# 查看磁盘分区
# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 500G 0 disk
├─sda1 8:1 0 1G 0 part /boot/efi
├─sda2 8:2 0 2G 0 part /boot
├─sda3 8:3 0 100G 0 part /
├─sda4 8:4 0 50G 0 part /home
├─sda5 8:5 0 50G 0 part /var
├─sda6 8:6 0 32G 0 part [SWAP]
└─sda7 8:7 0 265G 0 part /data

# 查看文件系统
# df -hT
Filesystem Type Size Used Avail Use% Mounted on
devtmpfs devtmpfs 63G 0 63G 0% /dev
tmpfs tmpfs 63G 0 63G 0% /dev/shm
tmpfs tmpfs 63G 8.5M 63G 1% /run
tmpfs tmpfs 63G 0 63G 0% /sys/fs/cgroup
/dev/sda3 ext4 100G 5.0G 95G 5% /
/dev/sda2 ext4 2.0G 150M 1.9G 8% /boot
/dev/sda1 vfat 1.0G 6.1M 1018M 1% /boot/efi
/dev/sda4 ext4 50G 1.0G 49G 2% /home
/dev/sda5 ext4 50G 2.0G 48G 4% /var
/dev/sda7 ext4 265G 20G 246G 8% /data

# 配置fgedu.net.cn
# hostnamectl set-hostname fgedu-euler01.fgedu.net.cn

# 配置时区
# timedatectl set-timezone Asia/Shanghai

# 查看时区设置
# timedatectl
Local time: Fri 2026-04-03 10:00:00 CST
Universal time: Fri 2026-04-03 02:00:00 UTC
RTC time: Fri 2026-04-03 02:00:00
Time zone: Asia/Shanghai (CST, +0800)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

# 配置NTP时间同步
# cat /etc/chrony.conf
server ntp1.fgedu.net.cn iburst
server ntp2.fgedu.net.cn iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony

# systemctl restart chronyd
# systemctl enable chronyd

# 查看时间同步状态
# chronyc sources
210 Number of sources = 2
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* ntp1.fgedu.net.cn 2 6 17 12 +123us[+456us] +/- 10ms
^+ ntp2.fgedu.net.cn 2 6 17 15 -234us[-123us] +/- 12ms

# 配置软件源
# cat /etc/yum.repos.d/openEuler.repo
[OS]
name=OS
baseurl=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/OS/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/OS/$basearch/RPM-GPG-KEY-openEuler

[everything]
name=everything
baseurl=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/everything/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/everything/$basearch/RPM-GPG-KEY-openEuler

[EPOL]
name=EPOL
baseurl=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/EPOL/main/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/OS/$basearch/RPM-GPG-KEY-openEuler

[update]
name=update
baseurl=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/update/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://repo.openeuler.org/openEuler-22.03-LTS-SP3/OS/$basearch/RPM-GPG-KEY-openEuler

# 更新软件源缓存
# dnf clean all
# dnf makecache
OS 2.5 MB/s | 3.4 kB 00:00
everything 3.0 MB/s | 4.5 kB 00:00
EPOL 2.8 MB/s | 3.8 kB 00:00
update 2.6 MB/s | 3.2 kB 00:00
Metadata cache created.

# 搜索软件包
# dnf search nginx
Last metadata expiration check: 0:01:00 ago on Fri 03 Apr 2026 10:00:00 AM CST.
================================== Name Matched: nginx ==================================
nginx.x86_64 : A high performance web server and reverse proxy server
nginx-all-modules.noarch : A meta package that installs all available Nginx modules
nginx-filesystem.noarch : The basic requirements and filesystem layout for Nginx

# 安装软件包
# dnf install -y nginx
Last metadata expiration check: 0:02:00 ago on Fri 03 Apr 2026 10:00:00 AM CST.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
nginx x86_64 1:1.21.5-3.oe2203sp3 EPOL 500 k
Installing dependencies:
nginx-filesystem noarch 1:1.21.5-3.oe2203sp3 EPOL 8.5 k

Transaction Summary
================================================================================
Install 2 Packages

Total download size: 509 k
Installed size: 1.5 M
Downloading Packages:
(1/2): nginx-filesystem-1.21.5-3.oe2203sp3.noarch 50 kB/s | 8.5 kB 00:00
(2/2): nginx-1.21.5-3.oe2203sp3.x86_64.rpm 5.0 MB/s | 500 kB 00:00
——————————————————————————–
Total 2.5 MB/s | 509 kB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : nginx-filesystem-1:1.21.5-3.oe2203sp3.noarch 1/2
Installing : nginx-1:1.21.5-3.oe2203sp3.x86_64 2/2
Verifying : nginx-filesystem-1:1.21.5-3.oe2203sp3.noarch 1/2
Verifying : nginx-1:1.21.5-3.oe2203sp3.x86_64 2/2

Installed:
nginx-1:1.21.5-3.oe2203sp3.x86_64 nginx-filesystem-1:1.21.5-3.oe2203sp3.noarch

Complete!

