#!/bin/bash echo "Xiaobei@xx123" | passwd --stdin root sed -i 's/\#Port 22/Port 8005/g' /etc/ssh/sshd_config sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config setenforce 0 systemctl restart sshd echo "128.1.156.200 jaguar-hk-kafka01.u4a.cn 128.1.156.201 jaguar-hk-kafka02.u4a.cn 128.1.156.202 jaguar-hk-kafka03.u4a.cn" >> /etc/hosts #mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup #curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo #yum clean all #yum makecache mkdir -p /opt/jaguar-ctrl/log yum -y install wget >/dev/null #yum -y install unzip >/dev/null sleep 10 wget http://128.1.156.184/kernel-ml-5.16.8-1.el7.elrepo.x86_64.rpm wget http://128.1.156.184/zabbix-agent-4.4.10-1.el7.x86_64.rpm wget -P /opt/jaguar-ctrl http://128.1.156.184/ctrl/jaguar-ctrl > /dev/null wget -P /opt/jaguar-ctrl http://128.1.156.184/ctrl/config.yaml > /dev/null wget -P /opt/jaguar-ctrl http://128.1.156.184/ctrl/IpVibe-Enterprise-DB.mmdb > /dev/null wget http://114.80.161.85/ip-probe chmod +x ip-probe /root/ip-probe -s 122.97.205.112 -p 10000 -w ip.txt > ip.log chmod +x /opt/jaguar-ctrl/jaguar-ctrl yum -y install epel-release > /dev/null yum install -y supervisor > /dev/null sleep 20 echo "[program:jaguar-ctrl] command=/opt/jaguar-ctrl/jaguar-ctrl directory=/opt/jaguar-ctrl user=root stopsignal=INT autostart=true autorestart=true startsecs=1 stderr_logfile=/var/log/ctrl_out.log stdout_logfile=/dev/null" > /etc/supervisord.d/jaguar-ctrl.ini sed -i "s/minfds=1024/minfds=1000000/" /etc/supervisord.conf sed -i "s/minprocs=200/minprocs=2000000/" /etc/supervisord.conf systemctl stop supervisord systemctl start supervisord systemctl enable supervisord echo '* soft nGproc 1000000 * hard nproc 1000000 * hard nofile 1000000 * soft nofile 1000000 * soft core unlimited * soft stack 10240' >> /etc/security/limits.conf echo "net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 # 避免放大攻击 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护 net.ipv4.icmp_ignore_bogus_error_responses = 11 #决定检查过期多久邻居条目 net.ipv4.neigh.default.gc_stale_time=120 #使用arp_announce / arp_ignore解决ARP映射问题 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.conf.lo.arp_announce=2 # 避免放大攻击 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护 net.ipv4.icmp_ignore_bogus_error_responses = 1 #处理无源路由的包 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 #core文件名中添加pid作为扩展名 kernel.core_uses_pid = 1 #修改消息队列长度 kernel.msgmnb = 65536 kernel.msgmax = 65536 #开启反向路径过滤 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 #设置最大内存共享段大小bytes kernel.shmmax = 68719476736 kernel.shmall = 4294967296 #timewait的数量，默认180000 net.ipv4.tcp_max_tw_buckets = 6000 net.ipv4.tcp_sack = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_rmem = 4096 16384 262144 net.ipv4.tcp_wmem = 4096 16384 262144 net.core.wmem_default = 32768 net.core.rmem_default = 32768 net.core.rmem_max = 262144 net.core.wmem_max = 262144 #每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目。 net.core.netdev_max_backlog = 32768 #记录的那些尚未收到客户端确认信息的连接请求的最大值。对于有128M内存的系统而言，缺省值是1024 net.ipv4.tcp_max_syn_backlog = 65536 #web应用中listen函数的backlog默认会给我们内核参数的net.core.somaxconn限制到128，而nginx定义的NGX_LISTEN_BACKLOG默认为511，所以有必要调整这个值。 net.core.somaxconn = 32768 #限制仅仅是为了防止简单的DoS 攻击 net.ipv4.tcp_max_orphans = 3276800 #未收到客户端确认信息的连接请求的最大值 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 #内核放弃建立连接之前发送SYNACK 包的数量 net.ipv4.tcp_synack_retries = 1 #内核放弃建立连接之前发送SYN 包的数量 net.ipv4.tcp_syn_retries = 1 #启用timewait 快速回收 net.ipv4.tcp_tw_recycle = 0 #开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 # 开启SYN洪水攻击保护(防范少量SYN攻击) net.ipv4.tcp_syncookies = 1 fs.file-max = 1000000 #允许系统打开的端口范围 net.ipv4.ip_local_port_range = 1024 50000 " > /etc/sysctl.conf sysctl -p >/dev/null ulimit -n 1000000 echo "sshd:221.6.206.54:allow sshd:128.1.156.140:allow sshd:128.1.156.130:allow sshd:120.232.214.139:allow sshd:103.237.29.33:allow