优化：
1）关闭selinux
操作：sed -i s#SELINUX=enforcing#SELINUX=disable#g /etc/selinux/config
setenforce 0 临时禁止，不用马上重启
2)更换yum源
默认是mirrorlist=
1:备份，cd/etc/yum.repos.d mv CentOS-Base.repo CentOS-Base.repo.ori
2:下载163源 wget
3:替换mv CentOS6-Base-163.repo CentOS-Base.repo
3）下载安装必要的软件包
yum install tree telnet dos2unix sysstat lrzsz -y
分别 树结构 测试 转码 性能监控 上传和下载
4）关闭无用自启动程序
必须开启的：crond network sshd rsyslog （c5.8syslog）
chkconfig --list|grep "3:on"
for yuan in `chkconfig --list |grep "3:on"|awk '{print $1}'`;do chkconfig $yuan off;done
for yuan in crond network rsyslog sshd ;do chkconfig $yuan on;done
或者一步for yuan in `chkconfig --list |grep "3:on"|awk '{print $1}'|grep -vE "crond|network|syslog|sshd"`;do chkconfig $yuan off;done
5）更改ssh远程登录服务配置
1：更改端口号 /etc/ssh/sshd_config port:65535
2：禁止root登录，/etc/ssh/sshd_config permitRootLogin no
或者 密钥登录
3：/etc/ssh/sshd_config UseDNS no 加速ssh登录
4：/etc/ssh/sshd_config GSSAPIAuthentication no 加速ssh登录
5：重启服务，/etc/init.d/sshd restart=service sshd restart
6）给普通用户root权限
1：visudo=vi /etc/sudoers 98gg到98行 yy复制 p粘帖
2:root>yuangq ALL>/usr/sbin/useradd yuangq就有useradd的权限。
3：在yuangq用户下，sudo useradd
4：yuangq ALL=(ALL) NOPASSWD: ALL
7)服务器时间同步 ntp
echo '#time sysnc by yuangq at 2016/11/8' >>/var/spool/cron/root
echo '*/5 * * * * /usr/sbin/ntpdate time.nist.gov >/dev/null2>&1'>>/var/spool/cron/root
crontab -l 检查定时任务
8）加大文件描述符
查看最大文件描述符 ulimit -n 最大65535 够用就好
echo '* - nofile 65535' >>/etc/security/limits.conf
9）调整内核参数
vi /etc/sysctl.conf
在最后面，添加内容
net.ipv4.tcp_fin_timeout = 2
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.ip_local_port_range = 4000 65000
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_max_tw_buckets = 36000
net.ipv4.route.gc_timeout = 100
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_synack_retries = 1
net.core.somaxconn = 16384
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_orphans = 16384
防火墙的优化
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
sysctl -p 使之生效
可能会报错
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
这个错误是由于自动处理可载入的模块bridge没有自动载入，解决办法是自动处理开载入的模块ip_conntrack
需要这样做
modprobe bridge
echo "modprobe bridge">> /etc/rc.local
也可能报错
error: "net.nf_conntrack_max" is an unknown key
error: "net.netfilter.nf_conntrack_max" is an unknown key
error: "net.netfilter.nf_conntrack_tcp_timeout_established" is an unknown key
error: "net.netfilter.nf_conntrack_tcp_timeout_time_wait" is an unknown key
error: "net.netfilter.nf_conntrack_tcp_timeout_close_wait" is an unknown key
error: "net.netfilter.nf_conntrack_tcp_timeout_fin_wait" is an unknown key
这个错误可能是你的防火墙没有开启或者自动处理可载入的模块ip_conntrack没有自动载入，解决办法有二，一是开启防火墙，二是自动处理开载入的模块ip_conntrack
启动防火墙：/etc/init.d/iptables stop
modprobe nf_conntrack
echo "modprobe nf_conntrack">> /etc/rc.local
10）隐藏系统版本
>/etc/issue 或者 cat /dev/null >/etc/issue
11）锁定关键文件
chattr +i /etc/passwd /etc/shadow /etc/group /etc/gshadow /etc/inittab -i解锁
lsattr /etc/passwd ---i---e-- i表示加锁了
12）定时清理 /var/spool/clientmqueue垃圾目录(cento6.4以上不需要)
echo "find /var/spool/clientmqueue/ -type f |xargs rm -f " >/server/scripts/del_sys_file.sh
echo "00 00 * * 0 /bin/sh/server/scripts/del_sys_file.sh >/dev/null2>&1" >>/var/spool/cron/root
crontab -l |tail -2