CentOS7一键安全加固及系统优化脚本
init_centos7.sh 脚本内容如下 脚本说明：本脚本在 https://github.com/vtrois/spacepack上下载，并在其脚本基础上做了调整，根据前期CentOS7安全加固系列文章，添加了部分加固项
#!/usr/bin/env bash
#
# Author: Seaton Jiang <seaton@vtrois.com>
# Github URL: https://github.com/vtrois/spacepack
# License: MIT
# Date: 2020-08-13
export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
RGB_DANGER=\'\033[31;1m\'
RGB_WAIT=\'\033[37;2m\'
RGB_SUCCESS=\'\033[32m\'
RGB_WARNING=\'\033[33;1m\'
RGB_INFO=\'\033[36;1m\'
RGB_END=\'\033[0m\'
CHECK_CENTOS=$( cat /etc/redhat-release|sed -r \'s/.* ([0-9] )\..*/\1/\' )
CHECK_RAM=$( cat /proc/meminfo | grep "MemTotal" | awk -F" " \'{ram=$2/1000000}{printf("%.0f",ram)}\' )
LOCK=/var/log/init_centos7_record.log
tool_info() {
echo -e "========================================================================================="
echo -e " Init CentOS 7 Script "
echo -e " For more information please visit https://github.com/vtrois/spacepack "
echo -e "========================================================================================="
}
check_root(){
if [[ $EUID -ne 0 ]]; then
echo -e "${RGB_DANGER}This script must be run as root!${RGB_END}"
exit 1
fi
}
check_lock() {
if [ ! -f "$LOCK" ];then
touch $LOCK
else
echo -e "${RGB_DANGER}Detects that the initialization is complete and does not need to be initialized any further!${RGB_END}"
exit 1
fi
}
check_os() {
if [ "${CHECK_CENTOS}" != \'7\' ]; then
echo -e "${RGB_DANGER}This script must be run in CentOS 7!${RGB_END}"
exit 1
fi
}
new_swap() {
echo "============= swap =============" >> ${LOCK} 2>&1
if [ "${CHECK_RAM}" -le \'2\' ]; then
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
dd if=/dev/zero of=/swapfile bs=1024 count=1048576 >> ${LOCK} 2>&1
chmod 600 /swapfile >> ${LOCK} 2>&1
mkswap /swapfile >> ${LOCK} 2>&1
swapon /swapfile >> ${LOCK} 2>&1
echo \'/swapfile swap swap defaults 0 0\' >> /etc/fstab
echo \'# Swap\' >> /etc/sysctl.conf
echo \'vm.swappiness = 10\' >> /etc/sysctl.conf
sysctl -p >> ${LOCK} 2>&1
sysctl -n vm.swappiness >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
else
echo -e "${RGB_SUCCESS}Skip, no configuration needed${RGB_END}"
fi
}
open_bbr() {
echo "============= bbr =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
echo "# BBR" >> /etc/sysctl.conf
echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
sysctl -p >> ${LOCK} 2>&1
sysctl -n net.ipv4.tcp_congestion_control >> ${LOCK} 2>&1
lsmod | grep bbr >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
disable_software() {
echo "============= selinux firewalld =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
setenforce 0 >> ${LOCK} 2>&1
sed -i \'s/^SELINUX=.*$/SELINUX=disabled/\' /etc/selinux/config
systemctl disable firewalld.service >> ${LOCK} 2>&1
systemctl stop firewalld.service >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
time_zone() {
echo "============= time zone =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
rm -rf /etc/localtime >> ${LOCK} 2>&1
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime >> ${LOCK} 2>&1
ls -ln /etc/localtime >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
custom_profile() {
echo "============= custom profile =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
cat > /etc/profile.d/centos7init.sh << EOF
PS1="\[\e[37;40m\][\[\e[32;40m\]\u\[\e[37;40m\]@\h \[\e[35;40m\]\W\[\e[0m\]]\\\\$ "
GREP_OPTIONS="--color=auto"
alias l=\'ls -AFhlt\'
alias grep=\'grep --color\'
alias egrep=\'egrep --color\'
alias fgrep=\'fgrep --color\'
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
EOF
