1. Linux系统概述与基本概念Linux作为开源操作系统的代表已经渗透到现代计算的各个领域。我第一次接触Linux是在大学实验室的服务器上当时被它强大的命令行界面和高效的资源管理能力所震撼。与Windows不同Linux采用模块化设计整个系统由众多功能单一的小程序组成这种组合式哲学让系统具有惊人的灵活性和可定制性。Linux内核由Linus Torvalds在1991年首次发布如今已发展出数百个发行版本。主流的发行版包括Red Hat系CentOS、Fedora等以稳定性著称Debian系Ubuntu、Mint等以易用性见长Arch系面向高级用户采用滚动更新实际工作中服务器环境多选择CentOS或Ubuntu Server桌面环境则推荐Ubuntu或Mint。我个人的开发机就同时运行着Ubuntu和Windows双系统。Linux的文件系统采用树状结构根目录(/)是所有文件的起点。几个关键目录需要特别注意/etc系统配置文件集中地/var经常变化的文件如日志/home用户个人目录/usr用户程序安装位置2. 基础命令操作实战2.1 文件与目录管理掌握基础命令是使用Linux的第一步。以下是我总结的常用命令速查表命令功能常用参数使用示例ls列出目录内容-l(详情)、-a(显示隐藏)ls -la /homecd切换目录-cd /var/logpwd显示当前路径-pwdmkdir创建目录-p(递归创建)mkdir -p project/srcrm删除文件-r(递归)、-f(强制)rm -rf temp/cp复制文件-r(递归)cp -r config backupmv移动/重命名-mv old.txt new.txt文件权限管理是Linux安全模型的核心。通过ls -l可以看到类似-rwxr-xr--的权限字符串这表示第1位文件类型(-表普通文件d表目录)2-4位所有者权限5-7位所属组权限8-10位其他用户权限修改权限的两种方式数字法chmod 755 script.sh(7rwx,5r-x)符号法chmod ux,g-w,or file2.2 文本处理与编辑器Vim作为Linux标配编辑器学习曲线陡峭但效率极高。我建议新手先掌握以下基本操作三种模式切换命令模式(ESC)执行编辑器命令插入模式(i/a/o)输入文本末行模式(:)保存退出等操作常用命令组合:wq保存退出dd删除当前行/keyword搜索关键词:set nu显示行号对于日志分析掌握文本处理命令很关键# 查看实时日志 tail -f /var/log/syslog # 统计nginx日志中404错误 grep 404 access.log | wc -l # 提取IP访问量TOP10 awk {print $1} access.log | sort | uniq -c | sort -nr | head -103. 用户与权限配置3.1 用户账户管理Linux是多用户系统每个用户拥有唯一的UID。添加用户的完整流程创建用户并指定主目录useradd -m -s /bin/bash devuser设置密码passwd devuser添加到附加组usermod -aG sudo,docker devuser删除用户userdel -r devuser # -r同时删除主目录生产环境中建议禁用root直接登录改用sudo提权。修改/etc/ssh/sshd_configPermitRootLogin no3.2 权限控制进阶除了基础的rwx权限Linux还支持特殊权限位SUID(4)执行时临时获取所有者权限chmod us /usr/bin/passwdSGID(2)目录中新文件继承组权限chmod gs /shared_dirSticky Bit(1)仅允许所有者删除文件chmod t /tmpACL(访问控制列表)提供了更精细的权限控制# 给特定用户添加权限 setfacl -m u:testuser:rwx /project # 查看ACL权限 getfacl /project4. 软件安装与环境配置4.1 包管理工具不同发行版使用不同的包管理器系统类型包管理工具安装命令示例RedHat系rpm/yumyum install nginxDebian系dpkg/aptapt install nginxArch系pacmanpacman -S nginx配置国内镜像源能显著提升下载速度。以Ubuntu为例备份原配置sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak替换为阿里源sudo sed -i s/archive.ubuntu.com/mirrors.aliyun.com/g /etc/apt/sources.list更新缓存sudo apt update4.2 Java环境部署JDK安装最佳实践下载官方tar.gz包推荐OpenJDK解压到/usr/local目录tar -xzf jdk-17_linux-x64_bin.tar.gz -C /usr/local/设置环境变量/etc/profileexport JAVA_HOME/usr/local/jdk-17 export PATH$JAVA_HOME/bin:$PATH使配置生效source /etc/profile验证安装java -version javac -version4.3 Docker环境搭建容器化部署已成为现代应用的标准方式。Docker安装步骤卸载旧版本sudo yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine安装依赖sudo yum install -y yum-utils device-mapper-persistent-data lvm2添加仓库sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo安装Dockersudo yum install docker-ce docker-ce-cli containerd.io启动服务sudo systemctl start docker sudo systemctl enable docker测试运行sudo docker run hello-world配置镜像加速sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json -EOF { registry-mirrors: [https://your-mirror.mirror.aliyuncs.com] } EOF sudo systemctl daemon-reload sudo systemctl restart docker5. 项目部署实战5.1 Spring Boot应用部署现代Java应用通常打包为可执行jar上传jar包到服务器创建启动脚本start.sh#!