#!/bin/bash


#  set environment
yum groupinstall "Development tools" -y
yum install lrzsz ntpdate sysstat -y
yum install wget openssl-devel kernel-devel  -y 
yum install subversion -y


#  install nginx
function nginx_install ()
{
mkdir -p /home/tar/
cd /home/tar
if [ -f pcre-8.37.tar.gz ] ;then
   tar zxf pcre-8.37.tar.gz
else
   wget http://ncu.dl.sourceforge.net/project/pcre/pcre/8.37/pcre-8.37.tar.gz
   tar zxf pcre-8.37.tar.gz
fi

if [ -f zlib-1.2.8.tar.gz ] ;then
   tar zxf zlib-1.2.8.tar.gz
else
   wget http://nchc.dl.sourceforge.net/project/libpng/zlib/1.2.8/zlib-1.2.8.tar.gz
   tar zxf zlib-1.2.8.tar.gz
fi

if [ -f openssl-1.0.2c.tar.gz ] ;then
   wget http://www.openssl.org/source/openssl-1.0.2c.tar.gz
   tar zxf openssl-1.0.2c.tar.gz
else
   tar zxf openssl-1.0.2c.tar.gz
fi

if [ -f tengine-2.1.0.tar.gz ] ;then  
   wget http://tengine.taobao.org/download/tengine-2.1.0.tar.gz
   tar zxf  tengine-2.1.0.tar.gz
else
   tar zxf  tengine-2.1.0.tar.gz
fi

cd tengine-2.1.0
sed -i 's/1.6.2/1.2.1/g;s/2.1.0/1.2.1/g;s/Tengine/Weyes-Web/g;s/nginx\//Weyes-Web\//g' src/core/nginx.h
./configure --with-http_ssl_module --with-pcre=/home/tar/pcre-8.37 --with-zlib=/home/tar/zlib-1.2.8 --with-openssl=/home/tar/openssl-1.0.2c
make && make install

}

# install php 
function php_install ()
{
rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
yum install yum-priorities -y
rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh http://rpms.famillecollet.com/remi-release-16.rpm
rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm

yum --enablerepo=remi install php php-cli php-common php-gd php-ldap  php-mbstring php-mcrypt php-mysql php-pdo php-imap php-odbc php-xml php-xmlrpc php-fpm  php-soap php-bcmath php-redis mysql-libs libpng-devel  libgd-devel libjpeg-devel zlib-devel libxml2-devel  gd-2  apr-util-devel


}

# install redis

yum --enablerepo=remi list redis


#  set iptables

function set_iptables ()
{
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 161 -j ACCEPT
iptables -A INPUT -p tcp --dport 199 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000:50500 -j ACCEPT


service iptables save
service iptables restart

}

#  Security configuration

function set_env ()
{
# chkconfig off
chkconfig auditd off
chkconfig ip6tables off
chkconfig mdmonitor off
chkconfig iscsi off
chkconfig iscsid off
chkconfig lvm2-monitor off

# del user
userdel adm
userdel lp
userdel shutdown
userdel halt
userdel uucp
userdel operator
userdel games
userdel gopher

# set date
echo "* */1 * * * /usr/sbin/ntpdate cn.pool.ntp.org >/dev/null 2>&1"  >> /etc/crontab
service crond restart

# set ulimit

echo "* hard nofile" >> /etc/security/limits.conf 
echo "* soft nofile" >> /etc/security/limits.conf 
echo "* hard nproc" >> /etc/security/limits.conf 
echo "* soft nproc" >> /etc/security/limits.conf 
echo "fs.file-max=65535" >> /etc/sysctl.conf

# set sysctl
 
echo "net.ipv4.tcp_syncookies = 1"  >> /etc/sysctl.conf
echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf 
echo "net.ipv4.tcp_tw_recycle = 1" >> /etc/sysctl.conf
echo "net.ipv4.ip_local_port_range = 1024 65535" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_tw_buckets = 5000" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_syn_backlog = 4096" >> /etc/sysctl.conf
echo "net.core.netdev_max_backlog = 10240" >> /etc/sysctl.conf
echo "net.core.somaxconn = 2048" >> /etc/sysctl.conf
echo "net.core.wmem_default = 8388608" >> /etc/sysctl.conf
echo "net.core.rmem_default = 8388608" >> /etc/sysctl.conf 
echo "net.core.rmem_max = 16777216" >> /etc/sysctl.conf
echo "net.core.wmem_max = 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_synack_retries = 2" >> /etc/sysctl.conf
echo "net.ipv4.tcp_syn_retries = 2" >> /etc/sysctl.conf
echo "net.ipv4.tcp_tw_recycle = 1" >> /etc/sysctl.conf
echo "net.ipv4.tcp_max_orphans = 3276800" >> /etc/sysctl.conf
echo "net.ipv4.tcp_mem = 786432 2097152 3145728" >> /etc/sysctl.conf
echo "net.ipv4.tcp_rmem = 4096 4096 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_wmem = 4096 4096 16777216" >> /etc/sysctl.conf

}


nginx_install  >> /home/log/Web_install.log
php_install  >> /home/log/Web_install.log
set_iptables  >> /home/log/Web_install.log
set_env >> /home/log/Web_install.log