CentOS7常用环境设置

一、云服务器ECS

地域：华东2

系统镜像：CentOS 7.3 64位

设置安全组，开放端口：80、3306、27017、21、22、2222、3717、8888、5672、15672、25672

二、基础安全设置

1、禁ping

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

 

2、修改ssh登录端口

修改/etc/ssh/sshd_config

找到#Port 22这一行，去掉注释，把端口号改为2222

重启ssh服务systemctl restart sshd.service

 

三、防火墙设置

1、查看防火墙是否打开

firewall-cmd --state

2、打开防火墙

systemctl start firewalld

3、设置防火墙开机启动

systemctl enable firewalld

4、添加端口

firewall-cmd --zone=public --add-port=3306/tcp --permanent

firewall-cmd --reload

5、查看开放端口状况

firewall-cmd --list-all

 

四、挂载扩展数据盘

请参考https://yq.aliyun.com/articles/160374

 

五、安装extundelete

Extundelete是用来做数据恢复的（简单防御“删库跑路”事件）

1、安装依赖库

yum -y install  bzip2  e2fsprogs-devel  e2fsprogs  gcc-c++ make

2、下载extundelete

wget  http://zy-res.oss-cn-hangzhou.aliyuncs.com/server/extundelete-0.2.4.tar.bz2

3、解压缩安装包

tar -xvjf extundelete-0.2.4.tar.bz2

4、编译和安装

cd extundelete-0.2.4

./configure

make && make install

注：默认安装路径是/usr/local/bin

5、基本用法

1）、卸载数据盘

umount /dev/vdb1

2）、查看已删除文件列表

extundelete --inode 2 /dev/vdb1

执行如下命令，使用extundelete工具，对整个 /dev/vdb1 分区进行搜索，并查看被删除文件的 Inode number 和 Delete status。--inode参数值设为 2 ，是对整个分区进行搜索。如果需要进入目录搜索，只需要制定目录 I 节点即可。

3）、恢复已删除的文件

extundelete  --restore-inode XXX  /dev/vdb1

注：XXX是文件的nodeId，从上一步查看已删除文件列表中获得

4）、得到恢复的文件

恢复的文件，被放在当前路径的RECOVERED_FILES文件夹下。注意恢复的文件名称不是原来的名称，需要自己重命名。

5）、重新挂载数据盘

mount -a

 

六、JDK安装

1、验证系统内是否有可用jdk

直接运行java，若没有命令参数规范提示，则说明当前系统内没有jdk

2、搜索yum里可用的jdk版本

yum search jdk

3、安装最新可用jdk版本

yum install -y java-1.8.0-openjdk

4、配置jdk系统环境变量

配置JAVA虚拟内存，修改/etc/java/java.conf，添加

JAVA_OPTS="-server –Xms800m –Xmx800m -XX:PermSize:1024M -XX:MaxPermSize=2048M -XX:MaxNewSize=2048M"

 

修改/etc/java/java.conf，添加

JAVA_HOME=$JVM_ROOT/jre

 

七、安装熵服务

CentOS7系统内在启支tomcat时，Tomcat的SessionID是通过SHA1PRNG算法计算得到的，SHA1算法需要一个密钥，这个密钥在Tomcat启动的时候随机生成一个，生成是使用了Linux随机函数生成器/dev/random。

/dev/random会根据 噪音 产生随机数，如果噪音不够它就会阻塞。Linux是通过I/O，键盘终端、内存使用量、CPU利用率等方式来收集噪音的，如果噪音不够生成随机数的时候就会被阻塞。

 

解决办法：安装熵服务（若不安装该服务，则tomcat启动会特别慢）

1、安装熵服务

yum -y install rng-tools

2、启动熵服务

systemctl start rngd

3、为熵服务添加随机启动

systemctl enable rngd.service

 

八、Tomcat安装

1、下载tomcat7

wget http://mirrors.tuna.tsinghua.edu.cn/apache/tomcat/tomcat-7/v7.0.81/bin/apache-tomcat-7.0.81.tar.gz

2、解压tomcat包

tar -zxvf apache-tomcat-7.0.81.tar.gz

3、将tomcat移动到usr目录下

mv apache-tomcat-7.0.81 /usr/share/tomcat7

4、创建快捷键

cd /root

ln -s /usr/share/tomcat7/ tomcat7

 