/bin/bash nohup java -jar your-app.jar --spring.profiles.activeprod app.log 21 添加执行权限chmod x start.sh启动应用./start.sh使用systemd管理服务更专业创建服务文件/etc/systemd/system/yourapp.service[Unit] DescriptionYour App Service Aftersyslog.target [Service] Userappuser ExecStart/usr/bin/java -jar /path/to/your-app.jar SuccessExitStatus143 [Install] WantedBymulti-user.target启用服务sudo systemctl daemon-reload sudo systemctl enable yourapp sudo systemctl start yourapp5.2 前端项目部署以Vue项目为例的Nginx配置构建生产包npm run build上传dist目录到服务器配置Nginx(/etc/nginx/conf.d/your-site.conf)server { listen 80; server_name yourdomain.com; location / { root /path/to/dist; index index.html; try_files $uri $uri/ /index.html; } location /api { proxy_pass http://backend:8080; proxy_set_header Host $host; } }测试并重载配置sudo nginx -t sudo systemctl reload nginx5.3 防火墙配置安全的生产环境必须配置防火墙查看开放端口sudo firewall-cmd --list-ports开放新端口sudo firewall-cmd --zonepublic --add-port8080/tcp --permanent重载防火墙sudo firewall-cmd --reload对于云服务器还需在云平台安全组中开放相应端口6. 系统监控与维护6.1 资源监控命令命令功能关键指标top实时进程监控CPU%、MEM%、LOADhtop增强版top彩色显示、树状结构free内存使用-h人性化显示df磁盘空间-h查看挂载点iostat磁盘IO%util表示利用率netstat网络连接-tunlp查看监听端口推荐安装更强大的监控工具# Sysstat工具集 sudo apt install sysstat # 可视化监控 sudo apt install glances6.2 日志管理系统日志主要存放在/var/log目录/var/log/messages常规系统消息/var/log/syslogUbuntu系统日志/var/log/nginx/Nginx日志/var/log/mysql/MySQL日志使用logrotate自动轮转日志创建配置/etc/logrotate.d/yourapp/path/to/your/app.log { daily rotate 7 compress missingok notifempty create 644 root root }测试配置logrotate -d /etc/logrotate.d/yourapp6.3 定时任务crontab是Linux的定时任务工具格式为* * * * * command ┬ ┬ ┬ ┬ ┬ │ │ │ │ └── 星期 (0 - 6) (0是周日) │ │ │ └──── 月份 (1 - 12) │ │ └────── 日 (1 - 31) │ └──────── 小时 (0 - 23) └────────── 分钟 (0 - 59)示例每天凌晨备份数据库0 3 * * * /usr/bin/mysqldump -u root -ppassword dbname /backups/db_$(date \%Y\%m\%d).sql查看当前用户的crontabcrontab -l编辑crontabcrontab -e7. 网络配置与安全7.1 网络基础配置网络配置文件位置RedHat系/etc/sysconfig/network-scripts/ifcfg-eth0Debian系/etc/network/interfaces静态IP配置示例DEVICEeth0 BOOTPROTOstatic ONBOOTyes IPADDR192.168.1.100 NETMASK255.255.255.0 GATEWAY192.168.1.1 DNS18.8.8.8 DNS28.8.4.4应用配置sudo systemctl restart network # RedHat sudo systemctl restart networking # Debian7.2 SSH安全加固修改默认端口Port 2222禁用密码登录PasswordAuthentication no限制root登录PermitRootLogin no使用密钥认证ssh-keygen -t rsa -b 4096 ssh-copy-id userserver -p 2222配置fail2ban防御暴力破解sudo apt install fail2ban sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local8. 常见问题排查8.1 磁盘空间不足排查步骤查找大文件du -h --max-depth1 / | sort -h清理日志文件find /var/log -type f -name *.log -size 100M -exec truncate -s 0 {} \;查找并删除临时文件find /tmp -type f -atime 7 -delete8.2 服务启动失败排查方法查看服务状态systemctl status servicename查看日志journalctl -u servicename -n 50 --no-pager手动运行调试/path/to/binary --config/etc/servicename.conf --debug8.3 网络连接问题诊断流程检查本地网络ping 127.0.0.1检查网关ping 192.168.1.1检查DNSnslookup example.com检查端口telnet example.com 80路由追踪traceroute example.com9. 性能优化技巧9.1 系统级优化调整swappinessecho vm.swappiness10 /etc/sysctl.conf sysctl -p优化文件描述符限制echo * soft nofile 65535 /etc/security/limits.conf echo * hard nofile 65535 /etc/security/limits.conf内核参数优化echo net.ipv4.tcp_tw_reuse 1 /etc/sysctl.conf echo net.core.somaxconn 65535 /etc/sysctl.conf sysctl -p9.2 应用级优化Nginx优化worker_processes auto; worker_connections 10240; keepalive_timeout 65; gzip on;MySQL优化[mysqld] innodb_buffer_pool_size 4G innodb_log_file_size 256M query_cache_size 64MJVM优化java -Xms2G -Xmx2G -XX:UseG1GC -jar your-app.jar10. 