sysctl.conf最適化
32924 ワード
- sysctl.conf ， 。 ， 。
-
- cp /etc/sysctl.conf /etc/sysctl.conf.bak
-
- 。
-
- # Kernel sysctl configuration file for Red Hat Linux
- #
- # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
- # sysctl.conf(5) for more details.
-
- # Disables packet forwarding
- net.ipv4.ip_forward=0
-
- # Disables IP source routing
- net.ipv4.conf.all.accept_source_route = 0
- net.ipv4.conf.lo.accept_source_route = 0
- net.ipv4.conf.eth0.accept_source_route = 0
- net.ipv4.conf.default.accept_source_route = 0
-
- # Enable IP spoofing protection, turn on source route verification
- net.ipv4.conf.all.rp_filter = 1
- net.ipv4.conf.lo.rp_filter = 1
- net.ipv4.conf.eth0.rp_filter = 1
- net.ipv4.conf.default.rp_filter = 1
-
- # Disable ICMP Redirect Acceptance
- net.ipv4.conf.all.accept_redirects = 0
- net.ipv4.conf.lo.accept_redirects = 0
- net.ipv4.conf.eth0.accept_redirects = 0
- net.ipv4.conf.default.accept_redirects = 0
-
- # Enable Log Spoofed Packets, Source Routed Packets, Redirect Packets
- net.ipv4.conf.all.log_martians = 0
- net.ipv4.conf.lo.log_martians = 0
- net.ipv4.conf.eth0.log_martians = 0
-
- # Disables the magic-sysrq key
- kernel.sysrq = 0
-
- # Decrease the time default value for tcp_fin_timeout connection
- net.ipv4.tcp_fin_timeout = 15
-
- # Decrease the time default value for tcp_keepalive_time connection
- net.ipv4.tcp_keepalive_time = 1800
-
- # Turn off the tcp_window_scaling
- net.ipv4.tcp_window_scaling = 0
-
- # Turn off the tcp_sack
- net.ipv4.tcp_sack = 0
-
- # Turn off the tcp_timestamps
- net.ipv4.tcp_timestamps = 0
-
- # Enable TCP SYN Cookie Protection
- net.ipv4.tcp_syncookies = 1
-
- # Enable ignoring broadcasts request
- net.ipv4.icmp_echo_ignore_broadcasts = 1
-
- # Enable bad error message Protection
- net.ipv4.icmp_ignore_bogus_error_responses = 1
-
- # Log Spoofed Packets, Source Routed Packets, Redirect Packets
- net.ipv4.conf.all.log_martians = 1
-
- # Increases the size of the socket queue (effectively, q0).
- net.ipv4.tcp_max_syn_backlog = 1024
-
- # Increase the tcp-time-wait buckets pool size
- net.ipv4.tcp_max_tw_buckets = 1440000
-
- # Allowed local port range
- net.ipv4.ip_local_port_range = 16384 65536
-
- CTRL + X to exit and save the file
-
- To make your changes take effect immediately, type this command:
- /sbin/sysctl -p
-
- :FreeBSD Web
- :heiyeluren http://www.unixsky.net
- /etc/sysctl.conf ， ：( )
-
- # TCP
- net.inet.tcp.sendspace=65536
-
- # TCP
- net.inet.tcp.recvspace=65536
-
- # UDP
- net.inet.udp.sendspace=65535
-
- # UDP
- net.inet.udp.maxdgram=65535
-
- #
- net.local.stream.sendspace=65535
-
- #
- net.inet.tcp.rfc1323=1
- net.inet.tcp.rfc1644=1
- net.inet.tcp.rfc3042=1
- net.inet.tcp.rfc3390=1
-
- #
- kern.ipc.maxsockbuf=2097152
-
- #
- kern.maxfiles=65536
-
- #
- kern.maxfilesperproc=32768
-
- # TCP ， ACK 。 ACK ， ， ， ， ， 。
- net.inet.tcp.delayed_ack=0
-
- # ICMP
- net.inet.icmp.drop_redirect=1
- net.inet.icmp.log_redirect=1
- net.inet.ip.redirect=0
- net.inet6.ip6.redirect=0
-
- # ICMP
- net.inet.icmp.bmcastecho=0
- net.inet.icmp.maskrepl=0
-
- # ICMP
- net.inet.icmp.icmplim=100
-
- # ， options TCP_DROP_SYNFIN
- net.inet.icmp.icmplim_output=0
- net.inet.tcp.drop_synfin=1
-
- # 1 TCP ， ， 。 TCP ， modem
- net.inet.tcp.always_keepalive=1
-
- # net.inet.ip.intr_queue_drops ， net.inet.ip.intr_queue_maxlen， 0
- net.inet.ip.intr_queue_maxlen=1000
-
- # DOS ， 30000
- net.inet.tcp.msl=7500