注：删除软链接rm tomcat7

5、创建/etc/init.d/tomcat7文件

 #!/bin/bash

# description: Tomcat Start Stop Restart

# processname: tomcat

# chkconfig: 234 20 80

#export JAVA_HOME=/usr/java

#export PATH=$JAVA_HOME/bin:$PATH

CATALINA_HOME=/usr/share/tomcat7

 

case $1 in

start)

sh $CATALINA_HOME/bin/startup.sh

;;

stop)

sh $CATALINA_HOME/bin/shutdown.sh

;;

restart)

sh $CATALINA_HOME/bin/shutdown.sh

sh $CATALINA_HOME/bin/startup.sh

;;

esac

exit 0

6、为tomcat7.service添加执行权限

chmod a+x /etc/init.d/tomcat7

7、为tomcat7.sh添加随机启动

chkconfig tomcat7 on

8、修改端口与字符编码

<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443"/>

修改为

<Connector port="80" maxHttpHeaderSize="8192" redirectPort="443" enableLookups="false" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" compression="on" URIEncoding="UTF-8" compressionMinSize="2048" noCompressionUserAgents="gozilla, traviata"  compressableMimeType="text/html,text/xml,text/javascript,text/css,text/plain"/>

 

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>

修改为

<Connector port="8009" protocol="AJP/1.3" redirectPort="443" URIEncoding="UTF-8"/>

9、Tomcat7服务

启动：service tomcat7 start

重启：service tomcat7 restart

关闭：service tomcat7 stop

 

注：若不打算将网站部署在tomcat默认地址tomcat/webapps目录下，则需要修改tomcat/conf/server.xml文件中Host的appBase参数。

 

九、MySQL数据库（5.7版本）

1、下载mysql的repo源

wget http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm

2、安装rpm包

rpm -ivh mysql-community-release-el7-5.noarch.rpm

3、安装mysql

yum -y install mysql-server

4、启动mysql服务

systemctl start mysqld.service

5、设置root密码

/usr/bin/mysqladmin -u root password 123456

6、设置字符编码

修改/etc/my.cnf文件，配置内容如下

[mysqld]

datadir=/mnt/mysql

socket=/mnt/mysql/mysql.sock

 

# Disabling symbolic-links is recommended to prevent assorted security risks

symbolic-links=0

 

# Recommended in standard MySQL setup

sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES

 

lower_case_table_names=1

character-set-server=utf8mb4

default-storage-engin=INNODB

character-set-client-handshake=FALSE

collation-server=utf8mb4_unicode_ci

init_connect='SET NAMES utf8mb4'

 

max_allowed_packet=10M

 

[mysql]

default-character-set=utf8mb4

socket=/mnt/mysql/mysql.sock

 

[client]

default-character-set=utf8mb4

socket=/mnt/mysql/mysql.sock

 

[mysqld_safe]

log-error=/var/log/mysqld.log

pid-file=/var/run/mysqld/mysqld.pid

 

注：若不打算将数据库的数据保存在mysql默认地址“/var/lib/mysql”下，则需要参数上面socket和datadir参数设置，具体地址可自行修改。

7、设置mysql随服务器启动

systemctl enable mysqld.service

8、mysql服务

启动：systemctl start mysqld.service

重启：systemctl restart mysqld.service

关闭：systemctl stop mysqld.service

9、删除无用mysql用户

进入mysql：mysql -u root –p

use mysql;

delete from user where user = "";

10、添加一个数据库用户，并限制只能在外网访问

create user '用户名'@'%' identified by '密码';

注：'用户名'@'%'表示，用户名可以远程访问数据库。

11、创建数据库，并将权限分配给用户

create database 数据库名;

grant all on 数据库名.* to '用户名'@'%';

flush privileges;

12、添加对外端口访问

firewall-cmd --zone=public --add-port=3306/tcp --permanent

firewall-cmd --reload

 

十、MongoDB数据库

1、添加文件/etc/yum.repos.d/mongodb-org-3.4.repo，文件内容如下

[mongodb-org-3.4]

name=MongoDB Repository

baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.4/x86_64/

gpgcheck=1

enabled=1

gpgkey=https://www.mongodb.org/static/pgp/server-3.4.asc

2、通过yum安装mongodb

yum install -y mongodb-org

3、设置mongo随服务器启动

systemctl enable mongod.service

4、去除IP绑定（mongoDB默认限制只能本机使用）

编辑/etc/mongod.conf

将bindIp设置注释掉

5、修改数据保存位置（mongoDB默认将数据保存在/var/lib/mongodb路径下）

编辑/etc/mongod.conf

将dbpath设置为/mnt/mongo（请将/mnt/mongo修改为你需要指定的位置），需要将/mnt/mongo权限给用户mongod（chown mongod.mongod -R /mnt/mongo）

