ubuntu 16.04.1 LTS 初始化

Posted 2020-10-11 kaka_jon

gcc环境
------------------
sudo apt-get update && \
sudo apt-get install build-essential software-properties-common -y && \
sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
sudo apt-get update && \
sudo apt-get install gcc-snapshot -y && \
sudo apt-get update && \
sudo apt-get install gcc-6 g++-6 -y && \
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-6 60 --slave /usr/bin/g++ g++ /usr/bin/g++-6 && \
sudo apt-get install gcc-4.8 g++-4.8 -y && \
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.8 60 --slave /usr/bin/g++ g++ /usr/bin/g++-4.8

编译安装lrzsz
---------------------
cd /tmp
wget http://www.ohse.de/uwe/releases/lrzsz-0.12.20.tar.gz
tar zxvf lrzsz-0.12.20.tar.gz && cd lrzsz-0.12.20
./configure && make && make install
ln -s /usr/local/bin/lrz /usr/bin/rz
ln -s /usr/local/bin/lsz /usr/bin/sz
rm -rf /tmp/lrzsz*

上传初始化脚本和startup.tar.gz，并执行
----------------------------------------
Os_Init_Optimization.sh

#!/bin/bash

#解压缩startup.tar.gz包
cd /tmp && tar -zxf startup.tar.gz

#下载工具及时间同步工具
apt-get install -y wget
apt-get install -y ntpdate
ntpdate -d cn.pool.ntp.org
date

#修改时区
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

echo "##### update server time #####" >> /var/spool/cron/crontabs/root
echo "*/10 * * * * /usr/sbin/ntpdate cn.pool.ntp.org > /dev/null 2>&1 && /sbin/clock -w > /dev/null 2>&1" >> /var/spool/cron/crontabs/root
echo "" >> /var/spool/cron/crontabs/root
echo "##### history #####" >> /var/spool/cron/crontabs/root
echo "*/5 * * * * /usr/local/gacp/worksh/history.sh > /dev/null 2>&1" >> /var/spool/cron/crontabs/root
echo "" >> /var/spool/cron/crontabs/root
echo "##### Logs #####" >> /var/spool/cron/crontabs/root
echo "00 00 * * * /usr/local/gacp/worksh/del_100day_before_logs.sh > /dev/null 2>&1" >> /var/spool/cron/crontabs/root
echo "00 00 * * * /usr/local/gacp/worksh/log_rotate.sh > /dev/null 2>&1" >> /var/spool/cron/crontabs/root
echo "" >> /var/spool/cron/crontabs/root

 

#file size
sed -i ‘N;14iulimit -SHn 65535‘ /etc/rc.local
cat >> /etc/security/limits.conf << EOF
* soft nofile 60000
* hard nofile 65535
EOF

#sysctl.conf
cat >> /etc/sysctl.conf <<eof

# NEW ADD
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_max_tw_buckets = 65535

net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 131070
net.core.somaxconn = 20480
eof

/sbin/sysctl -p

DATE=`date +%Y%m%H`

#add lsyw user
/usr/sbin/useradd lsyw
echo ‘lsyw:xxxxx‘ | /usr/sbin/chpasswd

#ssh
DATE=`date +%Y%m%H`
ssh_cf="/etc/ssh/sshd_config"

cp $ssh_cf $ssh_cf.$DATE
sed -i "s/Port 22/Port 50000/" $ssh_cf
sed -i ‘s/^PermitRootLogin yes/PermitRootLogin no/‘ $ssh_cf
sed -i ‘$aAllowUsers lsyw‘ $ssh_cf
systemctl restart ssh

#防爆破登录
apt-get install -y fail2ban

mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.$DATE
cp -ap .file/jail.conf /etc/fail2ban/

mkdir /usr/local/gacp/worksh -p
cp -ap ./file/history.sh ./file/log_rotate.sh ./file/del_100day_before_logs.sh /usr/local/gacp/worksh/

防火墙iptable
----------------------
由于Ubuntu使用iptable比较特殊，不能在脚本中操作，需要依下面步骤操作：

1. 为了保存iptables规则，需要安装两个包
apt-get install iptables-persistent netfilter-persistent

2. 修改防火墙：vi /etc/iptables/rules.v4
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 50000 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

3. 应用防火墙规则：
iptables-restore < /etc/iptables/rules.v4

4. 重启fail2ban
systemctl restart fail2ban

chkconfig 替代 sysv-rc-conf
-------------------------------------
安装: apt-get install -y sysv-rc-conf
sysv-rc-conf --list
sysv-rc-conf 服务 --levels 2345 on