标签：供应商 art pcr for oca centos7 inf set netmask
CenTos7.5系统优化更改主机名
centos7有一个新的修改主机名的命令hostnamectl
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
IP 主机名
修改网卡
vim /etc/sysconfig/network-scripts/ifcfg-eth0 --网卡名如果不一样，找到对应的文件就行
BOOTPROTO="static"
NAME="eth0"
DEVICE="eth0"
ONBOOT="yes"
IPADDR=10.0.0.1
NETMASK=255.255.255.0
GATEWAY=10.0.0.254
DNS1=114.114.114.114
DNS2=8.8.8.8
#关闭卸载firewalld
systemctl stop firewalld.service
systemctl disable firewalld.service
yum remove firewalld -y
yum install iptables-services -y #安装
关闭selinux
临时关闭setenforce 0
sed -i 7s/enforcing/disabled/ /etc/selinux/config
查看getenforce
内核优化
vim /etc/sysctl.conf
#关闭ipv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
#避免放大***
net.ipv4.icmp_echo_ignore_broadcasts = 1
#开启恶意icmp错误消息保护
net.ipv4.icmp_ignore_bogus_error_responses = 1
#关闭路由转发
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#开启反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
#处理无源路由的包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
#关闭sysrq功能
kernel.sysrq = 0
#core文件名中添加pid作为扩展名
kernel.core_uses_pid = 1
#开启SYN洪水***保护
net.ipv4.tcp_syncookies = 1
#修改消息队列长度
kernel.msgmnb = 65536
kernel.msgmax = 65536
#设置最大内存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
#timewait的数量，默认180000
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
#每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目
net.core.netdev_max_backlog = 262144
#限制仅仅是为了防止简单的DoS ***
net.ipv4.tcp_max_orphans = 3276800
#未收到客户端确认信息的连接请求的最大值
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
#内核放弃建立连接之前发送SYNACK 包的数量
net.ipv4.tcp_synack_retries = 1
#内核放弃建立连接之前发送SYN 包的数量
net.ipv4.tcp_syn_retries = 1
#启用timewait 快速回收
net.ipv4.tcp_tw_recycle = 1
#开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
#当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时
net.ipv4.tcp_keepalive_time = 30
#修改防火墙表大小，默认65536
#net.netfilter.nf_conntrack_max=655350
#net.netfilter.nf_conntrack_tcp_timeout_established=1200
#确保无人能修改路由表
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
vi /etc/resolv.conf
nameserver 8.8.8.8
nameserver 114.114.114.114
nameserver 4.2.2.2
nameserver 172.19.0.6
yum install wget vim lrzsz
安装 163源 网络源
cd /etc/yum.repos.d/
wget http://mirrors.163.com/.help/CentOS7-Base-163.repo
yum clean all
yum makecache fast
安装工具解决密钥问题
cd /etc/pki/rpm-gpg
wget https://archive.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-7
yum install -y gcc cmake bzip2-devel curl-devel db4-devel libjpeg-devel libpng-devel freetype-devel libXpm-devel gmp-devel libc-client-devel openldap-devel unixODBC-devel postgresql-devel sqlite-devel aspell-devel net-snmp-devel libxslt-devel libxml2-devel pcre-devel mysql-devel pspell-devel libmemcached libmemcached-devel zlib-devel tree htop net-tools
#yum install ntp ntpdate -y --安装ntp时间同步相关软件包
#vim /etc/ntp.conf --确认配置文件里有下列的时间同步源
server 0.rhel.pool.ntp.org iburst
server 1.rhel.pool.ntp.org iburst
server 2.rhel.pool.ntp.org iburst
server 3.rhel.pool.ntp.org iburst
#systemctl enable ntpd --设置开机自动启动ntpd
#systemctl start ntpd --立即启动ntpd服务
#date --确认时间与现在时间一致
#ntpdate 0.rhel.pool.ntp.org --如果还没有同步成功，你可以用此命令手动同步一下
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime #更改时区为上海
ulimit -n
ulimit -a
vi /etc/security/limits.conf
最后添加
sed -i ‘s#4096#65535#g‘ /etc/security/limits.d/20-nproc.conf #加大普通用户限制 也可以改为unlimited
egrep -v "^$|^#" /etc/security/limits.d/20-nproc.conf
标签：供应商 art pcr for oca centos7 inf set netmask
原文地址：http://blog.51cto.com/12102819/2307431
