Centos7作为web服务器优化

Centos7作为web服务器的一些简单配置

1. 关闭firewalld并替换iptables

1
2
3
4
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动
yum install iptables-services #安装
iptables -nvL #查看规则

2. 加大打开文件数限制

1
2
3
4
5
6
7
8
9
vim /etc/security/limits.conf
#添加如下内容:
* soft nofile 1024000
* hard nofile 1024000
hive - nofile 1024000
hive - nproc 1024000

ulimit -n
ulimit -a

查询当前配置

3. 更改用户进程限制

1
2
3
4
5
6
vim /etc/security/limits.d/20-nproc.conf
#更改一下内容
* soft nproc 40960
root soft nproc unlimited #无限制

此步骤需要重启机器生效,可以设置完后再重启

4. 网络线程优化

vim /etc/sysctl.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#加入如下内容
# Disable IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# Determines how often to check for stale neighbor entries.
net.ipv4.neigh.default.gc_stale_time=120
# Using arp_announce/arp_ignore to solve the ARP Problem
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.all.arp_announce=2
vm.swappiness = 0
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.tcp_keepalive_time = 1800
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30

执行/sbin/sysctl -p使设置生效

5. 时间校对

1
2
3
4
5
6
7
8
9
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate us.pool.ntp.org
crontab -e
0-59/10 * * * * /usr/sbin/ntpdate us.pool.ntp.org | logger -t NTP
service crond restart

6. 关闭root登录并修改ssh端口

1. 添加普通用户

1
2
3
groupadd power
useradd -d /home/www/ -g power test
passwd test

2. iptables开启5233端口

5233为下面的更改后ssh端口, 此步骤须先于下面步骤,否则会造成ssh连不上的

vi /etc/sysconfig/iptables

添加

1
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5233 -j ACCEPT

执行
/sbin/iptables restart

3. 修改sshd配置文件

vim /etc/ssh/sshd_config

禁止root登陆
PermitRootLogin yes
改为PermitRootLogin no

修改默认端口号
Port 22
改为Port 5233
最后执行systemctl restart sshd.service

7. 禁止ping

1
2
3
4
5
6
7
8
禁止
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
开启
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
#永久保存
vi /etc/rc.d/rc.local
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

8. 网络命令ifconfig,netstat

yum -y install net-tools