FREEBSD升级及优化全攻略(1)

FREEBSD系统是一种非常 UNIX、非常 Free、非常 BSD -- UNIX 的操作系统,因为它过UNIX化,太过专业化了,教很多新手无从下手学习本文的目的是使新手可以根据此文章的步骤和方法,架设一台专业,高效,安全的FREEBSD出来,并且可以立即投入实际运用,故文章中对运用及命令的使用多于理论化的知识点的描述,如果您不明白命令有何作用,建议您查查相关资料.

本文假设已经架设好或者新安装了一台FREEBSD系统主机. 本文中引用了很多FREEBSD官方站数据及网上数据,还有更多的是自己在实际工作中的经验,当然,里面的参数并不一定完全适合您,所以请您在使用时,尽可能根据您的实际需要调整一些参数,使您的SERVER的性能完全的发挥出来.本文只是一个总的线索,如果我要拆开来一个一个详细解释,我想会花更多的篇幅来写的,因为我忙着04年1月的自考,只写了实际中的运作情况,请各位朋友见谅.

升级源码树安装cvsup进入:/usr/ports/net/cvsupmake cleanmake deinstallmake installmake clean即可升级系统源码树及ports

更新/usr/share/examples/cvsup目录下stand-cvsup和ports-cvsup文件,并执行cvsup –g –L2 standard-supfile和cvsup –g –L2 ports-cvsup两个文件,升级ports树﹔

重新编译内核

优化编译环境更新/etc/make.conf文件,做适当的编译优化,我的CPU是Intel的:CPUTYPE=i686CFLAGS= -O3 -pipeCOPTFLAGS= -O3 -pipe升级操作系统进入/usr/src执行make world整个过程很久,需要2小时左右.升级配置文件

执行mergemaster升级配置文件,在此过程中,需要按i以便系统执行升级﹔

重新编译内核

到/sys/i386/conf里面,cp GENERIC onlinecq,再vi onlinecq优化内核,注意加入下面的内容#disable ctrl+alt+deleteoptions SC_DISABLE_REBOOT#quota limitoptions QUOTA#ipfw supportoptions IPFIREWALLoptions DUMMYNEToptions HZ=3000options IPDIVERToptions IPFIREWALL_VERBOSEoptions IPFIREWALL_VERBOSE_LIMIT=100options IPSTEALTHoptions TCP_DROP_SYNFINoptions IPFIREWALL_DEFAULT_TO_ACCEPToptions ICMP_BANDLIMoptions ACCEPT_FILTER_DATAoptions ACCEPT_FILTER_HTTP#ipfilter support#options IPFILTER#options IPFILTER_LOG#options IPFILTER_DEFAULT_BLOCK再执行:/usr/sbin/config onlinecqcd ../../compile/onlinecqmake dependmakemake install重新启动服务器到此为止,服务器操作系统及内核升级成功reboot优化FREEBSD

检查升级情况, 使用ssh进入系统,使用uname –a 可以查到是否升级成功﹔

打开防火墙更新rc.conf里面的设置,加上:#enable_quotas="YES"#check_quotas="YES"firewall_enable="YES"firewall_script="/etc/rc.firewall"firewall_type="/etc/ipfw.rules" #create it!firewall_quiet="NO"firewall_logging_enable="YES"log_in_vain="NO"tcp_drop_synfin="NO"tcp_restrict_rst="YES"icmp_drop_redirect="YES"优化内核参数

修改系统内核参数,实现微调:vi /etc/sysctl.confkern.ipc.somaxconn=8192kern.ipc.maxsockbuf=2097152kern.maxfilesperproc=32768kern.maxfiles=65536kern.securelevel=-1net.inet.tcp.sendspace=65536net.inet.tcp.recvspace=32768net.inet.udp.maxdgram=57344net.inet.icmp.drop_redirect=1net.inet.icmp.log_redirect=0net.inet.ip.redirect=0net.inet6.ip6.redirect=0net.inet.icmp.icmplim=100net.inet.tcp.always_keepalive=0net.inet.tcp.delayed_ack=0net.inet.tcp.log_in_vain=0net.inet.udp.log_in_vain=0net.inet.tcp.blackhole=2net.inet.udp.blackhole=1net.local.stream.sendspace=65535net.local.stream.recvspace=32768net.inet.ip.fastforwarding=1vfs.vmiodirenable=1安装防火墙

防火墙在上面已经编译入了内核,并且在上面的rc.conf里面已经打开了,所以在此只要设置一下即可! 允许所有IP通过,免得把自己给挡在外面了. ipfw add all from any to any 其它规则根据实际情况来做,如果您想系统每次启动都使用上一次的规则,可以把这些内容加到: vi /etc/ipfw.rules 里面,语法规则同ipfw.

