最简单易懂的linux系统基础优化

第10章 linux的系统优化

10.1 系统的版本,内核查看

10.1.1 系统版本的查看

[root@oldboy6666 ~]# cat /etc/redhat-release

CentOS Linux release 7.6.1810 (Core)

[root@oldboy6666 ~]#

10.1.2 系统内核的查看

[root@oldboy6666 ~]# uname -r

3.10.0-957.el7.x86_64

10.1.3 系统系统架构的查看

[root@oldboy6666 ~]# uname -m

x86_64

10.1.4 当前使用的系统查看

[root@oldboy6666 ~]# uname -s

Linux

[root@oldboy6666 ~]#

10.1.5 系统信息全部查看

[root@oldboy6666 ~]# uname -a

Linux oldboy6666 3.10.0-957.el7.x86_64 #1 SMP Thu Nov 8 23:39:32 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

10.1.6 系统主机名的查看

[root@oldboy6666 ~]# uname -n

oldboy6666

10.1.7 系统版本,内核查看的图示

10.2 系统的用户优化

10.2.1 用户的创建

[root@oldboy6666 ~]# useradd oldboy101

[root@oldboy6666 ~]#

10.2.2 用户密码的修改

10.2.2.1 root用户修改密码(密码可以随便写)

[root@oldboy6666 ~]# passwd

Changing password for user root.

New password:

BAD PASSWORD: The password is shorter than 8 characters

Retype new password:

passwd: all authentication tokens updated successfully.

[root@oldboy6666 ~]#

10.2.2.2 普通用户修改密码

[oldboy101@oldboy6666 ~] $ passwd

Changing password for user oldboy101.

Changing password for oldboy101.

(current) UNIX password:

New password:

BAD PASSWORD: The password is too similar to the old one 这个密码和旧密码太相似

New password:

[oldboy101@oldboy6666 ~] $ passwd

Changing password for user oldboy101.

Changing password for oldboy101.

(current) UNIX password:

New password:

BAD PASSWORD: The password is shorter than 8 characters 这个密码少于8个字符

New password:

Retype new password:

Sorry, passwords do not match.

New password:

Retype new password:

passwd: all authentication tokens updated successfully.

[oldboy101@oldboy6666 ~] $

10.2.2.3 普通用户修改密码注意事项

• (1).普通用户修改密码不可以过于简单,且必须大于等于8位字符
• (2).普通用户修改密码必须有数字字母特殊字符组成
• (3).普通用户修改密码必须有大小写字母

10.2.3 用户密码无交互方式修改

[root@oldboy6666 ~]# echo "123456" | passwd --stdin oldboy101

Changing password for user oldboy101.

10.2.4 用户切换

10.2.4.1 root用户往普通用户切换(不需要密码)

• su – oldboy101:切换到oldboy101:

[root@oldboy6666 ~]# su - oldboy101

Last login: Wed Sep 11 15:51:15 CST 2019 on pts/4

[oldboy101@oldboy6666 ~] $

10.2.4.2 普通用户往root用户切换

[root@oldboy6666 ~]# su - oldboy101

Last login: Wed Sep 11 15:51:15 CST 2019 on pts/4

[oldboy101@oldboy6666 ~] $ su - root

Password:

Last login: Wed Sep 11 15:11:23 CST 2019 from 10.0.0.1 on pts/3

[root@oldboy6666 ~] $

10.2.4.3 图示切换用户

10.2.5 用户的查看

[root@oldboy6666 ~] $ id

uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[root@oldboy6666 ~] $

10.2.6 查看当前登陆的用户

[root@oldboy6666 ~] $ whoami 直接查看当前登陆的用户

root

[root@oldboy6666 ~] $

[oldboy101@oldboy6666 ~] $ su – root 切换成功，则证明有这个用户

Password:

Last login: Wed Sep 11 15:11:23 CST 2019 from 10.0.0.1 on pts/3

[root@oldboy6666 ~] $

10.3 命令提示符的优化

10.3.1 提示符信息的修改

10.3.1.1 提示信息的字符介绍

• \u 显示当前登陆的系统用户
• \h 显示系统的主机名(简写)
• \W 显示当前所在的系统路径(简写)
• \H 显示系统的主机名(详细的)
• \w 显示绝对路径
• \d 代表日期
• \t 显示时间,24小时格式的
• \T 显示时间,12小时格式的
• \v 显示版本的信息
• \$ 提示字符(如果是root，则为#，如果是其他，则为$)

10.3.1.2 临时修改

[root@oldboyedu ~]# echo $PS1

[\u@\h \W]\$

[root@oldboyedu ~]#

[root@oldboyedu ~]#

[root@oldboyedu ~]#

[root@oldboyedu ~]# PS1='[\u@\H \w]\$'