cat /etc/profile.d/centos7init.sh >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
adjust_ulimit() {
echo "============= adjust ulimit =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i \'/^# End of file/,$d\' /etc/security/limits.conf
cat >> /etc/security/limits.conf <# End of file
* soft core unlimited
* hard core unlimited
* soft nproc 1000000
* hard nproc 1000000
* soft nofile 1000000
* hard nofile 1000000
root soft core unlimited
root hard core unlimited
root soft nproc 1000000
root hard nproc 1000000
root soft nofile 1000000
root hard nofile 1000000
EOF
cat /etc/security/limits.conf >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
kernel_optimum() {
echo "============= kernel optimum =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
[ ! -e "/etc/sysctl.conf_bak" ] && /bin/mv /etc/sysctl.conf{,_bak}
cat > /etc/sysctl.conf << EOF
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.promote_secondaries = 1
net.ipv4.conf.default.promote_secondaries = 1
# Controls the use of TCP syncookies
# Number of pid_max
kernel.core_uses_pid = 1
kernel.pid_max = 1000000
net.ipv4.tcp_syncookies = 1
# Controls the maximum size of a message, in bytes
# Controls the default maxmimum size of a mesage queue
# Controls the maximum shared segment size, in bytes
# Controls the maximum number of shared memory segments, in pages
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
kernel.sysrq = 1
kernel.softlockup_panic = 1
kernel.printk = 5
# TCP kernel paramater
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_sack = 1
# Socket buffer
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 32768
net.core.somaxconn = 65535
net.core.optmem_max = 81920
# TCP conn
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_retries1 = 3
net.ipv4.tcp_retries2 = 15
# TCP conn reuse
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 5
net.ipv4.tcp_max_tw_buckets = 7000
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_synack_retries = 1
# keepalive conn
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.ip_local_port_range = 1024 65535
net.ipv6.neigh.default.gc_thresh3 = 4096
net.ipv4.neigh.default.gc_thresh3 = 4096
EOF
sysctl -p >> ${LOCK} 2>&1
cat /etc/sysctl.conf >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
updatedb_optimum() {
echo "============= updatedb optimum =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i \'s,media,media /data,\' /etc/updatedb.conf
cat /etc/updatedb.conf >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
open_ipv6() {
echo "============= open ipv6 =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
echo \'# IPV6\' >> /etc/sysctl.conf
echo \'net.ipv6.conf.all.disable_ipv6=0\' >> /etc/sysctl.conf
echo \'net.ipv6.conf.default.disable_ipv6=0\' >> /etc/sysctl.conf
echo \'net.ipv6.conf.lo.disable_ipv6=0\' >> /etc/sysctl.conf
sysctl -p >> ${LOCK} 2>&1
cat /etc/sysctl.conf >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
disable_cad() {
echo "============= disable cad =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
systemctl mask ctrl-alt-del.target >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
remove_users() {
echo "============= remove users =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
for u in adm lp sync shutdown halt mail operator games ftp
do
userdel ${u} >> ${LOCK} 2>&1
done
cut -d : -f 1 /etc/passwd >> ${LOCK} 2>&1
for g in adm lp mail games ftp
do
groupdel ${g} >> ${LOCK} 2>&1
done
cat /etc/group >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
sys_permissions() {
