CentOS7

操作系统

基本优化

http://hequan.blog.51cto.com/5701886/1789146

修改主机名

http://www.centoscn.com/CentOS/config/2014/1031/4039.html

使用hostnamectl的命令行工具，它允许你查看及修改同主机名相关的配置。

hostnamectl set-hostname --static PBSZBX01

静态地址

http://www.centoscn.com/CentOS/config/2014/1031/4034.html

关闭不必要的服务

http://www.linuxdown.net/install/faq/20160309_how_linux_4976.html

服务开机自启动

http://www.centoscn.com/CentOS/config/2015/0507/5374.html

View and manage services

[root@zabbix-server ~]# systemctl -t service
UNIT                               LOAD   ACTIVE SUB     DESCRIPTION
auditd.service                     loaded active running Security Auditing Service
crond.service                      loaded active running Command Scheduler
dbus.service                       loaded active running D-Bus System Message Bus
getty@tty1.service                 loaded active running Getty on tty1
httpd.service                      loaded active running The Apache HTTP Server
irqbalance.service                 loaded active running irqbalance daemon
kmod-static-nodes.service          loaded active exited  Create list of required static device nodes for the current kernel
lvm2-lvmetad.service               loaded active running LVM2 metadata daemon
lvm2-monitor.service               loaded active exited  Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling
lvm2-pvscan@8:2.service            loaded active exited  LVM2 PV scan on device 8:2
network.service                    loaded active exited  LSB: Bring up/down networking
NetworkManager.service             loaded active running Network Manager
onealert.service                   loaded active running LSB: OneAlert local agent
polkit.service                     loaded active running Authorization Manager
rhel-autorelabel-mark.service      loaded active exited  Mark the need to relabel after reboot
rhel-dmesg.service                 loaded active exited  Dump dmesg to /var/log/dmesg
rhel-import-state.service          loaded active exited  Import network configuration from initramfs
rhel-readonly.service              loaded active exited  Configure read-only root support
rsyslog.service                    loaded active running System Logging Service
sendmail.service                   loaded active running Sendmail Mail Transport Agent
sm-client.service                  loaded active running Sendmail Mail Transport Client
sshd.service                       loaded active running OpenSSH server daemon
systemd-journal-flush.service      loaded active exited  Flush Journal to Persistent Storage
systemd-journald.service           loaded active running Journal Service
systemd-logind.service             loaded active running Login Service
systemd-random-seed.service        loaded active exited  Load/Save Random Seed
systemd-remount-fs.service         loaded active exited  Remount Root and Kernel File Systems
systemd-sysctl.service             loaded active exited  Apply Kernel Variables
systemd-tmpfiles-setup-dev.service loaded active exited  Create Static Device Nodes in /dev
systemd-tmpfiles-setup.service     loaded active exited  Create Volatile Files and Directories
systemd-udev-trigger.service       loaded active exited  udev Coldplug all Devices
systemd-udevd.service              loaded active running udev Kernel Device Manager
systemd-update-utmp.service        loaded active exited  Update UTMP about System Boot/Shutdown
systemd-user-sessions.service      loaded active exited  Permit User Sessions
systemd-vconsole-setup.service     loaded active exited  Setup Virtual Console
tuned.service                      loaded active running Dynamic System Tuning Daemon
vmware-tools.service               loaded active running SYSV: Manages the services needed to run VMware software
wpa_supplicant.service             loaded active running WPA Supplicant daemon
zabbix-agent.service               loaded active running Zabbix Agent
zabbix-server.service              loaded active running Zabbix Server
LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
40 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

关闭防火墙

[root@PBSZBX01 ~]# systemctl disable firewalld.service
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.
# Ckeck
[root@PBSZBX01 ~]# firewall-cmd --state
not running

Forbid IPv6

这只是其中一种办法，简单可行。

[root@hidocker ~]# vim /etc/sysctl.conf
# 增加下面两行：
net.ipv6.conf.all.disable_ipv6 =1
net.ipv6.conf.default.disable_ipv6 =1
# 保存并退出文件，并执行下面的命令来使设置生效：
sysctl -p

SELinux

http://www.centoscn.com/CentOS/config/2015/0618/5681.html

VNC

https://linux.cn/article-5335-1.html

安全加固、检测、审计

http://blog.csdn.net/wh211212/article/details/53063599?fps=1&locationNum=2