Loading... # 放置pubkey mkdir -p ~/.ssh/ touch ~/.ssh/authorized_keys cat <<'EOF'> ~/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCsFITm4ITWJPBvnD4pzVQQ7+gumY//IjWo2V8ciU+1Rzfv4IjYh25yPv0K6pf06JGtHyOGTkPzIWx85wtuNZ96cst6hjfzw7pp2IVy31DBPae6lMLhylZxrYmg8KAZE6msR1QKE4J3d8qFvyQWhOVcOF6gv5d5NPKR0vcQbOFtdAxoLGZE1/x3BXjCeb4IXA+bnXPgwB01a+cNEg8kLnt74DvoJU+aS2iX90hKOrMQ1yLzpoA0gHE38yJ9E2DfA5b6NiNcJU8r5wonWz9U08ztYTjsK1SAHSgXd5xgUlW2ImYASuxTznXIF9ehInCPxk/Khw6zKp2TaDnZUWojS1D5iEug0e+wVeuBtIMQdnHtNQtolKBzPmcSyr+SAGKdUU+y1oF6L9N4Ilu/Y1xUYfRP8s/qPUr8NBVkTyPiKslZKUeSVtn3hw5+FFR9ieKpvDinLizhkP/KWN2fKlQOjWHyB1ln4c00BjMc7HHCBioV+fN5YecFbIF82Wdr6p/XMVU= jacky EOF # 查看版本 cat /etc/redhat-release # 设置本地编码 要将 CentOS 的本地区域设置更改为 `zh_CN.UTF-8`（中文简体UTF-8编码），你可以执行以下步骤： 1. 打开终端并以超级用户（root）权限登录，或者使用 sudo 进行操作。 2. 首先，查看可用的语言和区域设置： localectl list-locales 确保 `zh_CN.UTF-8` 在列表中。 3. 设置系统的语言和区域设置为 `zh_CN.UTF-8`： localectl set-locale LANG=zh_CN.UTF-8 4. 更新系统的区域设置配置： source /etc/locale.conf 5. 重启系统以使更改生效： reboot 在系统重新启动后，你的本地区域设置应该已经更改为 `zh_CN.UTF-8`。这将影响系统的界面语言、日期格式和其他相关设置。请注意，这仅更改系统级别的区域设置。对于特定用户的区域设置，可以使用 `~/.bashrc` 或 `~/.bash_profile` 文件进行自定义。 # 修改主机名 hostnamectl set-hostname master #reboot # 修改hosts vim /etc/hosts # 添加如下内容 10.0.1.9 master 10.0.1.5 node1 # 修改时区 rm -f /etc/localtime ; ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime # 时间同步 yum install -y chrony systemctl restart chronyd systemctl enable chronyd systemctl status chronyd # 关闭selinux # 临时关闭selinux setenforce 0 # 设置永久关闭selinux sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config # 关闭交换分区 # 临时关闭交换分区 swapoff -a # 永久关闭交换分区 sed -i '/ swap / s/^/#/' /etc/fstab # 关闭防火墙 systemctl disable firewalld systemctl stop firewalld iptables -t filter -F # 修改更新源 cd /etc/yum.repos.d/ && mkdir bak && mv * bak/ cat <<EOF>/etc/yum.repos.d/CentOS-Base.repo [base] name=CentOS- enabled=1 failovermethod=priority baseurl=https://repo.huaweicloud.com/centos/7/os/x86_64 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/centos/RPM-GPG-KEY-CentOS-7 [updates] name=CentOS- enabled=1 failovermethod=priority baseurl=https://repo.huaweicloud.com/centos/7/updates/x86_64/ gpgcheck=1 gpgkey=https://repo.huaweicloud.com/centos/RPM-GPG-KEY-CentOS-7 [extras] name=CentOS- enabled=1 failovermethod=priority baseurl=https://repo.huaweicloud.com/centos/7/extras/x86_64/ gpgcheck=1 gpgkey=https://repo.huaweicloud.com/centos/RPM-GPG-KEY-CentOS-7 EOF cat <<EOF>/etc/yum.repos.d/docker-ce.repo [docker-ce-stable] name=Docker CE Stable - \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/\$basearch/stable enabled=1 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-stable-debuginfo] name=Docker CE Stable - Debuginfo \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/debug-\$basearch/stable enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-stable-source] name=Docker CE Stable - Sources baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/source/stable enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-test] name=Docker CE