作者：尹正杰

版权声明：原创作品，谢绝转载！否则将追究法律责任。

一.Ubuntu 24.04LTS基本配置

1.安装ubuntu系统

基于VMware Fusion或者"VMware Workstation"软件环境安装Ubuntu 22.04LTS版本可参考我之前的笔记。

参考链接:
	https://www.cnblogs.com/yinzhengjie/p/19571776

2.配置root用户登陆

	1.更新软件源
sudo apt update
sudo apt -y install gdm3 net-tools iputils-ping


	2.修改"gdm-password"配置文件
sudo vim /etc/pam.d/gdm-password 
...
# auth  required        pam_succeed_if.so user != root quiet_success


	3.修改"gdm-autologin"配置文件
sudo vim /etc/pam.d/gdm-autologin
...
# auth  required        pam_succeed_if.so user != root quiet_success


	4.修改sshd服务的配置文件
sudo vim /etc/ssh/sshd_config
...
PermitRootLogin yes


	5.重启sshd服务
sudo  systemctl restart ssh.service
 
	6.配置root的密码
sudo passwd root

3.修改默认的网卡为ens33为eth0

	1.修改前查看网卡信息
root@yinzhengjie:~# ifconfig 
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.99  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::20c:29ff:fe7c:3446  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:7c:34:46  txqueuelen 1000  (Ethernet)
        RX packets 183808  bytes 254335961 (254.3 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 27678  bytes 2825913 (2.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 177  bytes 16580 (16.5 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 177  bytes 16580 (16.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@yinzhengjie:~# 

	2.修改配置文件
root@yinzhengjie:~# vim /etc/default/grub
...
GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"


	3.用"grub-mkconfig"工具重新生成新的配置文件
root@yinzhengjie:~# grub-mkconfig -o /boot/grub/grub.cfg 
Sourcing file `/etc/default/grub'
Sourcing file `/etc/default/grub.d/init-select.cfg'
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-5.15.0-112-generic
Found initrd image: /boot/initrd.img-5.15.0-112-generic
Warning: os-prober will not be executed to detect other bootable partitions.
Systems on them will not be added to the GRUB boot configuration.
Check GRUB_DISABLE_OS_PROBER documentation entry.
Adding boot menu entry for UEFI Firmware Settings ...
done
root@yinzhengjie:~# 

4.配置静态IP地址

	1.修改网卡的配置文件
[root@jiege ~]# cat /etc/netplan/50-cloud-init.yaml 
# This is the network config written by 'subiquity'
network:
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 10.0.0.99/24
      routes:
        - to: default
          via: 10.0.0.254
      nameservers:
        addresses:
            # 114 DNS
          - 114.114.114.114
          - 114.114.115.115
            # 阿里云DNS
          - 223.5.5.5
          - 223.6.6.6
            # 腾讯云DNS
          - 119.29.29.29
          - 119.28.28.28
            # 百度DNS
          - 180.76.76.76
            # Google DNS
          - 8.8.8.8
          - 4.4.4.4
  version: 2
[root@jiege ~]# 



	2.应用配置
[root@jiege ~]# netplan apply 
[root@jiege ~]# 


	3.测试登陆
[C:\~]$ ssh root@10.0.0.99


Connecting to 10.0.0.99:22...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.

Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.8.0-117-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sat May 30 03:45:15 AM UTC 2026

  System load:  0.49               Processes:             225
  Usage of /:   15.9% of 47.93GB   Users logged in:       1
  Memory usage: 8%                 IPv4 address for eth0: 10.0.0.99
  Swap usage:   0%

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Expanded Security Maintenance for Applications is not enabled.

48 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


Last login: Sat May 30 03:43:01 2026 from 10.0.0.1
[root@jiege ~]# 

5.配置PS1变量

cat <<EOF >>  ~/.bashrc 
PS1='[\[\e[34;1m\]\u@\[\e[0m\]\[\e[32;1m\]\H\[\e[0m\]\[\e[31;1m\] \W\[\e[0m\]]# '
EOF
source ~/.bashrc

6.设置登陆界面为字符界面

	1.切换到字符界面
[root@yinzhengjie ~]# systemctl set-default multi-user.target
Created symlink /etc/systemd/system/default.target → /lib/systemd/system/multi-user.target.
[root@yinzhengjie ~]# 


	2.重启操作系统
[root@yinzhengjie ~]# reboot 
Connection to 10.0.0.99 closed by remote host.
Connection to 10.0.0.99 closed.
yinzhengjie@bogon ~ % 