echo "============= sys permissions =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
chmod 644 /etc/passwd >> ${LOCK} 2>&1
chmod 644 /etc/group >> ${LOCK} 2>&1
chmod 000 /etc/shadow >> ${LOCK} 2>&1
chmod 000 /etc/gshadow >> ${LOCK} 2>&1
ls -la /etc/passwd >> ${LOCK} 2>&1
ls -la /etc/group >> ${LOCK} 2>&1
ls -la /etc/shadow >> ${LOCK} 2>&1
ls -la /etc/gshadow >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
password_policy() {
echo "============= password policy =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i \'s/^PASS_MAX_DAYS.*$/PASS_MAX_DAYS 90/\' /etc/login.defs
sed -i \'s/^PASS_MIN_DAYS.*$/PASS_MIN_DAYS 10/\' /etc/login.defs
cat /etc/login.defs >> ${LOCK} 2>&1
cat >>/etc/security/pwquality.conf << EOF
minlen = 8
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
EOF
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
change_useradd() {
echo "============= change useradd =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i \'s/^INACTIVE.*$/INACTIVE=180/\' /etc/default/useradd
cat /etc/default/useradd >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
sec_ssh() {
echo "============= sec ssh =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i \'s/UseDNS.*$/UseDNS no/\' /etc/ssh/sshd_config
sed -i \'s/^#LoginGraceTime.*$/LoginGraceTime 60/\' /etc/ssh/sshd_config
sed -i \'s/^#PermitEmptyPasswords.*$/PermitEmptyPasswords no/\' /etc/ssh/sshd_config
sed -i \'s/^#PubkeyAuthentication.*$/PubkeyAuthentication yes/\' /etc/ssh/sshd_config
sed -i \'s/^#MaxAuthTries.*$/MaxAuthTries 3/\' /etc/ssh/sshd_config
sed -i "s/#ClientAliveInterval 0/ClientAliveInterval 30/g" /etc/ssh/sshd_config
sed -i "s/#ClientAliveCountMax 3/ClientAliveCountMax 3/g" /etc/ssh/sshd_config
sed -i "s/X11Forwarding yes/X11Forwarding no/g" /etc/ssh/sshd_config
sed -i "s/#Banner none/Banner \/etc\/issue.net/g" /etc/ssh/sshd_config
echo "Authorized users only. All activity may be monitored and reported.">/etc/issue.net
systemctl restart sshd.service >> ${LOCK} 2>&1
cat /etc/ssh/sshd_config >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
timeout_config() {
echo "============= timeout config =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
echo "export TMOUT=1800" >> /etc/profile.d/centos7init.sh
cat /etc/profile.d/centos7init.sh >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
lockout_policy() {
echo "============= lockout policy =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
[ ! -e "/etc/pam.d/system-auth_bak" ] && /bin/mv /etc/pam.d/system-auth{,_bak}
cat > /etc/pam.d/system-auth << EOF
auth required pam_env.so
auth required pam_faillock.so preauth silent audit deny=3 unlock_time=300
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3 unlock_time=300
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
account required pam_faillock.so
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
EOF
[ ! -e "/etc/pam.d/password-auth_bak" ] && /bin/mv /etc/pam.d/password-auth{,_bak}
cat > /etc/pam.d/password-auth << EOF
auth required pam_env.so
auth required pam_faillock.so preauth silent audit deny=3 unlock_time=300
auth required pam_faildelay.so delay=2000000
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3 unlock_time=300
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
account required pam_faillock.so
password requisite pam_pwquality.so try_first_pass local_users_only
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
EOF
systemctl restart sshd.service >> ${LOCK} 2>&1
cat /etc/pam.d/etc/pam.d/system-auth >> ${LOCK} 2>&1
cat /etc/pam.d/password-auth >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}
