使用Sysctl保护和强化CentOS 7内核

• 介绍
• 指令
• 固定和加固内核
• 结论

介绍

Sysctl用户无需重新构建内核就可以微调内核。它还会立即应用更改，因此不必重新引导服务器即可使更改生效。本教程提供了简短的介绍sysctl并演示了如何使用它来调整Linux内核的特定部分。

指令

要开始使用sysctl，请查看下面列出的参数和示例。

参量

-a：这将显示sysctl配置中当前可用的所有值。

-A：这将以表格形式显示sysctl配置中当前可用的所有值。

-e：此选项将忽略有关未知密钥的错误。

-p：用于加载特定的sysctl配置，默认情况下它将使用/etc/sysctl.conf

-n：此选项将在打印出值时禁用显示键名。

-w：此选项用于按需更改（或添加）sysctl的值。

例子

$ sysctl -a
$ sysctl -n fs.file-max
$ sysctl -w fs.file-max=2097152
$ sysctl -p

因此，首先我们要检查默认值。如果您/etc/sysctl.conf为空，它将显示所有默认键和值。其次，我们要检查fs.file-maxis 的值，然后将新值设置为2097152。最后，我们正在加载新的/etc/sysctl.conf配置文件。

如果您正在寻找其他帮助，可以使用man sysctl。

固定和加固内核

为了使更改永久生效，我们将不得不将这些值添加到配置文件中。使用CentOS默认提供的配置文件/etc/sysctl.conf。

用您喜欢的编辑器打开文件。

默认情况下，您应该会看到类似的内容。

# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).

让我们首先改善系统内存管理。

我们将尽量减少需要做的交换数量，增加文件句柄和inode缓存的大小，并限制核心转储。

# Minimizing the amount of swapping
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5

# Increases the size of file handles and inode cache & restricts core dumps
fs.file-max = 2097152
fs.suid_dumpable = 0

接下来，让我们调整网络的优化性能。

我们将更改传入连接和待办事项的数量，增加最大内存缓冲区数量，并增加默认和最大发送/接收缓冲区。

# Change the amount of incoming connections and incoming connections backlog
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 262144

# Increase the maximum amount of memory buffers
net.core.optmem_max = 25165824

# Increase the default and maximum send/receive buffers
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864

最后，我们将改善常规网络安全性。

我们将启用TCP SYN cookie保护，IP欺骗保护，忽略ICMP请求，忽略广播请求以及记录到欺骗数据包，源路由数据包和重定向数据包。除此之外，我们将禁用IP源路由和ICMP重定向接受。

# Enable TCP SYN cookie protection
net.ipv4.tcp_syncookies = 1

# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter = 1

# Enable ignoring to ICMP requests and broadcasts request
net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable logging of spoofed packets, source routed packets and redirect packets
net.ipv4.conf.all.log_martians = 1

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0

# Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects = 0

保存并关闭文件，然后使用sysctl -p命令加载文件。

结论

最后，您的文件应与此类似。

# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).

# Minimizing the amount of swapping
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5

# Increases the size of file handles and inode cache & restricts core dumps
fs.file-max = 2097152
fs.suid_dumpable = 0

# Change the amount of incoming connections and incoming connections backlog
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 262144

# Increase the maximum amount of memory buffers
net.core.optmem_max = 25165824

# Increase the default and maximum send/receive buffers
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864

# Enable TCP SYN cookie protection
net.ipv4.tcp_syncookies = 1

# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter = 1

# Enable ignoring to ICMP requests and broadcasts request
net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable logging of spoofed packets, source routed packets and redirect packets
net.ipv4.conf.all.log_martians = 1

# Disable IP source routing
net.ipv4.conf.all.accept_source_route = 0

# Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects = 0