CentOS6.7系统优化加强牢固脚本,centos6.7

文章由LinuxBoy分享于2019-04-04 08:04:00热评（616）

CentOS6.7系统优化加强牢固脚本,centos6.7

#!/bin/bash

# author wangqd

# description:this is a centos6.7 optimization script

# processname: 升级系统,精简服务，安装基本配置，记录bash执行时间，安全配置，su加固，ssh优化，iptables设置，时间同步系统优化

#检查是否为root用户；

if [ $(id -u) != "0" ];then

echo "运行此脚本需要root权限!"

yum update -y >> /etc/null

if [ $? = "0" ];then

echo "系统暂时无需更新"

#精简服务

# 关闭ipv6防火墙

chkconfig ip6tables off

if [ $? = "0" ];then

echo "设置ipv6防火墙开机不自启成功"

else

echo "设置ipv6防火墙开机不自启成功失败"

# 关闭iscsi服务

chkconfig iscsi off

if [ $? = "0" ];then

echo "设置iscsi服务开机不自启成功"

else

echo "设置iscsi服务开机不自启失败"

# 关闭iscsi相关服务

chkconfig iscsid off

if [ $? = "0" ];then

echo "设置iscsi相关服务开机不自启成功"

else

echo "设置iscsi相关服务开机不自启失败"

# 关闭NFS，smaba和NetWare网络文件系统

chkconfig netfs off

if [ $? = "0" ];then

echo "设置NFS，smaba和NetWare网络文件系统开机不自启成功"

else

echo "设置NFS，smaba和NetWare网络文件系统开机不自启失败"

# linux的审计功能

chkconfig auditd off

if [ -f "/var/lock/subsys/auditd" ];then

echo "linux的审计功能"

else

echo "linux的审计功能未开启"

# 关闭TCP/IP网络共享文件的协议的NFS的文件锁功能

if [ -f "/var/lock/subsys/nfslock" ];then

chkconfig nfslock off

echo "关闭TCP/IP网络共享文件的协议的NFS的文件锁功能"

else

echo "TCP/IP网络共享文件的协议的NFS的文件锁功能未开启"

# 关闭 NFS v4

if [ -f "/var/lock/subsys/rpcgssd" ];then

chkconfig rpcgssd off

echo "关闭 NFS-rpcgssd"

else

echo "NFS-rpcgssd服务未开启"

# 关闭RPC服务

if [ -f "/var/lock/subsys/rpcbind" ];then

chkconfig rpcbind off

echo "关闭RPC rpcbind服务"

else

echo "RPC服务未开启"

# 关闭 NFS v4

if [ -f "/var/lock/subsys/rpcidmapd" ];then

chkconfig rpcidmapd off

echo "关闭 rpcidmapd"

else

echo "rpcidmapd服务未开启"

# 关闭系統对Logical Volume Manager 逻辑磁区的支持

if [ -f "/var/lock/subsys/lvm2-monitor" ];then

chkconfig lvm2-monitor off

echo "关闭系統对Logical Volume Manager 逻辑磁区的支持"

else

echo "系統对Logical Volume Manager 逻辑磁区的支持未开"

# 关闭邻近发现协议

if [ -f "/var/lock/subsys/lldpad" ];then

chkconfig lldpad off

echo "关闭邻近发现协议"

else

echo "邻近发现协议未开启"

#安装基本组件

# setuptool Python的 distutilsde工具的增强工具（py2.3.5以上 64位py2.4）

# ntsysv 设置系统的各种服务

# system-config-firewall-tui 命令行用户接口（TUI）的防火墙客户端

# system-config-network-tui 安装Fedora网络配置的工具

yum install -y setuptool ntsysv system-config-firewall-tui system-config-network-tui cronie wget vim unzip openssh-clients screen rsync ftp telnet >> /etc/null

if [ $? = "0" ];then

echo "基本组件安装完成"

else

echo "基本组件已安装过"