温馨提示:
	我的环境默认安装的Ubuntu系统，对于VMware Fusion虚拟机打开发现是图形化界面，还没有终端可以操作。
	因此建议配置完成后，一定要将默认级别设置为字符界面，如果你真的很想用图形化界面，可以使用如下命令。
    方法一:
    systemctl set-default graphical.target

    方案二:
    startx

    方法三:
    init 5

7.修改软件源

参考链接:
    https://mirror.tuna.tsinghua.edu.cn/help/ubuntu/
    https://developer.aliyun.com/mirror/ubuntu

8.vim基础优化

   1.定义vim文件模板【可自行修改】
[root@yinzhengjie ~]# cat .vimtpl 
#!/bin/bash
# Filename: %FILENAME%
# email: y1053419035@qq.com
# Author: 尹正杰(yinzhengjie) Jason Yin
# CurrentUser:  %USER%
# Date: %DATE%
# Version: %VERSION%
# Blog: https://www.cnblogs.com/yinzhengjie
# Description:  


[root@yinzhengjie ~]# 

    2.配置vim配置并引用模板
[root@jiege ~]# cat  .vimrc 
" 设置字符编码为: utf-8
set encoding=utf-8

" 设置行号
set number

" 设置制表符宽度为4个空格
set tabstop=4
set shiftwidth=4

" 设置自动缩进和智能缩进
set autoindent
set smartindent

" 显示匹配的括号
set showmatch

" 开启自动换行
set wrap

" 开启搜索时忽略大小写
set ignorecase

" 高亮显示当前行
set cursorline

" 搜索时自动高亮匹配
set hlsearch

" 启用文件类型检测
filetype plugin on
filetype indent on

" 设置原样粘贴，避免粘贴变行之类的 
autocmd BufRead,BufNewFile * set paste

" 获取当前用户名                                                                                                                    
let s:current_user = $USER
" 设定默认版本号
let s:default_version = "v0.0.1"
 
" function! ReplaceTemplateVariables(timer_id)
function! YinZhengJieTpl(timer_id)
    let l:current_date = strftime("%Y-%m-%d")
    let l:current_filename = expand('%:t')
 
    " 替换对应的占位符
    execute "%s/%DATE%/" . l:current_date . "/g"
    execute "%s/%FILENAME%/" . l:current_filename . "/g"
    execute "%s/%User%/" . s:current_user . "/g"
    execute "%s/%VERSION%/" . s:default_version . "/g"
    " 设置光标位置
    call cursor(9, 20)
endfunction

" 安装 Timer 插件（如果尚未安装）
if !exists('g:loaded_timer') && !exists('g:did_timer_plugin')
    silent! timer defer timer_start 1
    let g:did_timer_plugin = 1 
endif

" 调用模板
autocmd BufNewFile *.sh 0r ~/.vimtpl | call timer_start(100, 'YinZhengJieTpl')
[root@jiege ~]# 



   3.测试效果，如上图所示
[root@yinzhengjie ~]# vim yinzhengjie-autoinstall-docker.sh

二.Linux 系统基础优化

1.内核参数优化

cat > /etc/sysctl.d/99-k8s-optimize.conf << 'EOF'
# ============= 网络性能优化 =============
net.netfilter.nf_conntrack_max = 10485760
net.netfilter.nf_conntrack_tcp_timeout_established = 300
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 30

# 套接字缓冲区（提升大规模集群吞吐量）
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.ipv4.tcp_rmem = 4096 87380 134217728
net.ipv4.tcp_wmem = 4096 65536 134217728

# 增大连接队列（APIServer 高并发）
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 250000
net.ipv4.tcp_max_syn_backlog = 65535

# 允许 IP 转发（Pod 路由必须）
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

# 禁止发送 ICMP 重定向
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# ARP 相关（避免跨节点 ARP 风暴）
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1

# 内存与 VM 参数
vm.swappiness = 0
vm.max_map_count = 262144
vm.overcommit_memory = 1
vm.panic_on_oom = 0
vm.oom_kill_allocating_task = 1

# 文件描述符
fs.file-max = 10000000
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 8192
fs.pipe-max-size = 4194304

# 进程数
kernel.pid_max = 4194304
kernel.threads-max = 2097152
EOF

sysctl --system

2.系统限制优化（ulimit）

cat > /etc/security/limits.d/99-k8s.conf << 'EOF'
*    soft  nofile   1048576
*    hard  nofile   1048576
*    soft  nproc    unlimited
*    hard  nproc    unlimited
*    soft  memlock  unlimited
*    hard  memlock  unlimited
root soft  nofile   1048576
root hard  nofile   1048576
root soft  nproc    unlimited
root hard  nproc    unlimited
EOF

