[svc]centos6系统安装(分区)及其18处调优调优最佳实战

系统下载

在阿里云下载

可以使用最小化的,也可以使用dvd版(CentOS-6.7-x86_64-bin-DVD1.iso),其中dvd版方便安装过程中选包.

一. 系统安装

1,时区选择

2,磁盘分区

boot	保持默认200M
swap	1024M
/	剩余空间
备注: 其中3个分区都force be a primary partion

参考:生产场景不同角色linux服务器分区案例分享

注意: raid之后的空间超过2T,fdisk就无法使用.改用parted

参考: linuxMBR分区

3.安装选包

选包参考: 运维老鸟教你安装centos6.5如何选择安装包

   Base
   Compatibility libraries
   Debugging Tools
   Development tools

　　

1、根据经验，选择安装包时应该按最小化原则，即不需要的或者不确定是否需要的就不安装，这样可以最大程度上确保系统安全。
2、如果安装过程落了部分包组或者其他伙伴安装时没选，再安装后可以按如下方式补上安装时未安装的包组：
yum groupinstall "Compatibility libraries" "Base" "Development tools"
yum groupinstall "debugging Tools" "Dial-up Networking Support"
可以通过yum groupinfo 包组查看具体安装的组件。
3、下面安装6.5后登陆系统的时候查看选包的情况：
yum grouplist:  #前4个都需要有
Installed Groups:
   Base
   Compatibility libraries
   Debugging Tools
   Development tools
   E-mail server
   Graphical Administration Tools
   Hardware monitoring utilities
   Legacy UNIX compatibility
   Networking Tools
   Performance Tools
   Perl Support
   Scientific support
   Security Tools
*可以看到除了我们选择的外，系统还是默认安装了一些额外的软件包组。
注意：不要使用yum的删除功能删除软件，会删除相关依赖，导致意外问题。
如果centos6系统已安装,如何补救没有安装的包?以及初始化安装时选包注意事项.

4.linux忘记密码处理(进单用户[启动级别为1]的模式去处理)

开机按e键,

输入户single,单用户模式启动(级别)

$ cat /etc/inittab
...
#   0 - halt (Do NOT set initdefault to this)
#   1 - Single user mode
#   2 - Multiuser, without NFS (The same as 3, if you do not have networking)
#   3 - Full multiuser mode
#   4 - unused
#   5 - X11
#   6 - reboot (Do NOT set initdefault to this)

　　

passwd root # 更新密码并重启即可.

5.centos6-系统优化

优化小结:
一清： 定时清理日志/var/spool/clientsqueue
一精： 精简开机启动服务
一增： 增大文件描述符
两优： linux内核参数的优化、yum源优化
四设：设置系统的字符集、设置ssh登录限制、设置开机的提示信息与内核信息、设置block的大小
七其他：文件系统优化、sync数据同步写入磁盘、不更新时间戳、锁定系统关键文件、时间同步、sudo集权管理、关闭防火墙和selinux

本文 centos 6.5 优化 的项有18处:
1、CentOS6.5最小化安装后启动网卡
2、ifconfig查询IP进行SSH链接
3、更新系统源并且升级系统
4、系统时间更新和设定定时任
5、修改ip地址、网关、主机名、DNS
6、关闭seLinux，清空iptables
7、创建普通用户并进行sudo授权管理
8、修改SSH端口号和屏蔽root账号远程登陆
9、锁定关键文件系统（禁止非授权用户获得权限）
10、精简开机自启动服务
11、调整系统文件描述符大小
12、设置系统字符集
13、清理登陆的时候显示的系统及内核版本
14、内核参数优化
15、定时清理/var/spool/clientmqueue
16、删除不必要的系统用户和群组
17、关闭重启ctl-alt-delete组合键
18、设置一些全局变量

https://raw.githubusercontent.com/lannyMa/scripts/master/utils/centos6_one_key_optimize.sh

#!/bin/sh
################################################
# this script is created by lanny
# version:1.2
################################################

#Source function library.

