shell基础优化脚本

 #!/bin/bash
 #########################################################
 #Created Time: Tue Aug  7 01:29:09 2018                 #
 #version:1.0    by：kingle    Mail: kingle122@vip.qq.com #
 #基于oldboy书籍优化编写                                    #
 #实现功能：一键系统优化15项脚本，适用于Centos6.x               #
 #########################################################
 #Source function library.
 . /etc/init.d/functions
 #date
 DATE=`date +"%y-%m-%d %H:%M:%S"`
 #ip
 IPADDR=`grep "IPADDR" /etc/sysconfig/network-scripts/ifcfg-eth0|cut -d= -f  `
 #hostname
 HOSTNAME=`hostname -s`
 #user
 USER=`whoami`
 #disk_check
 DISK_SDA=`df -h |grep -w "/" |awk '{print $5}'`
 #cpu_average_check
 cpu_uptime=`cat /proc/loadavg|awk '{print $1,$2,$3}'`
 #set LANG
 export LANG=zh_CN.UTF-
 #Require root to run this script.
 uid=`id | cut -d\( -f1 | cut -d= -f2`
 if [ $uid -ne  ];then
   action "Please run this script as root." /bin/false
   exit
 fi
 #"stty erase ^H"
 \cp /root/.bash_profile  /root/.bash_profile_$(date +%F)
 erase=`grep -wx "stty erase ^H" /root/.bash_profile |wc -l`
 if [ $erase -lt  ];then
     echo "stty erase ^H" >>/root/.bash_profile
     source /root/.bash_profile
 fi
 #Config Yum CentOS-Bases.repo and save Yum file
 configYum(){
 echo "================更新为国内YUM源=================="
   cd /etc/yum.repos.d/
   \cp CentOS-Base.repo CentOS-Base.repo.$(date +%F)
   ping -c  mirrors.aliyun.com >/dev/null
   if [ $? -eq  ];then
   wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-.repo
   else
     echo "无法连接网络。"
     exit $?
   fi
 echo "==============保存YUM源文件======================"
 sed -i 's#keepcache=0#keepcache=1#g' /etc/yum.conf
 grep keepcache /etc/yum.conf
 sleep
 action "配置国内YUM完成"  /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #Charset zh_CN.UTF-8
 initI18n(){
 echo "================更改为中文字符集================="
   \cp /etc/sysconfig/i18n /etc/sysconfig/i18n.$(date +%F)
 >/etc/sysconfig/i18n
 cat >>/etc/sysconfig/i18n<<EOF
 LANG="zh_CN.UTF-8"
 #LANG="en_US.UTF-8"
 SYSFONT="latarcyrheb-sun16"
 EOF
   source /etc/sysconfig/i18n
   echo '#cat /etc/sysconfig/i18n'
   grep LANG /etc/sysconfig/i18n
 action "更改字符集zh_CN.UTF-8完成" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #Close Selinux and Iptables
 initFirewall(){
 echo "============禁用SELINUX及关闭防火墙=============="
   \cp /etc/selinux/config /etc/selinux/config.$(date +%F)
   /etc/init.d/iptables stop
   sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
   setenforce
   /etc/init.d/iptables status
   echo '#grep SELINUX=disabled /etc/selinux/config '
   grep SELINUX=disabled /etc/selinux/config
   echo '#getenforce '
   getenforce
 action "禁用selinux及关闭防火墙完成" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #Init Auto Startup Service
 initService(){
 echo "===============精简开机自启动===================="
   export LANG="en_US.UTF-8"
   for A in `chkconfig --list |grep :on |awk '{print $1}' `;do chkconfig $A off;done
   for B in rsyslog network sshd crond sysstat;do chkconfig $B on;done
   echo '+--------which services on---------+'
   chkconfig --list |grep :on
   echo '+----------------------------------+'
   export LANG="zh_CN.UTF-8"
 action "精简开机自启动完成" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #Removal system and kernel version login before the screen display
 initRemoval(){
 echo "======去除系统及内核版本登录前的屏幕显示======="
 #must use root user run scripts
 if
    [ $UID -ne  ];then
    echo This script must use the root user ! ! !
    sleep
    exit
 fi
     >/etc/redhat-release
     >/etc/issue
 action "去除系统及内核版本登录前的屏幕显示" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #Change sshd default port and prohibit user root remote login.
