系统优化类

#!/bin/bash

PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin"
export PATH

Centos7=$(uname -a | grep "el7" | wc -l)
Centos6=$(uname -a | grep "el6" | wc -l)

if [ $Centos7 == 1 ];
then
   echo "System Centos 7 in reset kernel"
   /bin/grep "SELINUX=disabled" /etc/selinux/config 2>&1 >/dev/null
   if [ $? -eq 0 ];then
   	echo -e "\033[31m Selinux\033[0m  is already not running"
   else
   	/bin/sed -i  ‘/SELINUX/s/enforcing/disabled/g‘ /etc/selinux/config
   	setenforce 0 2>&1 >/dev/null
   	echo -e "\033[31m Selinux \033[0m is already  modify stop successful"
   fi
   
   ################# <关闭多余用户> ##########################
   
   userdel -r lp 2>&1 >/dev/null
   userdel -r sync 2>&1 >/dev/null
   userdel -r shutdown 2>&1 >/dev/null
   userdel -r halt 2>&1 >/dev/null
   userdel -r operator 2>&1 >/dev/null
   userdel -r games 2>&1 >/dev/null
   userdel -r gopher 2>&1 >/dev/null
   chmod +s /bin/netstat
   chmod 400 /etc/shadow
   ################# <系统内核安全> ##########################
   ipv4=$(grep "net.ipv4" /etc/sysctl.conf  | wc -l)
   if [ $ipv4 -lt 2 ];
   then
       echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
       echo "net.core.rmem_default = 256960" >> /etc/sysctl.conf
       echo "net.core.rmem_max = 513920" >> /etc/sysctl.conf
       echo "net.core.wmem_default = 256960" >> /etc/sysctl.conf
       echo "net.core.wmem_max = 513920" >> /etc/sysctl.conf
       echo "net.core.netdev_max_backlog = 2000" >> /etc/sysctl.conf
       echo "net.core.somaxconn = 2048" >> /etc/sysctl.conf
       echo "net.core.optmem_max = 81920" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_mem = 131072  262144  524288" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_rmem = 8760  256960  4088000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_wmem = 8760  256960  4088000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_time = 1800" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_intvl = 30" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_probes = 3" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_sack = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_fack = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_timestamps = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_window_scaling = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_tw_recycle = 0" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_fin_timeout = 30" >> /etc/sysctl.conf
       echo "net.ipv4.ip_local_port_range = 1024  65000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_max_syn_backlog = 2048" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_max_tw_buckets = 6000" >> /etc/sysctl.conf
       sysctl -p
   else
       echo "kernel already reset"
   fi
   hosts=$(grep "sshd:10.80.80.100:allow" /etc/hosts.allow  | wc -l)
   if [ $hosts -ne 1 ];
   then
       echo "insert sshd allow"
       echo ‘sshd:10.80.80.100:allow‘  >> /etc/hosts.allow
   else
      echo "sshd already reset"
   fi

   ################## 《更改时区》###############################
   
   TZ=`timedatectl |grep Time|awk {‘print $3‘}`
   SH="Adsia/Shanghai"
   if [ $TZ == $SH ];then
   	echo -e  "\033[31m Timezone \033[0m is already "Asia/Shanghai""
   else 
   	rm -f /etc/localtime
   	cp -arp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
   	echo -e "\033[31m Timezone \033[0m is already modify "Asia/Shanghai""
   fi
   
   ################ <更改ssh端口和禁止root登录> #######################
   Net=$(netstat -tulnp|grep 22502 | wc -l)
   if [ $Net = 0 ];then
       cp -r /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
   	   sed -i ‘/Port 22/aPort 22502‘ /etc/ssh/sshd_config
   	   echo -e  "\033[31m SSH‘s port  22 is already modify to 22502\033[0m"
   	    sed -i "s/#UseDNS/UseDNS/g" /etc/ssh/sshd_config
        sed -i "s/^Subsystem/#Subsystem/g" /etc/ssh/sshd_config
        sed -i "/^#Subsystem/aSubsystem       sftp    internal-sftp" /etc/ssh/sshd_config
   	if [ $? -eq 0 ];then
   		systemctl restart sshd 2>&1 >/dev/null
   		echo -e "\033[31m SSH‘s service\033[0m has restart again"
   	fi
   else 
   	sed -i "s/#UseDNS/UseDNS/g" /etc/ssh/sshd_config
        echo -e "\033[31m chage Use UseDns\033[0m"
   	PORT=`netstat -tulnp|grep 22 |awk {‘print $4‘}|head -n 1|cut -d : -f 2`
   	echo -e "ssh‘s port is \033[31m already modify $PORT\033[0m"
   fi
   ############## <登录密码相关设置> #######################################
   