 

注：“/mnt/mongo”目录需要事先创建好，并将权限赋予mongod

mkdir /mnt/mongo

chown -r mongod.mongod /mnt/mongo

6、mongo服务

启动：systemctl start mongod.service

重启：systemctl restart mongod.service

关闭：systemctl stop mongod.service

7、添加对外端口访问

firewall-cmd --zone=public --add-port=27017/tcp --permanent

firewall-cmd --reload

8、登录数据库

mongo

 

注：此时没有用户名和密码

9、添加数据库

use 数据库名;

db.item.insert({"name":"test"});        为数据库添加数据（没有任何数据的数据库，不会被显示出来）

10、       创建用户

db.dropUser("tony");

db.createUser({user:"用户名",pwd:"密码",roles:[{role:"readWrite",db:"ankopipeline"}]});

注意，要在ankopipeline数据库下执行该指令

 

注：mongoDB默认密码加密用的是SCRAM-SHA-1

11、       开启用户权限访问

编辑/etc/mongod.conf

将security前的注释去掉，并添加authorization: enabled

重启：systemctl restart mongod.service

 

注意，authorization的enabled参数与“:”之间要有空格，这是YAML语法要求。

 

十一、              安装RabbitMQ

1、创建一般用户rabbitmq，运行rabbitmq

useradd rabbitmq

2、设置主机名

echo rabbit1 > /etc/hostname

3、安装依赖包

yum -y install make gcc gcc-c++ m4 ncurses-devel openssl-devel unixODBC-devel

4、下载源码

wget http://erlang.org/download/otp_src_19.3.tar.gz

wget https://www.rabbitmq.com/releases/rabbitmq-server/v3.6.9/rabbitmq-server-generic-unix-3.6.9.tar.xz

5、安装Erlang（RabbitMQ是用Erlang开发的）

tar xzf otp_src_19.3.tar.gz

cd otp_src_19.3

./configure --prefix=/usr/share/erlang --enable-shared-zlib --with-ssl --enable-threads --enable-smp-support --enable-kernel-poll --enable-hipe --without-javac

make && make install

注意Erlang安装目录，前后设置要一致

6、解压rabbitmq

tar xvJf rabbitmq-server-generic-unix-3.6.9.tar.xz

mv rabbitmq_server-3.6.9  /usr/share/rabbitmq

7、rabbitmq环境变量配置

sed -i 's@^ERL_DIR=.*@ERL_DIR=/usr/share/erlang/bin/@' /usr/share/rabbitmq/sbin/rabbitmq-defaults

sed -i 's@^LOG_BASE=.*@LOG_BASE=/usr/share/rabbitmq/var/log/rabbitmq@' /usr/share/rabbitmq/sbin/rabbitmq-defaults

mkdir -p /usr/share/rabbitmq/var/{lib,log}/rabbitmq

8、RabbitMQ读写插件

wget http://pkgs.fedoraproject.org/cgit/rpms/rabbitmq-server.git/plain/rabbitmq-script-wrapper

注意如果上面链接下载不到rabbitmq-script-wrapper文件，那么请自行创建文件，文件内容如下

#!/bin/sh

##  The contents of this file are subject to the Mozilla Public License

##  Version 1.1 (the "License"); you may not use this file except in

##  compliance with the License. You may obtain a copy of the License

##  at http://www.mozilla.org/MPL/

##

##  Software distributed under the License is distributed on an "AS IS"

##  basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See

##  the License for the specific language governing rights and

##  limitations under the License.

##

##  The Original Code is RabbitMQ.

##

##  The Initial Developer of the Original Code is GoPivotal, Inc.

##  Copyright (c) 2007-2015 Pivotal Software, Inc.  All rights reserved.

##

 

SED_OPT="-E"

if [ $(uname -s) = "Linux" ]; then

    SED_OPT="-r"

fi

 

for arg in "$@" ; do

    # Wrap each arg in single quotes and wrap single quotes in double quotes, so that they're passed through cleanly.

    arg=`printf %s "$arg" | sed $SED_OPT -e "s/'/'\"'\"'/g"`

    CMDLINE="${CMDLINE} '${arg}'"

done

 

cd /usr/share/rabbitmq/var/lib/rabbitmq

 

SCRIPT=`basename $0`

 

if [ `id -u` = `id -u rabbitmq` -a "$SCRIPT" = "rabbitmq-server" ] ; then

    RABBITMQ_ENV=/usr/share/rabbitmq/sbin/rabbitmq-env

    RABBITMQ_SCRIPTS_DIR=$(dirname "$RABBITMQ_ENV")