 initSsh(){
 echo "========修改ssh默认端口禁用root远程登录=========="
   \cp /etc/ssh/sshd_config /etc/ssh/sshd_config.$(date +%F)
   sed -i 's/#Port 22/Port 52113/g' /etc/ssh/sshd_config
   sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
   sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
   sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
   echo '+-------modify the sshd_config-------+'
   echo 'Port 52113'
   echo 'PermitEmptyPasswords no'
   echo 'PermitRootLogin no'
   echo 'UseDNS no'
   echo '+------------------------------------+'
   /etc/init.d/sshd reload && action "修改ssh默认参数完成" /bin/true || action "修改ssh参数失败" /bin/false
 echo "================================================="
 echo ""
   sleep
 }
 #time sync
 syncSysTime(){
 echo "================配置时间同步====================="
   \cp /var/spool/cron/root /var/spool/cron/root.$(date +%F) >/dev/null
   NTPDATE=`grep ntpdate /var/spool/cron/root >/dev/null |wc -l`
   if [ $NTPDATE -eq  ];then
     echo "#times sync by lee at $(date +%F)" >>/var/spool/cron/root
     echo "*/5 * * * * /usr/sbin/ntpdate time.windows.com &>/dev/null" >> /var/spool/cron/root
   fi
   echo '#crontab -l'
   crontab -l
 action "配置时间同步完成" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #install tools
 initTools(){
     echo "#####安装升级系统补装工具及重要工具升级(选择最小化安装minimal)#####"
     ping -c  mirrors.aliyun.com
     sleep
     yum install tree nmap sysstat lrzsz dos2unix -y
     sleep
     rpm -qa tree nmap sysstat lrzsz dos2unix
     sleep
     yum install openssl openssh bash -y
     sleep
 action "安装升级系统补装工具及重要工具升级(选择最小化安装minimal)" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #add user and give sudoers
 addUser(){
 echo "===================新建用户======================"
 #add user
 while true
 do
     read -p "请输入新用户名:" name
     NAME=`awk -F':' '{print $1}' /etc/passwd|grep -wx $name >/dev/null|wc -l`
     if [ ${#name} -eq 0 ];then
        echo "用户名不能为空，请重新输入。"
        continue
     elif [ $NAME -eq  ];then
        echo "用户名已存在，请重新输入。"
        continue
     fi
 useradd $name
 break
 done
 #create password
 while true
 do
     read -p "为 $name 创建一个密码:" pass1
     if [ ${#pass1} -eq 0 ];then
        echo "密码不能为空，请重新输入。"
        continue
     fi
     read -p "请再次输入密码:" pass2
     if [ "$pass1" != "$pass2" ];then
        echo "两次密码输入不相同，请重新输入。"
        continue
     fi
 echo "$pass2" |passwd --stdin $name
 break
 done
 sleep
 #add visudo
 echo "#####add visudo#####"
 \cp /etc/sudoers /etc/sudoers.$(date +%F)
 SUDO=`grep -w "$name" /etc/sudoers |wc -l`
 if [ $SUDO -eq  ];then
     echo "$name  ALL=(ALL)       NOPASSWD: ALL" >>/etc/sudoers
     echo '#tail -1 /etc/sudoers'
     grep -w "$name" /etc/sudoers
     sleep
 fi
 action "创建用户$name并将其加入visudo完成"  /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 #Adjust the file descriptor(limits.conf)
 initLimits(){
 echo "===============加大文件描述符===================="
   LIMIT=`grep nofile /etc/security/limits.conf |grep -v "^#"|wc -l`
   if [ $LIMIT -eq  ];then
   \cp /etc/security/limits.conf /etc/security/limits.conf.$(date +%F)
   echo '*                  -        nofile         65535'>>/etc/security/limits.conf
   fi
   echo '#tail -1 /etc/security/limits.conf'
   tail - /etc/security/limits.conf
   ulimit -HSn
