#!/bin/sh
#优化1	开机启动网卡
cat >/etc/sysconfig/network-scripts/ifcfg-eth0<<EOF
DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.122.147
NETMASK=255.255.255.0
GATEWAY=192.168.122.1
DNS1=192.168.122.1
DNS2=114.114.114.114
EOF

#优化2	更改hostname
sed -i ‘s#HOSTNAME=\(.*\)#HOSTNAME=kvm-demo#g‘ /etc/sysconfig/network
hostname kvm-demo
sed -i ‘s#127\(.*\)#127\1\ kvm-demo#g‘ /etc/hosts
/etc/init.d/network restart

#优化3 使用国内yum源安装软件
##最小化安装是没有wget工具的，必须先安装在修改源
yum -y install wget

/bin/mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.`date +%F`.bak
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.163.com/.help/CentOS6-Base-163.repo
yum clean all
yum makecache
yum -y groupinstall "Base" 
yum -y groupinstall "Compatibility libraries"
yum -y groupinstall "Debugging Tools"
yum -y groupinstall "Development tools"
yum -y install telnet dos2unix tree lftp
yum -y update

#优化4	关闭selinux

setenforce 0
sed -i ‘s#SELINUX=enforcing#SELINUX=disabled#g‘ /etc/selinux/config

#优化5 清空iptables规则
iptables -F
/etc/init.d/iptables save

#优化6 精简开机启动服务
for service in `chkconfig --list|grep 3:on|awk ‘{print $1}‘|grep -Ev "crond|network|rsyslog|sysstat|sshd|iptables|ip6tables"`
do chkconfig $service off
done

#优化7 更改ssh设置
sed -i ‘s/#Port\ 22/Port\ 52113/g‘ /etc/ssh/sshd_config
sed -i ‘s/#ListenAddress 0.0.0.0/ListenAddress\ 192.168.122.147/g‘ /etc/ssh/sshd_config
sed -i ‘s/#PermitRootLogin\ yes/PermitRootLogin\ no/g‘ /etc/ssh/sshd_config
sed -i ‘s/#GSSAPIAuthentication\ no/GSSAPIAuthentication\ no/g‘ /etc/ssh/sshd_config
sed -i ‘s/GSSAPIAuthentication\ yes/#GSSAPIAuthentication\ yes/g‘ /etc/ssh/sshd_config
sed -i ‘s/#UseDNS\ yes/UseDNS\ no/g‘ /etc/ssh/sshd_config
/etc/init.d/sshd restart


#优化8	添加普通用户
useradd badboy
echo "123456"|passwd --stdin badboy
history -c

#优化9	sudo授权普通用户
echo "badboy  ALL=(ALL)       NOPASSWD: ALL" >>/etc/sudoers

#优化10	时间同步
echo "*/5 * * * * /usr/sbin/ntpdate ntp.api.bz  >/dev/null 2>&1 && /sbin/hwclock -w" >>/var/spool/cron/root

#优化11	加大服务器文件描述符
echo ‘* - nofile 65535‘ >> /etc/security/limits.conf

#优化12 内核调优
echo "net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120" >>/etc/sysctl.conf
sysctl -p

#优化13 隐藏linux系统版本
:>/etc/issue
:>/etc/issue.net

#优化14 锁定系统关键文件
chattr +i /etc/passwd /etc/group /etc/shadow /etc/gshadow /etc/inittab
##将chattr改名
/bin/mv /usr/bin/chattr /usr/bin/badboy

#优化15	grub引导密码（防止单用户模式修改root密码）
##md5密码为123456 使用grub-md5-crypt工具生成为$1$/0gD5/$VjhsgnUx6uIn9qpbVZIlL1
sed -i ‘/hiddenmenu/a\password\ --md5\ \$1\$\/0gD5\/\$VjhsgnUx6uIn9qpbVZIlL1‘ /etc/grub.conf

#优化16 设置全局变量
##设置自动退出终端，防止非法关闭ssh客户端造成登录进程过多，可以设置大一些，单位为秒
echo "TMOUT=3600">> /etc/profile
##历史命令记录数量设置为10条
sed -i ‘s/HISTSIZE=1000/HISTSIZE=10/g‘ /etc/profile
##立即生效
source /etc/profile

#重启
shutdown -r now