#!/bin/bash
#
#usage:系统初始化安装设置

#关闭防火墙、selinux
cat <<EOF
系统初始化包括：
1、关闭防火墙selinux；
2、更换yum源，安装epel源；
3、安装基本命令
4、内核调优
5、同步时间
6、更改主机名称
7、配置登录用户
8、禁止root用户远程登录
9、更改端口
EOF

echo "是否继续 [y/n]"
while read con;do
if [ "$con" = "y" ] || [ "$con" = "" ];then
    echo "系统初始化现在开始"
    sleep 2
    break
elif [ "$con" = "n" ];then
    echo "现在退出系统初始化"
    sleep 2
    exit 10
else
    echo "输入错误，请输入y或n"
fi
done

fire(){
systemctl disable --now firewalld  
sed -in 's/^SELINUX=.*$/SELINUX=disabled/g' /etc/selinux/config  
}

#更换阿里yum源、安装epel源
Base(){
rm -rf /etc/yum.repos.d/*  
curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-7.repo
yum -y install epel-release  
yum -y remove epel-release  
yum -y install epel-release  
}

#安装lsof、httpd、vim、ifconfig、wget、iostat、net-tools、telnet、openssl-devel、ntpdate
inst(){
yum -y install lsof  
yum -y install httpd  
yum -y install vim  
yum -y install ntpdate
yum -y install htop iotop sysstat-10.1.5-19.el7.x86_64 telnet 
yum -y install net-tools.x86_64  
yum -y install lrzsz-0.12.20-36.el7.x86_64
yum -y install wget
}

#系统调优
#设置好系统最大文件打开数65535
sysctl(){
cat > /etc/security/limits.conf <<EOF
* soft nofile 65535
* hard nofile 65535
EOF

#设置好常用的内核调优参数
cat > /etc/sysctl.conf <<EOF
fs.file-max = 6815744
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30

net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 10000 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000
EOF
#sysctl -p
echo "参数配置完成，请重启后生效"
sleep 3


#历史命令显示时间HISTTIMEFORMAT="%T %F $(whoame)"
export HISTTIMEFORMAT="%F %T"

#禁止定时发送邮件MAILTO
echo "unset MAILCHECK" >> /etc/profile
source /etc/profile
}

#SSH链接调优、并设置超过五分钟没有动作自动断开,echo “TMOUT=300” >> /etc/profile
#echo "TMOUT=300" >> /etc/profile

#校正时间
ntp_time(){
ntpdate cn.pool.ntp.org
if [ $? -eq 0 ];then
  echo "successful" 
fi
}

echo "是否关闭防火墙及selinux [y/n]"
while read A;do
  if [ "$A" = "y" ] || [ "$A" = "" ];then
    fire
    break
  elif [ "$A" = "n" ];then
   :
   break
  else 
     echo "输入错误，请输入y或n"
  fi
done

echo "是否更换国内源，安装epel源 [y/n]"
while read B;do
    if [ "$B" = "y" ] || [ "$B" = "" ];then
      Base
      break
    elif [ "$B" = "n" ];then
       :
       break
    else
       echo "输入错误，请输入y或n"
    fi
done

echo "是否安装命令 [y/n]"
while read C;do
    if [ "$C" = "y" ] || [ "$C" = "" ];then
       inst
       break
    elif [ "$C" = "n" ];then
       :
       break
    else
       echo "输入错误，请输入y或n"
    fi
done

echo "是否进行系统参数调优:内核调优、历史命令显示时间、禁止定时发送邮件 [y/n]"
while read D;do
    if [ "$D" = "y" ] || [ "$D" = "" ];then
       sysctl
       break
    elif [ "$D" = "n" ];then
        :
        break
    else
       echo "输入错误，请输入y或n"
    fi
done

echo "是否校正时间 [y/n]"
while read E;do
    if [ "$E" = "y" ] || [ "$E" = "" ];then
       ntp_time
       break
    elif [ "$E" = "n" ];then
       :
       break
    else
       echo "输入错误，请输入y或n"
    fi
done

#修改系统名称
sys_name(){
echo "请输入系统名称"
read AA
hostnamectl set-hostname $AA
}

#创立用户并提权
user_name(){ 
echo "请输入用户名称"
while read BB;do 
us_na=`grep -w "$BB" /etc/passwd  | awk -F":" '{print $1}'`
  if [ "$BB" = "" ];then
    echo "值为空，请重新输入"
  elif [ "$BB" = "$us_na" ];then
    echo "用户已存在"
  else
    useradd $BB
    break
    fi
done
echo  "请输入密码"
while read -s CC;do
  echo -e "\n请重新输入密码"
  read -s PP
  if [ "$CC" != "$PP" ];then
    echo -e "\n两次密码不一致"
    echo -e "\n请输入密码"
  else
    echo $CC | passwd --stdin $BB
    echo  "密码设置成功"
    break
  fi
done

echo "是否提权 [y/n]]"
while read EE;do
sudoerfile="/etc/sudoers.d/$BB"
    if [ "$EE" = "" ] ||  [ "$EE" = "y" ];then
       echo "$BB        ALL=(ALL)       NOPASSWD: ALL" >> $sudoerfile
       break
    elif [ "$E" = "n" ];then
        :
       break
    else
       echo "输入错误，请输入y或n"
    fi
done
}

#禁止root远程登录
Permit_root(){
sshdfile="/etc/ssh/sshd_config"
sed -i "s/^#PermitRootLogin yes/PermitRootLogin no/g"  $sshdfile
systemctl restart sshd
}

#修改端口
PORT(){
sshdfile="/etc/ssh/sshd_config"
echo "请输入端口号"
while read DD;do
  n1=`echo $DD | sed 's/[0-9]//g'`
  port_num=`netstat -antp | awk -F" " '{print $4}' | grep -wc ${DD}`
  if [ ! -z $n1 ];then
    echo "格式不正确，请重新输入"
  elif [ "$DD" = "" ];then
    echo "值为空，请重新输入"
  elif [  "$DD" -lt 1  ] || [  "$DD" -gt 65535 ];then
    echo "输入的端口号不在范围内"
  elif [  "$port_num" -gt 0 ];then
    echo "端口已被占用"
  else
    sed  -i "s/^#Port.*$/Port $DD/g" $sshdfile
    break
  fi
done
}

echo "是否进行用户、系统名称、端口设置 [y/n]"
read F 
if [ "$F" = "y" ] || [ "$F" = "" ];then
   :
else
   echo "退出初始化设置"
   sleep 2
   exit 10
fi

echo "是否修改系统名称 [y/n]"
read G
if [ "$G" = "y" ] || [ "$G" = "" ];then
   sys_name
fi

echo "是否创建用户 [y/n]"
read H
if [ "$H" = "y" ] || [ "$H" = "" ];then
   user_name
else
   :
fi

echo "是否禁止root远程登录 [y/n]"
read J
if [ "$J" = "y" ] || [ "$J" = "" ];then
   Permit_root
else 
   :
fi

echo "是否修改端口号 [y/n]"
read K
if [ "$K" = "y" ] || [ "$K" = "" ];then
   PORT
else
   :
fi

echo "配置已完成，是否重启系统 [y/n]"
read L
if [ "$L" = "y" ] || [ "$L" = "" ];then
   echo "现在重启系统"
   sleep 5
   reboot
else
   echo "系统初始化已完成"
fi

