Linux服务器内核参数优化
Linux内核参数调优主要是通过修改/proc伪文件系统和/etc/sysctl.conf配置文件的参数来实现的。
/proc目录结构如下：
/proc/driver 与驱动器相关的信息
/proc/fs 文件系统参数
/proc/net 网络信息
/proc/pid 每个进程的信息
/proc/sys 内核参数
/proc/scsi 与scsi相关的信息
/proc/sys/kernel 通用内核参数
/proc/sys/vm 内存管理参数
/proc/sys/dev 与设备相关的信息
/proc/sys/net 网络信息
vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1 #开启SYN Cookies。可以防范少量的SYN攻击。
net.ipv4.ip_local_port_range = 10000 65535 #设置向外连接的端口范围
net.ipv4.route.gc_timeout = 100 #路由缓存刷新频率
net.core.netdev_max_backlog = 16384 #允许排队更多的报文
net.core.somaxconn = 16384 #指定更大的accept队列backlog
net.ipv4.tcp_max_syn_backlog = 16384 #增加SYN队列长度
net.ipv4.tcp_synack_retries = 1 #重新发送响应的次数
net.ipv4.tcp_retries2 = 5 #向远程主机重新发送数据的次数
net.ipv4.tcp_keepalive_time = 1200 #内核向远程主机发送Keepalive消息的频度
net.ipv4.tcp_keepalive_intvl = 30 #内核向远程主机发送探测消息的间隔
系统优化脚本：
#!/bin/bash
yum -y groupinstall "Development tools"
cd /usr/local/src
wget https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
sed -i 's/start on control-alt-delete/#start on control-alt-delete/' /etc/init/control-alt-delete.conf
sed -i 's@exec /sbin/shutdown -r now "Control-Alt-Delete pressed"@#exec /sbin/shutdown -r now "Control-Alt-Delete pressed"@' /etc/init/control-alt-delete.conf
service iptables stop
chkconfig iptables off
ulimit -SHn 65534
echo "ulimit -SHn 65534" >> /etc/rc.local
cat >> /etc/sysctl.conf << EOF
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_local_port_range = 10000 65535
net.ipv4.route.gc_timeout = 100
net.core.netdev_max_backlog = 16384
net.core.somaxconn = 16384
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_intvl = 30
EOF
/sbin/sysctl -p
for i in `chkconfig | grep 3:on | awk '{print $1}'`
do
chkconfig --level 3 $i off
done
for service in crond rsyslog sshd network
do
chkconfig --level 3 $service on
done
reboot
Linux内核参数调优主要是通过修改/proc伪文件系统和/etc/sysctl.conf配置文件的参数来实现的。
/proc目录结构如下：
/proc/driver 与驱动器相关的信息
/proc/fs 文件系统参数
/proc/net 网络信息
/proc/pid 每个进程的信息
/proc/sys 内核参数
/proc/scsi 与scsi相关的信息
/proc/sys/kernel 通用内核参数
/proc/sys/vm 内存管理参数
/proc/sys/dev 与设备相关的信息
/proc/sys/net 网络信息
本文来自无奈人生安全网
vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1 #开启SYN Cookies。可以防范少量的SYN攻击。
net.ipv4.ip_local_port_range = 10000 65535 #设置向外连接的端口范围
net.ipv4.route.gc_timeout = 100 #路由缓存刷新频率
net.core.netdev_max_backlog = 16384 #允许排队更多的报文
net.core.somaxconn = 16384 #指定更大的accept队列backlog
net.ipv4.tcp_max_syn_backlog = 16384 #增加SYN队列长度
net.ipv4.tcp_synack_retries = 1 #重新发送响应的次数
net.ipv4.tcp_retries2 = 5 #向远程主机重新发送数据的次数
net.ipv4.tcp_keepalive_time = 1200 #内核向远程主机发送Keepalive消息的频度
net.ipv4.tcp_keepalive_intvl = 30 #内核向远程主机发送探测消息的间隔 内容来自无奈安全网
系统优化脚本：
#!/bin/bash
yum -y groupinstall "Development tools"
cd /usr/local/src
wget https://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
sed -i 's/start on control-alt-delete/#start on control-alt-delete/' /etc/init/control-alt-delete.conf
sed -i 's@exec /sbin/shutdown -r now "Control-Alt-Delete pressed"@#exec /sbin/shutdown -r now "Control-Alt-Delete pressed"@' /etc/init/control-alt-delete.conf
service iptables stop
chkconfig iptables off www.wnhack.com
ulimit -SHn 65534
echo "ulimit -SHn 65534" >> /etc/rc.local 内容来自无奈安全网
cat >> /etc/sysctl.conf << EOF
net.ipv4.tcp_syncookies = 1
net.ipv4.ip_local_port_range = 10000 65535
net.ipv4.route.gc_timeout = 100
net.core.netdev_max_backlog = 16384
net.core.somaxconn = 16384
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_retries2 = 5
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_keepalive_intvl = 30
EOF
/sbin/sysctl -p
for i in `chkconfig | grep 3:on | awk '{print $1}'`
do
chkconfig --level 3 $i off
done
for service in crond rsyslog sshd network
do
chkconfig --level 3 $service on
done
reboot 本文来自无奈人生安全网