   cp /etc/login.defs /etc/login.defs.bak
   sed -i ‘/^PASS_MAX_DAYS/s/[0-9]\{1,\}/99999/g‘ /etc/login.defs
   sed -i ‘/^PASS_MIN_DAYS/s/[0-9]\{1,\}/7/g‘ /etc/login.defs
   sed -i ‘/^PASS_MIN_LEN/s/[0-9]\{1,\}/12/g‘ /etc/login.defs
   sed -i ‘/^PASS_WARN_AGE/s/[0-9]\{1,\}/30/g‘ /etc/login.defs
   #########################################################################
   username=$(id kyeroot | grep "uid=0" | wc -l)
   if [ $username = 0 ];then
   	useradd kyeroot
   	echo "Aa+12345678" | passwd --stdin kyeroot
   	sed -i ‘/^kyeroot/s/[0-9]\{1,\}/0/g‘ /etc/passwd
   	sed -i ‘/^kyeroot/s/home\/kyeroot/root/g‘ /etc/passwd
        sed -i "/^root/s/bin/sbin/g" /etc/passwd
        sed -i "/^root/s/bash/nologin/g" /etc/passwd
        cp /etc/sudoers /etc/sudoers.bak
   	sed -i ‘/^root/akyeroot ALL=(ALL)   ALL‘ /etc/sudoers
   else
   	echo -e "\033[31m user kyeroot is exists\033[0m  or \033[31m password is wrong\033[0m"
   fi

   
   useradd kyeadmin 2>&1 >/dev/null
   d=$?
   if [ $d -eq 0 ];then
       echo "Aa+12345678" |passwd --stdin kyeadmin 2>&1 >/dev/null
   	echo -e "\033[31m create user kyeadmin successful \033[0m"
   	echo -e "\033[31m create user passwd successful \033[0m"
   else
   	echo -e "\033[31m user kyeadmin is exists\033[0m  or \033[31m password is wrong\033[0m"
   fi
   
   ############### <日志权限> #########################################
   chattr +a /var/log/messages
   if [ $? == "0" ];then
   	echo -e "\033[31m Already add "lsatrr +a"\033[0m  for "/var/log/messages" "
   else
   	echo -e "Add \033[31m "lsattr +a"\033[0m  is failed,please check it!"
   fi
   
   find /var/log/ -type f -exec chmod u-x,g-x,o-wx {} \;
   echo -e "\033[31m modify "/var/log/*"\033[0m all files permission of "u-x,g-x,o-wx" successful"
chmod +x /etc/rc.local
null=$(grep "/dev/null" /etc/rc.local  |wc -l)
if [ $null = 0 ];
then
    echo "chmod 666 /dev/null" >> /etc/rc.local
else
   echo "already reset /dev/null"
fi

   ############## <修改文件句柄数> ###################################
   
   h=`ulimit -n`
   if [ $h -ne 65535 ];then
   
   	ulimit -n 65535
   	grep "* soft nofile 65535" /etc/security/limits.conf 2>&1 >/dev/null
   	i=$?   #判断“soft nofile 65536”是否存在
   	grep "* hard nofile 65535" /etc/security/limits.conf 2>&1 >/dev/null
   	j=$?   #判断“hard nofile 65536”是否存在
   	k=$[i+j] 
   	if [ $k -ne 0 ];then #同时判断“soft/hard nofile 65536”
   		cp /etc/security/limits.conf /etc/security/limits.conf.bak
   		echo "* soft nofile 65535" >> /etc/security/limits.conf
   		echo "* hard nofile 65535" >> /etc/security/limits.conf
   		echo -e "\033[31m default ulimit is $h\033[0m,now ulimit is already modify 65535"
   	else
   	echo -e "\033[31m "soft nofile 65535 and  hard nofile 65535"\033[0m is already configure,not to modify "
   	fi
   else 
   	echo -e "\033[31m default ulimit is 65535\033[0m,not modify"
   fi
   
