#!/bin/bash

######################################################################################
#### Version 1.02                                                                 ####
#### For questions or comments contact@mylinux.work                               ####
#### Author : Phil Connor                                                         ####
####                                                                              ####
#### Notes :                                                                      ####
####   This script is a simple "helper" to configure your sysctl.conf on linux    ####
####   servers. There is no silver bullet. Don't expect the perfect setup,        ####
####   review comments and adapt the parameters to your application usage.        ####
####                                                                              ####
####   Use this script at your OWN risk. There is no guarantee whatsoever.        ####
####                                                                              ####
####   Usage "tuning.sh" or "tuning.sh ssd" if you are running on ssd'd           ####
######################################################################################

##########################
#### System Variables ####
##########################
host=$(hostname)
if [ "$(command -v lsb_release)" ]; then
    os=$(lsb_release -i | awk '{print $3}' | tr '[:upper:]' '[:lower:]')
    osv=$(lsb_release -r | awk '{print $2}' | awk -F. '{print $1}')
else 
    os=$(grep PRETTY_NAME /etc/os-release | sed 's/PRETTY_NAME=//g' | tr -d '="' | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
    osv=$(grep VERSION_ID /etc/os-release | sed 's/VERSION_ID=//g' | tr -d '="' | awk -F. '{print $1}')
fi
sfile=/etc/sysctl.conf

##################################
#### Detect OS and OS Version ####
##################################
if [[ ${os} = alma || ${os} = amazon || ${os} = centos || ${os} = red || ${os} = rocky || ${os} = oracle ]]; then
	if [ "${osv}" = 7 ]; then
		PAKMGR="yum -y"
	else
        PAKMGR="dnf -y"
    fi
elif [ "${os}" = ubuntu ]; then
    PAKMGR="apt -y"
fi

##########################################
#### Check to see if bc is Instaslled ####
##########################################
if ! command -v bc &> /dev/null; then
    ${PAKMGR} install bc
fi

##########################
#### Sysctl Variables ####
##########################
mem_bytes=$(awk '/MemTotal:/ { printf "%0.f",$2 * 1024}' /proc/meminfo)
shmmax=$(echo "$mem_bytes * 0.90" | bc | cut -f 1 -d '.')
shmall=$(("$mem_bytes" / $(getconf PAGE_SIZE)))
max_orphan=$(echo "$mem_bytes * 0.10 / 65536" | bc | cut -f 1 -d '.')
file_max=$(echo "$mem_bytes / 4194304 * 256" | bc | cut -f 1 -d '.')
max_tw=$((file_max * 2))
min_free=$(echo "($mem_bytes / 1024) * 0.01" | bc | cut -f 1 -d '.')

############################
#### Update Sysctl.conf ####
############################
echo "#######################################"
echo "#### Updating sysctl for $host"
echo "#######################################"

cp -a -- "$sfile" "$sfile-$(date +"%m-%d-%y-%r")"

######################################
#### Check for ssd on commandline ####
######################################
if [ "$1" != "ssd" ]; then
    vm_dirty_bg_ratio=5
    vm_dirty_ratio=15
else
    # This setup is generally ok for ssd and highmem servers
    vm_dirty_bg_ratio=3
    vm_dirty_ratio=5
fi

>>$sfile cat << EOF 

############################
#### Performance Tuning ####
############################

# Disable syncookies 
# (syncookies are not RFC compliant and can use too many resources)
net.ipv4.tcp_syncookies = 0

# Basic TCP tuning
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_synack_retries = 3
net.ipv4.tcp_syn_retries = 3

# RFC1337
net.ipv4.tcp_rfc1337 = 1

# Defines the local port range that is used by TCP and UDP
# to choose the local port
net.ipv4.ip_local_port_range = 1024 65535