3.内核模块加载

cat > /etc/modules-load.d/k8s.conf << 'EOF'
# 网络模块
br_netfilter
overlay
ip_vs
ip_vs_rr
ip_vs_wrr
ip_vs_sh
nf_conntrack
# RDMA / 高性能网络（可选）
rdma_cm
ib_uverbs
# GPU 相关
nvidia
nvidia_uvm
nvidia_drm
nvidia_modeset
EOF

modprobe br_netfilter overlay ip_vs ip_vs_rr ip_vs_wrr ip_vs_sh nf_conntrack

4.禁用 Swap

swapoff -a
# 永久禁用
sed -i '/\bswap\b/d' /etc/fstab
systemctl mask swap.target 2>/dev/null || true

5.时间同步（chrony）

dnf install -y chrony   # Rocky Linux
# 或 apt install -y chrony  # Ubuntu

cat > /etc/chrony.conf << 'EOF'
# 使用内网 NTP 服务器（推荐）
server 10.10.0.1 iburst prefer
server ntp.aliyun.com iburst
server ntp.tencent.com iburst
driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony
EOF

systemctl enable --now chrony
chronyc tracking

6.磁盘 I/O 调度优化

# 对 NVMe 使用 none 调度器，对 SSD 使用 mq-deadline
for disk in $(lsblk -d -o NAME,ROTA | awk '$2==0{print $1}'); do
    if [[ -e /sys/block/${disk}/queue/scheduler ]]; then
        echo "mq-deadline" > /sys/block/${disk}/queue/scheduler
        echo "none" > /sys/block/${disk}/queue/scheduler 2>/dev/null || true
    fi
done

# 永久配置（udev 规则）
cat > /etc/udev/rules.d/60-io-scheduler.rules << 'EOF'
ACTION=="add|change", KERNEL=="nvme[0-9]n[0-9]", ATTR{queue/scheduler}="none"
ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline"
EOF
udevadm control --reload-rules

7.配置时区

  1.查看当前时区
[root@harbor250 ~]# ll /etc/localtime 
lrwxrwxrwx 1 root root 27 Feb 10 00:26 /etc/localtime -> /usr/share/zoneinfo/Etc/UTC
[root@harbor250 ~]# 
[root@harbor250 ~]# date -R
Fri, 12 Jun 2026 02:26:14 +0000
[root@harbor250 ~]# 


  2.强制修改时区
[root@harbor250 ~]# ln -svf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
'/etc/localtime' -> '/usr/share/zoneinfo/Asia/Shanghai'
[root@harbor250 ~]# 
[root@harbor250 ~]# date -R
Fri, 12 Jun 2026 10:26:18 +0800
[root@harbor250 ~]# 

8.关闭非必要服务

systemctl disable --now firewalld 2>/dev/null || ufw disable
systemctl disable --now NetworkManager 2>/dev/null || true
systemctl disable --now apparmor 2>/dev/null || true

# 关闭 SELinux（RHEL/Rocky）
setenforce 0
sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# 关闭 avahi-daemon（用于局域网内设备自动发现、域名解析。）
systemctl disable --now avahi-daemon && systemctl mask avahi-daemon

# 关闭systemd-resolved（systemd-resolved 是 systemd 自带的「本地 DNS 解析 + 缓存服务」，主要负责把域名翻译成 IP，并且监听 127.0.0.53:53）【千万别关，已经踩坑了。】
# systemctl disable --now systemd-resolved && systemctl mask systemd-resolved
# 如果上面的关了DNS解析服务，则会缺少'/run/systemd/resolve/resolv.conf'文件，
# 解决方案： systemctl unmask systemd-resolved && systemctl enable --now systemd-resolved


# 解除 resolv.conf 软链接，手动固化 DNS
rm -f /etc/resolv.conf
cat > /etc/resolv.conf <<EOF
nameserver 223.5.5.5
nameserver 223.6.6.6
EOF

# 彻底禁用 X11（xshell支持的图形化转发端口6010）转发
sed -i 's/^X11Forwarding yes/X11Forwarding no/' /etc/ssh/sshd_config
sed -i 's/^#X11Forwarding/X11Forwarding/' /etc/ssh/sshd_config
systemctl restart ssh.service  # 如果依旧无效的话需要重启虚拟机。