#!/bin/bash

#set env

export LANG="en_US.UTF-8"

export PATH=$PATH:/bin/sbin:/usr/sbin

#whether root to running user

if [[ $(whoami) != root ]];then

   echo "please su - root run the script."

fi

SERVICE=`which service`

CHKCONFIG=`which chkconfig`

. /etc/init.d/functions

#set time

initTime(){

   yum -y install ntpdate > /dev/null 2>&1

   ntpdate asia.pool.ntp.org > /dev/null 2>&1

   echo "*/5 * * * * ntpdate asia.pool.ntp.org >> /var/spool/cron/root 2> /dev/null" > /var/spool/cron/root 2> /dev/null

   [ $? -eq 0 ] && action "initTime is ok " /bin/true || exit 1

   sleep 3

}

#install packages

initTool(){

   yum -y install sysstat net-snmp lrzsz sar gcc gcc-c++ > /dev/vull 2>&1

   yum groupinstall "Compatibility libraries" "Base" "Development tools" > /dev/null 2>&1

   yum groupinstall "debugging Tools" "Dial-up Networking Support" >/dev/null 2>&1

   [ $? -eq 0 ] && action "initTool is ok " /bin/true || exit 1

   sleep 3

}

#update the system lang

initI18n(){

   cat /etc/sysconfig/i18n > /etc/sysconfig/i18n.bak

   echo LANG="en_US.UTF-8" >> /etc/sysconfig/i18n

   source /etc/sysconfig/i18n

   [ $? -eq 0 ] && action "initI18n is ok.." /bin/true || exit 1

   sleep 3

}

#start iptables

initSelinux(){

   selinux="`/usr/sbin/getenforce`"

   cat /etc/selinux/config > /etc/selinux/config.bak

   [ $selinux != "Disabled" ] &&  /usr/sbin/setenforce 0 > /dev/null 2>& 1 || echo "selinux is ok... "

   sleep 3

}

#close not need to service

initService(){

   export LANG="en_US.UTF-8"

   for i in `chkconfig --list | grep -i "3:on" | awk ‘{print $1}‘`;do chkconfig $i off; done

   for i in crond network rsyslog sshd;do chkconfig --level 3 $i on;done

   [ $? -eq 0 ] && action "initService is ok.." /bin/true || exit 1

   sleep 3

}

#youhua for ssh

initSsh(){

   cat /etc/ssh/sshd_config > /etc/ssh/sshd_config.bak

   useradd user > /dev/null 2>&1

   echo "feb803873cc1401f" | passwd --stdin user

   sed -i ‘s/#Port 22/Port 22/‘ /etc/ssh/sshd_config

   sed -i ‘s/#PermitRootLogin yes/PermitRootLogin yes/‘ /etc/ssh/sshd_config

   sed -i ‘s/#PermitEmptyPasswords no/PermitEmptyPasswords no/‘ /etc/ssh/sshd_config

   /etc/init.d/sshd stop > /dev/null 2>& 1

   [ $? -eq 0 ] || exit 1

   /etc/init.d/sshd start > /dev/null 2>& 1

   [ $? -eq 0 ] && action "initSsh is ok.." || exit 1

}

#change file inode

openFiles(){

   cat /etc/security/limits.conf > /etc/security/limits.conf.bak

   echo "ulimit -HSn 65535" >> /etc/security/limits.conf

   [ $? -eq 0 ] && action "limit is ok" /bin/true || exit 1

   sleep 3

}

#youhua kernel

openKernel(){

   modprobe bridge > /dev/null 2>& 1

   cat /etc/sysctl.conf > /etc/sysctl.conf.bak

   cat >> /etc/sysctl.conf << EOF

########################################################

net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.conf.all.log_martians = 1

net.ipv4.conf.default.log_martians = 1

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.default.secure_redirects = 0

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

kernel.exec-shield = 1

kernel.randomize_va_space = 1

fs.file-max = 65535

kernel.pid_max = 65536

net.core.netdev_max_backlog = 4096

net.ipv4.tcp_window_scaling = 1

net.ipv4.tcp_max_syn_backlog = 4096

net.ipv4.tcp_max_tw_buckets = 4096

net.ipv4.tcp_keepalive_time = 20

net.ipv4.ip_forward = 0

net.ipv4.tcp_mem = 192000 300000 732000

net.ipv4.tcp_rmem = 51200 131072 204800

net.ipv4.tcp_wmem = 51200 131072 204800

net.ipv4.tcp_keepalive_timenet.ipv4.tcp_keepalive_time = 20

net.ipv4.tcp_keepalive_intvl = 5

net.ipv4.tcp_keepalive_probes = 2

net.ipv4.tcp_orphan_retries = 3

net.ipv4.tcp_syn_retries = 3

net.ipv4.tcp_synack_retries = 3

net.ipv4.tcp_retries2 = 5

net.ipv4.tcp_fin_timeout = 30

net.ipv4.tcp_max_orphans = 2000

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

vm.min_free_kbytes=409600

vm.vfs_cache_pressure=200

vm.swappiness = 40

vm.dirty_expire_centisecs = 1500

vm.dirty_writeback_centisecs = 1000

vm.dirty_ratio = 20

vm.dirty_background_ratio = 100

######################################################

EOF

   /sbin/sysctl -p > /dev/null 2>& 1

   [ $? -eq 0 ] && action "kernel is ok" /bin/true || exit 1

   sleep 1

}

#init_snmp

init_snmp(){

   cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

   sed -i ‘s/#view all/view all/‘ /etc/snmp/snmpd.conf

   sed -i ‘s/#access MyROGroup/access MyROGroup/‘ /etc/snmp/snmpd.conf

   ${CHKCONFIG} snmpd on > /dev/null 2>&1

   ${SERVICE} snmpd start > /dev/null 2>&1

   [ $? -eq 0 ] && action "snmpd is starting" /bin/true || exit 0

}

initdos(){

   echo 180 > /proc/sys/net/ipv4/tcp_keepalive_time

   echo 2 > /proc/sys/net/ipv4/tcp_keepalive_probes

   echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog

   echo 1 > /proc/sys/net/ipv4/tcp_synack_retries

   echo 1 > /proc/sys/net/ipv4/tcp_syn_retries

   echo 1 > /proc/sys/net/ipv4/tcp_syncookies

   [ $? -eq 0 ] && action "snmpd is starting" /bin/true || exit 0

}

initTime

initTool

initI18n

initSelinux

initService

initSsh

openFiles

openKernel

init_snmp

initdos

echo "Don‘t forget start your iptables."

本文出自 “三人行，必有我师焉” 博客，请务必保留此出处http://lovers.blog.51cto.com/5850489/1585178

linux一键优化（适用于RedHat以及衍生版）