Linux系统小优化以及简单防御

LINUX系统小优化，请自行填写脚本：

#set sysctl

cp /etc/sysctl.conf/etc/sysctl.conf.bak

>/etc/sysctl.conf

cat >>/etc/sysctl.conf << EOF

#防止内部网络被探测

net.inet.ip.sourceroute=0

net.inet.ip.accept_sourceroute=0

#增加vnode降低磁盘IO，但是会消耗内存

kern.maxvnodes=100000

#硬盘快取

hw.ata.wc: 1

#加速反映ISR封包

net.isr.direct: 0

#调整ARP清理时间

net.link.ether.inet.max_age:300

#本地数据流接受空间

net.inet.raw.recvspace:65536

net.inet.raw.maxdgram:65536

#处理无响应的tcp链接

net.inet.tcp.always_keepalive:1

#加速不正常的握手释放过程

net.inet.tcp.msl:2500

#防御SYN

net.ipv4.tcp_max_syn_backlog= 2048

sysctl -wnet.ipv4.tcp_syncookies = 1

net.ipv4.tcp_synack_retries= 3

net.ipv4.tcp_syn_retries= 3

#常规优化

net.ipv4.ip_forward =0

net.ipv4.conf.default.rp_filter= 1

net.ipv4.conf.default.accept_source_route= 0

kernel.sysrq = 0

kernel.core_uses_pid= 1

net.ipv4.tcp_syncookies= 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax =68719476736

kernel.shmall =4294967296

net.ipv4.tcp_max_tw_buckets= 6000

net.ipv4.tcp_sack = 1

net.ipv4.tcp_window_scaling= 1

net.ipv4.tcp_rmem =4096 87380 4194304

net.ipv4.tcp_wmem =4096 16384 4194304

net.core.wmem_default= 8388608

net.core.rmem_default= 8388608

net.core.rmem_max =16777216

net.core.wmem_max =16777216

net.core.netdev_max_backlog= 262144

net.core.somaxconn =262144

net.ipv4.tcp_max_orphans= 3276800

net.ipv4.tcp_timestamps= 0

net.ipv4.tcp_tw_recycle= 1

net.ipv4.tcp_tw_reuse= 1

net.ipv4.tcp_mem =94500000 915000000 927000000

net.ipv4.tcp_fin_timeout= 1

net.ipv4.tcp_keepalive_time= 600