    . "$RABBITMQ_ENV"

 

    exec /usr/share/rabbitmq/sbin/rabbitmq-server "$@"

elif [ `id -u` = `id -u rabbitmq` -o "$SCRIPT" = "rabbitmq-plugins" ] ; then

    if [ -f $PWD/.erlang.cookie ] ; then

        export HOME=.

    fi

    exec /usr/share/rabbitmq/sbin/${SCRIPT} "$@"

elif [ `id -u` = 0 ] ; then

    su rabbitmq -s /bin/sh -c "/usr/share/rabbitmq/sbin/${SCRIPT} ${CMDLINE}"

else

    /usr/share/rabbitmq/sbin/${SCRIPT}

    echo

    echo "Only root or rabbitmq should run ${SCRIPT}"

    echo

    exit 1

fi

sed -i 's@cd /var/lib/rabbitmq@cd /usr/share/rabbitmq/var/lib/rabbitmq@g' rabbitmq-script-wrapper  #更改rabbitmq数据存储目录

sed -i 's@/usr/lib/rabbitmq/bin/@/usr/share/rabbitmq/sbin/@g' rabbitmq-script-wrapper

chmod +x rabbitmq-script-wrapper

cp rabbitmq-script-wrapper /usr/sbin/rabbitmqctl

cp rabbitmq-script-wrapper /usr/sbin/rabbitmq-server

cp rabbitmq-script-wrapper /usr/sbin/rabbitmq-plugins

chown -R rabbitmq.rabbitmq /usr/share/rabbitmq/var

9、rabbitmq日志割接

新建文件/etc/logrotate.d/rabbitmq-server

内容如下

/usr/share/rabbitmq/var/log/rabbitmq/*.log {

  weekly

  missingok

  rotate 20

  compress

  delaycompress

  notifempty

  sharedscripts

  postrotate

    /sbin/service rabbitmq-server rotate-logs > /dev/null

  endscript

}

10、rabbitmq启动脚本

新建文件/etc/init.d/rabbitmq-server

#!/bin/sh

#

# rabbitmq-server RabbitMQ broker

#

# chkconfig: - 80 05

# description: Enable AMQP service provided by RabbitMQ

#

### BEGIN INIT INFO

# Provides:          rabbitmq-server

# Required-Start:    $remote_fs $network

# Required-Stop:     $remote_fs $network

# Description:       RabbitMQ broker

# Short-Description: Enable AMQP service provided by RabbitMQ broker

### END INIT INFO

# Source function library.

. /etc/init.d/functions

PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/share/erlang/bin

NAME=rabbitmq-server

DAEMON=/usr/sbin/${NAME}

CONTROL=/usr/sbin/rabbitmqctl

DESC=rabbitmq-server

USER=rabbitmq

ROTATE_SUFFIX=

INIT_LOG_DIR=/usr/share/rabbitmq/var/log/rabbitmq

PID_FILE=/var/run/rabbitmq/pid

START_PROG="daemon"

LOCK_FILE=/var/lock/subsys/$NAME

test -x $DAEMON || exit 0

test -x $CONTROL || exit 0

RETVAL=0

set -e

[ -f /etc/default/${NAME} ] && . /etc/default/${NAME}

[ -f /etc/sysconfig/${NAME} ] && . /etc/sysconfig/${NAME}

ensure_pid_dir () {

    PID_DIR=`dirname ${PID_FILE}`

    if [ ! -d ${PID_DIR} ] ; then

        mkdir -p ${PID_DIR}

        chown -R ${USER}:${USER} ${PID_DIR}

        chmod 755 ${PID_DIR}

    fi

}

remove_pid () {

    rm -f ${PID_FILE}

    rmdir `dirname ${PID_FILE}` || :

}

start_rabbitmq () {

    status_rabbitmq quiet

    if [ $RETVAL = 0 ] ; then

        echo RabbitMQ is currently running

    else

        RETVAL=0

        # RABBIT_NOFILES_LIMIT from /etc/sysconfig/rabbitmq-server is not handled

        # automatically

        if [ "$RABBITMQ_NOFILES_LIMIT" ]; then

                ulimit -n $RABBITMQ_NOFILES_LIMIT

        fi

        ensure_pid_dir

        set +e

        RABBITMQ_PID_FILE=$PID_FILE $START_PROG $DAEMON \

            > "${INIT_LOG_DIR}/startup_log" \

            2> "${INIT_LOG_DIR}/startup_err" \

            0<&- &

        $CONTROL wait $PID_FILE >/dev/null 2>&1

        RETVAL=$?

