#!/bin/bash
#################################################
# --Info
# Initialization CentOS 6.x script
#################################################
# Changelog
# 20160601 shaonbean initial creation
#################################################
# Auther: hwang@aniu.tv
#################################################
# Check if user is root
if [ $(id -u) != "0" ]; then
echo "Error: You must be root to run this script, please use root to initialization OS"
exit 1
fi
echo "+------------------------------------------------------------------------+"
echo "| To initialization the system for security and performance |"
echo "+------------------------------------------------------------------------+"
#check host && network
check_hosts()
{
hostname=`hostname`
if grep -Eqi '^127.0.0.1[[:space:]]*localhost' /etc/hosts; then
echo "Hosts: ok."
else
echo "127.0.0.1 localhost.localdomain $hostname" >> /etc/hosts
fi
ping -c1 www.aniu.tv
if [ $? -eq 0 ] ; then
echo "DNS...ok"
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
else
echo "DNS...fail"
echo -e "nameserver 8.8.8.8\nnameserver 114.114.114.114" > /etc/resolv.conf
fi
}
#Set time zone synchronization
set_timezone()
{
echo "Setting timezone..."
rm -rf /etc/localtime
ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
#install ntp
echo "[+] Installing ntp..."
yum install ntpdate -y
/usr/sbin/ntpdate pool.ntp.org
echo '*/5 * * * * /usr/sbin/ntpdate pool.ntp.org > /dev/null 2>&1' > /var/spool/cron/root;chmod 600 /var/spool/cron/root
/sbin/service crond restart
}
#update os
update(){
yum -y update
# change yum source
# cd /etc/yum.repos.d/
# mkdir bak
# mv ./*.repo bak
# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo
# yum clean all && yum makecache
yum -y install wget vim unzip openssl-devel gcc gcc-c++ sysstat iotop openssh-clients telnet lsof
echo "yum update && yum install common command ......... succeed."
}
selinux()
{
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
setenforce 0
echo "disbale selinux ..................succeed."
}
#xen_hwcap_setting()
#{
# if [ -s /etc/ld.so.conf.d/libc6-xen.conf ]; then
# sed -i 's/hwcap 1 nosegneg/hwcap 0 nosegneg/g' /etc/ld.so.conf.d/libc6-xen.conf
# fi
#}
#Modify file open number,define 1024
# /etc/security/limits.conf
limits_config()
{
cat >> /etc/security/limits.conf <<EOF
* soft nproc 65535
* hard nproc 65535
* soft nofile 8192
* hard nofile 8192
EOF
#ulimit -n 8192
echo "ulimit -SHn 65535" >> /etc/rc.local
}
ulimit -n 8192
#Shut off system service
stop_server()
{
echo "stop not nessccery services!"
for server in `chkconfig --list |grep 3:on|awk '{ print $1}'`
do
chkconfig --level 3 $server off
done
for server in crond network rsyslog sshd lvm2-monitor sysstat netfs blk-availability udev-post
do
chkconfig --level 3 $server on
done
}
#define sshd
sshd_config(){
#sed -i '/^#Port/s/#Port 22/Port 54077/g' /etc/ssh/sshd_config
sed -i '/^#UseDNS/s/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
#sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
/etc/init.d/sshd restart
echo "set sshd && restat sshd succedd!"
}
# iptables
iptables(){
#disable iptables
/etc/init.d/iptables stop
chkconfig --level 3 iptables off
#disable ipv6
echo "alias net-pf-10 off" >> /etc/modprobe.d/modprobe.conf
echo "alias ipv6 off" >> /etc/modprobe.d/modprobe.conf
echo "NETWORKING_IPV6=no" >> /etc/sysconfig/network
chkconfig --level 3 ip6tables off
/etc/init.d/ip6tables stop
echo "iptables is stop && ipv6 is disabled!"
}
other(){
# initdefault
sed -i 's/^id:.*$/id:3:initdefault:/' /etc/inittab
/sbin/init q
# PS1
#echo 'PS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h \[\e[35;40m\]\W\[\e[0m\]]\\$ \[\e[33;40m\]"' >> /etc/profile
echo "TMOUT=7200" >> /etc/profile
# Record command
sed -i 's/^HISTSIZE=.*$/HISTSIZE=1000/' /etc/profile
#echo "export PROMPT_COMMAND='{ msg=\$(history 1 | { read x y; echo \$y; });user=\$(whoami); echo \$(date \"+%Y-%m-%d %H:%M:%S\"):\$user:\`pwd\`/:\$msg ---- \$(who am i); } >> /tmp/\`hostname\`.\`whoami\`.history-timestamp'" >> /root/.bash_profile
# wrong password five times locked 180s
sed -i '4a auth required pam_tally2.so deny=5 unlock_time=180' /etc/pam.d/system-auth
# forbiden ctl-alt-delete
sed -i 's/exec \/sbin\/shutdown -r now \"Control-Alt-Delete pressed"/\#exec \/sbin\/shutdown -r now \"Control-Alt-Delete pressed"/g' /etc/init/control-alt-delete.conf
source /etc/profile
}
#
delete_user()
{
# delete no use user
echo "delete not use user"
echo ""
for user in adm lp sync shutdown halt uucp operator gopher
do userdel $user ; done
}
#
sysctl_add(){
cat >> /etc/sysctl.conf << EOF
# appends
net.ipv4.tcp_synack_retries = 0
net.ipv4.tcp_max_syn_backlog = 20480
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 10
fs.file-max = 819200
net.core.somaxconn = 65536
net.core.rmem_max = 1024123000
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 165536
net.ipv4.ip_local_port_range = 10000 65535
EOF
# set kernel parameters work
sysctl -p
}
#main function
main(){
check_hosts
set_timezone
selinux
update
limits_config
stop_server
sshd_config
iptables
other
delete_user
sysctl_add
}
# execute main functions
main
echo "+------------------------------------------------------------------------+"
echo "| To initialization system all completed !!! |"
echo "+------------------------------------------------------------------------+"