#!/bin/sh###openiptablesservice,allowthisportsaccess80,3307,21####functionfirewall(){serviceiptablesstartforPortin21803307doiptables-IINPUT5-mstate--stateNEW-mtcp-ptcp--dport$Port-jACCEPTdone/etc/init.d/iptablessave}###disableselinuxservice
#!/bin/sh
###open iptables service, allow this ports access 80, 3307, 21####
function firewall() {
service iptables start
for Port in 21 80 3307
do
iptables -I INPUT 5 -m state --state NEW -m tcp -p tcp --dport $Port -j ACCEPT
done
/etc/init.d/iptables save
}
###disable selinux service###
function safety() {
/usr/sbin/setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/sysconfig/selinux
}
###edit os runlevel, 3 - Full multiuser mode###
function runlevel() {
sed -i 's/^id:[0-9]:initdefault:/id:3:initdefault:/' /etc/inittab
}
###thin systrv, initation system open this service: crond, iptables, network, sshd, rsyslog####
function systrv() {
Srv_List=`chkconfig --list|grep 3:on| awk '{print $1}'`
for i in $Srv_List
do
chkconfig --level 3 $i off
done
for j in crond iptables network sshd rsyslog
do
chkconfig --level 3 $j on
done
}
###add common user zkyw as operation account###
function adduser() {
/usr/sbin/useradd zkyw
echo "zkyw@123" | passwd zkyw --stdin
}
###Optimization ssh service, alter default port 22, disable root login######
function myssh() {
sed -i 's/^#Port 22/Port 16182/' /etc/ssh/sshd_config #alter ssh default port 16182
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PermitEmptyPasswords no/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sed -i 's/^#MaxAuthTries 6/MaxAuthTries 3/' /etc/ssh/sshd_config
sed -i '$aAllowUsers zkyw' /etc/ssh/sshd_config #allow common user zkyw ssh login
/etc/init.d/sshd reload
}
###clock Synchronous with internet time###
function ntpclock() {
/usr/sbin/ntpdate 202.120.2.101
echo "30 22 * * * /usr/sbin/ntpdate 202.120.2.101" >> /var/spool/cron/root
/etc/init.d/crond reload
}
###lock the key files including: passwd、group、shadow、gshadow、inittab#####
function lockfile() {
for file in passwd group shadow gshadow inittab
do
chattr +i /etc/$file
done
}
###alter max nofile and max user processes####
function userlimit() {
sed -i '$a* soft nofile 65536\n* hard nofile 65536' /etc/security/limits.conf
sed -i 's/^/#/' /etc/security/limits.d/90-nproc.conf
sed -i '$a* soft nproc 51200\nroot soft nproc unlimited' /etc/security/limits.d/90-nproc.conf
}
###optimization system kernel parameters, including tcp/ip protocal, iptables and so on####
function syskernel() {
cp /etc/sysctl.conf /etc/sysctl.conf.eri
modprobe bridge
(
cat << EOF
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
EOF
) >> /etc/sysctl.conf
/sbin/sysctl -p >/dev/null 2>&1
}
###delete some of no great importance users and groups####
function cleanusers() {
for user in adm lp sync shutdown halt uucp operator games gopher ftp
do
/usr/sbin/userdel $user
done
for gp in adm lp dip
do
/usr/sbin/groupdel $gp
done
}
echo "Iptables Optimization Starting..."
firewall
echo "Selinux Disabled Starting..."
safety
echo "Runlevel Optimization Starting..."
runlevel
echo "System Init Service Optimization Starting..."
systrv
echo "Add zkyw Common Account Starting..."
adduser
echo "SSH Service Optimization Starting..."
myssh
echo "Clock Synchronous Optimization Starting..."
ntpclock
echo "Max nofile and user processes Optimization Starting..."
userlimit
echo "System Kernel Parameters Optimization Starting..."
syskernel
