Centso7 简单优化（阿里云服务器）

##.下载常用包
# yum -y install wget net-tools screen lsof tcpdump nc mtr openssl-devel vim bash-completion lrzsz nmap telnet tree ntpdate
##.内核优化
cp /etc/sysctl.conf{,.default}
cat>/etc/sysctl.conf<<EOF
net.ipv6.conf.all.disable_ipv6 =
net.ipv6.conf.default.disable_ipv6 =
net.ipv6.conf.lo.disable_ipv6 =
vm.swappiness =
net.ipv4.neigh.default.gc_stale_time=
net.ipv4.conf.all.rp_filter=
net.ipv4.conf.default.rp_filter=
net.ipv4.conf.default.arp_announce =
net.ipv4.conf.lo.arp_announce=
net.ipv4.conf.all.arp_announce=
net.ipv4.tcp_max_tw_buckets =
net.ipv4.tcp_syncookies =
net.ipv4.tcp_max_syn_backlog =
net.ipv4.tcp_synack_retries =
kernel.sysrq =
net.ipv4.tcp_syn_retries =
net.ipv4.tcp_keepalive_time =
net.ipv4.tcp_keepalive_probes =
net.ipv4.tcp_keepalive_intvl =
net.ipv4.tcp_retries2 =
net.ipv4.tcp_fin_timeout =
net.ipv4.tcp_tw_recycle =
net.ipv4.tcp_tw_reuse =
net.ipv4.tcp_max_orphans =
net.ipv4.tcp_wmem =
net.ipv4.tcp_rmem =
net.ipv4.tcp_mem =
net.ipv4.ip_local_port_range =
net.ipv4.ip_conntrack_max =
net.ipv4.netfilter.ip_conntrack_max =
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established =
net.core.somaxconn =
net.core.netdev_max_backlog =
kernel.shmmax =
kernel.shmall =
kernel.msgmax =
kernel.msgmnb =
net.ipv4.tcp_sack =
net.ipv4.tcp_window_scaling =
kernel.sysrq =
EOF
sysctl -p

##.开机自启优化

systemctl disable postfix

systemctl  disable  ntpd

systemctl  disable  tuned

##4.操作系统和数据库系统管理用户身份鉴别信息令应有复杂度要求并定期更换。

cp  /etc/login.defs{,.default}

sed -i "s#PASS_MAX_DAYS\t99999#PASS_MAX_DAYS\t90#g" /etc/login.defs

sed -i "s#PASS_MIN_LEN\t5#PASS_MIN_LEN\t8#g"  /etc/login.defs

sed -i "s#PASS_MIN_DAYS\t0#PASS_MIN_DAYS\t2#g" /etc/login.defs

##5.启用登录失败处理功能

cp  /etc/pam.d/system-auth{,.default}

sed -i "13a password requisite pam_cracklib.so retry=3 difok=2 minlen=8 lcredit=-1 dcredit=-1" /etc/pam.d/system-auth

##6.设置登录终端的操作超时锁定

sed -i "46a TMOUT=900"  /etc/profile