邹可见

                                       LINUX系统安装规范

                                         V1.0 2006-xx-14
一、安装
准备工作：获取下列信息：交换分区的大小；IP地址，掩码，网关；boot loader 口令，root 口令；
1. 分区：    /boot: 100M
                 Swap: 假设RAM 为 m G, IF m =1 THEN swap = 2G ELSE swap = mG END
                 /:   2G
                 /usr:   6G
                 /var:   2G
                 /home   2G
                 /tmp   2G
                 /opt:   所有剩余空间
2. 设置 boot loader password： 参考《XX LINUX主机安全规范》
3. 配置静态IP, Gateway, DNS Server, hostname
4. 防火墙：No Firewall; Enable SELinux? Active
5. 语言：English(USA), Chinese(P.R. of China)
6. 时区：Asia/Shanghai                                    
7. root 口令：参考《XX LINUX主机安全规范》;
8. 软件包： X Window System, GNOME Desktop Environment;
                     Editors;
                     Text Internet; 
                     Development Tools, X Software Development, Legacy Software Development 
                     Administration Tools, System Tools(net-snmp-utils, sysstat, iptraf)
二. 配置
1. 初始配置：RedHat Login：选择Tell my why…
              Why Register?：选择 …. Remind me later.
              System User：不建立任何系统用户.
  2．配置内核启动参数：位置：/boot/group/grub.conf 的 kernel 行
              DB服务器：elevator=deadline
              WEB 服务器：elevator=as
              服务器有很好的RAID卡：elevator=noop
              其它情况：使用RHEL4的默认配置(elevator=cfq)
  3． 建立并进入/opt/software目录，从 ftp://software.xx.com/software 下载 host.tgz 包, 解压, 进入host目录

4．配置默认运行级别：3

5．配置时间同步：a. 每天5:10 AM跟时间服务器172.16.0.60作一次同步

                          b. 该配置在“配置cron”部分完成

6．配置/etc/hosts 文件：   a. 配置：#install config/hosts /etc/hosts

                                             b. 验证：#cat /etc/hosts

                                            127.0.0.1                 localhost.localdomain       localhost

                                            x.x.x.x                      loghost.xx.com                 loghost

                                            x.x.x.x                      software.xx.com               software

                                            x.x.x.x                      backcenter.xx.com            backcenter

7．配置内核参数：a. 配置：#install config/sysctl.conf /etc/sysctl.conf; sysctl -p

                                  b. 验证：#sysctl –p
                                                  net.ipv4.ip_forward = 0
                                                  net.ipv4.tcp_syncookies = 1
                                                  net.ipv4.conf.all.rp_filter = 1
                                                  net.ipv4.conf.all.accept_source_route = 0
                                                  net.ipv4.conf.all.accept_redirects = 0
                                                  net.ipv4.tcp_keepalive_time = 1800
                                                  net.ipv4.tcp_timestamps = 0
                                                  net.ipv4.tcp_fin_timeout = 30 
                                                  net.ipv4.tcp_window_scaling = 1
                                                  net.ipv4.tcp_sack = 0
                                                  net.ipv4.tcp_max_syn_backlog = 1280
                                                  net.ipv4.tcp_synack_retries = 2
                                                  net.ipv4.tcp_syn_retries = 3
                                                  net.ipv4.icmp_echo_ignore_broadcasts = 1
                                                  net.ipv4.icmp_ignore_bogus_error_responses = 1 
                                                  net.ipv4.ip_local_port_range = 32768 61000
                                                  kernel.sysrq = 0
                                                  kernel.core_uses_pid = 1
                                                  kernel.ctrl-alt-del = 1
8. 配置系统日志：a.. 系统日志集中存放到主机loghost上; 本地保存4周的日志备份
                                b. 配置：运行脚本script/config_log.sh 
                                c. 验证： #cat /etc/syslog.conf 
                                              *.=emerg                                 *
                                              *.=emerg                                 /var/log/emergent.log
                                              *.=crit;kern.none                             /var/log/critical.log
                                              kern.*                                   /var/log/kernel.log
                                              authpriv.*                   /var/log/secure.log
                                              mail.*                                   /var/log/mail.log 
                                              cron.*                                   /var/log/cron.log
                                              local7.*                                 /var/log/boot.log
                                              *.info;mail.none;authpriv.none;cron.none   /var/log/messages
                                              *.info                                   @loghost
                                            

                                             #cat /etc/logrotate.d/syslog 
                                             /var/log/emergent.log /var/log/critical.log /var/log/kernel.log 
                                              /var/log/secure.log /var/log/mail.log /var/log/cron.log 
                                               /var/log/boot.log /var/log/messages { 
                                                sharedscripts

                                                  postrotate

                                                  /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

                                               endscript

}

9. 脚本：1). 目录结构：/opt/script/prod: 存放经过严格测试的(在使用中的)脚本

                                 /opt/script/test: 编写，测试脚本的地方
                                 /opt/script/temp: 存放脚本的临时文件的地方
                                /opt/script/data: 存放脚本的永久性数据的地方
                2). 基准脚本：backup.sh       备份脚本 
                                   monitor_ cpu_mem.sh 监控单个系统进程对CPU和内存使用情况的脚本
                                   app_log_dealwith.sh   处理应用程序日志的脚本
                3). 运行脚本 script/config_script.sh
10. 应用程序：1). 原则：a. 所有应用程序都装到/opt目录下
                                   b. 在/opt下建立目录software，存放需要安装的软件，并在此目录下安装软件 
                     2). JAVA: a. JAVA_HOME= /opt/java/jdk/jdk-<version> 
                                    b. 运行脚本: script/install_jdk.sh 完成本步骤的安装
3). MySQL: a. MYSQL_HOME= /opt/mysql-<version>
                  b. 数据文件目录：$MYSQL_HOME/data
                  c. 日志文件目录：$MYSQL_HOME/log
                  d. 配置文件：将定制的配置文件config/my.conf 拷贝到/etc/下
                  e. 用户：mysql

                  f. 编译选项： --prefix=$MYSQL_HOME

                                     --sysconfdir=/etc

                                     --localstatedir=$MYSQL_HOME/data

                                     --with-mysqld-user=mysql

                                     --enable-largefile

                                     --with-charset=gb2312

                                     --with-extra-charsets=gbk,utf8

                  h. 自动启动脚本：使用MySQL自带的脚本mysql.server，将其拷贝

为/etc/init.d/mysql

                     c. 模块：authn-basic authn-default authn-file authz-default authz-host

                                 authz-groupfile authz-user access dir env http log-config mime

                                 setenvif status cache disk-cache expires file-cache

                                 headers logio mem-cache mime-magic rewrite so worker

                                 (httpd –l 可以验证安装了那些模块)