. /etc/init.d/functions

#date
DATE=`date +"%Y-%m-%d %H:%M:%S"`
#ip
IPADDR=IPADDR=`ifconfig eth0|sed -n '2p'|awk -F ":" '{print $2}'|awk '{print $1}'`
#hostname
HOSTNAME=`hostname -s`
#user
USER=`whoami`
#disk_check
DISK_SDA=`df -h |grep -w "/" |awk '{print $5}'`
#cpu_average_check
cpu_uptime=`cat /proc/loadavg|awk '{print $1,$2,$3}'`

#set LANG
export LANG=zh_CN.UTF-8

#Require root to run this script.
uid=`id | cut -d\( -f1 | cut -d= -f2`
if [ $uid -ne 0 ];then
  action "Please run this script as root." /bin/false
  exit 1
fi
#"stty erase ^H"
\cp /root/.bash_profile  /root/.bash_profile_$(date +%F)
erase=`grep -wx "stty erase ^H" /root/.bash_profile |wc -l`
if [ $erase -lt 1 ];then
    echo "stty erase ^H" >>/root/.bash_profile
    source /root/.bash_profile
fi
#Config Yum CentOS-Bases.repo
configYum(){
echo "================更新为国内YUM源=================="
  cd /etc/yum.repos.d/

  \cp CentOS-Base.repo CentOS-Base.repo.$(date +%F)
  ping -c 2 mirrors.aliyun.com >/dev/null
  if [ $? -eq 0 ];then
  wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
  wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-6.repo
  yum clean all && yum makecache
  else
    echo "无法连接网络。"
    exit $?
  fi

action "配置国内aliyun YUM完成"  /bin/true
echo "================================================="
echo ""
  sleep 2
}

#install tools
initTools(){
  echo "#####install tools#####"
  yum install lrzsz ntpdate sysstat dos2unix wget telnet vim-enhanced -y
  yum groupinstall base -y
  yum groupinstall core -y
  yum groupinstall development libs -y
  yum groupinstall development tools -y
  echo "install toos complete."
  sleep 1
}

initVim(){
cat >>/etc/vimrc<<EOF
set nu
set cursorline
set nobackup
set ruler
set autoindent
set vb t_vb=
set ts=4
set expandtab
EOF
source /etc/vimrc
}

#Charset zh_CN.UTF-8
initI18n(){
echo "================更改为中文字符集================="
  \cp /etc/sysconfig/i18n /etc/sysconfig/i18n.$(date +%F)
  echo "LANG="zh_CN.UTF-8"" >/etc/sysconfig/i18n
  source /etc/sysconfig/i18n
  echo '#cat /etc/sysconfig/i18n'
  grep LANG /etc/sysconfig/i18n
action "更改字符集zh_CN.UTF-8完成" /bin/true
echo "================================================="
echo ""
  sleep 2
}
#Close Selinux and Iptables
initFirewall(){
echo "============禁用SELINUX及关闭防火墙=============="
  \cp /etc/selinux/config /etc/selinux/config.$(date +%F)
  /etc/init.d/iptables stop
  sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
  setenforce 0
  /etc/init.d/iptables status
  echo '#grep SELINUX=disabled /etc/selinux/config '
  grep SELINUX=disabled /etc/selinux/config
  echo '#getenforce '
  getenforce
action "禁用selinux及关闭防火墙完成" /bin/true
echo "================================================="
echo ""
  sleep 2
}
#Init Auto Startup Service
initService(){
echo "===============精简开机自启动===================="
  export LANG="en_US.UTF-8"
  for A in `chkconfig --list |grep 3:on |awk '{print $1}' `;do chkconfig $A off;done
  for B in rsyslog network sshd crond;do chkconfig $B on;done
  echo '+--------which services on---------+'
  chkconfig --list |grep 3:on
  echo '+----------------------------------+'
  export LANG="zh_CN.UTF-8"
action "精简开机自启动完成" /bin/true
echo "================================================="
echo ""
  sleep 2
}
#Change sshd default port and prohibit user root remote login.
initSsh(){
echo "========修改ssh默认端口禁用root远程登录=========="
  \cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%F)
  sed -i 's/#Port 22/Port 52000/g' /etc/ssh/sshd_config
  sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
  sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
  sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
  echo '+-------modify the sshd_config-------+'
  echo 'Port 52000'
  echo 'PermitEmptyPasswords no'
  echo 'PermitRootLogin no'
  echo 'UseDNS no'
  echo '+------------------------------------+'
  /etc/init.d/sshd reload && action "修改ssh默认参数完成" /bin/true || action "修改ssh参数失败" /bin/false
echo "================================================="
echo ""
  sleep 2
}
#time sync
syncSysTime(){
echo "================配置时间同步====================="
  \cp /var/spool/cron/root /var/spool/cron/root.$(date +%F) 2>/dev/null
  NTPDATE=`grep ntpdate /var/spool/cron/root 2>/dev/null |wc -l`
  if [ $NTPDATE -eq 0 ];then
    /bin/rm -rf /etc/localtime && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && /usr/sbin/ntpdate ntp1.aliyun.com
    echo "#times sync by lanny at $(date +%F)" >>/var/spool/cron/root
    echo "*/5 * * * * /usr/sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1" >> /var/spool/cron/root
  fi
  echo '#crontab -l'
  crontab -l
action "配置时间同步完成" /bin/true
echo "================================================="
echo ""
  sleep 2
}