[root@oldboyedu.com ~]#echo $PS1

[\u@\H \w]\$

[root@oldboyedu.com ~]#

10.3.1.3 永久修改

[root@oldboyedu.com ~]#echo "export PS1='[\u@\H \w]\$'" >> /etc/profile

[root@oldboyedu.com ~]#

10.3.4 提示符颜色的修改

• echo -e "\033[字体颜色;背景颜色m 输入的内容 \033[0m"
• export PS1='\[\e[30;1m\][\u@\h \W]\\$ \[\e[0m\]' 灰色
• export PS1='\[\e[31;1m\][\u@\h \W]\\$ \[\e[0m\]' 红色
• export PS1='\[\e[32;1m\][\u@\h \W]\\$ \[\e[0m\]' 绿色
• export PS1='\[\e[33;1m\][\u@\h \W]\\$ \[\e[0m\]' 黄色
• export PS1='\[\e[34;1m\][\u@\h \W]\\$ \[\e[0m\]' 蓝色
• export PS1='\[\e[35;1m\][\u@\h \W]\\$ \[\e[0m\]' 紫色
• export PS1='\[\e[36;1m\][\u@\h \W]\\$ \[\e[0m\]' 浅蓝色
• export PS1='\[\e[37;1m\][\u@\h \W]\\$ \[\e[0m\]' 白色

10.3.3 提示符优化的好处

可以方便的查看文件内容较多的文本

10.4 yum源的优化

10.4.1 yum源优化的里程碑

10.4.1.1 访问阿里云网站

网址为:mirrors.aliyun.com

10.4.1.2 查找你需要的源(centos)

• 点击centos后面的帮助,将centos7的软件下载路径复制出来

更新阿里云的下载路径

curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

查看文件(cat /etc/yum.repos.d/CentOS-Base.repo)--------------------base源

[base]

name=CentOS-$releasever - Base - mirrors.aliyun.com

failovermethod=priority

baseurl=http://mirrors.aliyun.com/centos/$releasever/os/$basearch/

http://mirrors.aliyuncs.com/centos/$releasever/os/$basearch/

http://mirrors.cloud.aliyuncs.com/centos/$releasever/os/$basearch/

gpgcheck=1

gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7

• $releasever(/etc/redhat) 代表查看的版本
• $basearch(uname -m) 架构(x86_64)

  查找epel源

点击帮助，将路径复制出来进行更新

更新阿里云(epel)的路径

curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

查看文件(cat /etc/yum.repos.d/ epel.repo)

[epel]

name=Extra Packages for Enterprise Linux 7 - $basearch

baseurl=http://mirrors.aliyun.com/epel/7/$basearch

failovermethod=priority

enabled=1

gpgcheck=0

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

$basearch:查看系统的架构(X86_64)

10.4.1.3 安装软件

yum install -y vim wget net-tools telnet sl cowsay bash-completion tree lrzsz

vim         -- vi命令升级版, 编辑文件信息

wget         -- 用于下载文件或者软件信息 下载工具

net-tools -- 网络相关工具包

telnet -- 测试网络服务端口是否正常

bash-completion --- 让systemctl后面参数信息具有补全功能

lrzsz -- 将windows主机数据可以上传到linux系统中 rz -y

-- 将linux主机数据可以下载到windows系统中 sz -y

10.4.2 图示yum源的连接

10.4.3 阿里云种base的优化

点击centos后面的帮助,将centos7的软件下载路径复制出来

更新阿里云的下载路径

curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

查看文件(cat /etc/yum.repos.d/CentOS-Base.repo)--------------------base源

[base]

name=CentOS-$releasever - Base - mirrors.aliyun.com

failovermethod=priority

baseurl=http://mirrors.aliyun.com/centos/$releasever/os/$basearch/

http://mirrors.aliyuncs.com/centos/$releasever/os/$basearch/

http://mirrors.cloud.aliyuncs.com/centos/$releasever/os/$basearch/

gpgcheck=1

gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7

$releasever(/etc/redhat):代表查看的版本

$basearch(uname -m):架构(x86_64)

10.4.4 阿里云种epel的优化

查找epel源

点击帮助，将路径复制出来进行更新

更新阿里云(epel)的路径

curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

查看文件(cat /etc/yum.repos.d/ epel.repo)

[epel]

name=Extra Packages for Enterprise Linux 7 - $basearch

baseurl=http://mirrors.aliyun.com/epel/7/$basearch

failovermethod=priority

enabled=1

gpgcheck=0

gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

$basearch:查看系统的架构(X86_64)

10.5 系统安全优化

10.5.1 centos7防火墙安全配置

10.5.1.1 临时配置

• (1).查看防火墙当前的状态(正在运行)

[root@oldboy6666 scripts] # systemctl status firewalld.service

● firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)

Active: active (running) since Thu 2019-09-12 15:25:50 CST; 2s ago

Docs: man:firewalld(1)

Main PID: 7839 (firewalld)

CGroup: /system.slice/firewalld.service

└─7839 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Sep 12 15:25:49 oldboy6666 systemd[1]: Starting firewalld - dynamic firewall daemon...