# Log Martian Packets with impossible addresses
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

EOF

if [ -f /proc/sys/net/ipv4/inet_peer_gc_mintime ]; then
    {
    echo '# Minimum interval between garbage collection passes This interval is'
    echo '# in effect under high memory pressure on the pool'
    echo 'net.ipv4.inet_peer_gc_mintime = 5'
    echo ''
    } >> $sfile
fi

>> $sfile cat << EOF
# Disable Explicit Congestion Notification in TCP
net.ipv4.tcp_ecn = 0

# Enable window scaling as defined in RFC1323
net.ipv4.tcp_window_scaling = 1

# Enable timestamps (RFC1323)
net.ipv4.tcp_timestamps = 1

# Enable select acknowledgments
net.ipv4.tcp_sack = 1

# Enable FACK congestion avoidance and fast restransmission
net.ipv4.tcp_fack = 1

# Allows TCP to send "duplicate" SACKs
net.ipv4.tcp_dsack = 1

# Controls IP packet forwarding for router advertisements
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding=1

# Strict reverse path filtering
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter=1

EOF

if [ -f /proc/sys/net/ipv4/tcp_tw_recycle ]; then
    {
    echo '# Enable fast recycling TIME-WAIT sockets'
    echo 'net.ipv4.tcp_tw_recycle = 1'
    echo ''
    } >> $sfile
fi

>>$sfile cat << EOF
# Max number of remembered connection requests
# TCP_SYNQ_HSIZE*16<=tcp_max_syn_backlog
# NOTE: Setting this too low may impact IP6 Sessions
net.ipv4.tcp_max_syn_backlog = 20000

# tells the kernel how many TCP sockets that are 
# not attached to any user file handle to maintain
net.ipv4.tcp_max_orphans = $max_orphan

# How may times to retry before killing TCP connection, 
# closed by the side
net.ipv4.tcp_orphan_retries = 1

# how long to keep sockets in the state FIN-WAIT-2
# if we were the one closing the socket
net.ipv4.tcp_fin_timeout = 20

# maximum number of sockets in TIME-WAIT to be held simultaneously
net.ipv4.tcp_max_tw_buckets = $max_tw

# don't cache ssthresh from previous connection
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_moderate_rcvbuf = 1

# increase Linux autotuning TCP buffer limits
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# increase TCP max buffer size
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216

net.core.netdev_max_backlog = 2500
net.core.somaxconn = 65000

vm.swappiness = 0

# You can monitor the kernel behavior with regard to the dirty
# pages by using grep -A 1 dirty /proc/vmstat
vm.dirty_background_ratio = $vm_dirty_bg_ratio
vm.dirty_ratio = $vm_dirty_ratio

# required free memory (set to 1% of physical ram)
vm.min_free_kbytes = $min_free

# system open file limit
fs.file-max = $file_max

# Core dump suidsafe
fs.suid_dumpable = 2 

#( 3 4 1 3 for most webbased applications )
kernel.printk = 4 4 1 7 
kernel.core_uses_pid = 1
kernel.sysrq = 0
kernel.msgmax = 65536
kernel.msgmnb = 65536

# Maximum shared segment size in bytes
kernel.shmmax = $shmmax

# Maximum number of shared memory segments in pages
kernel.shmall = $shmall

###########################
#### Security Settings ####
###########################

# Protect against worms and other automated attacks
EOF

if [ -f /proc/sys/kernel/exec-shield ]; then
    echo 'kernel.exec-shield = 1'  >> $sfile
fi

>>$sfile cat << EOF
kernel.randomize_va_space = 1

# Don't accept ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Don't send ICMP redirects (I'm not a router!)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Don't accept IP source route packets (I'm not a router)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route  = 0
net.ipv6.conf.all.accept_source_route = 0

# Ignoring ICMP broadcasts and ignore bogus responses
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Don’t accept routing preferences
net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.all.accept_ra_rtr_pref = 0

# Don’t try to learn prefix information
net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.all.accept_ra_pinfo = 0

# Don’t accept hop limits
net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.all.accept_ra_defrtr = 0

EOF

sysctl -p
exit $?