自动化运维入门10.1 Shell脚本编写基础模板#!/bin/bash # Description: Backup database # Author: Your Name # Date: $(date %F) # 定义变量 BACKUP_DIR/backups DB_USERroot DB_PASSpassword DB_NAMEmydb DATE$(date %Y%m%d) # 创建备份目录 mkdir -p $BACKUP_DIR # 执行备份 mysqldump -u$DB_USER -p$DB_PASS $DB_NAME $BACKUP_DIR/${DB_NAME}_${DATE}.sql # 检查执行结果 if [ $? -eq 0 ]; then echo Backup successful else echo Backup failed 2 exit 1 fi # 删除旧备份 find $BACKUP_DIR -name *.sql -mtime 7 -delete10.2 Ansible基础安装sudo apt install ansible基础使用创建hosts文件[webservers] web1 ansible_host192.168.1.101 web2 ansible_host192.168.1.102 [dbservers] db1 ansible_host192.168.1.201测试连接ansible all -m ping -i hosts执行命令ansible webservers -a uptime -i hosts使用playbook- hosts: webservers tasks: - name: Install Nginx apt: namenginx statepresent11. 容器化进阶11.1 Docker Compose典型docker-compose.ymlversion: 3 services: web: image: nginx:alpine ports: - 80:80 volumes: - ./html:/usr/share/nginx/html depends_on: - app app: image: your-app:latest environment: - DB_HOSTdb - DB_USERuser db: image: mysql:5.7 environment: - MYSQL_ROOT_PASSWORDsecret - MYSQL_DATABASEmydb volumes: - db_data:/var/lib/mysql volumes: db_data:常用命令docker-compose up -d # 启动服务 docker-compose down # 停止服务 docker-compose logs -f web # 查看日志11.2 Kubernetes基础minikube本地集群安装curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64 sudo install minikube-linux-amd64 /usr/local/bin/minikube minikube start --driverdocker基础部署示例# 创建部署 kubectl create deployment nginx --imagenginx:alpine # 暴露服务 kubectl expose deployment nginx --port80 --typeNodePort # 查看服务 kubectl get pods,svc12. 备份与恢复策略12.1 系统备份使用tar全量备份sudo tar -cvpzf /backup/system-$(date %Y%m%d).tar.gz \ --exclude/backup \ --exclude/proc \ --exclude/tmp \ --exclude/mnt \ --exclude/dev \ --exclude/sys \ /12.2 数据库备份MySQL定时备份脚本#!/bin/bash DATE$(date %Y%m%d) BACKUP_DIR/backups/mysql USERroot PASSpassword mkdir -p $BACKUP_DIR mysqldump -u$USER -p$PASS --all-databases | gzip $BACKUP_DIR/full-$DATE.sql.gz # 保留最近7天备份 find $BACKUP_DIR -name *.sql.gz -mtime 7 -delete12.3 增量备份方案使用rsync进行增量备份rsync -avz --delete \ --link-dest/backups/last_full \ /source/directory/ \ /backups/incremental/$(date %Y%m%d)13. 安全加固指南13.1 系统安全基线更新系统sudo apt update sudo apt upgrade -y禁用不必要的服务sudo systemctl disable bluetooth配置防火墙sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow ssh sudo ufw enable安装安全工具sudo apt install fail2ban rkhunter lynis13.2 审计与监控启用auditdsudo apt install auditd sudo auditctl -e 1监控关键文件sudo auditctl -w /etc/passwd -p wa -k passwd_changes查看审计日志sudo ausearch -k passwd_changes | aureport -f -i14. 云计算集成14.1 AWS CLI配置安装与配置curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip unzip awscliv2.zip sudo ./aws/install aws configure常用命令# 查看EC2实例 aws ec2 describe-instances # 上传文件到S3 aws s3 cp file.txt s3://your-bucket/ # 创建CloudFormation堆栈 aws cloudformation create-stack --stack-name mystack --template-body file://template.yaml14.2 阿里云CLI安装curl -L https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o aliyun-cli.tgz tar xzvf aliyun-cli.tgz sudo cp aliyun /usr/local/bin配置aliyun configure使用示例# 查看ECS实例 aliyun ecs DescribeInstances # 创建SLB aliyun slb CreateLoadBalancer --RegionId cn-hangzhou --LoadBalancerName my-slb15. 