#!/bin/bash echo "Xiaobei@xx123" | passwd --stdin root sed -i 's/\#Port 22/Port 8005/g' /etc/ssh/sshd_config sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/^#\?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config systemctl restart sshd ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime echo "export LC_TIME=C" >> /root/.bashrc export LC_TIME=C cat << 'EOF' | sudo tee -a /etc/rc.d/rc.local iptables -A INPUT -p tcp --dport 8005 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 221.6.206.54 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 120.232.214.139 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 103.237.29.33 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.130 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 128.1.156.140 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 165.154.111.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 156.59.87.0/26 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -s 162.128.174.128/25 -j ACCEPT iptables -A INPUT -p tcp --dport 8005 -j DROP EOF chmod +x /etc/rc.d/rc.local #mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup #curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo #yum clean all #yum makecache mkdir -p /var/log/xproxyFlow mkdir -p /var/log/xproxyLog mkdir -p /var/log/statslog1 mkdir -p /var/log/detaillog mkdir -p /var/log/countlog mkdir -p /opt/xproxy/log mkdir -p /opt/xproxy/conf mkdir -p /opt/xproxy/bin yum -y install wget >/dev/null wget -P /opt/xproxy/conf http://128.1.156.184/rockysd/tunnelConfig.ini wget -P /opt/xproxy/conf http://128.1.156.184/rockysd/ads_file.txt wget -P /opt/xproxy/conf http://128.1.156.184/rockysd/blacklist.txt wget -P /opt/xproxy/bin http://128.1.156.184/rockysd/xproxy-kni wget -P /opt/xproxy/conf http://128.1.156.184/rockysd/directlist.txt chmod +x /opt/xproxy/bin/xproxy-kni ln -s /opt/xproxy/bin/xproxy-kni /opt/xproxy/xproxy wget http://128.1.156.184/ip-probe chmod +x ip-probe /root/ip-probe -s 122.97.205.112 -p 10000 -w ip.txt > ip.log ipadd=`head -1 /root/ip.txt |awk -F: '{print $2}'` intip=`cat /root/ip.txt |awk -F: '{print $2}' |awk -F. '{print ($1 * 256^3) + ($2 * 256^2) + ($3 * 256^1) + ($4 * 256^0)}'` sed -i "s/^ros_id.*/ros_id = ${intip}/" /opt/xproxy/conf/tunnelConfig.ini sed -i "s/^tag.*/tag = \"host=${ipadd}\"/" /opt/xproxy/conf/tunnelConfig.ini #########获取ipv6地址########## ipadv6=`ip -6 addr show | grep -v "fe80::" | grep inet6 | awk '{print $2}' | cut -d'/' -f1 | tail -n1` sed -i "s/^ipv6_addr =.*/ipv6_addr =${ipadv6}/" /opt/xproxy/conf/tunnelConfig.ini cp /root/ip.txt /opt/xproxy/conf/ yum -y install epel-release > /dev/null yum install -y supervisor > /dev/null sleep 20 echo "[program:xproxy] command=/opt/xproxy/xproxy -c /opt/xproxy/conf/tunnelConfig.ini directory=/opt/xproxy user=root stopsignal=INT autostart=true autorestart=true startsecs=1 stderr_logfile=/opt/xproxy/log/server.log stdout_logfile=/opt/xproxy/log/server.log stdout_logfile_maxbytes=500MB stderr_logfile_maxbytes=500MB" > /etc/supervisord.d/xproxy.ini sed -i "s/minfds=1024/minfds=1000000/" /etc/supervisord.conf sed -i "s/minprocs=200/minprocs=2000000/" /etc/supervisord.conf systemctl stop supervisord systemctl start supervisord systemctl enable supervisord rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch tee /etc/yum.repos.d/elastic.repo <> /etc/hosts echo '* soft nGproc 1000000 * hard nproc 1000000 * hard nofile 1000000 * soft nofile 1000000 * soft core unlimited * soft stack 10240' >> /etc/security/limits.conf echo "net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 # 避免放大攻击 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护 net.ipv4.icmp_ignore_bogus_error_responses = 11 #决定检查过期多久邻居条目 net.ipv4.neigh.default.gc_stale_time=120 #使用arp_announce / arp_ignore解决ARP映射问题 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.conf.lo.arp_announce=2 # 避免放大攻击 net.ipv4.icmp_echo_ignore_broadcasts = 1 # 开启恶意icmp错误消息保护 net.ipv4.icmp_ignore_bogus_error_responses = 1 #处理无源路由的包 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 #core文件名中添加pid作为扩展名 kernel.core_uses_pid = 1 #修改消息队列长度 kernel.msgmnb = 65536 kernel.msgmax = 65536 #开启反向路径过滤 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 #设置最大内存共享段大小bytes kernel.shmmax = 68719476736 kernel.shmall = 4294967296 #timewait的数量，默认180000 net.ipv4.tcp_max_tw_buckets = 6000 net.ipv4.tcp_sack = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_rmem = 4096 16384 262144 net.ipv4.tcp_wmem = 4096 16384 262144 net.core.wmem_default = 32768 net.core.rmem_default = 32768 net.core.rmem_max = 262144 net.core.wmem_max = 262144 #每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目。 net.core.netdev_max_backlog = 32768 #记录的那些尚未收到客户端确认信息的连接请求的最大值。对于有128M内存的系统而言，缺省值是1024 net.ipv4.tcp_max_syn_backlog = 65536 #web应用中listen函数的backlog默认会给我们内核参数的net.core.somaxconn限制到128，而nginx定义的NGX_LISTEN_BACKLOG默认为511，所以有必要调整这个值。 net.core.somaxconn = 32768 #限制仅仅是为了防止简单的DoS 攻击 net.ipv4.tcp_max_orphans = 3276800 #未收到客户端确认信息的连接请求的最大值 net.ipv4.tcp_max_syn_backlog = 262144 net.ipv4.tcp_timestamps = 0 #内核放弃建立连接之前发送SYNACK 包的数量 net.ipv4.tcp_synack_retries = 1 #内核放弃建立连接之前发送SYN 包的数量 net.ipv4.tcp_syn_retries = 1 #启用timewait 快速回收 net.ipv4.tcp_tw_recycle = 0 #开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 94500000 915000000 927000000 net.ipv4.tcp_fin_timeout = 1 # 开启SYN洪水攻击保护(防范少量SYN攻击) net.ipv4.tcp_syncookies = 1 fs.file-max = 1000000 #允许系统打开的端口范围 net.ipv4.ip_local_port_range = 1024 49999 " > /etc/sysctl.conf sysctl -p >/dev/null ulimit -n 1000000 echo "sshd:221.6.206.54:allow sshd:128.1.156.140:allow sshd:128.1.71.151:allow sshd:120.232.214.139:allow sshd:103.237.29.33:allow sshd:128.1.156.130:allow sshd:165.154.111.0/24:allow sshd:156.59.87.0/26:allow sshd:162.128.174.128/25:allow sshd:10.0.0.0/8:allow sshd:all:deny" >> /etc/hosts.allow echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQChxHeoWcIlozxSb9SRkx4DBAwF+GxihViPbY3UGEduZi9X2rHBZyrHj8YxBakPVQ2kAPLoi8Z2aqtpuvG+zH40PyxvNvxDNwtis4kMeVNBAzYnQl1abKOt8+ZGz6Bhm2p+DoQL+21/jM1riussMLPakzH43sWeWL93Ib1AGlgn0PGqpW3sSBsnmEBVYPkf1RjaZD7PF9RUU72uvLFCd3KZAe8oOUY/6ozBiaTcAddtcSU0/gcTqjDC2qk7tf6uZ7n3DJ/s85/siKff+rffW8p9K2TnEIpuc8S42Yv1zAVc5zUSYwzXMH0DDs8CMCzkYJ8NMx1rxDX4s9CNotJIssbPp0snJYnGxKSAQei8vrGopbtv+sALQXztN6VUjohClqDz5cgGPumfXwdR9SAam+KO3wsddYr+9MXlZ+PgfU+E9sNGlypH0Jl/kT2JXmtROMUtqK/a90CoCp084Kqi6EKxSZb+9rtwG/LH8QhL6J3QcLc/GQm+r8CU8d2/qVXlY5c= root@localhost.localdomain" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys dnf -y install zabbix-agent sleep 10 ipad=`head -1 /opt/xproxy/conf/ip.txt |awk -F: '{print $2}'` sed -ri "s/^Hostname=.*/Hostname=${ipad}/g" /etc/zabbix_agentd.conf sed -ri 's/^Server=.*/Server=128.1.71.203,101.37.254.110/g' /etc/zabbix_agentd.conf systemctl stop zabbix-agent systemctl start zabbix-agent systemctl enable zabbix-agent >/dev/null cat > /etc/filebeat/filebeat.yml << EOF filebeat.inputs: - type: log enabled: true tail_files: false scan_frequency: 5s max_backoff: 1s paths: - /var/log/statslog1/x_*.log fields: topic: sl_xproxy_flow_log - type: log enabled: true tail_files: false scan_frequency: 5s max_backoff: 1s paths: - /var/log/detaillog/x_*.log fields: topic: sl_xproxy_flow_target_log - type: log enabled: true tail_files: false scan_frequency: 5s max_backoff: 1s paths: - /var/log/countlog/x_*.log fields: topic: sl_xproxy_count_log logging.level: info logging.to_files: true logging.files: path: /var/log/filebeat1 name: filebeat keepfiles: 7 permissions: 0644 output.kafka: hosts: ["hk-aso-kafka01.u4a.cn:6667","hk-aso-kafka02.u4a.cn:6667","hk-aso-kafka03.u4a.cn:6667","hk-aso-kafka04.u4a.cn:6667","hk-aso-kafka05.u4a.cn:6667","hk-aso-kafka06.u4a.cn:6667","hk-aso-kafka07.u4a.cn:6667","hk-aso-kafka08.u4a.cn:6667"] topic: "%{[fields.topic]}" username: "asoworld" password: "XXAD2014WNUCDJEKOLKUGCUCHT" partition.round_robin: reachable_only: false required_acks: 1 compression: gzip codec.format: string: '%{[message]}' EOF systemctl restart filebeat && systemctl enable filebeat ###################################### FILE="/opt/xproxy/conf/ip.txt" # 检查文件是否存在且不为空 [ ! -f "$FILE" ] && echo "文件不存在" && exit 1 [ ! -s "$FILE" ] && echo "文件为空" && exit 0 # 检查重复并删除最后一行 if [ $(sort "$FILE" | uniq -d | wc -l) -gt 0 ]; then echo "发现重复行，删除最后一行" sed -i '$d' "$FILE" else echo "没有重复行" fi ########################## # 1. 下载 node_exporter，失败直接退出 wget http://128.1.156.184/rockysd/node_exporter-1.8.2.linux-amd64.tar.gz if [ $? -ne 0 ]; then echo -e "\033[31m node_exporter 下载失败，终止安装 \033[0m" exit 1 fi # 2. 解压 tar -zxvf node_exporter-1.8.2.linux-amd64.tar.gz mv node_exporter-1.8.2.linux-amd64 /usr/local/node_exporter # 3. 创建 systemd 服务 cat > /usr/lib/systemd/system/node_exporter.service << EOF [Unit] Description=node_exporter After=network.target [Service] User=root ExecStart=/usr/local/node_exporter/node_exporter Restart=on-failure [Install] WantedBy=multi-user.target EOF # 4. 加载服务并开机自启 systemctl daemon-reload systemctl enable node_exporter systemctl start node_exporter # 5. 判断启动结果 sleep 1 if systemctl is-active node_exporter | grep -q active; then echo -e "\033[32m node_exporter 安装启动成功 \033[0m" else echo -e "\033[31m node_exporter 安装启动失败 \033[0m" fi reboot