CenTos7.5系統優化
更改主機名
centos7有一個新的修改主機名的命令hostnamectl
hostnamectl set-hostname --static 主機名
vim /etc/hosts --最後加上你的IP與主機名的綁定
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
IP 主機名
修改網卡
vim /etc/sysconfig/network-scripts/ifcfg-eth0 --網卡名如果不一樣，找到對應的文件就行
BOOTPROTO="static"
NAME="eth0"
DEVICE="eth0"
ONBOOT="yes"
IPADDR=10.0.0.1
NETMASK=255.255.255.0
GATEWAY=10.0.0.254
DNS1=114.114.114.114
DNS2=8.8.8.8
#關閉卸載firewalld
systemctl stop firewalld.service
systemctl disable firewalld.service
yum remove firewalld -y
yum install iptables-services -y #安裝
關閉selinux
臨時關閉setenforce 0
sed -i 7s/enforcing/disabled/ /etc/selinux/config
查看getenforce
內核優化
vim /etc/sysctl.conf
#關閉ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
#避免放大***
net.ipv4.icmp_echo_ignore_broadcasts = 1
#開啓惡意icmp錯誤消息保護
net.ipv4.icmp_ignore_bogus_error_responses = 1
#關閉路由轉發
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#開啓反向路徑過濾
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
#處理無源路由的包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
#關閉sysrq功能
kernel.sysrq = 0
#core文件名中添加pid作爲擴展名
kernel.core_uses_pid = 1
#開啓SYN洪水***保護
net.ipv4.tcp_syncookies = 1
#修改消息隊列長度
kernel.msgmnb = 65536
kernel.msgmax = 65536
#設置最大內存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
#timewait的數量，默認180000
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
#每個網絡接口接收數據包的速率比內核處理這些包的速率快時，允許送到隊列的數據包的最大數目
net.core.netdev_max_backlog = 262144
#限制僅僅是爲了防止簡單的DoS ***
net.ipv4.tcp_max_orphans = 3276800
#未收到客戶端確認信息的連接請求的最大值
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
#內核放棄建立連接之前發送SYNACK 包的數量
net.ipv4.tcp_synack_retries = 1
#內核放棄建立連接之前發送SYN 包的數量
net.ipv4.tcp_syn_retries = 1
#啓用timewait 快速回收
net.ipv4.tcp_tw_recycle = 1
#開啓重用。允許將TIME-WAIT sockets 重新用於新的TCP 連接
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
#當keepalive 起用的時候，TCP 發送keepalive 消息的頻度。缺省是2 小時
net.ipv4.tcp_keepalive_time = 30
#修改防火牆表大小，默認65536
#net.netfilter.nf_conntrack_max=655350
#net.netfilter.nf_conntrack_tcp_timeout_established=1200
#確保無人能修改路由表
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
DNS優化（添加對應網絡供應商的更佳）
vi /etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
nameserver 4.2.2.2
nameserver 172.19.0.6
工具1
yum install wget vim lrzsz
安裝 163源 網絡源
cd /etc/yum.repos.d/
wget http://mirrors.163.com/.help/CentOS7-Base-163.repo
yum clean all
yum makecache fast
安裝工具解決密鑰問題
cd /etc/pki/rpm-gpg
wget https://archive.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
常用工具2安裝
yum install -y gcc cmake bzip2-devel curl-devel db4-devel libjpeg-devel libpng-devel freetype-devel libXpm-devel gmp-devel libc-client-devel openldap-devel unixODBC-devel postgresql-devel sqlite-devel aspell-devel net-snmp-devel libxslt-devel libxml2-devel pcre-devel mysql-devel pspell-devel libmemcached libmemcached-devel zlib-devel tree htop net-tools
時間同步
#yum install ntp ntpdate -y --安裝ntp時間同步相關軟件包
#vim /etc/ntp.conf --確認配置文件裏有下列的時間同步源
server 0.rhel.pool.ntp.org iburst
server 1.rhel.pool.ntp.org iburst
server 2.rhel.pool.ntp.org iburst
server 3.rhel.pool.ntp.org iburst
#systemctl enable ntpd --設置開機自動啓動ntpd
#systemctl start ntpd --立即啓動ntpd服務
#date --確認時間與現在時間一致
#ntpdate 0.rhel.pool.ntp.org --如果還沒有同步成功，你可以用此命令手動同步一下
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime #更改時區爲上海
加大打開文件數的限制（open files）
ulimit -n
ulimit -a
vi /etc/security/limits.conf
最後添加
- soft nofile 1024000
- hard nofile 1024000
hive - nofile 1024000
hive - nproc 1024000
用戶進程限制
sed -i 's#4096#65535#g' /etc/security/limits.d/20-nproc.conf #加大普通用戶限制 也可以改爲unlimited
egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf
- soft nproc 65535
root soft nproc unlimited
重啓讓設置生效
reboot
大概就這麼多了吧其他的以後再更新