优化:

   1)关闭selinux

     操作:sed -i s#SELINUX=enforcing#SELINUX=disable#g /etc/selinux/config  

         setenforce 0  临时禁止,不用马上重启

   2)更换yum源

默认是mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib&infra=$infra

    1:备份,cd/etc/yum.repos.d  mv CentOS-Base.repo CentOS-Base.repo.ori

    2:下载163源 wget http://mirrors.163.com/.help/CentOS6-Base-163.repo

    3:替换mv CentOS6-Base-163.repo CentOS-Base.repo

   3)下载安装必要的软件包

    yum install tree telnet dos2unix sysstat lrzsz -y

    分别 树结构 测试 转码 性能监控 上传和下载

   4)关闭无用自启动程序

    必须开启的:crond network sshd rsyslog (c5.8syslog)

    chkconfig --list|grep "3:on"

  for yuan in `chkconfig --list |grep "3:on"|awk '{print $1}'`;do chkconfig $yuan off;done

  for yuan in crond network rsyslog sshd ;do chkconfig $yuan on;done

  或者一步for yuan in `chkconfig --list |grep "3:on"|awk '{print $1}'|grep -vE "crond|network|syslog|sshd"`;do chkconfig $yuan off;done

    5)更改ssh远程登录服务配置

    1:更改端口号 /etc/ssh/sshd_config port:65535

    2:禁止root登录,/etc/ssh/sshd_config permitRootLogin no

      或者 密钥登录

    3:/etc/ssh/sshd_config UseDNS no 加速ssh登录

    4:/etc/ssh/sshd_config GSSAPIAuthentication no 加速ssh登录

    5:重启服务,/etc/init.d/sshd restart=service sshd restart

    6)给普通用户root权限

    1:visudo=vi /etc/sudoers  98gg到98行 yy复制 p粘帖

    2:root>yuangq  ALL>/usr/sbin/useradd  yuangq就有useradd的权限。

    3:在yuangq用户下,sudo useradd

    4:yuangq ALL=(ALL) NOPASSWD: ALL

    7)服务器时间同步 ntp

    echo '#time sysnc by yuangq at 2016/11/8' >>/var/spool/cron/root

    echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null2>&1'>>/var/spool/cron/root

   crontab -l 检查定时任务

   8)加大文件描述符

   查看最大文件描述符 ulimit -n 最大65535 够用就好

   echo '*           -      nofile   65535' >>/etc/security/limits.conf

   9)调整内核参数

   vi /etc/sysctl.conf

   在最后面,添加内容

net.ipv4.tcp_fin_timeout = 2

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_keepalive_time = 600

net.ipv4.ip_local_port_range = 4000   65000

net.ipv4.tcp_max_syn_backlog = 16384

net.ipv4.tcp_max_tw_buckets = 36000

net.ipv4.route.gc_timeout = 100

net.ipv4.tcp_syn_retries = 1

net.ipv4.tcp_synack_retries = 1

net.core.somaxconn = 16384

net.core.netdev_max_backlog = 16384

net.ipv4.tcp_max_orphans = 16384

防火墙的优化

net.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_max = 25000000

net.netfilter.nf_conntrack_tcp_timeout_established = 180

net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120

net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60

net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

    sysctl -p 使之生效

可能会报错

error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key

error: "net.bridge.bridge-nf-call-iptables" is an unknown key

error: "net.bridge.bridge-nf-call-arptables" is an unknown key

这个错误是由于自动处理可载入的模块bridge没有自动载入,解决办法是自动处理开载入的模块ip_conntrack

需要这样做

modprobe bridge

echo "modprobe bridge">> /etc/rc.local

也可能报错

error: "net.nf_conntrack_max" is an unknown key

error: "net.netfilter.nf_conntrack_max" is an unknown key

error: "net.netfilter.nf_conntrack_tcp_timeout_established" is an unknown key

error: "net.netfilter.nf_conntrack_tcp_timeout_time_wait" is an unknown key

error: "net.netfilter.nf_conntrack_tcp_timeout_close_wait" is an unknown key

error: "net.netfilter.nf_conntrack_tcp_timeout_fin_wait" is an unknown key

这个错误可能是你的防火墙没有开启或者自动处理可载入的模块ip_conntrack没有自动载入,解决办法有二,一是开启防火墙,二是自动处理开载入的模块ip_conntrack

启动防火墙:/etc/init.d/iptables stop

modprobe nf_conntrack

echo "modprobe nf_conntrack">> /etc/rc.local

    10)隐藏系统版本

    >/etc/issue 或者 cat /dev/null >/etc/issue

    11)锁定关键文件

    chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab  -i解锁

    lsattr /etc/passwd  ---i---e--  i表示加锁了

    12)定时清理 /var/spool/clientmqueue垃圾目录(cento6.4以上不需要)

    echo "find /var/spool/clientmqueue/ -type f |xargs rm -f " >/server/scripts/del_sys_file.sh

    echo "00 00 * * 0 /bin/sh/server/scripts/del_sys_file.sh >/dev/null2>&1" >>/var/spool/cron/root

    crontab -l |tail -2