CentOS 65安全加固及性能优化

1、CentOS 6.5安全加固及性能优化经常玩Linux系统的朋友多多少少也知道些系统参数优化和怎样增强系统安全性，系 统默认的一些参数都是比较保守的，所以我们可以通过调整系统参数来提高系统内存、CP U、内核资源的占用，通过禁用不必要的服务、端口，来提高系统的安全性，更好的发挥系 统的可用性。通过自己对Linux 了解，对系统调优做了如下小结：操作系统：CentOS 6.5_x64最小化安装1、主机名设置1. rootlocalhost#vi /etc/sysconfig/network2. HOSTNAME二 tes 3. root localhos t#hos tn ame test .com #临时生效2、关闭 SELinux1. rootlocalhost#vi /etc/selinux/config2. SELINUX=disabled3. roo tlocalhos t#set enforce#临时生效4. root localhos t#get enforce# 查看 selinux 状态3、清空防火墙并设置规则1. roo tlocalhos t#ip tables-F

2、#青楚防火墙规则2. roo tlocalhos t#ip tables-L#查看防火墙规则3. rootlocalhost#iptables-AINPUT-ptcpdport80-jACCEPT4. rootlocalhost#iptables-AINPUT-ptcpdport22-jACCEPT5. rootlocalhost#iptables-AINPUT-ptcpdport53-jACCEPT6. rootlocalhost#iptables-AINPUT-pudpdport53-jACCEPT7. rootlocalhost#iptables-AINPUT -p udp -dport123 -j ACCEPT&rootlocalhost#iptables-AINPUT -p icmp -j ACCEPT9. rootlocalhost#iptables-PINPUT DROP10. rootlocalhost#/etc/init .d/iptables save#根据需求开启相应端口root1ocalhost -# cat /etc/sysconfig/iptables：IN

3、PUT DROP 0:0# Generated by iptables-save vl.4.7 on 5un Dec 15 10:17:41 2013 liter：0:FORWARD ACCEPT：OUTPUT ACCEPT ：-A-A-AINPUT INPUT INPUT INPUT INPUT INPUTp p p p p c c cdd c r- T- r- u uiID m in mpppppc c c cdd A T- T- r- u u11111Luo o o o p p p p p ddddd80 -22 -53 -5B -123ACCEPTACCEPTACCEPTACCEPT-j ACCEPTCOMMIT# Completed on 5un Dec 15 10:17:41 20134、添加普通用户并进行sudo授权管理1. rootlocalhost# useradd user2. roo tlocalhos t# echo 123456 | passwd st din user #设置密码3. rootlocalhost# vi /etc/sudoers #或 vis

4、udo 打开，添加 user 用户所有权 限4. rootALL=(ALL)ALL5. userALL=(ALL)ALL5、禁用root远程登录1. rootlocalhost# vi /etc/ssh/sshd_config2. PermitRootLoginno3. Permi tEmp tyPasswords no#禁止空密码登录4. UseDNSno #关闭 DNS 查询6、关闭不必要开机自启动服务rootlocal host chkconfi q auditd0:off 1:offbl k-availabi liry0: offcrond0:off 1:offi p6tab7es lvm2-monitor netf s network postf i x 豔回 udev-post Lraat酿I oca I host rootlocal host rootlocal host r oot1 ocal host rooWJocalhost rooWlocal host roowl ocal host crond network postfix rsslog rootlocal

5、host0:off 1: off 0:off 1: on 0:off 1: off 0:off 1: off 0:off 1: off 0:off 1:off 0:off 1:off 0:off 1:on # chkcorrfl g chkconfig -# chkconfig chkconf1g J# chkconf1g -# chkcorrfig # chkconf1q 0:off 1: off 0:off 1: off 0:off 1: off 0:off 1: off 0:off 1: off 1#12122222222stonons:-.罰offonononon4344444444o3n n n n n n 口门口口 po 0OOOOOOOO e r3233333333 gauditd ott blk-avai lability i pfitabl es off IvmZ-monitor off netfs off udev-post off -st j grep 3: 2:on3:on2:on3:on2:on3:on2:on3:on2:on3:onoffonontinono

6、nononononononortonononononononf f f f f f f f f f ofonofofafofofofofofof 65666666666of6:f f f f fQfofofofof7、删除不必要的系统用户root(&localhost -# awk -F :fprint $1 /etc/passwdrootbi ndaemonadm1Psyncshutdownhaltmai 1uucp operator gamesvcsa saslauth postf i x sshduserde I userdel userdel userdel userdel userdel userdeladm1haltuucp opErator gamesntp _ootlocalhost oot(&local host ootl o匚己 1 host - oot(&local host - ootlocalhost - ootlocalhost rootlocal host 8、关闭重启ctlaltdelete 组合键1. rootlocalhost # vi /etc/i

7、nit/control-alt-delete.conf2. #exec /sbin/sh ut down -r now Co ntro l-A lt- Dele tepressed #注释掉9、调整文件描述符大小1.2.3.1.2.1.2.1.2.3.4.1.2.3.4.5.rootlocalhost # ulimit - n #默认是 10241024 roo tlocalhos t # echo ulimit SHn 102400/e tc/rc.local 敝置开机自动生效10、去除系统相关信息root localhos t # echo Welcome to Server /e tc/issuerootlocalhost # echo Welcome to Server /etc/redhatrelease11、修改history记录rootlocalhost # vi /etc/profile #修改记录 10 个HISTSIZE=1012、同步系统时间rootlocalhost # cp /usr/share/zoneinfo/Asia/Shanghai/etc/local

8、time#设置Shanghai时区root localhos t # nt pda te cn.pool .nt p.org ； hwclock - w # 同步时间并写 入blos硬件时间roo tlocalhost # cron tab - e#设置任务计划每天零点同步一次 0 * * * * /usr/sbin/ntpdate cn.pool .ntp.org ; hwclock w13、内核参数优化roo tlocalhost # vi /et c/sysc tl.conf#末尾添加如下参数net.ipv4. tcp_syncookies = 1#1 是开启 SYN Cookies，当出现SYN等待队列溢出时，启用Cookies来处，理，可防范少量SYN攻击，默认是0关闭net.ipv4. tcp_tw_reuse = 1#1 是开启重用，允许讲TIME_AIT sockets重新用于新的TCP连接，默认是0关闭net.ipv4. tcp_tw_recycle = 1#TCP失败重传次数，默认是 15,减少次数可释放内核资源net .ipv4.ip_local_por t_range = 4096 65000 #应用程序可使用的端口范围net.ipv4. tcp_max_twjbuckets = 5000#系统同时保持 TIME_WAIT 套接字的最大数量，如果超出这个数字，TIME_WATI套接字将立刻被清除并打印警告信息，默认180 000net. ipv4.tcp_max_syn_backlog = 4096#进入SYN宝的最大请求队列，默认是 dev_max_backlog =10240#允许送到队列的数据包最大设备队列，默认300net .core.somaxconn = 2048#lis ten挂起请求的最大数量，默认128net .core.wmem_default 二 8388608#发送缓存区大小的缺省值net.core.

《CentOS 65安全加固及性能优化》由会员hs****ma分享，可在线阅读，更多相关《CentOS 65安全加固及性能优化》请在金锄头文库上搜索。