#!/bin/bash
#服务器一键优化工具

function define_check_network() {
    echo 主机名为`hostname -f`
    ping www.baidu.com -c 6
}
function define_yum () {
    #关闭selinux
        sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
    #常用软件安装
        yum clean all
        yum -y install bash vim wget curl sysstat gcc gcc-c++ make lsof sudo unzip openssh-clients net-tools systemd rpm yum rsyslog logrotate crontabs python-libs centos-release p7zip file
        yum -y update && yum -y upgrade
}
function define_tuning_services() {
        #关闭多余服务
        systemctl stop postfix firewalld chronyd cups
        #停止开机自启动
        systemctl disable postfix firewalld chronyd  cups
        echo "非关键系统服务已经关闭"
}
function define_tuning_kernel () {
#4.内核参数优化
    echo "内核参数优化"
        cp /etc/sysctl.conf /etc/sysctl.conf.bak
        cat /dev/null > /etc/sysctl.conf
cat >> /etc/sysctl.conf << EOF
##内核默认参数
kernel.sysrq = 0
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
kernel.sem=500 64000 64 256
##打开文件数参数(20*1024*1024)
fs.file-max= 20971520
##WEB Server参数
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_tw_recycle=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=1200
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_rmem=4096 87380 8388608
net.ipv4.tcp_wmem=4096 87380 8388608
net.ipv4.tcp_max_syn_backlog=8192
net.ipv4.tcp_max_tw_buckets = 5000
##TCP补充参数
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 65535
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
##禁用ipv6
net.ipv6.conf.all.disable_ipv6 =1
net.ipv6.conf.default.disable_ipv6 =1
##swap使用率优化
vm.swappiness=0
EOF
echo "系统参数设置OK"
}
function define_tuning_system () {
    #加一个防呆判断
    if [ ` cat /etc/fstab |grep noatime|wc -l` = 0 ]; then 
       echo "脚本首次执行"
    else
        echo "第二次执行脚本，请手动检查错误"
    exit 1
    fi
    #磁盘IO优化
        sed -i '/xfs/s/defaults/defaults,noatime/' /etc/fstab
    ##nproc设置仅适合centos6
    #sed -i 's/1024/65535/' /etc/security/limits.d/90-nproc.conf
    ##nproc设置仅适合centos7
        sed -i 's/4096/524288/' /etc/security/limits.d/20-nproc.conf
    #管理open files数量
        echo "*  soft nofile   1024000" >> /etc/security/limits.conf
        echo "*  hard nofile   1024000" >> /etc/security/limits.conf
    #管理最大进程数
        echo "*  soft nproc   1024000" >> /etc/security/limits.conf
        echo "*  hard nproc   1024000" >> /etc/security/limits.conf  
        echo "session    required    /lib64/security/pam_limits.so" >> /etc/pam.d/login
    #全局变量设置优化
        echo 'export TMOUT=600' >> /etc/profile
        echo 'export TIME_STYLE="+%Y/%m/%d %H:%M:%S"'  >> /etc/profile
        echo 'export HISTTIMEFORMAT="%F %T `whoami` "' >> /etc/profile
        echo 'unset MAILCHECK' >> /etc/profile
        sed -i '/HISTSIZE/s/1000/12000/' /etc/profile
        source /etc/profile
    #关闭日志无效输出
    echo 'if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop' >/etc/rsyslog.d/ignore-systemd-session-slice.conf
    systemctl restart rsyslog
    #权限优化
    #   echo 'umask 0022' >> /etc/profile
    #禁止Ctrl+Alt+Del重启
    rm -rf /usr/lib/systemd/system/ctrl-alt-del.target
    #修改运行级别
    systemctl set-default multi-user.target
    #关闭hugepage
    chmod +x /etc/rc.d/rc.local
    echo "echo never > /sys/kernel/mm/transparent_hugepage/enabled;" >> /etc/rc.d/rc.local
    echo "echo never > /sys/kernel/mm/transparent_hugepage/defrag;" >> /etc/rc.d/rc.local
    ##启用日志压缩
    sed -i 's/'#compress'/'compress'/' /etc/logrotate.conf
    ## ssh弱密码算法修复
    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr" >> /etc/ssh/sshd_config
    ## 限制journal大小
    echo "SystemMaxUse=2048M" >> /etc/systemd/journald.conf
    echo "ForwardToSyslog=no" >> /etc/systemd/journald.conf
    echo "MaxFileSec=14day" >> /etc/systemd/journald.conf
    systemctl restart systemd-journald.service
    #系统别名设置
cat >> /etc/bashrc << EOF
##系统别名设置
alias vi='vim'
alias ls='ls -trlh --color=auto'
alias grep='grep --color=auto'
EOF
source /etc/bashrc
echo '系统别名设置完成'
}
function define_ntpdate1 () {
#本地时间同步
yum -y install ntpdate
echo "/usr/sbin/ntpdate -us ntp1.aliyun.com;hwclock -w;" >> /etc/rc.d/rc.local
##时区校正
timedatectl set-timezone Asia/Shanghai
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && hwclock -w
##时间同步
/usr/sbin/ntpdate -us ntp1.aliyun.com;hwclock -w;
cat >> /var/spool/cron/root << EOF
##时间同步
0-59/20 * * * * /usr/sbin/ntpdate -us ntp1.aliyun.com;hwclock -w;
EOF
}
function define_update () {
## yum update
cat >> /var/spool/cron/root << EOF
#yum update software
45 00 * * * /usr/bin/yum -y install bash sudo ntpdate openssh openssl vim systemd rpm yum rsyslog logrotate crontabs curl; > /dev/null 2>&1;
EOF
}
}
function denfine_swap () {
cat  >> /var/spool/cron/root << EOF
## swap enable/disable
15 * * * *  /usr/sbin/swapoff -a && /usr/sbin/swapon -a;
EOF
}
function define_localhost () {
define_yum
define_tuning_services
define_tuning_kernel
define_tuning_system
define_ntpdate1
define_update
denfine_swap
}
function define_exit () {
echo '' > /tmp/one_key.sh
exit
}
 
while :
do
echo ""
echo "服务器一键优化脚本"
echo ""
echo ""
echo " 0) 检查服务器网络           1) 本地环境专用"
echo " 2) 退出脚本"
echo
read -p "请输入一个选项: " opmode
echo
case ${opmode} in
0) define_check_network;;
1) define_localhost;;
2) define_exit;;
*) echo "无效输入" ;;
esac
done