        set -e

        case "$RETVAL" in

            0)

                echo SUCCESS

                if [ -n "$LOCK_FILE" ] ; then

                    touch $LOCK_FILE

                fi

                ;;

            *)

                remove_pid

                echo FAILED - check ${INIT_LOG_DIR}/startup_\{log, _err\}

                RETVAL=1

                ;;

        esac

    fi

}

stop_rabbitmq () {

    status_rabbitmq quiet

    if [ $RETVAL = 0 ] ; then

        set +e

        $CONTROL stop ${PID_FILE} > ${INIT_LOG_DIR}/shutdown_log 2> ${INIT_LOG_DIR}/shutdown_err

        RETVAL=$?

        set -e

        if [ $RETVAL = 0 ] ; then

            remove_pid

            if [ -n "$LOCK_FILE" ] ; then

                rm -f $LOCK_FILE

            fi

        else

            echo FAILED - check ${INIT_LOG_DIR}/shutdown_log, _err

        fi

    else

        echo RabbitMQ is not running

        RETVAL=0

    fi

}

status_rabbitmq() {

    set +e

    if [ "$1" != "quiet" ] ; then

        $CONTROL status 2>&1

    else

        $CONTROL status > /dev/null 2>&1

    fi

    if [ $? != 0 ] ; then

        RETVAL=3

    fi

    set -e

}

rotate_logs_rabbitmq() {

    set +e

    $CONTROL rotate_logs ${ROTATE_SUFFIX}

    if [ $? != 0 ] ; then

        RETVAL=1

    fi

    set -e

}

restart_running_rabbitmq () {

    status_rabbitmq quiet

    if [ $RETVAL = 0 ] ; then

        restart_rabbitmq

    else

        echo RabbitMQ is not runnning

        RETVAL=0

    fi

}

restart_rabbitmq() {

    stop_rabbitmq

    start_rabbitmq

}

case "$1" in

    start)

        echo -n "Starting $DESC: "

        start_rabbitmq

        echo "$NAME."

        ;;

    stop)

        echo -n "Stopping $DESC: "

        stop_rabbitmq

        echo "$NAME."

        ;;

    status)

        status_rabbitmq

        ;;

    rotate-logs)

        echo -n "Rotating log files for $DESC: "

        rotate_logs_rabbitmq

        ;;

    force-reload|reload|restart)

        echo -n "Restarting $DESC: "

        restart_rabbitmq

        echo "$NAME."

        ;;

    try-restart)

        echo -n "Restarting $DESC: "

        restart_running_rabbitmq

        echo "$NAME."

        ;;

    *)

        echo "Usage: $0 {start|stop|status|rotate-logs|restart|condrestart|try-restart|reload|force-reload}" >&2

        RETVAL=1

        ;;

esac

exit $RETVAL

11、添加RabbitMQ-Server执行权限，并设置自启动

chmod +x /etc/init.d/rabbitmq-server

chkconfig --add rabbitmq-server

chkconfig rabbitmq-server on

12、修改rabbitmq.config

新建文件/usr/share/rabbitmq/etc/rabbitmq/rabbitmq.config

内容如下（注意：default_user，default_pass，loopback_users）（注意末尾点号）

[

  {rabbit, [

    {tcp_listeners,[5672]},

    {tcp_listen_options, [binary, {packet,raw},

                                  {reuseaddr,true},

                                  {backlog,128},

                                  {nodelay,true},

                                  {exit_on_close,false},

                                  {keepalive,true}]},

    {default_vhost,       <<"/">>},

    {default_user,        <<"guest">>},

    {default_pass,        <<"guest">>},

    {loopback_users, ["guest"]},

    {default_permissions, [<<".*">>, <<".*">>, <<".*">>]}

  ]} 

].

13、将Erlang路径添加到PATH中

vi /usr/sbin/rabbitmq-server

添加

export PAHT=$PATH:/usr/share/erlang/bin

14、开启rabbitmq manager

vi /usr/share/rabbitmq/etc/rabbitmq/enabled_plugins

内容如下（注意末尾点号）

[rabbitmq_management].

15、启动rabbitmq

service rabbitmq-server start

13、添加对外端口访问

firewall-cmd --zone=public --add-port=5672/tcp --permanent

firewall-cmd --zone=public --add-port=15672/tcp --permanent

firewall-cmd --zone=public --add-port=25672/tcp --permanent

firewall-cmd --reload

16、进入管理页面

浏览器访问http://公网IP:15672

用户名和密码，是在第12步设置的default_user和default_pass