initHistory(){
echo "================配置history显示格式====================="
    export HISTTIMEFORMAT="%F %T `whoami` "
    echo 'export HISTTIMEFORMAT="%F %T `whoami` ' >> /etc/profile
    echo '#grep HISTTIMEFORMAT /etc/profile '
    grep HISTTIMEFORMAT /etc/profile
action "配置history显示格式" /bin/true
echo "================================================="
echo ""
  sleep 2
}

initCADShutdown(){
echo "================关掉ctrl+alt+delete关机====================="
    \cp /etc/init/control-alt-delete.conf /etc/init/control-alt-delete.conf.bak
    sed -i 's#exec /sbin/shutdown -r now "Control-Alt-Deletepressed"#\#exec /sbin/shutdown -r now "Control-Alt-Deletepressed"#g' /etc/init/control-alt-delete.conf
action "关掉ctrl+alt+delete关机" /bin/true
echo "================================================="
echo ""
  sleep 2
}

#add user and give sudoers
addUser(){
echo "===================新建用户======================"
#add user
while true
do
    read -p "请输入新用户名:" name
    NAME=`awk -F':' '{print $1}' /etc/passwd|grep -wx $name 2>/dev/null|wc -l`
    if [ ${#name} -eq 0 ];then
       echo "用户名不能为空，请重新输入。"
       continue
    elif [ $NAME -eq 1 ];then
       echo "用户名已存在，请重新输入。"
       continue
    fi
useradd $name
break
done
#create password
while true
do
    read -p "为 $name 创建一个密码:" pass1
    if [ ${#pass1} -eq 0 ];then
       echo "密码不能为空，请重新输入。"
       continue
    fi
    read -p "请再次输入密码:" pass2
    if [ "$pass1" != "$pass2" ];then
       echo "两次密码输入不相同，请重新输入。"
       continue
    fi
echo "$pass2" |passwd --stdin $name
break
done
sleep 1
#add visudo
echo "#####add visudo#####"
\cp /etc/sudoers /etc/sudoers.$(date +%F)
SUDO=`grep -w "$name" /etc/sudoers |wc -l`
if [ $SUDO -eq 0 ];then
    echo "$name  ALL=(ALL)       NOPASSWD: ALL" >>/etc/sudoers
    echo '#tail -1 /etc/sudoers'
    grep -w "$name" /etc/sudoers
    sleep 1
fi
action "创建用户$name并将其加入visudo完成"  /bin/true
echo "================================================="
echo ""
sleep 2
}

#Adjust the file descriptor(limits.conf)
initLimits(){
echo "===============加大文件描述符===================="
  LIMIT=`grep nofile /etc/security/limits.conf |grep -v "^#"|wc -l`
  if [ $LIMIT -eq 0 ];then
  \cp /etc/security/limits.conf /etc/security/limits.conf.$(date +%F)
  echo '*                  -        nofile         65535'>>/etc/security/limits.conf
  fi
  echo '#tail -1 /etc/security/limits.conf'
  tail -1 /etc/security/limits.conf
  ulimit -HSn 65535
  echo '#ulimit -n'
  ulimit -n
action "配置文件描述符为65535" /bin/true
echo "================================================="
echo ""
sleep 2
}

