|
echo -e "\e[31mUnidentified Kernel version: $(uname -r). Only support for kernel el6/el7\e[0m"
fi
}
function optimize_kel_args(){
local item="Optimize Kernel Arguments"
cp /etc/sysctl.conf /etc/sysctl.conf.${current_time} > /dev/null 2>&1
arch_ratio=$([[ ! -z $(uname -a | grep x86_64) ]] && expr 64 / 32 || expr 32 / 32)
memory_size=$(free -b| awk 'NR==2{print $2}')
nf_conntrack_size=$(expr ${memory_size} / 16384 / ${arch_ratio})
#开启反向路径过滤
add_config_tofile "net.ipv4.conf.default.rp_filter = 1" /etc/sysctl.conf
add_config_tofile "net.ipv4.conf.all.rp_filter = 1" /etc/sysctl.conf
#处理无源路由包
add_config_tofile "net.ipv4.conf.all.accept_source_route = 0" /etc/sysctl.conf
add_config_tofile "net.ipv4.conf.default.accept_source_route = 0" /etc/sysctl.conf
#core文件名中添加pid作为扩展名
add_config_tofile "kernel.core_uses_pid = 1" /etc/sysctl.conf
#开启syn洪水攻击保护
add_config_tofile "net.ipv4.tcp_syncookies = 1" /etc/sysctl.conf
#修改消息队列长度
add_config_tofile "kernel.msgmnb = 65536" /etc/sysctl.conf
add_config_tofile "kernel.msgmax = 65536" /etc/sysctl.conf
#修改最大内存共享段大小bytes
add_config_tofile "kernel.shmmax = 68719476736" /etc/sysctl.conf
add_config_tofile "kernel.shmall = 4294967296" /etc/sysctl.conf
#timewait数量默认18000
add_config_tofile "net.ipv4.tcp_max_tw_buckets = 600" /etc/sysctl.conf
add_config_tofile "net.ipv4.tcp_sack = 1" /etc/sysctl.conf
add_config_tofile "net.ipv4.tcp_window_scaling = 1" /etc/sysctl.conf
add_config_tofile "net.ipv4.tcp_rmem = 4096 87380 16777216" /etc/sysctl.conf
add_config_tofile "net.ipv4.tcp_wmem = 4096 65536 16777216" /etc/sysctl.conf
add_config_tofile "net.core.rmem_default = 8388608" /etc/sysctl.conf
add_config_tofile "net.core.wmem_max = 16777216" /etc/sysctl.conf
#未收到客户端确认信息连接请求的最大值
add_config_tofile "net.ipv4.tcp_max_syn_backlog = 262144" /etc/sysctl.conf
#放弃建立连接之前发送的synack包
add_config_tofile "net.ipv4.tcp_syn_retries = 2" /etc/sysctl.conf
#开启重用，允许time—wait socket 重新用语新的tcp连接
add_config_tofile "net.ipv4.tcp_tw_reuse = 1" /etc/sysctl.conf
add_config_tofile "net.ipv4.tcp_fin_timeout = 1" /etc/sysctl.conf
#防止简单的ddos攻击
add_config_tofile "net.ipv4.tcp_max_orphans = 3276800" /etc/sysctl.conf
#启用timewait快速收回
add_config_tofile "net.ipv4.tcp_tw_recycle = 0" /etc/sysctl.conf
#keeptime启用时tcp发送keepalive消息的频度，默认2h
add_config_tofile "net.ipv4.tcp_keepalive_time = 600" /etc/sysctl.conf
#允许系统打开的端口范围
add_config_tofile "net.ipv4.ip_local_port_range = 1024 65535" /etc/sysctl.conf
#资源回收
add_config_tofile "net.ipv4.tcp_tw_recycle = 0" /etc/sysctl.conf
#路由转发
add_config_tofile "net.ipv4.ip_forward = 1" /etc/sysctl.conf
#修改防火墙连接跟踪表大小，默认65535
add_config_tofile "net.netfilter.nf_conntrack_max = ${nf_conntrack_size}" /etc/sysctl.conf
add_config_tofile "net.nf_conntrack_max = ${nf_conntrack_size}" /etc/sysctl.conf
#解禁ping
add_config_tofile "net.ipv4.icmp_echo_ignore_all = 0" /etc/sysctl.conf
modprobe bridg |