# 查看已安装软件包
# rpm -qa | grep nginx
nginx-1.21.5-3.oe2203sp3.x86_64
nginx-filesystem-1.21.5-3.oe2203sp3.noarch

# 更新系统
# dnf update -y

# 创建用户
# useradd -m -s /bin/bash fgedu_user

# 设置密码
# passwd fgedu_user
Changing password for user fgedu_user.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

# 创建用户组
# groupadd fgedu_group

# 将用户加入组
# usermod -aG fgedu_group fgedu_user

# 查看用户信息
# id fgedu_user
uid=1001(fgedu_user) gid=1001(fgedu_user) groups=1001(fgedu_user),1002(fgedu_group)

# 配置sudo权限
# cat > /etc/sudoers.d/fgedu << 'EOF' fgedu_user ALL=(ALL) NOPASSWD: ALL EOF # 查看登录用户 # who root pts/0 2026-04-03 09:00 (192.168.1.10) fgedu_user pts/1 2026-04-03 09:30 (192.168.1.20) # 配置密码策略 # cat /etc/security/pwquality.conf minlen = 12 minclass = 4 maxrepeat = 3 maxclassrepeat = 3 lcredit = -1 ucredit = -1 dcredit = -1 ocredit = -1 # 配置登录失败锁定 # cat /etc/pam.d/password-auth auth required pam_env.so auth required pam_faillock.so preauth audit deny=5 unlock_time=900 auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_faillock.so authfail audit deny=5 unlock_time=900
auth required pam_deny.so

# 查看登录失败记录
# faillock –user fgedu_user

# 查看网络接口
# ip addr show
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:50:56:ab:cd:ef brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::250:56ff:feab:cdef/64 scope link
valid_lft forever preferred_lft forever

# 使用nmcli配置网络
# nmcli device status
DEVICE TYPE STATE CONNECTION
eth0 ethernet connected eth0
lo loopback unmanaged —

# 配置静态IP
# nmcli connection modify eth0 ipv4.addresses 192.168.1.100/24
# nmcli connection modify eth0 ipv4.gateway 192.168.1.1
# nmcli connection modify eth0 ipv4.dns “192.168.1.2,192.168.1.3”
# nmcli connection modify eth0 ipv4.method manual
# nmcli connection up eth0
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1)

# 查看连接信息
# nmcli connection show eth0
connection.id: eth0
connection.type: 802-3-ethernet
connection.autoconnect: yes
ipv4.method: manual
ipv4.addresses: 192.168.1.100/24
ipv4.gateway: 192.168.1.1
ipv4.dns: 192.168.1.2,192.168.1.3

# 配置防火墙
# systemctl start firewalld
# systemctl enable firewalld

# 开放端口
# firewall-cmd –permanent –add-port=80/tcp
# firewall-cmd –permanent –add-port=443/tcp
# firewall-cmd –permanent –add-port=22/tcp

# 开放服务
# firewall-cmd –permanent –add-service=http
# firewall-cmd –permanent –add-service=https
# firewall-cmd –permanent –add-service=ssh

# 重新加载配置
# firewall-cmd –reload
success

# 查看防火墙规则
# firewall-cmd –list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client http https ssh
ports: 80/tcp 443/tcp 22/tcp
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

# 查看磁盘信息
# fdisk -l
Disk /dev/sda: 500 GiB, 536870912000 bytes, 1048576000 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt

# 创建LVM
# pvcreate /dev/sdb
Physical volume “/dev/sdb” successfully created.

# vgcreate vg_data /dev/sdb
Volume group “vg_data” successfully created

# lvcreate -L 200G -n lv_app vg_data
Logical volume “lv_app” created.

# 创建文件系统
# mkfs.xfs /dev/vg_data/lv_app
meta-data=/dev/vg_data/lv_app isize=512 agcount=4, agsize=13107200 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=0
= reflink=1
data = bsize=4096 blocks=52428800, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0, ftype=1
log =internal log bsize=4096 blocks=25600, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0