开发环境配置15.1 Python环境使用pyenv管理多版本curl https://pyenv.run | bash echo export PATH$HOME/.pyenv/bin:$PATH ~/.bashrc echo eval $(pyenv init -) ~/.bashrc echo eval $(pyenv virtualenv-init -) ~/.bashrc source ~/.bashrc pyenv install 3.9.7 pyenv global 3.9.7创建虚拟环境python -m venv myenv source myenv/bin/activate15.2 Node.js环境使用nvm安装curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash source ~/.bashrc nvm install 16 nvm use 16常用npm命令npm init -y npm install express --save npm install -g nodemon16. 故障恢复策略16.1 系统崩溃恢复使用Live CD/USB启动挂载原系统分区mount /dev/sda1 /mnt mount --bind /dev /mnt/dev mount --bind /proc /mnt/proc mount --bind /sys /mnt/syschroot到原系统chroot /mnt /bin/bash修复问题grub-install /dev/sda update-grub16.2 数据恢复使用extundelete恢复删除的文件sudo apt install extundelete sudo umount /dev/sdb1 sudo extundelete /dev/sdb1 --restore-file /home/user/important.txt17. 性能调优实战17.1 数据库优化MySQL性能优化-- 创建索引 CREATE INDEX idx_name ON users(name); -- 分析查询 EXPLAIN SELECT * FROM users WHERE age 30; -- 优化表 OPTIMIZE TABLE large_table;Redis优化配置maxmemory 2gb maxmemory-policy allkeys-lru save 900 1 save 300 10 save 60 1000017.2 Web服务器优化Nginx调优参数worker_processes auto; worker_rlimit_nofile 100000; events { worker_connections 4096; multi_accept on; use epoll; } http { sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; keepalive_requests 100000; reset_timedout_connection on; }18. 高可用架构18.1 负载均衡配置Nginx负载均衡示例upstream backend { server 192.168.1.101:8080 weight5; server 192.168.1.102:8080; server 192.168.1.103:8080 backup; } server { location / { proxy_pass http://backend; proxy_next_upstream error timeout invalid_header http_500; } }18.2 数据库主从复制MySQL主库配置[mysqld] server-id1 log-binmysql-bin binlog-formatROW从库配置CHANGE MASTER TO MASTER_HOSTmaster_ip, MASTER_USERrepl_user, MASTER_PASSWORDpassword, MASTER_LOG_FILEmysql-bin.000001, MASTER_LOG_POS120; START SLAVE;19. 监控告警系统19.1 Prometheus部署安装wget https://github.com/prometheus/prometheus/releases/download/v2.30.3/prometheus-2.30.3.linux-amd64.tar.gz tar xvfz prometheus-*.tar.gz cd prometheus-* ./prometheus --config.fileprometheus.ymlNode Exporter安装wget https://github.com/prometheus/node_exporter/releases/download/v1.2.2/node_exporter-1.2.2.linux-amd64.tar.gz tar xvfz node_exporter-*.tar.gz cd node_exporter-* ./node_exporter19.2 Grafana配置安装sudo apt-get install -y adduser libfontconfig1 wget https://dl.grafana.com/oss/release/grafana_8.1.5_amd64.deb sudo dpkg -i grafana_8.1.5_amd64.deb sudo systemctl start grafana-server添加数据源访问http://localhost:3000添加Prometheus数据源导入官方仪表板如Node Exporter Full20. 持续集成部署20.1 Jenkins安装Docker方式运行docker run -d \ -p 8080:8080 \ -p 50000:50000 \ -v jenkins_home:/var/jenkins_home \ jenkins/jenkins:lts-jdk11获取初始密码docker exec container-id cat /var/jenkins_home/secrets/initialAdminPassword20.2 GitLab CI配置.gitlab-ci.yml示例stages: - build - test - deploy build_job: stage: build script: - mvn clean package artifacts: paths: - target/*.jar test_job: stage: test script: - mvn test deploy_job: stage: deploy script: - scp target/*.jar userserver:/opt/app - ssh userserver systemctl restart myapp only: - master21. 