reboot_os() {
echo -e "\n${RGB_WARNING}Please restart the server and see if the services start up fine.${RGB_END}"
echo -en "${RGB_WARNING}Do you want to restart OS ? [y/n]: ${RGB_END}"
while :; do
read REBOOT_STATUS
if [[ ! "${REBOOT_STATUS}" =~ ^[y,n]$ ]]; then
echo -en "${RGB_DANGER}Input error, please only input \'y\' or \'n\': ${RGB_END}"
else
break
fi
done
[ "${REBOOT_STATUS}" == \'y\' ] && reboot
}
main() {
echo -e "\n${RGB_INFO}1/18 : Start Init CentOS7 Script ${RGB_END}"
echo -e "\n${RGB_INFO}2/18 : Customize the profile (color and alias)${RGB_END}"
custom_profile
echo -e "\n${RGB_INFO}3/18 : Time zone adjustment${RGB_END}"
time_zone
echo -e "\n${RGB_INFO}4/18 : Disable selinux and firewalld${RGB_END}"
disable_software
echo -e "\n${RGB_INFO}5/18 : Disable Ctrl Alt Del${RGB_END}"
disable_cad
echo -e "\n${RGB_INFO}6/18 : Kernel parameter optimization${RGB_END}"
kernel_optimum
echo -e "\n${RGB_INFO}7/18 : The updatedb optimization${RGB_END}"
updatedb_optimum
echo -e "\n${RGB_INFO}8/18 : Adding swap space${RGB_END}"
new_swap
echo -e "\n${RGB_INFO}9/18 : Adjustment of ulimit${RGB_END}"
adjust_ulimit
echo -e "\n${RGB_INFO}10/18 : Enable tcp bbr congestion control algorithm${RGB_END}"
open_bbr
echo -e "\n${RGB_INFO}11/18 : Enable IPV6${RGB_END}"
open_ipv6
echo -e "\n${RGB_INFO}12/18 : Remove unnecessary users and user groups from the system${RGB_END}"
remove_users
echo -e "\n${RGB_INFO}13/18 : System permissions for sensitive files${RGB_END}"
sys_permissions
echo -e "\n${RGB_INFO}14/18 : Modify Account Password Survival Policy${RGB_END}"
password_policy
echo -e "\n${RGB_INFO}15/18 : Maximum number of days an account is valid after password expiration strategy${RGB_END}"
change_useradd
echo -e "\n${RGB_INFO}16/18 : Secure configuration of SSH${RGB_END}"
sec_ssh
echo -e "\n${RGB_INFO}17/18 : Timeout Auto-Logout Configuration${RGB_END}"
timeout_config
echo -e "\n${RGB_INFO}18/18 : Configure account login failure lockout policy${RGB_END}"
lockout_policy
reboot_os
}
clear
tool_info
check_root
check_os
check_lock
main
测试执行截图如下
再次执行脚本会提示已经做了安全加固优化，无须再次执行
内容出处：，
声明：本网站所收集的部分公开资料来源于互联网，转载的目的在于传递更多信息及用于网络分享，并不代表本站赞同其观点和对其真实性负责，也不构成任何其他建议。如果您发现网站上有侵犯您的知识产权的作品，请与我们取得联系，我们会及时修改或删除。文章链接：http://www.yixao.com/share/14492.html
赞 (0)
打赏
微信扫一扫
支付宝扫一扫
微信扫一扫
支付宝扫一扫
阳光正义的割韭菜 理财暴利攻略
上一篇
2020-11-14 08:12
超轻巧Canvas图表库
下一篇
2020-11-15 11:02
相关推荐
-
UME–丰富的Flutter调试工具
背景 目前西瓜视频作者侧 Flutter 业务场景已经覆盖了 80% (包括视频播放场景)，用户侧核心场景包括我的 Tab 也已经是 Flutter，在开发过程中，暴露了一些问题，…
-
OpenBLT Bootloader的使用分享
OpenBLT 简介 OpenBLT是一种开源引导加载程序，可以在任何微控制器上运行并使用任何类型的通信接口来执行软件更新，而无需专用的调试器硬件。 官网介绍页： https://…
-
收藏这些网站，了解最新黑科技动向
当别人在朋友圈晒娃晒自己的时候，作为没有颜值的单身狗，你该如何去叱咤朋友圈呢？别着急，天无绝人之路，你还可以靠才华啊。收好下面这些网站，从此黑科技滚滚而来，你就是朋友圈中的大神！ …
-
推荐15个发外链的方法和资源！
废话不多说，今天给大家讲：15个发外链的方法，肯定有一个适合你！ 辅助网站的SEO优化的外链平台、外链方法综合： 常用的平台有：飞骑网、精度、红网、客至上、36推、华夏网、39栋同…
-
SQLite工具类：SQLiteHelper
工具类前期准备： 1.System.Data.SQLite 库下载，用于C#操作SQLite的dll文件。下载地址：http://system.data.sqlite.org/in…
-
Lyrebird–美团开源的抓包及Mock工具
1. 前言 抓包和 Mock 是日常工作中经常用到的 2 个功能，可能第一时间你会想到 Charles、Fiddler 但是这两款工具在 Mock 数据管理上功能过于简单，并且扩展…
-
一个基于Vue3 + Vant3的开源商城项目开源了
开源地址 所有的代码、文件全部都开源到 GitHub 仓库中，并没有任何藏着掖着的行为，不会说缺少哪个页面或者某个重要功能，这种事情是不存在的，大家先看看文章和预览图，觉得不错的朋…
-
分享7个被你忽略的精美网站
Good Resume Good Resume 是一个质量很高的简历模板网站，它提供了丰富的免费简历模板，每一个模板都是非常精美，质量极高。 你可以利用网站导航栏的模板分类功能找到…
-
php开发的简单轻量级的web防火墙，拦截SQL注入和XSS攻击
一个朋友发给我看的小的web防火墙，是基于php开发的，整体就一个文件，比较简单，能拦截一些SQL注入和XSS攻击，整个代码也是100多行，主要就是利用一些正则匹配拦截。还支持自定…
-
这些风靡一时的前端开发神器，你还在用吗？
随着前端开发的兴起，很多编辑器、工具、框架都蜂拥而至，很多程序员也都有一些不错的选择，以下这七大开发神器，程序员不妨试试。 标配的功能基本都是带有颜色标识的HTML、CSS和Jav…