步骤一:设置最大 PID 数
# vi /etc/sysctl.conf
添加以下内容:
......
kernel.pid_max=102400
(补充:这里以把 PID 数设置成 102400 为例)
步骤二:让修改的 /etc/sysctl.conf 文件生效
# sysctl -p /etc/sysctl.conf
# vi /etc/sysctl.conf
添加以下内容:
......
kernel.pid_max=102400
(补充:这里以把 PID 数设置成 102400 为例)
# sysctl -p /etc/sysctl.conf
某些服务没有开机自启例如 NetworkManager.service
在系统日志里可以类似 …… Job network.target/start deleted to break ordering cycle starting with …… 报错例如:
# cat /var/log/messages
Jan 1 10:09:24 server systemd[1]: network-online.target: Found ordering cycle on network.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on NetworkManager.service/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on basic.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on slices.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on mysql.slice/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on remote-fs.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on remote-fs-pre.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on iscsi.service/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Found dependency on network-online.target/start
Jan 1 10:09:24 server systemd[1]: network-online.target: Job network.target/start deleted to break ordering cycle starting with network-online.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found ordering cycle on NetworkManager.service/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on basic.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on slices.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on mysql.slice/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on remote-fs.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on remote-fs-pre.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on iscsi.service/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on network-online.target/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Found dependency on NetworkManager-wait-online.service/start
Jan 1 10:09:24 server systemd[1]: NetworkManager-wait-online.service: Job NetworkManager.service/start deleted to break ordering cycle starting with NetworkManager-wait-online.service/start
从案例中日志里的内容可以判断:
1) network.target/NetworkManager.service 启动
2) NetworkManager.service 作为基础服务依赖 basic.target
3) basic.target 依赖所有 slice 包括 mysql.slice
4) mysql.slice 依赖 iscsi.service/remote-fs.target/remote-fs-pre.target
5) iscsi.service/remote-fs.target/remote-fs-pre.target 依赖 network.target/NetworkManager.service
6) 系统为了防止启动时陷入死循环,systemd 报错 Job NetworkManager.service/start deleted to break ordering cycle 并放弃启动 NetworkManager.service
取消不太重要的服务的依赖要求
# vi /etc/systemd/system/mysql.slice
将以下内容:
......
Before=slices.target
Wants=-.slice
After=-.slice remote-fs.target
......
修改为:
......
Before=slices.target
Wants=-.slice
After=-.slice remote-fs.target
......
(补充:这里以取消使用 /etc/systemd/system/mysql.slice 文件的服务的依赖要求为例)
/init: error while loading shared libraries: libsystemd-shared-239.so: cannot open shared object file: No such file or directory
kernel panic - no syncing: Attempted to kill init! exitcode=0x00007f00
# ldconfig -p > /tmp/ldconfig.out
# for l in $(awk '{ print $1 }' /tmp/ldconfig.out); do matches=$(awk "\$1 == \"$l\" { print }" /tmp/ldconfig.out); if [ $(echo "$matches" | wc -l) -ge 2 ]; then echo "$matches"; echo; fi; done
(补充:如果没有第三方软件库的话这里不会有任何输出)
(步骤略)
# ldconfig
# dracut -f /boot/initramfs-(uname -r).img $(uname -r)
(补充:这里以将正在运行的内核版本生成一个新的 initramfs 为例)
(注意:此时原来启动系统时使用的那个 initramfs 文件会被覆盖)
# reboot
https://access.redhat.com/solutions/7096246
# vi /etc/ld.so.conf
或者:
# vi /etc/ld.so.conf.d/*.conf
添加以下内容:
......