日志分析系统21.1 ELK Stack部署Docker Compose配置version: 3 services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.14.0 environment: - discovery.typesingle-node ports: - 9200:9200 volumes: - es_data:/usr/share/elasticsearch/data kibana: image: docker.elastic.co/kibana/kibana:7.14.0 ports: - 5601:5601 depends_on: - elasticsearch logstash: image: docker.elastic.co/logstash/logstash:7.14.0 volumes: - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf ports: - 5044:5044 depends_on: - elasticsearch volumes: es_data:Logstash配置示例input { beats { port 5044 } } filter { grok { match { message %{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message} } } } output { elasticsearch { hosts [elasticsearch:9200] } }22. 消息队列应用22.1 RabbitMQ安装Docker方式运行docker run -d \ --name rabbitmq \ -p 5672:5672 \ -p 15672:15672 \ rabbitmq:3-management常用命令# 查看队列 rabbitmqadmin list queues # 创建用户 rabbitmqctl add_user myuser mypassword rabbitmqctl set_user_tags myuser administrator22.2 Kafka集群Docker Compose配置version: 3 services: zookeeper: image: wurstmeister/zookeeper ports: - 2181:2181 kafka: image: wurstmeister/kafka ports: - 9092:9092 environment: KAFKA_ADVERTISED_HOST_NAME: kafka KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181 KAFKA_CREATE_TOPICS: test:1:1 volumes: - /var/run/docker.sock:/var/run/docker.sock基础操作# 创建topic docker exec kafka_kafka_1 kafka-topics.sh --create --topic test --partitions 1 --replication-factor 1 --bootstrap-server localhost:9092 # 生产消息 docker exec -it kafka_kafka_1 kafka-console-producer.sh --topic test --bootstrap-server localhost:9092 # 消费消息 docker exec -it kafka_kafka_1 kafka-console-consumer.sh --topic test --from-beginning --bootstrap-server localhost:909223. 缓存系统配置23.1 Redis安装与配置编译安装wget https://download.redis.io/releases/redis-6.2.5.tar.gz tar xzf redis-6.2.5.tar.gz cd redis-6.2.5 make make install生产环境配置bind 0.0.0.0 protected-mode yes port 6379 tcp-backlog 511 timeout 0 tcp-keepalive 300 daemonize yes supervised systemd pidfile /var/run/redis_6379.pid loglevel notice logfile /var/log/redis/redis.log databases 16 save 900 1 save 300 10 save 60 10000 stop-writes-on-bgsave-error yes rdbcompression yes rdbchecksum yes dbfilename dump.rdb dir /var/lib/redis requirepass yourstrongpassword maxclients 10000 maxmemory 2gb maxmemory-policy allkeys-lru appendonly yes appendfilename appendonly.aof appendfsync everysec no-appendfsync-on-rewrite no auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb aof-load-truncated yes aof-use-rdb-preamble yes lua-time-limit 5000 slowlog-log-slower-than 10000 slowlog-max-len 128 latency-monitor-threshold 0 notify-keyspace-events hash-max-ziplist-entries 512 hash-max-ziplist-value 64 list-max-ziplist-size -2 list-compress-depth 0 set-max-intset-entries 512 zset-max-ziplist-entries 128 zset-max-ziplist-value 64 hll-sparse-max-bytes 3000 stream-node-max-bytes 4096 stream-node-max-entries 100 activerehashing yes client-output-buffer-limit normal 0 0 0 client-output-buffer-limit replica 256mb 64mb 60 client-output-buffer-limit pubsub 32mb 8mb 60 hz 10 dynamic