#记录每次bash命令的执行时间

time="HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S""

grep "$time" /etc/profile >> /etc/null

if [ $? = "0" ];then

echo "记录每次bash命令的执行时间已经做过"

else

line=$(sed -n "/export PATH USER/=" /etc/profile| tail -n1)

sed -i "${line}a HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S"nexport HISTTIMEFORMAT" /etc/profile

echo "记录每次bash命令的执行时间已经成功"

#安全配置

grep "^SELINUX=disabled" /etc/selinux/config

if [ $? = "0" ];then

echo "已经做过安全配置"

else

selinux1=$(grep "^SELINUX=enforcing" /etc/selinux/config)

sed -i "s/$selinux1/SELINUX=disabled/" /etc/selinux/config

echo "服务器安全配置已经完成"

#su加固

grep "^auth" /etc/pam.d/su|grep "pam_wheel.so use_uid"

if [ $? = "0"];then

echo "su 已加固"

else

line2=$(sed -n "/^auth/=" /etc/pam.d/su|tail -1 )

sed -i "${line2}a auth required pam_wheel.so use_uid" /etc/pam.d/su

echo "su加固成功"

#ssh 优化

#port 端口

grep "^Port[[:space:]]" /etc/ssh/sshd_config|grep "58022"

if [ $? = "0" ];then

echo "ssh端口号设置正确修改"

else

check1=$(grep "^#Port" /etc/ssh/sshd_config)

sline1=$(sed -n "/$check1/=" /etc/ssh/sshd_config)

sed -i "/^Port/d" /etc/ssh/sshd_config

sed -i "${sline1}a Port 58022" /etc/ssh/sshd_config

echo "SSH已改为58022"

#不允许用root进行登录

grep "^PermitRootLogin[[:space:]]" /etc/ssh/sshd_config|grep "no"

if [ $? = "0" ];then

echo "ssh不允许root登录功能已设置"

else

check2=$(grep "^#PermitRootLogin[[:space:]]" /etc/ssh/sshd_config)

sline2=$(sed -n "/$check2/=" /etc/ssh/sshd_config)

sed -i "/^PermitRootLogin/d" /etc/ssh/sshd_config

sed -i "${sline2}a PermitRootLogin no" /etc/ssh/sshd_config

echo "不允许root登录ssh设置成功"

#不允许空密码登录

grep "^PermitEmptyPasswords[[:space:]]" /etc/ssh/sshd_config|grep "no"

if [ $? = "0" ];then

echo "请查看ssh不允许空密码登录已被设置"

else

check3=$(grep "^#PermitEmptyPasswords[[:space:]]" /etc/ssh/sshd_config)

sline3=$(sed -n "/$check3/=" /etc/ssh/sshd_config)

sed -i "/^PermitEmptyPasswords/d" /etc/ssh/sshd_config

sed -i "${sline3}a PermitEmptyPasswords no" /etc/ssh/sshd_config

echo "ssh不允许空密码登录设置成功"

#禁用DNS

grep "^GSSAPIAuthentication[[:space:]]" /etc/ssh/sshd_config|grep "no"

if [ $? = "0" ];then

echo "禁用DNS已被设置"

else

check4=$(grep "#GSSAPIAuthentication[[:space:]]" /etc/ssh/sshd_config)

sed -i "/^GSSAPIAuthentication/d" /etc/ssh/sshd_config

sline4=$(sed -n "/$check4/=" /etc/ssh/sshd_config)

sed -i "${sline4}c GSSAPIAuthentication no" /etc/ssh/sshd_config

echo "禁用DNS设置成功"

