#!/bin/bash

echo "Xiaobei@xx123" | passwd --stdin root
sed -i 's/\#Port 22/Port 8005/g' /etc/ssh/sshd_config
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

cat << 'EOF' | sudo tee -a /etc/rc.d/rc.local
iptables -A INPUT -p tcp --dport 8005 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 221.6.206.54 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 120.232.214.139 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 103.237.29.33 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.130 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.140 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 165.154.111.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 156.59.87.0/26 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -s 162.128.174.128/25 -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -j DROP
EOF

chmod +x /etc/rc.d/rc.local

#mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
#curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
#yum clean all
#yum makecache

mkdir -p /var/log/xproxyFlow
mkdir -p /var/log/xproxyLog
mkdir -p /var/log/statslog1
mkdir -p /var/log/detaillog
mkdir -p /opt/xproxy/
mkdir -p /opt/xproxy/
mkdir -p /opt/xproxy/

yum -y install wget >/dev/null

wget http://128.1.156.184/filebeat-7.10.1-x86_64.rpm  > /dev/null
wget http://128.1.156.184/kernel-ml-5.16.8-1.el7.elrepo.x86_64.rpm  > /dev/null
wget http://128.1.156.184/zabbix-agent-4.4.10-1.el7.x86_64.rpm  > /dev/null
wget -P /opt/xproxy/  http://128.1.156.184/xproxysd/qmip_config.ini
wget -P /opt/xproxy/  http://128.1.156.184/xproxysd/ads_file.txt
wget -P /opt/xproxy/  http://128.1.156.184/xproxysd/blacklist.txt
wget -P /opt/xproxy/  http://128.1.156.184/xproxysd/xproxy-kni
chmod +x /opt/xproxy/xproxy-kni

wget http://128.1.156.184/ip-probe
chmod +x ip-probe
/root/ip-probe  -s 122.97.205.112 -p 10000 -w ip.txt > ip.log


ipadd=`head -1 /root/ip.txt |awk -F: '{print $2}'`
intip=`cat /root/ip.txt |awk -F: '{print $2}' |awk -F. '{print ($1 * 256^3) + ($2 * 256^2) + ($3 * 256^1) + ($4 * 256^0)}'`
sed -i "s/^ros_id.*/ros_id = ${intip}/" /opt/xproxy/qmip_config.ini
sed -i "s/^tag.*/tag = \"host=${ipadd}\"/" /opt/xproxy/qmip_config.ini

cp /root/ip.txt /opt/xproxy/

yum -y install epel-release > /dev/null
yum install -y supervisor > /dev/null
sleep 20
echo "[program:xproxy]
command=/opt/xproxy/xproxy-kni -c qmip_config.ini
directory=/opt/xproxy
user=root
stopsignal=INT
autostart=true
autorestart=true
startsecs=1
stderr_logfile=/dev/null
stdout_logfile=/var/log/xproxy_out.log" > /etc/supervisord.d/xproxy.ini

sed -i "s/minfds=1024/minfds=1000000/" /etc/supervisord.conf
sed -i "s/minprocs=200/minprocs=2000000/" /etc/supervisord.conf

systemctl stop supervisord
systemctl start supervisord
systemctl enable supervisord

yum -y install filebeat-7.10.1-x86_64.rpm > /dev/null
sleep 15

echo 'filebeat.inputs:
- type: log
  enabled: true
  tail_files: false
  scan_frequency: 5s
  max_backoff: 1s
  paths:
    - /var/log/xproxyLog/x_*.log

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

output.kafka:
  hosts: ["nj-kafka01.u4a.cn:6667","nj-kafka01.u4a.cn:6667","nj-kafka02.u4a.cn:6667","nj-kafka03.u4a.cn:6667","nj-kafka04.u4a.cn:6667","nj-kafka05.u4a.cn:6667"]
  topic: "oversea-proxy-raw_user_log"
  username: "vpn"
  password: "XXVN2014YJDBXHEGQWNHSGYXIK"
  partition.round_robin:
    reachable_only: false

  required_acks: 1
  compression: gzip
  codec.format:
    string: '%{[message]}'' > /etc/filebeat/filebeat.yml