安装数据库MYSQL安装mysql40-server和mysql40-client进入/usr/ports/databases/mysql40-server执行:make cleanmake deinstallmake WITH_OPENSSL=yes WITH_LINUXTHREADS=yes BUILD_OPTIMIZED=yes install或者使用下面可参考的编译参数:BUILD_STATIC=yes编译成静态执行版本make clean更改mysql的root密码:mysqladmin –uroot –p password 123456生成/etc/my.cnf,使用如下命令:vi /etc/my.cnf[client]#password = your_passwordport = 3306socket = /tmp/mysql.sock[mysqld]skip-innodbskip-lockingskip-networkingset-variable = port=3306set-variable = socket=/tmp/mysql.sockset-variable = back_log=50set-variable = connect_timeout=3set-variable = key_buffer=128Mset-variable = max_connections=1000set-variable = max_allowed_packet=1Mset-variable = net_buffer_length=8Kset-variable = wait_timeout=3set-variable = read_buffer_size=1Mset-variable = sort_buffer_size=1Mset-variable = table_cache=256set-variable = myisam_sort_buffer_size=32Mset-variable = log_slow_queries=/var/log/log_slow_queries.log#log-binserver-id = 1[mysqldump]quickset-variable = max_allowed_packet=16M[mysql]no-auto-rehash# Remove the next comment character if you are not familiar with SQL#safe-updates[isamchk]set-variable = key_buffer=20Mset-variable = sort_buffer=20Mset-variable = read_buffer=2Mset-variable = write_buffer=2M[myisamchk]set-variable = key_buffer=20Mset-variable = sort_buffer=20Mset-variable = read_buffer=2Mset-variable = write_buffer=2M[mysqlhotcopy]interactive-timeout安装phpmyadmin注意,此步骤需要在apache和php之后再执行进入/usr/ports/databases/phpmyadmin执行:make cleanmake deinstallmake installmake clean新建立一个system的数据库备用.安装FTP服务器安装ftp软件(使用pure-ftpd/)进入/usr/ports/ftp/pufe-ftpd执行:make cleanmake deinstallmake WITH_MYSQL=1 install或者使用下面可参考的编译参数:WITH_LANG=simplified-chinese使用简体中文语言包make clean配置pure-ftpd,主要需要做以下的工作:cp /usr/local/etc/pure-ftpd.conf.sample /usr/local/etc/pure-ftpd.confcp /usr/local/etc/pureftpd-mysql.conf.sample /usr/local/etc/pureftpd-mysql.conf再修改/usr/local/etc/pure-ftpd.conf的如下部份为:NoAnonymous yesMySQLConfigFile /usr/local/etc/pureftpd-mysql.conf再修改/usr/local/etc/pureftpd-mysql.conf的如下部份为您的设定值:# Mandatory : user to bind the server as.MYSQLUser demo# Mandatory : user password. You must have a password.MYSQLPassword demo# Mandatory : database to open.MYSQLDatabase demo再进入使用mysql –uroot –p123456 进入mysql的文本方式﹔使用如下命令建立新表:use system;DROP TABLE IF EXISTS users;CREATE TABLE users (User varchar(16) NOT NULL default '',status enum('0','1') NOT NULL default '0',Password varchar(64) NOT NULL default '',Uid varchar(11) NOT NULL default '-1',Gid varchar(11) NOT NULL default '-1',Dir varchar(128) NOT NULL default '',ULBandwidth smallint(5) NOT NULL default '0',DLBandwidth smallint(5) NOT NULL default '0',comment tinytext NOT NULL,ipaccess varchar(15) NOT NULL default '*',QuotaSize smallint(5) NOT NULL default '0',QuotaFiles int(11) NOT NULL default 0,PRIMARY KEY (User),UNIQUE KEY User (User)) TYPE=MyISAM;安装pureftpd_php_manager下载pureftpd_php_manager.zip解压并放到指定的目录里面,比如:/usr/local/www/datachmod –R 755 /usr/local/www/data/pureftpd_php_manager再加入一个普通用户和一个群组,以供ftp使用:pw groupadd ftpuserspw useradd ftpuser –g ftpusers –s /sbin/nologin记住他们的uid和gid号,备用!进入并编辑pureftp.config.php文件更改里面的如下行:$PUREFTP_CONFIG_FILE = '/usr/local/etc/pureftpd-mysql.conf';^M$DefaultUser = "ftpuser"; # Default User Logon^M$DefaultPass = ""; # Default User Password^M$DefaultUid = "1002"; # Default User ID ( must be a real user acct )^M$DefaultGid = "1001"; # Default Group ID ( must be a real group acct )^M$DefaultDir = "/home"; # Default User Dir ( use/./ at the end to chroot )^M$DefaultUL = "0"; # Default Upload Throttle ( 0 disables it )^M$DefaultDL = "0"; # Default Download Throttle ( 0 disables it )^M$Defaultip = "*"; # Default IP restrictions ( * = any IP )^M$DefaultQS = "200"; # Default Quota Size ( 0 disables it )^M$Defaultcmt = ""; # Default Comment for user^M^M// UA^M$DefaultQF = "0"; # Default Quota Files ( 0 disabl