#禁用UseDNS

grep "^UseDNS[[:space:]]" /etc/ssh/sshd_config|grep "no"

if [ $? = "0" ];then

echo "禁用UseDNS已被设置"

else

check5=$(grep "^#UseDNS[[:space:]]" /etc/ssh/sshd_config)

sline5=$(sed -n "/$check5/=" /etc/ssh/sshd_config)

sed -i "/^UseDNS/d" /etc/ssh/sshd_config

sed -i "${sline5}a UseDNS no" /etc/ssh/sshd_config

echo "禁用UseDNS设置成功"

#AllowUsers

sed -i "/^AllowUsers/d" /etc/ssh/sshd_config

if [ $? = "0" ];then

echo "SSH的其他允许登录的用户已被删除"

else

echo "ssh 无其他允许登录的用户"

AU=$(sed -n "/^#/=" /etc/ssh/sshd_config|tail -1)

sed -i "${AU}a AllowUsers $1" /etc/ssh/sshd_config

if [ $? = "0" ];then

echo "AllowUsers已设置用户成功"

else

echo "AllowUsers设置用户失败"

#设置防火墙

iptab="-A INPUT -m state --state NEW -m tcp -p tcp --dport 58022 -j ACCEPT"

grep "58022" /etc/sysconfig/iptables

if [ $? != 0 ];then

line8=$(sed -n "/22/=" /etc/sysconfig/iptables|head -1)

sed -i "${line8}a $iptab" /etc/sysconfig/iptables

echo "添加58022端口成功"

#line9=$(sed -n "/lo/=" /etc/sysconfig/iptables|head -1)

#sed -i "${line9}a $iptab" /etc/sysconfig/iptables

else

echo "58022 已被设置请查看"

/etc/init.d/sshd restart

if [ $? = "0" ];then

echo "sshd已重启"

/etc/init.d/iptables restart

if [ $? = "0" ];then

echo "iptables"

#时间同步

yum install ntp -y >> /etc/null

if [ $? = "0" ];then

echo "ntp服务已被安装"

/usr/sbin/ntpdate time.nist.gov

if [ $? = "0" ];then

echo "本地时间一同步时间服务器"

/sbin/hwclock --systohc

if [ $? = "0" ];then

echo "系统时间已同步到硬件"

#将时间同步写入计划日志

line10=$(sed -n "/^#/=" /etc/crontab|tail -1)

sed -i "${line10}a 5 */6 * * * /usr/sbin/ntpdate time.nist.gov > /dev/null 2>&1" /etc/crontab

if [ $? = "0" ];then

echo "时间同步已写入计划日志"

#优化内核参数

line11=$(sed -n "/^#/=" /etc/sysctl.conf|tail -1)

sed -i "${line11}a net.ipv4.tcp_max_syn_backlog = 65536nnet.core.netdev_max_backlog = 32768nnet.core.somaxconn = 32768nnet.core.wmem_default = 8388608nnet.core.rmem_default = 8388608nnet.core.rmem_max = 16777216nnet.core.wmem_max = 16777216net.ipv4.tcp_timestamps = 0nnet.ipv4.tcp_synack_retries = 2nnet.ipv4.tcp_syn_retries = 2nnet.ipv4.tcp_tw_recycle = 1n#net.ipv4.tcp_tw_len = 1nnet.ipv4.tcp_tw_reuse = 1nnet.ipv4.tcp_mem = 94500000 915000000 927000000nnet.ipv4.tcp_max_orphans = 3276800nnet.ipv4.ip_local_port_range = 1024 65535" /etc/sysctl.conf

if [ $? = "0" ];then

echo "系统已经优化完成"

#创建wheel用户

useradd -G wheel $1

echo "$2" | passwd $1 --stdin > /dev/null 2>&1

if [ $? = "0" ];then

echo "user is created!"

echo "SU_WHEEL_ONLY yes" >> /etc/login.defs

#只允许wheel用户su到root

if [ $? = "0" ];then

echo "只允许wheel用户su到root执行成功"

else

echo "只允许wheel用户su到root执行失败请查看"

init 6

推荐文章：

CentOS6.7系统优化加强牢固脚本,centos6.7