Sep 12 15:25:50 oldboy6666 systemd[1]: Started firewalld - dynamic firewall daemon.

[root@oldboy6666 scripts] #

• (2).关闭防火墙,并且查看防火墙的状态

[root@oldboy6666 scripts] # systemctl stop firewalld.service 关闭防火墙

[root@oldboy6666 scripts] # systemctl status firewalld.service 查看防火墙的状态

● firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)

Active: inactive (dead)

Docs: man:firewalld(1)

Sep 12 15:25:49 oldboy6666 systemd[1]: Starting firewalld - dynamic firewall daemon...

Sep 12 15:25:50 oldboy6666 systemd[1]: Started firewalld - dynamic firewall daemon.

Sep 12 15:27:35 oldboy6666 systemd[1]: Stopping firewalld - dynamic firewall daemon...

Sep 12 15:27:36 oldboy6666 systemd[1]: Stopped firewalld - dynamic firewall daemon.

[root@oldboy6666 scripts] #

10.5.2.2 永久配置

[root@oldboy6666 scripts] # systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)

Active: inactive (dead)

Docs: man:firewalld(1)

Sep 12 15:25:49 oldboy6666 systemd[1]: Starting firewalld - dynamic firewall daemon...

Sep 12 15:25:50 oldboy6666 systemd[1]: Started firewalld - dynamic firewall daemon.

Sep 12 15:27:35 oldboy6666 systemd[1]: Stopping firewalld - dynamic firewall daemon...

Sep 12 15:27:36 oldboy6666 systemd[1]: Stopped firewalld - dynamic firewall daemon.

[root@oldboy6666 scripts] #

10.5.2 centos6防火墙安全配置

10.5.2.1 临时配置

• (1).查看防火墙的状态(防火墙是开启的)

[root@oldboyedu ~] # /etc/init.d/iptables status

Table: filter

Chain INPUT (policy ACCEPT)

num target prot opt source destination

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22

5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

num target prot opt source destination

1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination

[root@oldboyedu ~] #

(2).关闭防火墙

[root@oldboyedu ~] # /etc/init.d/iptables stop

iptables: Setting chains to policy ACCEPT: filter [ OK ]

iptables: Flushing firewall rules: [ OK ]

iptables: Unloading modules: [ OK ]

[root@oldboyedu ~] # /etc/init.d/iptables status

iptables: Firewall is not running.

10.5.2.2 永久配置

[root@oldboyedu.com ~]#chkconfig --list | grep iptables 查看当前防火墙的状态
iptables        0:off 1:off 2:on 3:on 4:on 5:on 6:off
[root@oldboyedu.com ~]#chkconfig iptables off 关闭防火墙
[root@oldboyedu.com ~]#chkconfig --list | grep iptables 再次查看防火墙
iptables        0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@oldboyedu.com ~]#

10.5.3 selinux系统安全的配置

10.5.3.1 selinux安全优化的好处

selinux开启是为了限制root用户的权限,可以让root在使用的时候权力受到限制

由于在公司root用户一般是经理或者更高级别的人才可以拥有，导致selinux虽然可以限制，但是为了操作更加方便，一般都是关闭

10.5.3.2 selinux临时配置

• (1).查看selinux的状态(现在是开启的)

[root@oldboy6666 scripts] # getenforce

Enforcing

[root@oldboy6666 scripts] #

• (2).关闭selinux

[root@oldboy6666 scripts] # setenforce 0

[root@oldboy6666 scripts] # getenforce

Permissive

[root@oldboy6666 scripts] #

10.5.3.3 selinux永久配置

• (1).修改配置文件

[root@oldboy6666 scripts] # cat /etc/selinux/config 配置文件路径

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced. selinux安全策略是开启的

# permissive - SELinux prints warnings instead of enforcing. selinux打印警告信息代替开启

# disabled - No SELinux policy is loaded. 没有selinux策略的加载

SELINUX=enforcing
要改成disabled

# SELINUXTYPE= can take one of three values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

• (2).利用sed命令来进行修改

[root@oldboy6666 scripts] # sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config