# 挂载文件系统
# mkdir /app
# mount /dev/vg_data/lv_app /app

# 配置自动挂载
# cat /etc/fstab
/dev/mapper/vg_data-lv_app /app xfs defaults 0 0

# 查看LVM信息
# lvs
LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert
lv_app vg_data -wi-ao—- 200.00g
root klas -wi-ao—- 100.00g
swap klas -wi-ao—- 32.00g

# 扩展LVM
# lvextend -L +50G /dev/vg_data/lv_app
Size of logical volume vg_data/lv_app changed from 200.00 GiB to 250.00 GiB.
Logical volume vg_data/lv_app successfully resized.

# 扩展文件系统
# xfs_growfs /app
meta-data=/dev/mapper/vg_data-lv_app isize=512 agcount=4, agsize=13107200 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=0
= reflink=1
data = bsize=4096 blocks=52428800, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0, ftype=1
log =internal log bsize=4096 blocks=25600, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
data blocks changed from 52428800 to 65536000

# 查看服务状态
# systemctl status nginx
● nginx.service – The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2026-04-03 10:00:00 CST; 5min ago
Main PID: 12345 (nginx)
Tasks: 5 (limit: 49141)
Memory: 10.0M
CGroup: /system.slice/nginx.service
├─12345 nginx: master process /usr/sbin/nginx
├─12346 nginx: worker process
├─12347 nginx: worker process
├─12348 nginx: worker process
└─12349 nginx: worker process

Apr 03 10:00:00 fgedu-euler01 systemd[1]: Starting The nginx HTTP and reverse proxy server…
Apr 03 10:00:00 fgedu-euler01 nginx[12344]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Apr 03 10:00:00 fgedu-euler01 nginx[12344]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Apr 03 10:00:00 fgedu-euler01 systemd[1]: Started The nginx HTTP and reverse proxy server.

# 启动服务
# systemctl start nginx

# 停止服务
# systemctl stop nginx

# 重启服务
# systemctl restart nginx

# 开机自启
# systemctl enable nginx
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.

# 查看所有运行的服务
# systemctl list-units –type=service –state=running
UNIT LOAD ACTIVE SUB DESCRIPTION
auditd.service loaded active running Security Auditing Service
crond.service loaded active running Command Scheduler
dbus.service loaded active running D-Bus System Message Bus
firewalld.service loaded active running firewalld – dynamic firewall daemon
NetworkManager.service loaded active running Network Manager
nginx.service loaded active running The nginx HTTP and reverse proxy server
polkit.service loaded active running Authorization Manager
rsyslog.service loaded active running System Logging Service
sshd.service loaded active running OpenSSH server daemon
systemd-journald.service loaded active running Journal Service

# 创建自定义服务
# cat > /etc/systemd/system/fgedu-app.service << 'EOF' [Unit] Description=FGedu Application Service After=network.target [Service] Type=simple User=app Group=app WorkingDirectory=/opt/app ExecStart=/opt/app/bin/start.sh ExecStop=/opt/app/bin/stop.sh Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target EOF # systemctl daemon-reload # systemctl enable fgedu-app # systemctl start fgedu-app

# 配置SELinux
# getenforce
Enforcing

# 查看SELinux配置
# cat /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

# 配置SSH安全
# cat /etc/ssh/sshd_config | grep -v “^#” | grep -v “^$”
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
GSSAPIAuthentication no
UseDNS no

# systemctl restart sshd

# 配置审计
# dnf install -y audit
# systemctl enable auditd
# systemctl start auditd

# 添加审计规则
# cat >> /etc/audit/rules.d/audit.rules << 'EOF' -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/sudoers -p wa -k sudoers -w /var/log/secure -p wa -k logins -a exit,always -F arch=b64 -S execve EOF # service auditd restart # 查看审计日志 # ausearch -k identity | tail -5 # 安全加固脚本 # cat > /opt/scripts/security_hardening.sh << 'EOF' #!/bin/bash echo "开始安全加固..." # 禁用不必要的服务 systemctl disable bluetooth systemctl disable cups # 配置密码策略 cat > /etc/security/pwquality.conf << 'PWCONF' minlen = 12 minclass = 4 maxrepeat = 3 PWCONF # 配置登录失败锁定 sed -i '2a auth required pam_faillock.so preauth audit deny=5 unlock_time=900' /etc/pam.d/password-auth # 配置文件权限 chmod 600 /etc/ssh/sshd_config chmod 600 /etc/security/pwquality.conf chmod 700 /root echo "安全加固完成" EOF # chmod +x /opt/scripts/security_hardening.sh # /opt/scripts/security_hardening.sh