Test - \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/\$basearch/test enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-test-debuginfo] name=Docker CE Test - Debuginfo \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/debug-\$basearch/test enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-test-source] name=Docker CE Test - Sources baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/source/test enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-nightly] name=Docker CE Nightly - \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/\$basearch/nightly enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-nightly-debuginfo] name=Docker CE Nightly - Debuginfo \$basearch baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/debug-\$basearch/nightly enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg [docker-ce-nightly-source] name=Docker CE Nightly - Sources baseurl=https://repo.huaweicloud.com/docker-ce/linux/centos/\$releasever/source/nightly enabled=0 gpgcheck=1 gpgkey=https://repo.huaweicloud.com/docker-ce/linux/centos/gpg EOF cat <<EOF>epel.repo [epel] name=Extra Packages for Enterprise Linux 7 - enabled=1 failovermethod=priority baseurl=https://repo.huaweicloud.com/epel/7/x86_64/ gpgcheck=0 gpgkey=https://repo.huaweicloud.com/epel/RPM-GPG-KEY-EPEL-7 EOF # 参数优化 cat <<'EOF'>/etc/sysctl.conf kernel.shmall = 4294967296 net.netfilter.nf_conntrack_max = 1000000 kernel.unknown_nmi_panic = 0 kernel.sysrq = 0 fs.file-max = 1000000 vm.swappiness = 10 fs.inotify.max_user_watches = 10000000 net.core.wmem_max = 327679 net.core.rmem_max = 327679 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 fs.notify.max_queued_events = 3276792 net.ipv4.neigh.default.gc_thresh1 = 2048 net.ipv4.neigh.default.gc_thresh2 = 4096 net.ipv4.neigh.default.gc_thresh3 = 8192 vm.overcommit_memory=1 net.core.somaxconn = 512 vm.max_map_count = 262144 kernel.pid_max=1000000 net.ipv6.conf.all.disable_ipv6 = 1 EOF # 安装基础软件 yum install -y tar curl wget telnet rsync iftop dstat sysstat lrzsz net-tools traceroute tcpdump tshark bind-utils # proxychains #1. 下载 #2. so文件放在/usr/lib64/proxychains-ng #3. conf文件放在/etc/proxychains.conf #4. proxychains文件放在/bin/或者别的地方也可以 mkdir -p /usr/lib64/proxychains-ng cd /tmp wget https://vip.123pan.cn/1815238395/download/proxychains/proxychains.tar.gz tar xzvf proxychains.tar.gz mv libproxychains4.so /usr/lib64/proxychains-ng mv proxychains.conf /etc/ mv proxychains /bin/ # tcping typing cd /bin wget https://vip.123pan.cn/1815238395/download/tcping/amd64/tcping_Linux_static%202.0.0.tar.gz tar xzvf tcping_Linux_static\ 2.0.0.tar.gz # nali cd /bin wget https://vip.123pan.cn/1815238395/download/nali/nali-linux-amd64-v0.7.3.gz gunzip nali-linux-amd64-v0.7.3.gz mv nali-linux-amd64-v0.7.3 nali chmod a+x nali mkdir -p ~/.local/share/nali cd ~/.local/share/nali/ wget https://vip.123pan.cn/1815238395/download/nali/nali.share.tar.gz tar xzvf nali.share.tar.gz cd ~/.local/share/nali wget https://vip.123pan.cn/1815238395/download/nali/qqwry.dat # python # 使用本镜像站来升级 pip pip install -i https://mirrors.ustc.edu.cn/pypi/web/simple pip -U pip config set global.index-url https://mirrors.ustc.edu.cn/pypi/web/simple" golang "export all_proxy=socks5://120.224.58.239:47891 wget https://golang.google.cn/dl/go1.21.1.linux-amd64.tar.gz sudo tar xfz go1.21.1.linux-amd64.tar.gz -C /usr/local cat <<'EOF'>> /etc/profile export GOROOT=/usr/local/go export GOPATH=$HOME/gowork export GOBIN=$GOPATH/bin export PATH=$GOPATH:$GOBIN:$GOROOT/bin:$PATH EOF source /etc/profile" conda "cd /root wget https://mirrors.tuna.tsinghua.edu.cn/anaconda/archive//Anaconda3-2022.10-Linux-x86_64.sh bash Anaconda3-2022.10-Linux-x86_64.sh -p /opt/anaconda3 -b -p /opt/conda -u source ~/.bashrc source /etc/bashrc conda init bash conda create --name test python=3.9 conda activate test # ip # 显示网络接口信息 ip a # 显示路由表 ip route # 配置IP地址和子网掩码 ip addr add <IP地址>/<子网掩码位数> dev <接口名> ip addr add 192.168.1.2/24 dev eth0 # 启用或禁用接口 ip link set <接口名> up ip link set <接口名> down # 添加静态路由 ip route add <目标网络> via <网关IP> ip route add 192.168.2.0/24 via 192.168.1.1 # 删除静态路由 ip route del <目标网络> # firewalld # 启动firewalld服务 sudo systemctl start firewalld # 停止firewalld服务 sudo systemctl stop firewalld # 重启firewalld服务 sudo systemctl restart firewalld # 查看firewalld服务状态 sudo systemctl status firewalld # 启用firewalld服务开机自启动 sudo systemctl enable firewalld # 禁用firewalld服务开机自启动 sudo systemctl disable firewalld # 查看防火墙规则列表 sudo firewall-cmd --list-all # 查看已启用的防火墙服务 sudo firewall-cmd --list-services # 开放端口（例如，打开SSH端口 22） sudo firewall-cmd --add-port=22/tcp --permanent sudo firewall-cmd --reload # 开放服务（例如，打开HTTP服务） sudo firewall-cmd --add-service=http --permanent sudo firewall-cmd --reload # 移除端口或服务规则（例如，移除SSH端口规则） sudo firewall-cmd --remove-port=22/tcp --permanent sudo firewall-cmd --reload # 显示防火墙状态（运行时信息） sudo firewall-cmd --state # 查看firewalld的版本信息 sudo firewall-cmd --version # ipsec # 需求 Intranet subnets: 172.17.165.249/32 Public network address: 1.222.209.74 密码：XXX # ipsec.conf - strongSwan IPsec configuration file # basic configuration config setup uniqueids=never conn %default authby=psk type=tunnel conn To-Unitel-FirtiGate500E keyexchange=ikev1 left=%any leftsubnet=172.17.165.249/32 leftid=1.222.209.74 right=2.182.106.164 rightsubnet=10.120.54.115/32 rightid=2.182.106.164 auto=start ike=aes256-sha256-modp1024 ikelifetime=28800s esp=aes256-sha256 lifetime=3600 type=tunnel closeaction=restart dpdaction=restart keyingtries=%forever conn To-Unitel-FirtiGate100F keyexchange=ikev1 left=%any leftsubnet=172.17.165.249/32 leftid=8.222.209.74 right=183.182.100.130 rightsubnet=10.78.3.234/32 rightid=183.182.100.130 auto=start ike=aes256-sha256-modp1024 ikelifetime=28800s esp=aes256-sha256 lifetime=3600 type=tunnel closeaction=restart dpdaction=restart keyingtries=%forever # 密码文件 # ipsec.secrets - strongSwan IPsec secrets file 1.222.209.74 2.182.106.164 : PSK ""xxx"" # 测试命令 ## 查看状态 strongswan statusall strongswan up xxx strongswan down xxx ## 查看路由 ip xfrm policy ## 