   ############# <防止暴力破解，提高系统安全性> ################################
   
   grep "remember" /etc/pam.d/system-auth  2>&1 >/dev/null
   o=$?
   grep "unlock_time" /etc/pam.d/system-auth  2>&1 >/dev/null
   p=$?
   grep "pam_pwquality.so" /etc/pam.d/system-auth 2>&1 >/dev/null
   w=$?
   if [ $o -ne 0 ];then
        cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
   	sed  -i "/sha512/s/use_authtok/use_authtok remember=4/g" /etc/pam.d/system-auth ###表示禁止使用最近用过的4个密码（己使用过的密码会被保存在 /etc/security/opasswd 下面）
   	echo -e "Configure "use_authtok remember=4" for /etc/pam.d/system-auth successful"
   fi
   if [ $w -ne 0 ];then
   	sed -i "/pam_pwquality.so/s/local_users_only/minclass=3/g" /etc/pam.d/system-auth
   	echo -e "Configure "use_authtok remember=4" for /etc/pam.d/system-auth successful"
   fi
   if [ $p -eq 0 ];then
   	echo "auth required pam_tally2.so even_deny_root deny=5 unlock_time=1800" >> /etc/pam.d/system-auth 
   	echo -e "Configure "auth required pam_tally2.so even_deny_root deny=5 unlock_time=1800" for /etc/pam.d/system-auth successful"
   fi
   
   ################# <设置shell会话超时退出> ##################################
   
   n=`grep "TMOUT=" /etc/profile|cut -d "=" -f 2` #读取默认的超时的时间
   l=`grep "TMOUT" /etc/profile`
   if [ $? -ne 0 ];then   ##判断TMOUT没有设置过超时配置
        cp /etc/profile /etc/profile.bak
   	echo "TMOUT=300" >> /etc/profile
   	echo "export TMOUT" >> /etc/profile
   #	sed -i ‘s/^HISTSIZE=1000/HISTSIZE=30/g‘ /etc/profile
   	echo -e "\033[31m TMOUT \033[0m is already modify TMOUT=300"
   else               ##若是配置过超时命令,替换换默认超时时间
   	sed -i s/TMOUT=$n/TMOUT=300/g /etc/profile  #替换默认超时时间为180
   	echo -e  "\033[31m default TMOUT \033[0m is $n,TMOUT is already modify to 180s successful  " #获取默认超时时间
   #	echo "export TMOUT" >> /etc/profile
   fi
   
   ################# <禁止root ftp登录> #######################################
   
   systemctl status vsftpd 2>&1 >/dev/null
   if [ $? -eq 0 ];then
   	echo "root" >> /etc/vsftpd/ftpusers 
   	echo -e "\033[31m The ftp for root forbidden \033[0m successful"
   else
   	echo -e "\033[31m The vsftpd \033[0m service not exists,not need to forbidden"
   fi 
   
   ############### <登录警告语> #############################################
   
   grep "WARNING" /etc/motd 2>&1 >/dev/null
   if [ $? -ne 0 ];then
   	echo "WARNING: If you are not authorized to access this private computer system, disconnect now. All activities on this system will be monitored and recorded without prior notification or permission!" > /etc/motd
   	echo -e "\033[31m The motd \033[0m is add at /etc/motd successful"
   else 
   	echo -e "\033[31m The motd "WARNING" is exsits\033[0m,please check if need to modify again"
   fi
   

   ################ <设置允许能su到root的用户> #################################
   grep "SU_WHEEL_ONLY yes" /etc/login.defs && echo "Already set" || echo "SU_WHEEL_ONLY yes" >> /etc/login.defs

elif [ $Centos6 == 1 ]
then

   echo "System Centos 6 in reset kernel"
   ################ 《关闭selinux》############################################

