1、不用root管理，以普通用户的名义通过sudo授权管理。
2、更改默认的远程连接SSH服务端口，禁止root用户远程连接，更改只监听在内网地址。
[[email protected] ~]# vim /etc/ssh/sshd_config
Port 51898 ##监听端口，端口范围（0-65535，最好是大于1024的端口）
ListenAddress 192.168.1.128 ##监听地址，为了安全起见，监听在内网之上
Protocol 2 ##使用协议
PermitEmptyPasswords no ##禁止空密码登录系统，默认是禁止
UseDNS no ##禁止DNS反解析
PermitRootLogin no ##禁止root远程登录
GSSAPIAuthentication no ##加速登录ssh
3、定时自动更新时间服务器，使其和互联网时间同步。
[[email protected] ~]ntpdate time.nist.gov
4、配置yum更新源，从国内更新源下载安装软件包。
[[email protected] ~]# mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo
[[email protected] ~]# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-6.repo
[[email protected] ~]# yum makecache
5、关闭selinux。
[[email protected] ~]# setenforce 0 ##临时生效
[[email protected] ~]# sed -i ‘s#SELINUX=enforcing#SELINUX=disabled#g‘ /etc/selinux/config ##永久关闭
6、调整文件描述符的数量，进程及文件的打开都会消耗文件描述符。
[[email protected] ~]# ulimit -n ##系统默认1024
1024
[[email protected] ~]# ulimit -SHn 65535 ##临时设置
[[email protected] ~]# ulimit -n ##当前shell生效
65535
[[email protected] ~]# vim /etc/security/limits.conf ##永久生效
* soft nofile 65535
* hard nofile 65535
7、定时清理邮件目录下的垃圾文件，防止inodes节点被占满。
8、精简并保留必要的开机自启动服务，如：crond、sshd、rsyslog、iptables、network、sysstat。
方法一：
[[email protected] ~]# for name in `chkconfig --list | grep 3:on | awk ‘{print $1}‘ | grep -Ev "sshd|crond|iptables|network|rsyslog|sshd|sysstat"`;do chkconfig $name off;done
方法二：
[[email protected] ~]# chkconfig --list | grep 3:on | awk ‘{print $1}‘ | grep -Ev "sshd|crond|iptables|network|rsyslog|sshd|sysstat" | sed -r ‘s#(.*)#chkconfig \1 off#g‘ | bash
方法三：
[[email protected] ~]# chkconfig --list | grep 3:on | awk ‘{print $1}‘ | grep -Ev "crond|iptables|network|rsyslog|sshd|sysstat" | awk ‘{print "chkconfig"" "$1" " "off"}‘ | bash
9、Linux内核参数优化
[[email protected] ~]# vim /etc/sysctl.conf
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl =15
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 32768
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_wmem = 8192 131072 16777216
net.ipv4.tcp_rmem = 32768 131072 16777216
net.ipv4.tcp_mem = 786432 1048576 1572864
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_conntrack_max = 65536
net.ipv4.netfilter.ip_conntrack_max=65536
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
[[email protected] ~]# sysctl -p ##立即生效
10、更改字符集，使其支持中文，但建议还是使用英文字符集，防止出现乱码。
服务器端：
[[email protected] ~]# export LANG=zh_CN.UTF-8 ##临时生效
[[email protected] ~]# sed -i ‘s#en_US.UTF-8#zh_CN.UTF-8#g‘ /etc/sysconfig/i18n ##永久生效
[[email protected] ~]# source /etc/sysconfig/i18n ##不重启生效
客户端：
Session Options---Appearance--Character encoding 选择UTF-8
11、锁定关键系统文件，如：/etc/passwd、/etc/shadow、/etc/group、/etc/gshadow。
[[email protected] ~]# chattr +i /etc/passwd
[[email protected] ~]# chattr +i /etc/shadow
[[email protected] ~]# chattr +i /etc/group
[[email protected] ~]# chattr +i /etc/gshadow
[[email protected] ~]# lsattr /etc/passwd ##查看文件属性
----i--------e- /etc/passwd
[[email protected] ~]# lsattr /etc/shadow
----i--------e- /etc/shadow
[[email protected] ~]# lsattr /etc/group
----i--------e- /etc/group
[[email protected] ~]# lsattr /etc/gshadow
----i--------e- /etc/gshadow
12、清空/etc/issue、/etc/issue.net，去除系统及内核版本登录信息。
[[email protected] ~]# > /etc/issue.net
[[email protected] ~]# echo "this server for test" > /etc/motd
Last login: Mon Aug 31 05:04:13 2015 from 192.168.1.104
this server for test
[[email protected] ~]#
13、清除多余的系统虚拟账号。
14、设置grub菜单密码。
[[email protected] ~]# /sbin/grub-md5-crypt
Password: ##密码axbc1kof
Retype password:
$1$5YV9P$tu.BCkBxWEr.rvC/KVKFh1
[[email protected] ~]# vim /boot/grub/grub.conf
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
password --md5 $1$5YV9P$tu.BCkBxWEr.rvC/KVKFh1
hiddenmenu
title CentOS (2.6.32-358.el6.x86_64)
root (hd0,0)
kernel /vmlinuz-2.6.32-358.el6.x86_64 ro root=UUID=fc5604d8-4d18-43d1-9df2-b6dfecbbb267 rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=us rd_NO_MD crashkernel=auto LANG=zh_CN.UTF-8 rd_NO_LVM rd_NO_DM rhgb quiet
initrd /initramfs-2.6.32-358.el6.x86_64.img
15、禁止服务器被ping
[[email protected] ~]# echo "net.ipv4.icmp_echo_ignore_all=1" >> /etc/sysctl.conf //修改内核参数
[[email protected] ~]# sysctl -p ##立即生效
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.icmp_echo_ignore_all = 1