链路测试 traceroute -w 1 -d -n 1.62.111.200 # docker yum install -y docker cat <<'EOF'>/etc/docker/daemon.json { ""debug"": false, ""experimental"": true, ""registry-mirrors"": [ ""https://harbor.test.stesh.cn"",""https://r1qjm8hm.mirror.aliyuncs.com"" ], ""log-opts"":{""max-size"":""100m"",""max-file"":""1""} } EOF systemctl daemon-reload systemctl restart docker systemctl enable docker" docker-compose "wget ""https://ghproxy.com/https://github.com/docker/compose/releases/download/v2.15.1/docker-compose-linux-x86_64"" -O /bin/docker-compose chmod a+x /bin/docker-compose # wireguard brew "# 安装brew export HOMEBREW_BREW_GIT_REMOTE=""https://mirrors.ustc.edu.cn/brew.git"" export HOMEBREW_CORE_GIT_REMOTE=""https://mirrors.ustc.edu.cn/homebrew-core.git"" export HOMEBREW_BOTTLE_DOMAIN=""https://mirrors.ustc.edu.cn/homebrew-bottles"" export HOMEBREW_API_DOMAIN=""https://mirrors.ustc.edu.cn/homebrew-bottles/api"" #/bin/bash -c ""$(curl -fsSL https://github.com/Homebrew/install/raw/HEAD/install.sh)"" /bin/bash -c ""$(curl -fsSL https://mirrors.ustc.edu.cn/misc/brew-install.sh)"" # 更换源 ##临时使用 export HOMEBREW_BREW_GIT_REMOTE=""https://mirrors.ustc.edu.cn/brew.git"" brew update ## 对于 bash 用户 echo 'export HOMEBREW_BREW_GIT_REMOTE=""https://mirrors.ustc.edu.cn/brew.git""' >> ~/.bash_profile ## 对于 zsh 用户 echo 'export HOMEBREW_BREW_GIT_REMOTE=""https://mirrors.ustc.edu.cn/brew.git""' >> ~/.zshrc" tcpdump "tcpdump -i ens33 src host 1.1.1.1 tcpdump -i ens33 icmp tcpdump -i ens33 icmp -w /www # safeline # 安装 bash -c ""$(curl -fsSLk https://waf-ce.chaitin.cn/release/latest/setup.sh)"" # cd /path/to/safeline mv compose.yaml compose.yaml.old.`date ""+%Y-%m-%d %H:%M:%S""` wget ""https://waf-ce.chaitin.cn/release/latest/compose.yaml"" --no-check-certificate -O compose.yaml wget ""https://waf-ce.chaitin.cn/release/latest/seccomp.json"" --no-check-certificate -O seccomp.json sed -i ""s/IMAGE_TAG=.*/IMAGE_TAG=latest/g"" "".env"" grep ""SAFELINE_DIR"" "".env"" > /dev/null || echo ""SAFELINE_DIR=$(pwd)"" >> "".env"" grep ""IMAGE_TAG"" "".env"" > /dev/null || echo ""IMAGE_TAG=latest"" >> "".env"" grep ""MGT_PORT"" "".env"" > /dev/null || echo ""MGT_PORT=9443"" >> "".env"" grep ""POSTGRES_PASSWORD"" "".env"" > /dev/null || echo ""POSTGRES_PASSWORD=$(LC_ALL=C tr -dc A-Za-z0-9 </dev/urandom | head -c 32)"" >> "".env"" grep ""REDIS_PASSWORD"" "".env"" > /dev/null || echo ""REDIS_PASSWORD=$(LC_ALL=C tr -dc A-Za-z0-9 </dev/urandom | head -c 32)"" >> "".env"" grep ""SUBNET_PREFIX"" "".env"" > /dev/null || echo ""SUBNET_PREFIX=172.22.222"" >> "".env"" cd /tmp;rm -f image.tar.gz;wget https://demo.waf-ce.chaitin.cn/image.tar.gz --no-check-certificate -O image.tar.gz;docker load -i image.tar.gz docker compose down docker compose up -d # iterm # 1panel curl -sSL https://resource.fit2cloud.com/1panel/package/quick_start.sh -o quick_start.sh && sh quick_start.sh # bt面板 yum install -y wget && wget -O install.sh https://download.bt.cn/install/install_6.0.sh && sh install.sh ed8484bec # halo # rustdesk # nxshell # rinetd wget https://vip.123pan.cn/1815238395/download/rinetd/rinetd -O /usr/local/bin/rinetd wget https://vip.123pan.cn/1815238395/download/rinetd/rinetd.service -O /etc/systemd/system/rinetd.service chmod a+x /bin/rinetd systemctl daemon-reload systemctl restart rinetd # 用法 echo '0.0.0.0 46781 127.0.0.1 7891' >> /etc/rinetd.conf" # ddnsgo #wget https://ghproxy.com/https://github.com/jeessy2/ddns-go/releases/download/v5.6.1/ddns-go_5.6.1_linux_x86_64.tar.gz wget https://vip.123pan.cn/1815238395/download/ddns-go/ddns-go_5.6.1_linux_x86_64.tar.gz tar xzvf ddns-go_5.6.1_linux_x86_64.tar.gz mv ddns-go /bin/ ddns-go -s install # 配置文件 dnsconf: - ipv4: enable: true gettype: url url: https://myip4.ipip.net,https://ddns.oray.com/checkip,https://ip.3322.net,https://4.ipw.cn netinterface: """" cmd: """" domains: - raspberrypi.hlab.sddts.cn ipv6: enable: true gettype: netInterface url: https://speed.neu6.edu.cn/getIP.php,https://v6.ident.me,https://6.ipw.cn netinterface: eth0 cmd: """" ipv6reg: """" domains: - raspberrypi.hlab.sddts.cn dns: name: dnspod id: ""438041"" secret: 42c2006d3cf452bcb2ec632123456559 ttl: """" user: username: admin password: 123123 webhook: webhookurl: """" webhookrequestbody: """" webhookheaders: """" notallowwanaccess: false # icmptunnel # 下载 https://vip.123pan.cn/1815238395/download/icmptunnel/icmptunnel-1.0.0.tar.gz # 用法 ./icmptunnel -s 240e:345:4070:1200:20c:29ff:fefb:9724 # jumpserver curl -sSL https://resource.fit2cloud.com/jumpserver/jumpserver/releases/latest/download/quick_start.sh | bash # webstart version: '3.3' services: web-start: ports: - '2000:2000' image: 'dockerproxy.com/luode0320/web-start:1.0' volumes: - ./index-95ea9c5d.js:/app/dist/assets/index-95ea9c5d.js" # 文件系统扩容 # xfs扩容sda1 yum install -y cloud-utils-growpart LANG=en_US.UTF-8 growpart /dev/sda 1 -v lsblk xfs_growfs xfs_growfs -d /dev/sda1 df -h # xfs扩容vda1 LANG=en_US.UTF-8 growpart /dev/vda 1 -v lsblk xfs_growfs xfs_growfs -d /dev/vda1 df -h # xfs扩容vdb LANG=en_US.UTF-8 growpart /dev/vdb 1 -v lsblk xfs_growfs xfs_growfs -d /dev/vdb df -h # 扩容ext4 yum install cloud-utils-growpart -y # 1是分区编号 growpart /dev/sda 1 resize2fs /dev/sda1 # tailsacle nginx "upstream xxx { server xxx:10001 weight=1 max_fails=3 fail_timeout=20s; server xxx:10001 weight=1 max_fails=3 fail_timeout=20s; } server{ listen 80; server_name xxx; location / { proxy_pass http://xxx; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-real-ip $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-remoteip $http_x_forwarded_for; } } server { listen 443 ssl; server_name xxx; ssl_certificate /usr/local/nginx/sslkey/xxx.crt; ssl_certificate_key /usr/local/nginx/sslkey/xxx.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE; ssl_prefer_server_ciphers on; location / { proxy_pass http://xxx; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-real-ip $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-remoteip $http_x_forwarded_for; } } 最后修改：2024 年 05 月 11 日 © 允许规范转载 赞 如果觉得我的文章对你有用，请随意赞赏