   /bin/grep "SELINUX=disabled" /etc/selinux/config 2>&1 >/dev/null
   if [ $? -eq 0 ];then
   	echo -e "\033[31m Selinux\033[0m  is already not running"
   else
   	/bin/sed -i  ‘/SELINUX/s/enforcing/disabled/g‘ /etc/selinux/config
   	setenforce 0 2>&1 >/dev/null
   	echo -e "\033[31m Selinux \033[0m is already  modify stop successful"
   fi
   ################# <关闭多余用户> ##########################
   
   userdel -r lp 2>&1 >/dev/null
   userdel -r sync 2>&1 >/dev/null
   userdel -r shutdown 2>&1 >/dev/null
   userdel -r halt 2>&1 >/dev/null
   userdel -r operator 2>&1 >/dev/null
   userdel -r games 2>&1 >/dev/null
   chmod +s /bin/netstat
   chmod 400 /etc/shadow
   ################# <系统内核安全> ##########################
   ipv4=$(grep "net.ipv4" /etc/sysctl.conf  | wc -l)
   if [ $ipv4 -lt 2 ];
   then
       echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
       echo "net.core.rmem_default = 256960" >> /etc/sysctl.conf
       echo "net.core.rmem_max = 513920" >> /etc/sysctl.conf
       echo "net.core.wmem_default = 256960" >> /etc/sysctl.conf
       echo "net.core.wmem_max = 513920" >> /etc/sysctl.conf
       echo "net.core.netdev_max_backlog = 2000" >> /etc/sysctl.conf
       echo "net.core.somaxconn = 2048" >> /etc/sysctl.conf
       echo "net.core.optmem_max = 81920" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_mem = 131072  262144  524288" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_rmem = 8760  256960  4088000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_wmem = 8760  256960  4088000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_time = 1800" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_intvl = 30" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_keepalive_probes = 3" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_sack = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_fack = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_timestamps = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_window_scaling = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_tw_recycle = 0" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_fin_timeout = 30" >> /etc/sysctl.conf
       echo "net.ipv4.ip_local_port_range = 1024  65000" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_max_syn_backlog = 2048" >> /etc/sysctl.conf
       echo "net.ipv4.tcp_max_tw_buckets = 6000" >> /etc/sysctl.conf
       sysctl -p
   else
       echo "kernel already reset"
   fi
   hosts=$(grep "sshd:10.80.80.100:allow" /etc/hosts.allow  | wc -l)
   if [ $hosts -ne 1 ];
   then
       echo "insert sshd allow"
       echo ‘sshd:10.80.80.100:allow‘  >> /etc/hosts.allow
   else
      echo "sshd already reset"
   fi
   ################ 《更改时区》##############################################
   
   /bin/grep "Asia/Shanghai" /etc/sysconfig/clock 2>&1 >/dev/null
   if [ $? -eq 0 ];then
   	echo -e  "\033[31m Timezone \033[0m is already "Asia/Shanghai""
   else 
   	rm -f /etc/localtime
   	cp -arp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
   	echo -e "\033[31m Timezone \033[0m is already modify "Asia/Shanghai""
   fi
   
   ###############《更改ssh端口和禁止root登录》##############################

   Net=$(netstat -tulnp|grep 22502 | wc -l)
   if [ $Net = 0 ];then
       cp -r /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
   	sed -i ‘/port 22/aport 22502‘ /etc/ssh/sshd_config
   	echo -e  "\033[31m SSH‘s port  22 is already modify to 22502\033[0m"
   	sed -i "s/#UseDNS/UseDNS/g" /etc/ssh/sshd_config
        sed -i "s/^Subsystem/#Subsystem/g" /etc/ssh/sshd_config
        sed -i "/^#Subsystem/aSubsystem       sftp    internal-sftp" /etc/ssh/sshd_config
   	if [ $? -eq 0 ];then
   		service sshd restart 2>&1 >/dev/null
   		echo -e "\033[31m SSH‘s service\033[0m has restart again"
   	fi
   else 
   	sed -i "s/#UseDNS/UseDNS/g" /etc/ssh/sshd_config
        echo -e "\033[31m chage Use UseDns\033[0m"
   	PORT=`netstat -tulnp|grep 22 |awk {‘print $4‘}|head -n 1|cut -d : -f 2`
   	echo -e "ssh‘s port is \033[31m already modify $PORT\033[0m"
   fi
   ############### 《禁止组合键关机》#######################################
   