-
- # ， drop， 1 TCP
- net.inet.tcp.blackhole=2
-
- # UDP drop
- net.inet.udp.blackhole=1
-
- #
- net.inet.tcp.inflight.enable=1
-
- # arp ， ,
- net.inet.ip.fastforwarding=0
-
- #kernel options POLLING ， SMP polling
- #kern.polling.enable=1
-
- # ， 128， 1024-4096 ，
- kern.ipc.somaxconn=32768
-
- #
- security.bsd.see_other_uids=0
-
- # kernel
- kern.securelevel=0
-
- # TCP
- net.inet.tcp.log_in_vain=1
-
- # UDP
- net.inet.udp.log_in_vain=1
-
- # udp
- net.inet.udp.checksum=1
-
- # DOS
- net.inet.tcp.syncookies=1
-
- # ， 256
- kern.ipc.shm_use_phys=1
-
- #
- kern.ipc.shmmax=67108864
-
- #
- kern.ipc.shmall=32768
-
- #
- kern.coredump=0
-
- # lo
- net.local.stream.recvspace=65536
- net.local.dgram.maxdgram=16384
- net.local.dgram.recvspace=65536
-
- # ，ADSL 1452。
- net.inet.tcp.mssdflt=1460
-
- #
- net.inet.tcp.inflight_enable=1
-
- # ，ADSL 1452
- net.inet.tcp.minmss=1460
-
- #
- net.inet.raw.maxdgram=65536
-
- #
- net.inet.raw.recvspace=65536
-
- #ipfw ， 4096， TCP ，
- net.inet.ip.fw.dyn_max=65535
-
- # ipf TCP ， 8640000（120 ）
- net.inet.ipf.fr_tcpidletimeout=864000
-
- ：
- #set sysctl
- true > /etc/sysctl.conf
- cat >> /etc/sysctl.conf << EOF
- net.ipv4.ip_forward = 0
- net.ipv4.conf.default.rp_filter = 1
- net.ipv4.conf.default.accept_source_route = 0
- kernel.sysrq = 0
- kernel.core_uses_pid = 1
- net.ipv4.tcp_syncookies = 1
- kernel.msgmnb = 65536
- kernel.msgmax = 65536
- kernel.shmmax = 68719476736
- kernel.shmall = 4294967296
- net.ipv4.tcp_max_tw_buckets = 6000
- net.ipv4.tcp_sack = 1
- net.ipv4.tcp_window_scaling = 1
- net.ipv4.tcp_rmem = 4096 87380 4194304
- net.ipv4.tcp_wmem = 4096 16384 4194304
- net.core.wmem_default = 8388608
- net.core.rmem_default = 8388608
- net.core.rmem_max = 16777216
- net.core.wmem_max = 16777216
- net.core.netdev_max_backlog = 262144
- net.core.somaxconn = 262144
- net.ipv4.tcp_max_orphans = 3276800
- net.ipv4.tcp_max_syn_backlog = 262144
- net.ipv4.tcp_timestamps = 0
- net.ipv4.tcp_synack_retries = 1
- net.ipv4.tcp_syn_retries = 1
- net.ipv4.tcp_tw_recycle = 1
- net.ipv4.tcp_tw_reuse = 1
- net.ipv4.tcp_mem = 94500000 915000000 927000000
- net.ipv4.tcp_fin_timeout = 1
- net.ipv4.tcp_keepalive_time = 1200
- net.ipv4.ip_local_port_range = 1024 65535
- EOF
- #300second
- #Optimization of system kernel //
- initKernel() {
- cat << EOF
- +--------------------------------------------------------------+
- +------ Welcome to Optimization of system kernel. ------+
- +--------------------------------------------------------------+
- EOF
- \cp /etc/sysctl.conf /etc/sysctl.conf.`date +"%Y-%m-%d_%H-%M-%S"`
- cat>>/etc/sysctl.conf<<EOF
- net.ipv4.tcp_timestamps = 0
- net.ipv4.tcp_synack_retries = 2
- net.ipv4.tcp_syn_retries = 2
- net.ipv4.tcp_mem = 94500000 915000000 927000000
- net.ipv4.tcp_max_orphans = 3276800
- net.core.wmem_default = 8388608
- net.core.rmem_default = 8388608
- net.core.rmem_max = 16777216
- net.core.wmem_max = 16777216
- net.ipv4.tcp_rmem = 4096 87380 16777216
- net.ipv4.tcp_wmem = 4096 87380 16777216
- net.core.netdev_max_backlog = 32768
- net.core.somaxconn = 32768
- net.ipv4.tcp_syncookies = 1
- net.ipv4.tcp_tw_reuse = 1
- net.ipv4.tcp_tw_recycle = 1
- net.ipv4.tcp_fin_timeout = 1
- net.ipv4.tcp_keepalive_time = 600
- net.ipv4.tcp_max_syn_backlog = 65535
- net.ipv4.ip_local_port_range = 1024 65535
- EOF
- /sbin/sysctl -p
- echo "Optimization of system kernel.------>OK"
- sleep 3
- }