CentOS 7 最小化安裝後初始化配置標準化手冊：網絡、YUM 源、內核參數、時間同步

CentOS 7 最小化安裝 (Minimal Install) 缺乏圖形界面、基礎工具、優化內核參數，直接上線屬裸奔。本文提供可直接執行的 Ansible 化初始化清單，覆蓋網絡、軟件源、內核、時間、安全、監控六大維度。

1. 網絡配置 (nmcli 推薦，兼容傳統 ifcfg)

# 查看設備
nmcli device status
# 假設 ens192 為管理網卡

# 靜態 IP 配置
nmcli connection modify ens192 \
  ipv4.method manual \
  ipv4.addresses 192.168.4.64/24 \
  ipv4.gateway 192.168.4.254 \
  ipv4.dns "202.101.172.47 202.101.172.35 221.12.1.228" \
  ipv4.dns-search "corp.local" \
  connection.autoconnect yes

# 重載生效
nmcli connection up ens192

# 驗證
ip addr show ens192
ping -c 3 192.168.4.254
dig @202.101.172.47 www.baidu.com

2. YUM 源優化：阿里云/清華源 + fastestmirror

# 備份官方源
mkdir -p /etc/yum.repos.d/backup
mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/backup/

# 獲取阿里云 CentOS 7 源
curl -o /etc/yum.repos.d/CentOS-Base.repo \
  https://mirrors.aliyun.com/repo/CentOS-7.repo

# 安裝 fastestmirror 插件 (自動選最快鏡像)
yum -y install yum-plugin-fastestmirror

# 清理緩存並重建
yum clean all
yum makecache fast

# 可選：EPEL 源
yum -y install epel-release
sed -i 's|^metalink=|#metalink=|' /etc/yum.repos.d/epel.repo
sed -i 's|^#baseurl=|baseurl=|' /etc/yum.repos.d/epel.repo
sed -i 's|https://download.fedoraproject.org/pub|https://mirrors.aliyun.com|g' /etc/yum.repos.d/epel.repo

3. 系統更新與基礎工具包

# 全量更新 (含內核)
yum -y update

# 基礎工具集
yum -y install \
  vim-enhanced net-tools lsof tcpdump strace sysstat \
  wget curl tar zip unzip bzip2 xz \
  tree htop iftop iotop \
  git bash-completion \
  psmisc lrzsz \
  bind-utils telnet nc nmap-ncat \
  yum-utils device-mapper-persistent-data lvm2

4. 內核參數優化 (/etc/sysctl.d/99-sysctl.conf)

cat > /etc/sysctl.d/99-sysctl.conf <<'EOF'
# 連接追蹤表擴容 (高併發必調)
net.netfilter.nf_conntrack_max = 1000000
net.nf_conntrack_max = 1000000

# TCP 優化
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_max_tw_buckets = 200000
net.ipv4.tcp_fastopen = 3
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535

# 文件描述符
fs.file-max = 1000000
fs.nr_open = 1000000

# 內存過度提交 (適配 Java/Redis)
vm.overcommit_memory = 1
vm.swappiness = 10

# 禁用 IPv6 (純 IPv4 環境)
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
EOF

# 生效
sysctl --system

5. 時間同步 (chrony 替代 ntp)

yum -y install chrony
cat > /etc/chrony.conf <<'EOF'
server ntp.aliyun.com iburst
server ntp1.aliyun.com iburst
server ntp2.aliyun.com iburst
server ntp3.aliyun.com iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony
EOF

systemctl enable chronyd
systemctl restart chronyd
chronyc sources -v
chronyc tracking

6. 安全基線

# SSH 硬化
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#\?Port 22/Port 2222/' /etc/ssh/sshd_config  # 非常用端口
systemctl reload sshd

# 防火牆 (firewalld) 基礎規則
systemctl enable firewalld
systemctl start firewalld
firewall-cmd --permanent --add-port=2222/tcp  # SSH
firewall-cmd --permanent --add-service=http --add-service=https
firewall-cmd --reload

# SELinux 保持 Enforcing (配合應用策略)
# getenforce 確認

7. 限制配置 (/etc/security/limits.d/99-limits.conf)

cat > /etc/security/limits.d/99-limits.conf <<'EOF'
* soft nofile 1000000
* hard nofile 1000000
* soft nproc 1000000
* hard nproc 1000000
root soft nofile 1000000
root hard nofile 1000000
EOF

8. 歷史命令加時間戳與審計

cat > /etc/profile.d/history.sh <<'EOF'
export HISTTIMEFORMAT="%F %T $(whoami) "
export HISTSIZE=10000
export HISTFILESIZE=10000
export HISTCONTROL=ignoredups:ignorespace
shopt -s histappend
PROMPT_COMMAND="history -a"
EOF
chmod +x /etc/profile.d/history.sh
source /etc/profile

驗證清單

• ip a IP/掩碼/網關正確
• yum repolist 顯示 aliyun/epel 源
• sysctl -a | grep tcp_max_syn_backlog 參數生效
• chronyc tracking Leap status: Normal, RMS offset < 10ms
• ssh -p 2222 user@server 金鑰登錄成功
• ulimit -n 輸出 1000000
• history 顯示時間戳

將上述步驟封裝為 Ansible Role common/bootstrap，新機器入庫執行 ansible-playbook site.yml -l new_host 實現 5 分鐘交付生產基線。