   echo '#ulimit -n'
   ulimit -n
 action "配置文件描述符为65535" /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 #set ssh
 initSsh(){
 echo "======禁用GSSAPI来认证，也禁用DNS反向解析，加快SSH登陆速度======="
 sed -i 's/^GSSAPIAuthentication yes$/GSSAPIAuthentication no/' /etc/ssh/sshd_config
 sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
 service sshd restart
 action "禁用GSSAPI来认证，也禁用DNS反向解析，加快SSH登陆速度" /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 #set the control-alt-delete to guard against the miSUSE
 initRestart(){
 sed -i 's#exec /sbin/shutdown -r now#\#exec /sbin/shutdown -r now#' /etc/init/control-alt-delete.conf
 action "将ctrl alt delete键进行屏蔽，防止误操作的时候服务器重启" /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 #Optimizing the system kernel
 initSysctl(){
 echo "================优化内核参数====================="
 SYSCTL=`grep "net.ipv4.tcp" /etc/sysctl.conf |wc -l`
 if [ $SYSCTL -lt  ];then
 \cp /etc/sysctl.conf /etc/sysctl.conf.$(date +%F)
 cat >>/etc/sysctl.conf<<EOF
 net.ipv4.tcp_fin_timeout =
 net.ipv4.tcp_tw_reuse =
 net.ipv4.tcp_tw_recycle =
 net.ipv4.tcp_syncookies =
 net.ipv4.tcp_keepalive_time =
 net.ipv4.ip_local_port_range =
 net.ipv4.tcp_max_syn_backlog =
 net.ipv4.tcp_max_tw_buckets =
 net.ipv4.route.gc_timeout =
 net.ipv4.tcp_syn_retries =
 net.ipv4.tcp_synack_retries =
 net.core.somaxconn =
 net.core.netdev_max_backlog =
 net.ipv4.tcp_max_orphans =
 net.netfilter.nf_conntrack_max =
 net.netfilter.nf_conntrack_tcp_timeout_established =
 net.netfilter.nf_conntrack_tcp_timeout_time_wait =
 net.netfilter.nf_conntrack_tcp_timeout_close_wait =
 net.netfilter.nf_conntrack_tcp_timeout_fin_wait =
 EOF
 fi
   \cp /etc/rc.local /etc/rc.local.$(date +%F)
   modprobe nf_conntrack
   echo "modprobe nf_conntrack">> /etc/rc.local
   modprobe bridge
   echo "modprobe bridge">> /etc/rc.local
   sysctl -p
 action "内核调优完成" /bin/true
 echo "================================================="
 echo ""
   sleep
 }
 #setting history and login timeout
 initHistory(){
 echo "======设置默认历史记录数和连接超时时间======"
 echo "TMOUT=300" >>/etc/profile
 echo "HISTSIZE=5" >>/etc/profile
 echo "HISTFILESIZE=5" >>/etc/profile
 tail - /etc/profile
 source /etc/profile
 action "设置默认历史记录数和连接超时时间" /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 #chattr file system
 initChattr(){
 echo "======锁定关键文件系统======"
 chattr +i /etc/passwd
 chattr +i /etc/inittab
 chattr +i /etc/group
 chattr +i /etc/shadow
 chattr +i /etc/gshadow
 /bin/mv /usr/bin/chattr /usr/bin/lock
 action "锁定关键文件系统" /bin/true
 echo "================================================="
 echo ""
 sleep
 }
 del_file(){
 echo "======定时清理邮件任务======"
 [ -f /server/scripts/ ] || mkdir -p /server/scripts/
 echo "find /var/spool/postfix/maildrop/ -type f|xargs rm -f" >/server/scripts/del_file.sh
 echo '#this is del mail task by kingle at 2018-8-8' >>/var/spool/cron/root
 echo "*/1 * * * * /bin/bash /server/scripts/del_file.sh &>/dev/null" >>/var/spool/cron/root
 echo "================================================="
 echo ""
 sleep
 }
 hide_info(){
 echo "======！！隐藏系统信息！！======"
 echo "======此项注意不要自己忘记了那就没救了======"
 echo "======不建议使用======"
 Version_information=`cat /etc/issue|grep "CentOS"`
 >/etc/issue
 >/etc/issue.net