[root@oldboy6666 scripts] # cat /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=disabled
已经关闭

# SELINUXTYPE= can take one of three values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

[root@oldboy6666 scripts] #

10.6 系统字符集优化

10.6.1 为什么要优化字符集

优化字符集可以防止在输入命令或者文件信息的时候出现乱码

可以显示中文信息

10.6.2 临时修改字符设置

[root@oldboy6666 scripts] # LANG="en_US.GBK"

[root@oldboy6666 scripts] # echo $LANG

en_US.GBK

[root@oldboy6666 scripts] #

10.6.3 永久修改字符设置(centos7)

• (1).配置文件的修改

[root@oldboy6666 scripts] # cat /etc/locale.conf

LANG=en_US.UTF-8

[root@oldboy6666 scripts] #

• (2).命令的修改

[root@oldboy6666 ~] # localectl set-locale 'LANG=zh_CN.UTF-8' 命令

[root@oldboy6666 ~] # echo $LANG

zh_CN.UTF-8

[root@oldboy6666 ~] #

10.6.4 永久修改字符设置(centos6)

[root@oldboyedu ~] # cat /etc/sysconfig/i18n

LANG="en_US.UTF-8"

SYSFONT="latarcyrheb-sun16"

[root@oldboyedu ~] #

10.7 系统时间优化

10.7.1 查看时间的方法

[root@oldboy6666 ~] # date
Thu Sep 12 16:55:49 CST 2019
[root@oldboy6666 ~] #

10.7.2 手动更新时间

[root@oldboy6666 ~] # ntpdate ntp1.aliyun.com

12 Sep 16:57:03 ntpdate[8479]: adjust time server 120.25.115.20 offset 0.000488 sec

[root@oldboy6666 ~] #

10.7.3 自动更新时间

10.7.3.1 自动更新时间常用的参数

[root@oldboy6666 ~] # timedatectl

list-timezones 显示所有时区(timedatectl list-timezones)

set-local-rtc 更新硬件(bios)时间(timedatectl set-local-rtc 1)

1:代表开启 0代表关闭

set-ntp ntp服务器时间的更新(timedatectl set-ntp 1)

1:代表开启 0代表关闭

set-time 更新时间(timedatectl set-time 20190528)

set-timezone 设置时区(timedatectl set-timezone +时区)

[root@oldboy6666 ~] # timedatectl

10.7.3.2 ntp服务器的讲解

• (1).ntp服务器的作用

ntp服务器用于在时间服务器和客户端进行同步的操作

• (2).ntp服务器同步操作

[root@oldboy6666 ~] # timedatectl set-ntp 1 设置1为同步开启

[root@oldboy6666 ~] # timedatectl

Local time: Thu 2019-09-12 17:25:22 CST

Universal time: Thu 2019-09-12 09:25:22 UTC

RTC time: Thu 2019-09-12 09:25:22

Time zone: Asia/Shanghai (CST, +0800)

NTP enabled: yes

NTP synchronized: yes

RTC in local TZ: yes

DST active: n/a

Warning: The system is configured to read the RTC time in the local time zone.

This mode can not be fully supported. It will create various problems

with time zone changes and daylight saving time adjustments. The RTC

time is never updated, it relies on external facilities to maintain it.

If at all possible, use RTC in UTC by calling

'timedatectl set-local-rtc 0'.

[root@oldboy6666 ~] #

[root@oldboy6666 ~] # timedatectl set-ntp 0 ntp服务器同步关闭

[root@oldboy6666 ~] # timedatectl

Local time: Thu 2019-09-12 17:27:28 CST

Universal time: Thu 2019-09-12 09:27:28 UTC

RTC time: Thu 2019-09-12 09:27:28

Time zone: Asia/Shanghai (CST, +0800)

NTP enabled: no

NTP synchronized: yes

RTC in local TZ: yes

DST active: n/a

Warning: The system is configured to read the RTC time in the local time zone.

This mode can not be fully supported. It will create various problems

with time zone changes and daylight saving time adjustments. The RTC

time is never updated, it relies on external facilities to maintain it.

If at all possible, use RTC in UTC by calling

'timedatectl set-local-rtc 0'.

[root@oldboy6666 ~] #

10.7.3.3 硬件时间的讲解

硬件时间简称(bios)，由于服务器断电，但是bios电池有电，还会继续的更新时间，这也就是为啥偶尔关机服务器的时间开机以后也可以是正确的原因

10.8 ssh的优化

打开:vim /etc/ssh/sshd_config

79 GSSAPIAuthentication yes 改为 no

115 UseDNS yes 改为 no

重启sshd服务

systemctl restart sshd