sshd:165.154.111.0/24:allow sshd:156.59.87.0/26:allow sshd:162.128.174.128/25:allow sshd:all:deny" >> /etc/hosts.allow echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChxHeoWcIlozxSb9SRkx4DBAwF+GxihViPbY3UGEduZi9X2rHBZyrHj8YxBakPVQ2kAPLoi8Z2aqtpuvG+zH40PyxvNvxDNwtis4kMeVNBAzYnQl1abKOt8+ZGz6Bhm2p+DoQL+21/jM1riussMLPakzH43sWeWL93Ib1AGlgn0PGqpW3sSBsnmEBVYPkf1RjaZD7PF9RUU72uvLFCd3KZAe8oOUY/6ozBiaTcAddtcSU0/gcTqjDC2qk7tf6uZ7n3DJ/s85/siKff+rffW8p9K2TnEIpuc8S42Yv1zAVc5zUSYwzXMH0DDs8CMCzkYJ8NMx1rxDX4s9CNotJIssbPp0snJYnGxKSAQei8vrGopbtv+sALQXztN6VUjohClqDz5cgGPumfXwdR9SAam+KO3wsddYr+9MXlZ+PgfU+E9sNGlypH0Jl/kT2JXmtROMUtqK/a90CoCp084Kqi6EKxSZb+9rtwG/LH8QhL6J3QcLc/GQm+r8CU8d2/qVXlY5c= root@localhost.localdomain" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys yum install -y zabbix-agent-4.4.10-1.el7.x86_64.rpm sleep 10 ipad=`head -1 /root/ip.txt |awk -F: '{print $2}'` sed -ri "s/^Hostname=.*/Hostname=${ipad}/g" /etc/zabbix/zabbix_agentd.conf sed -ri 's/^Server=.*/Server=128.1.71.203,103.237.29.44/g' /etc/zabbix/zabbix_agentd.conf systemctl stop zabbix-agent systemctl start zabbix-agent systemctl enable zabbix-agent >/dev/null iptables -A INPUT -p tcp --dport 8005 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 221.6.206.54 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 120.232.214.139 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 103.237.29.33 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.130 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.184 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 165.154.111.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 156.59.87.0/26 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 162.128.174.128/25 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -j DROP cat << 'EOF' | sudo tee -a /etc/rc.d/rc.local iptables -A INPUT -p tcp --dport 8005 -s 221.6.206.54 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 120.232.214.139 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 103.237.29.33 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.130 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.140 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 165.154.111.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 156.59.87.0/26 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 162.128.174.128/25 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -j DROP EOF chmod +x /etc/rc.local yum -y install kernel-ml-5.16.8-1.el7.elrepo.x86_64.rpm grub2-mkconfig -o /boot/grub2/grub.cfg sed -i 's/^GRUB_DEFAULT.*/GRUB_DEFAULT=0/' /etc/default/grub grub2-mkconfig -o /boot/grub2/grub.cfg ############## # 获取出口IP EXIT_IP=$(curl -s https://api.ipify.org) # 获取国家信息（确保使用 lang=zh-CN） GEO_INFO=$(curl -s "http://ip-api.com/json/${EXIT_IP}?fields=country&lang=zh-CN") # 解析国家名称 COUNTRY=$(echo $GEO_INFO | grep -o '"country":"[^"]*"' | cut -d'"' -f4) sed -i "s/udid: .*/udid: \"伊斯坦布尔-$EXIT_IP\"/" /opt/jaguar-ctrl/config.yaml sed -i "s/host: \".*\"/host: \"$EXIT_IP\"/" /opt/jaguar-ctrl/config.yaml # 1. 下载 node_exporter，失败直接退出 wget http://128.1.156.184/xproxysd/node_exporter-1.8.2.linux-amd64.tar.gz if [ $? -ne 0 ]; then echo -e "\033[31m node_exporter 下载失败，终止安装 \033[0m" exit 1 fi # 2. 解压 tar -zxvf node_exporter-1.8.2.linux-amd64.tar.gz mv node_exporter-1.8.2.linux-amd64 /usr/local/node_exporter # 3. 创建 systemd 服务 cat > /usr/lib/systemd/system/node_exporter.service << EOF [Unit] Description=node_exporter After=network.target [Service] User=root ExecStart=/usr/local/node_exporter/node_exporter Restart=on-failure [Install] WantedBy=multi-user.target EOF # 4. 加载服务并开机自启 systemctl daemon-reload systemctl enable node_exporter systemctl start node_exporter # 5. 判断启动结果 sleep 1 if systemctl is-active node_exporter | grep -q active; then echo -e "\033[32m node_exporter 安装启动成功 \033[0m" else echo -e "\033[31m node_exporter 安装启动失败 \033[0m" fi reboot