centons 7 清机 脚本

#/bin/bash
##################################初始化系统###################
setenforce 0

yum install -y yum-axelget net-snmp.x86_64 epel-release lrzsz gcc gcc-c++ make man vim unzip wget curl lua-devel lua-static patch libxml2-devel libxslt libxslt-devel gd gd-devel ntp ntpdate screen sysstat tree rsync lsof openssh-clients iftop net-snmp libuuid-devel.x86_64 uuidd.x86_64 device-mapper-devel.x86_64 popt-devel.x86_64 popt.x86_64 popt-static.x86_64 iptables-services rdate ntp smartmontools iptraf net-tools
yum install -y salt-minion
yum update -y
chmod 775 test.sh
cp test.sh /home/
echo "y"|cp -rf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
echo "1 1 */1 * * rdate time-b.nist.gov" >>/var/spool/cron/root&&chmod 600 /var/spool/cron/root
echo "1 1 */1 * * ntpdate asia.pool.ntp.org" >>/var/spool/cron/root&&chmod 600 /var/spool/cron/root

PWD=`pwd`
mkdir /home/soft
DownDir=/home/soft
cd /home/soft

cat > /etc/sysctl.conf <<EOF
net.nf_conntrack_max = 65536
net.netfilter.nf_conntrack_max = 65536
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.tcp_max_tw_buckets = 15000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 262144
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 30
net.ipv4.ip_local_port_range = 1024 65000
fs.file-max = 13000000
net.ipv4.tcp_keepalive_probes=5
net.ipv4.tcp_orphan_retries=3
net.ipv4.tcp_synack_retries=2
kernel.printk_ratelimit = 30
kernel.printk_ratelimit_burst = 200
EOF

cat >> /etc/security/limits.conf <<EOF
* soft nofile 1024000
* hard nofile 1024000
hive - nofile 1024000
hive - nproc 1024000
# End of file
EOF

cat >> /etc/bashrc <<EOF
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export HISTFILESIZE=1000000
export HISTSIZE=2000
EOF
source /etc/bashrc

if [ -f /etc/selinux/config ];then
sed -i 's/enforcing/disabled/' /etc/selinux/config
fi
cat >> /etc/profile <<EOF

USER_IP=\`who -u am i 2>/dev/null| awk '{print \$NF}'|sed -e 's/[()]//g'\`
HISTFILESIZE=4000
HISTSIZE=4000
HISTTIMEFORMAT="%F %T \${USER_IP} \`whoami\` "
export HISTTIMEFORMAT

EOF

useradd ian -g wheel
echo "zIoMBBzhSonPWED" |passwd --stdin ian

sed -i 's/MAILTO=root/MAILTO=""/' /etc/crontab
systemctl reload crond
echo "%wheel ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers

sed -i 's/4096/40960/' /etc/security/limits.d/20-nproc.conf
sed -i 's/#Port 22/Port 59157/' /etc/ssh/sshd_config
sed -i 's/#UseDNS yes/UseDNS no/' /etc/ssh/sshd_config
sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl restart sshd
systemctl stop postfix
systemctl stop wpa_supplicant
systemctl stop firewalld
systemctl enable iptables
systemctl start iptables
systemctl disable wpa_supplicant
systemctl disable postfix
systemctl disable firewalld
iptables -F INPUT
iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -p tcp --dport 59157 -j ACCEPT
iptables -I INPUT -i lo -j ACCEPT
iptables -A INPUT -p all -j DROP
iptables -I INPUT -p tcp -m multiport --dport 443,444,80,8389 -j ACCEPT
iptables -I INPUT -m state --state NEW -m tcp -p tcp --dport 1028:2028 -j ACCEPT
iptables -I INPUT -p icmp -j ACCEPT
iptables-save >/etc/sysconfig/iptables

rdate time-b.nist.gov
source /etc/profile
. /etc/profile
echo finished >~/cjds.sh