/root/lib
(补充:这里以添加位于目录 /root/lib 的库为例)
(注意:这里的 /etc/ld.so.conf.d/*.conf 是指 /etc/ld.so.conf.d/ 目录下任意以 .conf 结尾的文件,例如 /etc/ld.so.conf.d/one.conf)
# cp /boot/initramfs-4.18.0-553.89.1.el8_10.x86_64.img /boot/initramfs-4.18.0-553.89.1.el8_10.x86_64.img.backup
(
补充:
1) 这里以将:/boot/initramfs-4.18.0-553.89.1.el8_10.x86_64.img 备份为:/boot/initramfs-4.18.0-553.89.1.el8_10.x86_64.img.backup 为例
2) initramfs 是压缩的 cpis 文件,是临时的根文件系统包含一些脚本、程序和配置文件,在 Linux 启动过程中被加载在内存里,负责 Linux 操作系统在挂载根目录前加载内核模块、检查硬件、加载驱动以及挂载真正的根文件系统等)
# dracut -f /boot/initramfs-(uname -r).img $(uname -r)
(补充:这里以将正在运行的内核版本生成一个新的 initramfs 为例)
(注意:此时原来启动系统时使用的那个 initramfs 文件会被覆盖)
# reboot
# ldconfig -p -M -X | grep out
(
补充:
1) 这里的 -N 和 -X 必须一起使用,作用是不更新相关链接和不重建相关缓存
2) 这里的 -p 作用是打印现在在缓存中的相关目录和相关候选库
3) 这条命令会显示目前在缓存中的第三方库
)
# for l in $(ldconfig -p -N -X | awk '{ print $1 }') ; do matches=$(ldconfig -p -N -X | awk "\$1 == \"$l\" { print }"); if [ $(echo "$matches" | wc -l) -ge 2 ]; then echo "$matches"; echo; fi; done |wc -l
(补充:如果加载的库中没有重复的则这里不会有任何输出结果)
# vim /etc/ssh/sshd_config
确保部分内容如下:
......
Include /etc/ssh/sshd_config.d/*.conf
......
Include /usr/etc/ssh/sshd_config.d/*.conf
......
# vim /etc/ssh/sshd_config.d/*.conf
或者:
# vim /usr/etc/ssh/sshd_config.d/*.conf
确保部分内容如下:
......
Include /etc/crypto-policies/back-ends/opensshserver.config
......
# cp /etc/crypto-policies/back-ends/opensshserver.config /etc/crypto-policies/back-ends/opensshserver.config.backup
# vim /etc/crypto-policies/back-ends/opensshserver.config
添加需要使用的 SSH 算法 (algorithms) 和加密方式 (ciphers):
(内容略)
(注意:如果需要使用的 SSH 加密方式 (cipher) 、信息验证代码 (message authentication code) 和算法 (algorithm) ,已包含在其中了则可以不用添加)
# cat /etc/crypto-policies/back-ends/opensshserver.config
Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512
GSSAPIKexAlgorithms gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-
KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com
CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512
RequiredRSASize 2048
(补充:这里以显示 openSUSE & SLES 默认使用的 SSH 加密方式 (cipher)、信息验证代码 (message authentication code) 和算法 (algorithm) 为例)
# systemctl restart sshd
# ssh -vv -oCiphers=3des-cbc -oPort=22 192.168.0.1
(补充:这里以测试 IP 地址是 192.168.0.1,端口号是 22,有没有启用 3des-cbc SSH 加密方式 (cipher) 为例)
# ssh -vv -oCiphers=3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc -oPort=22 192.168.0.1
(补充:这里以测试 IP 地址是 192.168.0.1,端口号是 22,有没有启用 3des-cbc、aes128-cbc、aes192-cbc 和 aes256-cbc SSH 加密方式 (cipher) 为例)
# ssh -vv -oMACs=hmac-md5 -oPort=22 192.168.0.1
(补充:这里以测试 IP 地址是 192.168.0.1,端口号是 22,有没有启用 hmac-md5 SSH 信息验证代码 (message authentication code) 为例)
# ssh -vv -oMACs=hmac-md5,hmac-md5-96,hmac-sha1,hmac-sha1-96,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com -oPort=22 192.168.0.1
(补充:这里以测试 IP 地址是 192.168.0.1,端口号是 22,有没有启用 hmac-md5、hmac-md5-96、hmac-sha1、hmac-sha1-96、hmac-md5-etm@openssh.com 和 hmac-md5-96-etm@openssh.com SSH 信息验证代码 (message authentication code) 为例)
# sshd -T | egrep -i "ciphers|macs|kexalgorithms"
# nmap --script ssh2-enum-algos -sV -p 22 127.0.0.1
(补充:这里以测试本地的 22 端口为例)
# ssh -vvv 127.0.0.1
(补充:这里以测试本地的 22 端口为例)