#Optimizing the system kernel
initSysctl(){
echo "================优化内核参数====================="
SYSCTL=`grep "net.ipv4.tcp" /etc/sysctl.conf |wc -l`
if [ $SYSCTL -lt 10 ];then
\cp /etc/sysctl.conf /etc/sysctl.conf.$(date +%F)
cat >>/etc/sysctl.conf<<EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
EOF
fi
  \cp /etc/rc.local /etc/rc.local.$(date +%F)
  modprobe nf_conntrack
  echo "modprobe nf_conntrack">> /etc/rc.local
  modprobe bridge
  echo "modprobe bridge">> /etc/rc.local
  sysctl -p
action "内核调优完成" /bin/true
echo "================================================="
echo ""
  sleep 2
}
#menu2
menu2(){
while true
do
clear
cat << EOF
----------------------------------------
|****Please Enter Your Choice:[0-9]****|
----------------------------------------
(1) 新建一个用户并将其加入visudo
(2) 配置为国内YUM源镜像
(3) 配置中文字符集
(4) 禁用SELINUX及关闭防火墙
(5) 精简开机自启动
(6) 修改ssh默认端口及禁用root远程登录
(7) 设置时间同步
(8) 加大文件描述符
(9) 内核调优
(0) 返回上一级菜单
EOF
read -p "Please enter your Choice[0-9]: " input2
case "$input2" in
  0)
  clear
  break
  ;;
  1)
  addUser
  ;;
  2)
  configYum
  ;;
  3)
  initI18n
  ;;
  4)
  initFirewall
  ;;
  5)
  initService
  ;;
  6)
  initSsh
  ;;
  7)
  syncSysTime
  ;;
  8)
  initLimits
  ;;
  9)
  initSysctl
  ;;
  *) echo "----------------------------------"
     echo "|          Warning!!!            |"
     echo "|   Please Enter Right Choice!   |"
     echo "----------------------------------"
     for i in `seq -w 3 -1 1`
       do
         echo -ne "\b\b$i";
  sleep 1;
     done
     clear
esac
done
}
#initTools
#menu
while true
do
clear
echo "========================================"
echo '          Linux Optimization            '
echo "========================================"
cat << EOF
|-----------System Infomation-----------
| DATE       :$DATE
| HOSTNAME   :$HOSTNAME
| USER       :$USER
| IP         :$IPADDR
| DISK_USED  :$DISK_SDA
| CPU_AVERAGE:$cpu_uptime
----------------------------------------
|****Please Enter Your Choice:[1-3]****|
----------------------------------------
(1) 一键优化
(2) 自定义优化
(3) 退出
EOF
#choice
read -p "Please enter your choice[0-3]: " input1

case "$input1" in
1)
  addUser
  configYum
  initTools
  initCADShutdown
  initI18n
  initFirewall
  initService
  initSsh
  syncSysTime
  initLimits
  initSysctl
  initVim
  ;;

2)
  menu2
  ;;
3)
  clear
  break
  ;;
*)
  echo "----------------------------------"
  echo "|          Warning!!!            |"
  echo "|   Please Enter Right Choice!   |"
  echo "----------------------------------"
  for i in `seq -w 3 -1 1`
      do
        echo -ne "\b\b$i";
        sleep 1;
  done
  clear
esac
done
centos6系列系统安装完毕后,一键优化脚本.

细节:http://oldboy.blog.51cto.com/2561410/1336488
网络状态优化:http://oldboy.blog.51cto.com/2561410/1184228
定时任务优化:http://oldboy.blog.51cto.com/2561410/1216730
一键脚本:
较简单: http://mofansheng.blog.51cto.com/8792265/1710247      http://www.chocolee.cn/archives/68
较健全: http://chocolee.blog.51cto.com/8158455/1424587

附: centos6一键优化脚本参考