# 内核参数调优
# cat >> /etc/sysctl.conf << 'EOF' # 网络优化 net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_fin_timeout = 30 net.ipv4.tcp_keepalive_time = 600 net.ipv4.tcp_max_syn_backlog = 65535 net.core.somaxconn = 65535 # 内存优化 vm.swappiness = 10 vm.dirty_ratio = 20 vm.dirty_background_ratio = 5 # 文件系统优化 fs.file-max = 6815744 EOF # sysctl -p # 系统限制调优 # cat >> /etc/security/limits.conf << 'EOF' * soft nofile 65535 * hard nofile 65535 * soft nproc 65535 * hard nproc 65535 * soft memlock unlimited * hard memlock unlimited EOF # 查看系统资源 # top -bn1 | head -20 top - 10:00:00 up 2 days, 5:30, 3 users, load average: 0.10, 0.05, 0.01 Tasks: 150 total, 1 running, 149 sleeping, 0 stopped, 0 zombie %Cpu(s): 1.0 us, 0.5 sy, 0.0 ni, 98.5 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 65536.0 total, 60000.0 free, 5000.0 used, 536.0 buff/cache MiB Swap: 32768.0 total, 32768.0 free, 0.0 used. 60000.0 avail Mem # 查看磁盘I/O # iostat -x 1 3 Linux 5.10.0-136.65.0.122.oe2203sp3.x86_64 (fgedu-euler01) 04/03/2026 _x86_64_ (32 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 1.00 0.00 0.50 0.00 0.00 98.50 Device r/s w/s rkB/s wkB/s rrqm/s wrqm/s %rrqm %wrqm r_await w_await aqu-sz rareq-sz wareq-sz svctm %util sda 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

# 查看系统日志
# journalctl -xe | tail -50
— Logs begin at Thu 2026-04-01 10:00:00 CST, end at Fri 2026-04-03 10:00:00 CST. —
Apr 03 10:00:00 fgedu-euler01 systemd[1]: Started The nginx HTTP and reverse proxy server.
Apr 03 10:00:00 fgedu-euler01 sshd[12345]: Accepted publickey for root from 192.168.1.10 port 54321 ssh2
Apr 03 10:00:00 fgedu-euler01 systemd[1]: Started Session 10 of user root.

# 查看特定服务日志
# journalctl -u nginx -f
— Logs begin at Thu 2026-04-01 10:00:00 CST. —
Apr 03 10:00:00 fgedu-euler01 systemd[1]: Starting The nginx HTTP and reverse proxy server…
Apr 03 10:00:00 fgedu-euler01 nginx[12344]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
Apr 03 10:00:00 fgedu-euler01 nginx[12344]: nginx: configuration file /etc/nginx/nginx.conf test is successful
Apr 03 10:00:00 fgedu-euler01 systemd[1]: Started The nginx HTTP and reverse proxy server.

# 查看内核日志
# dmesg | tail -20
[ 0.000000] Linux version 5.10.0-136.65.0.122.oe2203sp3.x86_64 (mockbuild@openeuler) (gcc version 10.3.1 (GCC)) #1 SMP Fri Jan 15 10:00:00 CST 2026
[ 0.000000] Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.10.0-136.65.0.122.oe2203sp3.x86_64 root=/dev/mapper/klas-root ro crashkernel=auto resume=/dev/mapper/klas-swap rd.lvm.lv=klas/root rd.lvm.lv=klas/swap rhgb quiet

# 查看系统消息
# tail -50 /var/log/messages
Apr 3 10:00:00 fgedu-euler01 systemd: Started The nginx HTTP and reverse proxy server.
Apr 3 10:00:00 fgedu-euler01 sshd[12345]: Accepted publickey for root from 192.168.1.10 port 54321 ssh2

# 网络故障排查
# ping -c 3 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.521 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.432 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.398 ms

— 192.168.1.1 ping statistics —
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 0.398/0.450/0.521/0.052 ms

# 查看网络连接
# ss -tuln
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:443 0.0.0.0:*