sed -i "s/string.*/string: '%{[message]}'/"  /etc/filebeat/filebeat.yml

echo '122.97.205.101	nj-kafka01	nj-kafka01.u4a.cn
122.97.205.102	nj-kafka02	nj-kafka02.u4a.cn
122.97.205.103	nj-kafka03	nj-kafka03.u4a.cn
122.97.205.104	nj-kafka04	nj-kafka04.u4a.cn
122.97.205.105	nj-kafka05	nj-kafka05.u4a.cn
122.97.205.116	nj-kafka06	nj-kafka06.u4a.cn
122.97.205.117	nj-kafka07	nj-kafka07.u4a.cn
122.97.205.118	nj-kafka08	nj-kafka08.u4a.cn
122.97.205.49	nj-kafka09	nj-kafka09.u4a.cn
122.97.205.50	nj-kafka10	nj-kafka10.u4a.cn
122.97.205.51	nj-kafka11	nj-kafka11.u4a.cn
162.128.174.184   hk-aso-kafka01.u4a.cn
162.128.174.185   hk-aso-kafka02.u4a.cn
162.128.174.186   hk-aso-kafka03.u4a.cn
162.128.174.187   hk-aso-kafka04.u4a.cn
162.128.174.188   hk-aso-kafka05.u4a.cn
162.128.174.189   hk-aso-kafka06.u4a.cn
162.128.174.190   hk-aso-kafka07.u4a.cn   
162.128.174.191   hk-aso-kafka08.u4a.cn
162.128.174.144    hk-aso-kafka09.u4a.cn' >> /etc/hosts

systemctl stop filebeat
systemctl start filebeat
systemctl enable filebeat  >>/dev/null


echo '* soft nGproc 1000000
* hard nproc 1000000
* hard nofile 1000000
* soft nofile 1000000
* soft core unlimited
* soft stack 10240' >> /etc/security/limits.conf


echo "net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 避免放大攻击
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 开启恶意icmp错误消息保护
net.ipv4.icmp_ignore_bogus_error_responses = 11

#决定检查过期多久邻居条目
net.ipv4.neigh.default.gc_stale_time=120

#使用arp_announce / arp_ignore解决ARP映射问题
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.all.arp_announce=2
net.ipv4.conf.lo.arp_announce=2 # 避免放大攻击
net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护
net.ipv4.icmp_ignore_bogus_error_responses = 1

#处理无源路由的包
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

#core文件名中添加pid作为扩展名
kernel.core_uses_pid = 1

#修改消息队列长度
kernel.msgmnb = 65536
kernel.msgmax = 65536

#开启反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

#设置最大内存共享段大小bytes
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

#timewait的数量，默认180000
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 16384 262144
net.ipv4.tcp_wmem = 4096 16384 262144
net.core.wmem_default = 32768
net.core.rmem_default = 32768
net.core.rmem_max = 262144
net.core.wmem_max = 262144

#每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目。
net.core.netdev_max_backlog = 32768

#记录的那些尚未收到客户端确认信息的连接请求的最大值。对于有128M内存的系统而言，缺省值是1024
net.ipv4.tcp_max_syn_backlog = 65536

#web应用中listen函数的backlog默认会给我们内核参数的net.core.somaxconn限制到128，而nginx定义的NGX_LISTEN_BACKLOG默认为511，所以有必要调整这个值。
net.core.somaxconn = 32768

#限制仅仅是为了防止简单的DoS 攻击
net.ipv4.tcp_max_orphans = 3276800

#未收到客户端确认信息的连接请求的最大值
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0

#内核放弃建立连接之前发送SYNACK 包的数量
net.ipv4.tcp_synack_retries = 1

#内核放弃建立连接之前发送SYN 包的数量
net.ipv4.tcp_syn_retries = 1

#启用timewait 快速回收
net.ipv4.tcp_tw_recycle = 0

#开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1

# 开启SYN洪水攻击保护(防范少量SYN攻击)
net.ipv4.tcp_syncookies = 1

fs.file-max = 1000000
#允许系统打开的端口范围
net.ipv4.ip_local_port_range = 1024    49999 " > /etc/sysctl.conf

sysctl -p >/dev/null
ulimit -n 1000000

echo "sshd:221.6.206.54:allow
sshd:128.1.156.140:allow
sshd:128.1.71.151:allow
sshd:120.232.214.139:allow
sshd:103.237.29.33:allow
sshd:128.1.156.130:allow
sshd:165.154.111.0/24:allow
sshd:156.59.87.0/26:allow
sshd:162.128.174.128/25:allow
sshd:10.0.0.0/8:allow
sshd:all:deny" >> /etc/hosts.allow

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChxHeoWcIlozxSb9SRkx4DBAwF+GxihViPbY3UGEduZi9X2rHBZyrHj8YxBakPVQ2kAPLoi8Z2aqtpuvG+zH40PyxvNvxDNwtis4kMeVNBAzYnQl1abKOt8+ZGz6Bhm2p+DoQL+21/jM1riussMLPakzH43sWeWL93Ib1AGlgn0PGqpW3sSBsnmEBVYPkf1RjaZD7PF9RUU72uvLFCd3KZAe8oOUY/6ozBiaTcAddtcSU0/gcTqjDC2qk7tf6uZ7n3DJ/s85/siKff+rffW8p9K2TnEIpuc8S42Yv1zAVc5zUSYwzXMH0DDs8CMCzkYJ8NMx1rxDX4s9CNotJIssbPp0snJYnGxKSAQei8vrGopbtv+sALQXztN6VUjohClqDz5cgGPumfXwdR9SAam+KO3wsddYr+9MXlZ+PgfU+E9sNGlypH0Jl/kT2JXmtROMUtqK/a90CoCp084Kqi6EKxSZb+9rtwG/LH8QhL6J3QcLc/GQm+r8CU8d2/qVXlY5c= root@localhost.localdomain" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys

yum install -y zabbix-agent-4.4.10-1.el7.x86_64.rpm
sleep 10
ipad=`head -1 /opt/xproxy/ip.txt |awk -F: '{print $2}'`
sed  -ri "s/^Hostname=.*/Hostname=${ipad}/g" /etc/zabbix/zabbix_agentd.conf
sed  -ri 's/^Server=.*/Server=128.1.71.203,101.37.254.110/g'  /etc/zabbix/zabbix_agentd.conf
systemctl stop zabbix-agent
systemctl start zabbix-agent
systemctl enable zabbix-agent >/dev/null

cat > /usr/lib/systemd/system/filebeat1.service  << EOF
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat1/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat1 --path.config /etc/filebeat1 --path.data /var/lib/filebeat1 --path.logs /var/log/filebeat1"
ExecStart=/usr/share/filebeat1/bin/filebeat --environment systemd \$BEAT_LOG_OPTS \$BEAT_CONFIG_OPTS \$BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target
EOF

mkdir -p /etc/filebeat1
cat > /etc/filebeat1/filebeat.yml << EOF
filebeat.inputs:
- type: log
  enabled: true
  tail_files: false
  scan_frequency: 5s
  max_backoff: 1s
  paths:
    - /var/log/statslog1/x_*.log
  fields:
    topic: sl_xproxy_flow_log

- type: log
  enabled: true
  tail_files: false
  scan_frequency: 5s
  max_backoff: 1s
  paths:
    - /var/log/detaillog/x_*.log
  fields:
    topic: sl_xproxy_flow_target_log

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat1
  name: filebeat
  keepfiles: 7
  permissions: 0644

output.kafka:
  hosts: ["hk-aso-kafka01.u4a.cn:6667","hk-aso-kafka02.u4a.cn:6667","hk-aso-kafka03.u4a.cn:6667","hk-aso-kafka04.u4a.cn:6667","hk-aso-kafka05.u4a.cn:6667","hk-aso-kafka06.u4a.cn:6667","hk-aso-kafka07.u4a.cn:6667","hk-aso-kafka08.u4a.cn:6667"]
  topic: "%{[fields.topic]}"
  username: "asoworld"
  password: "XXAD2014WNUCDJEKOLKUGCUCHT"
  partition.round_robin:
    reachable_only: false

  required_acks: 1
  compression: gzip
  codec.format:
    string: '%{[message]}'
EOF

mkdir  -p /usr/share/filebeat1
cp -r /usr/share/filebeat/*  /usr/share/filebeat1/
mkdir  -p /var/lib/filebeat1
cp -r /var/lib/filebeat/* /var/lib/filebeat1/
mkdir -p /var/log/filebeat1
systemctl daemon-reload
systemctl restart filebeat1 && systemctl enable filebeat1



yum -y install  kernel-ml-5.16.8-1.el7.elrepo.x86_64.rpm
grub2-mkconfig -o /boot/grub2/grub.cfg
sed -i 's/^GRUB_DEFAULT.*/GRUB_DEFAULT=0/' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg

# 1. 下载 node_exporter，失败直接退出
wget http://128.1.156.184/xproxysd/node_exporter-1.8.2.linux-amd64.tar.gz
if [ $? -ne 0 ]; then
    echo -e "\033[31m node_exporter 下载失败，终止安装 \033[0m"
    exit 1
fi

# 2. 解压
tar -zxvf node_exporter-1.8.2.linux-amd64.tar.gz
mv node_exporter-1.8.2.linux-amd64 /usr/local/node_exporter

# 3. 创建 systemd 服务
cat > /usr/lib/systemd/system/node_exporter.service << EOF
[Unit]
Description=node_exporter
After=network.target

[Service]
User=root
ExecStart=/usr/local/node_exporter/node_exporter
Restart=on-failure

[Install]
WantedBy=multi-user.target
EOF

# 4. 加载服务并开机自启
systemctl daemon-reload
systemctl enable node_exporter
systemctl start node_exporter

# 5. 判断启动结果
sleep 1
if systemctl is-active node_exporter | grep -q active; then
    echo -e "\033[32m node_exporter 安装启动成功 \033[0m"
else
    echo -e "\033[31m node_exporter 安装启动失败 \033[0m"
fi

reboot