlimited
*     soft  nproc     1000000
*     hard  nproc     1000000
*     soft  nofile    1000000
*     hard  nofile    1000000
*     soft  memlock   32000
*     hard  memlock   32000
*     soft  msgqueue  8192000
*     hard  msgqueue  8192000
EOF
color "优化系统资源限制已完成" 0
}
 
set_kernel_params() {
cat > /etc/sysctl.conf <<'EOF'
# 1：开启严格的反向路径校验。对每个进来的数据包，校验其反向路径是否是最佳路径。如果反向路径不是最佳路径，则直接丢弃该数据包。
#  减少DDoS攻击,校验数据包的反向路径，如果反向路径不合适，则直接丢弃数据包，避免过多的无效连接消耗系统资源。
#  防止IP Spoofing,校验数据包的反向路径，如果客户端伪造的源IP地址对应的反向路径不在路由表中，或者反向路径不是最佳路径，则直接丢弃数据包，不会向伪造IP的客户端回复响应。
net.ipv4.conf.default.rp_filter = 1
# 监听非本机
net.ipv4.ip_nonlocal_bind = 1
# 转发
net.ipv4.ip_forward = 1
#处理无源路由的包
net.ipv4.conf.default.accept_source_route = 0
#关闭sysrq功能
kernel.sysrq = 0
#core文件名中添加pid作为扩展名
kernel.core_uses_pid = 1
# tcp_syncookies是一个开关，是否打开SYN Cookie功能，该功能可以防止部分SYN攻击。tcp_synack_retries和tcp_syn_retries定义SYN的重试次数。
net.ipv4.tcp_syncookies = 1
# docker
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
# docker运行时，需要设置为1
fs.may_detach_mounts = 1
#修改消息队列长度
kernel.msgmnb = 65536
kernel.msgmax = 65536
#设置最大内存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
 
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_sack = 1
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
# net.core.somaxconn 是Linux中的一个kernel参数，表示socket监听（listen）的backlog上限。什么是backlog呢？backlog就是socket的监听队列，当一个请求（request）尚未被处理或建立时，他会进入backlog。而socket server可以一次性处理backlog中的所有请求，处理后的请求不再位于监听队列中。当server处理请求较慢，以至于监听队列被填满后，新来的请求会被拒绝。 
net.core.somaxconn = 20480
net.core.optmem_max = 81920
# tcp_max_syn_backlog 进入SYN包的最大请求队列.默认1024.对重负载服务器,增加该值显然有好处.
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_syn_retries = 3
net.ipv4.tcp_retries1 = 3
net.ipv4.tcp_retries2 = 15
# 在使用 iptables 做 nat 时，发现内网机器 ping 某个域名 ping 的通，而使用 curl 测试不通, 原来是 net.ipv4.tcp_timestamps 设置了为 1 ，即启用时间戳
net.ipv4.tcp_timestamps = 0
# tw_reuse 只对客户端起作用，开启后客户端在1s内回收
net.ipv4.tcp_tw_reuse = 1
# recycle 同时对服务端和客户端启作用。如果服务端断开一个NAT用户可能会影响。
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_fin_timeout = 1
# Nginx 之类的中间代理一定要关注这个值，因为它对你的系统起到一个保护的作用，一旦端口全部被占用，服务就异常了。 tcp_max_tw_buckets 能帮你降低这种情况的发生概率，争取补救时间。
net.ipv4.tcp_max_tw_buckets = 20000
# 这个值表示系统所能处理不属于任何进程的socket数量，当我们需要快速建立大量连接时，就需要关注下这个值了。 
net.ipv4.tcp_max_orphans = 327680
# 15. 现大量fin-wait-1
#首先，fin发送之后，有可能会丢弃，那么发送多少次这样的fin包呢？fin包的重传，也会采用退避方式，在2.6.358内核中采用的是指数退避，2s，4s，最后的重试次数是由
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syncookies = 1
# KeepAlive的空闲时长，或者说每次正常发送心跳的周期，默认值为7200s（2小时）
net.ipv4.tcp_keepalive_time = 300
# KeepAlive探测包的发送间隔，默认值为75s
net.ipv4.tcp_keepalive_intvl = 30
# 在tcp_keepalive_time之后，没有接收到对方确认，继续发送保活探测包次数，默认值为9（次）
net.ipv4.tcp_keepalive_probes = 3
# 允许超载使用内存，避免内存快到极限报错
vm.overcommit_memory = 1
# 0,内存不足启动oom killer. 1内存不足,kernel panic(系统重启) 或oom. 2. 内存不足, 强制kernel panic. (系统重启) 
vm.panic_on_oom=0
vm.swappiness = 10
#net.ipv4.conf.eth1.rp_filter = 0
#net.ipv4.conf.lo.arp_ignore = 1
#net.ipv4.conf.lo.arp_announce = 2
#net.ipv4.conf.all.arp_ignore = 1
#net.ipv4.conf.all.arp_announce = 2
net.ipv4.tcp_mem = 786432 1048576 1572864
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
# 随机端口的范围
net.ipv4.ip_local_port_range = 10001 65000
 
# inotify监听文件数量
fs.inotify.max_user_watches=89100
 
# 文件打开数量
# 所有进程 
fs.file-max=52706963
# 单个进程
fs.nr_open=52706963
EOF
color "内核参数优化已完成" 0
}
 
init_install() {
 
function_arr=("disable_selinux" "disable_firewall" "set_hostname" "set_vimrc" "yum_centos_config" "install_packages" "set_cdrom" "set_chinese" "set_env" "set_limit" "set_kernel_params" "network_config")
 
for func in ${function_arr[@]} ;do 
 $func
 sleep 2
 
done
color "初始化完成，10s后重启系统！" 0
sleep 10
 
reboot
}
init_install