 if [ `cat /etc/issue|grep cent|wc -l` -eq  -a `cat /etc/issue|grep cent|wc -l` -eq  ];then
 echo "======清除成功====="
 else
 >/etc/issue
 >/etc/issue.net
 fi
 echo "$Version_information"
 echo "=====认准本系统版本======"
 sleep
 echo "================================================="
 }
 grub_md5(){
 echo "======grub_md5加密======"
 echo "======命令行输入：/sbin/grub-md5-crypt 进行交互式加密======"
 echo "把密码写入/etc/grub.conf 格式：password --MD5 密码"
 echo ""
 sleep
 }
 ban_ping(){
     #内网可以ping 其他不能ping 这个由于自己也要ping测试不一定要设置
 echo '#内网可以ping 其他不能ping 这个由于自己也要ping测试不一定要设置'
 echo 'iptables -t filter -I INPUT -p icmp --icmp-type 8 -i eth0 -s 10.0.0.0/24 -j ACCEPT'
 sleep
 }

 #menu2
 menu2(){
 while true
 do
 clear
 cat <<EOF
 ----------------------------------------
 |****Please Enter Your Choice:[-]****|
 ----------------------------------------
 ()  新建一个用户并将其加入visudo
 ()  配置为国内YUM源镜像和保存YUM源文件
 ()  配置中文字符集
 ()  禁用SELINUX及关闭防火墙
 ()  精简开机自启动
 ()  去除系统及内核版本登录前的屏幕显示
 ()  修改ssh默认端口及禁用root远程登录
 ()  设置时间同步
 ()  安装系统补装工具(选择最小化安装minimal)
 () 加大文件描述符
 () 禁用GSSAPI来认证，也禁用DNS反向解析，加快SSH登陆速度
 () 将ctrl alt delete键进行屏蔽，防止误操作的时候服务器重启
 () 系统内核调优
 () 设置默认历史记录数和连接超时时间
 () 锁定关键文件系统
 () 定时清理邮件任务
 () 隐藏系统信息
 () grub_md5加密
 () ban_ping
 () 返回上一级菜单

 EOF
 read -p "Please enter your Choice[0-15]: " input2
 case "$input2" in
   )
   clear
   break
   ;;
   )
   addUser
   ;;
   )
   configYum
   ;;
   )
   initI18n
   ;;
   )
   initFirewall
   ;;
   )
   initService
   ;;
   )
   initRemoval
   ;;
   )
   initSsh
   ;;
   )
   syncSysTime
   ;;
   )
   initTools
   ;;
   )
   initLimits
   ;;
   )
   initSsh
   ;;
   )
   initRestart
   ;;
   )
   initSysctl
   ;;
   )
   initHistory
   ;;
   )
   initChattr
   ;;
   )
   del_file
   ;;
   )
   hide_info
   ;;
   )
   grub_md5
   ;;
   )
   ban_ping
   ;;
   *) echo "----------------------------------"
      echo "|          Warning!!!            |"
      echo "|   Please Enter Right Choice!   |"
      echo "----------------------------------"
      for i in `seq -w  - `
        do
          echo -ne "\b\b$i";
   sleep ;
      done
      clear
 esac
 done
 }
 #initTools
 #menu
 while true
 do
 clear
 echo "========================================"
 echo '          Linux Optimization            '
 echo "========================================"
 cat << EOF
 |-----------System Infomation-----------
 | DATE       :$DATE
 | HOSTNAME   :$HOSTNAME
 | USER       :$USER
 | IP         :$IPADDR
 | DISK_USED  :$DISK_SDA
 | CPU_AVERAGE:$cpu_uptime
 ----------------------------------------
 |****Please Enter Your Choice:[-]****|
 ----------------------------------------
 () 一键优化
 () 自定义优化
 () 退出
 EOF
 #choice
 read -p "Please enter your choice[0-3]: " input1
 case "$input1" in
 )
   addUser
   configYum
   initI18n
   initFirewall
   initService
   initRemoval
   initSsh
   syncSysTime
   initTools
   initLimits
   initSsh
   initRestart
   initSysctl
   initHistory
   initChattr
   ;;
 )
   menu2
   ;;
 )
   clear
   break
   ;;
 *)
   echo "----------------------------------"
   echo "|          Warning!!!            |"
   echo "|   Please Enter Right Choice!   |"
   echo "----------------------------------"
   for i in `seq -w  - `
       do
         echo -ne "\b\b$i";
         sleep ;
   done
   clear
 esac
 done

--- 借鉴于各路大神---

----致谢----