   /bin/grep ^exec /etc/init/control-alt-delete.conf 2>&1 >/dev/null
   a=$?    #判断是否关闭“exec /etc/init/control-alt-delete.conf”
   /bin/grep ^start /etc/init/control-alt-delete.conf 2>&1 >/dev/null
   b=$?    #判断是否关闭"start on control-alt-delete"
   c=$[a+b]
   if [ $c -eq 2 ];then
           echo -e "\033[31m "control-alt-delete" \033[0m modify is \033[31m failed \033[0m,or configure successful,please check it again"
   else
       cp  /etc/init/control-alt-delete.conf /etc/init/control-alt-delete.conf.bak
   	sed -i "/^start/s/start/#start/g" /etc/init/control-alt-delete.conf
   	sed -i "/^exec/s/exec/#exec/g" /etc/init/control-alt-delete.conf
   	echo -e "\033[31m “control-alt-delete”\033[0m is already modify stop successful"
   fi
   
   
   ############# 《登录密码相关设置》##############################
   cp /etc/login.defs /etc/login.defs.bak
   sed -i ‘/^PASS_MAX_DAYS/s/[0-9]\{1,\}/90/g‘ /etc/login.defs
   sed -i ‘/^PASS_MIN_DAYS/s/[0-9]\{1,\}/7/g‘ /etc/login.defs
   sed -i ‘/^PASS_MIN_LEN/s/[0-9]\{1,\}/12/g‘ /etc/login.defs
   sed -i ‘/^PASS_WARN_AGE/s/[0-9]\{1,\}/30/g‘ /etc/login.defs
   
   ############## 《新建用户》############################################
   #u=`grep "^kyeroot" /etc/passwd | wc -l`
      username=$(id kyeroot | grep "uid=0" | wc -l)
      if [ $username = 0 ];then
      	useradd kyeroot
      	echo "Aa+12345678" | passwd --stdin kyeroot
      	sed -i ‘/^kyeroot/s/[0-9]\{1,\}/0/g‘ /etc/passwd
      	sed -i ‘/^kyeroot/s/home\/kyeroot/root/g‘ /etc/passwd
           sed -i "/^root/s/bin/sbin/g" /etc/passwd
           sed -i "/^root/s/bash/nologin/g" /etc/passwd
           cp /etc/sudoers /etc/sudoers.bak
      	sed -i ‘/^root/akyeroot ALL=(ALL)   ALL‘ /etc/sudoers
      else
      	echo -e "\033[31m user kyeroot is exists\033[0m  or \033[31m password is wrong\033[0m"
      fi
   
      
      useradd kyeadmin 2>&1 >/dev/null
      d=$?
      if [ $d -eq 0 ];then
          echo "Aa+12345678" |passwd --stdin kyeadmin 2>&1 >/dev/null
      	echo -e "\033[31m create user kyeadmin successful \033[0m"
      	echo -e "\033[31m create user passwd successful \033[0m"
      else
      	echo -e "\033[31m user kyeadmin is exists\033[0m  or \033[31m password is wrong\033[0m"
      fi
   ############# 《日志权限》############################################
   
   chattr +a /var/log/messages
   if [ $? == "0" ];then
   	echo -e "\033[31m Already add "lsatrr +a"\033[0m  for "/var/log/messages" "
   else
   	echo -e "Add \033[31m "lsattr +a"\033[0m  is failed,please check it!"
   fi
   
   find /var/log/ -type f -exec chmod u-x,g-x,o-wx {} \;
   echo -e "\033[31m modify "/var/log/*"\033[0m all files permission of "u-x,g-x,o-wx" successful"
   
   chmod +x /etc/rc.local
   null=$(grep "/dev/null" /etc/rc.local  |wc -l)
   if [ $null = 0 ];
   then
       echo "chmod 666 /dev/null" >> /etc/rc.local
   else
      echo "already reset /dev/null"
   fi
   ############# 《修改文件句柄数》######################################
   h=`ulimit -n`
   if [ $h -ne 65535 ];then
   	ulimit -n 65535
   	grep "* soft nofile 65535" /etc/security/limits.conf 2>&1 >/dev/null
   	i=$?   #判断“soft nofile 65536”是否存在
   	grep "* hard nofile 65535" /etc/security/limits.conf 2>&1 >/dev/null
   	j=$?   #判断“hard nofile 65536”是否存在
   	k=$[i+j] 
   	if [ $k -ne 0 ];then #同时判断“soft/hard nofile 65536”
   	    cp /etc/security/limits.conf /etc/security/limits.conf.bak
   		echo "* soft nofile 65535" >> /etc/security/limits.conf
   		echo "* hard nofile 65535" >> /etc/security/limits.conf
   		echo -e "\033[31m default ulimit is $h\033[0m,now ulimit is already modify 65535"
   	else
   	echo -e "\033[31m "soft nofile 65535 and  hard nofile 65535"\033[0m is already configure,not to modify "
   	fi
   else 
   	echo -e "\033[31m default ulimit is 65535\033[0m,not modify"
   fi
   
   
   ############## 《防止暴力破解，提高系统安全性》######################
   
   grep "remember" /etc/pam.d/system-auth  2>&1 >/dev/null
   o=$?
   p=`grep "unlock_time" /etc/pam.d/system-auth | wc -l`
   if [ $o -ne 0 ];then
       cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
   	sed  -i "/sha512/s/use_authtok/use_authtok remember=4/g" /etc/pam.d/system-auth ###表示禁止使用最近用过的4个密码（己使用过的密码会被保存在 /etc/security/opasswd 下面）
   fi
   if [ $p -lt 1 ];then
   	echo "auth    required        pam_tally2.so even_deny_root deny=5 unlock_time=1800" >> /etc/pam.d/system-auth 
   fi
   
   ############## 《设置shell会话超时退出》############################
   
   n=`grep "TMOUT=" /etc/profile|cut -d "=" -f 2` #读取默认的超时的时间
   l=`grep "TMOUT" /etc/profile`
   if [ $? -ne 0 ];then   ##判断TMOUT没有设置过超时配置
   	cp /etc/profile /etc/profile.bak
   	echo "TMOUT=300" >> /etc/profile
   	echo "export TMOUT" >> /etc/profile
   #	sed -i ‘s/^HISTSIZE=1000/HISTSIZE=30/g‘ /etc/profile
   	echo -e "\033[31m TMOUT \033[0m is already modify TMOUT=300"
   else               ##若是配置过超时命令,替换换默认超时时间
   	sed -i s/TMOUT=$n/TMOUT=300/g /etc/profile  #替换默认超时时间为180
   	echo -e  "\033[31m default TMOUT \033[0m is $n,TMOUT is already modify to 180s successful  " #获取默认超时时间
   #	echo "export TMOUT" >> /etc/profile
   fi
   
   ############## 《禁止root ftp登录》################################
   
   if [ -f /etc/vsftpd/ftpusers ];then
           p=`grep ‘root‘ /etc/vsftpd/ftpusers | wc -l`
           if [ $p -eq 0 ];then
               cp  /etc/vsftpd/ftpusers /etc/vsftpd/ftpusers.bak
               echo "root" >> /etc/vsftpd/ftpusers
               echo -e "\033[31m The ftp for root forbidden \033[0m successful or\033[31m ftp‘s service not exsits \033[0m"
           else
               echo -e "\033[31m The vsftpd \033[0m service not exists or Have been modified"
           fi
   
   else
           echo -e "\033[31m The vsftpd \033[0m service not exists or Have been modified"
   fi
   
   ################ 《登录警告语》###################################
   
   grep "WARNING" /etc/motd 2>&1 >/dev/null
   if [ $? -ne 0 ];then
       cp  /etc/motd /etc/motd.bak 
   	echo "WARNING: If you are not authorized to access this private computer system, disconnect now. All activities on this system will be monitored and recorded without prior notification or permission!" > /etc/motd
   	echo -e "\033[31m The motd \033[0m is add at /etc/motd successful"
   else 
   	echo -e "\033[31m The motd "WARNING" is exsits\033[0m,please check if need to modify again"
   fi
   
   
   ############## 《关闭telnet》####################################
   
   y=`chkconfig --list|grep telnet |awk ‘{print $2}‘`
   m=`chkconfig --list|grep telnet `
   if [ $? -ne 0 ];then
   	echo -e "\033[31m The telnet \033[0m is not exsits"
   else
      	if [ $y == "on" ];then
   		chkconfig telnet off
   		echo -e "\033[31m The telnet \033[0m is stop sucessful"
   	else
   		echo -e "\033[31m The telnet\033[0m is already stop "
   	fi
   fi

else
   echo "cache System version"
fi