\u8ba9\u6211\u4eec\u4f7f\u7528Ubuntu Server 22.04 LTS\u5efa\u7acb\u5b89\u5168\u57fa\u7840\u3002\u4ee5\u4e0b\u662f\u83b7\u5f97SSH\u8bbf\u95ee\u6743\u9650\u540e\u7684\u7b2c\u4e00\u7ec4\u57fa\u672c\u547d\u4ee4\uff1a<\/p>\n

\r\n# \u66f4\u65b0\u7cfb\u7edf\u5305\r\nsudo apt update && sudo apt upgrade -y\r\n\r\n# \u5b89\u88c5\u57fa\u672c\u5b89\u5168\u5de5\u5177\r\nsudo apt install ufw fail2ban unattended-upgrades -y\r\n\r\n# \u914d\u7f6e\u81ea\u52a8\u5b89\u5168\u66f4\u65b0\r\nsudo dpkg-reconfigure --priority=low unattended-upgrades\r\n<\/code><\/pre>\n
\u52a0\u56faSSH\u8bbf\u95ee<\/h3>\n
\u4f7f\u7528\u8fd9\u4e9b\u5b89\u5168\u6027\u53c2\u6570\u4fee\u6539\/etc\/ssh\/sshd_config\u4e2d\u7684SSH\u914d\u7f6e\uff1a<\/p>\n
\r\nPort 2222                    # \u66f4\u6539\u9ed8\u8ba4SSH\u7aef\u53e3\r\nPermitRootLogin no          # \u7981\u7528root\u767b\u5f55\r\nPasswordAuthentication no    # \u4ec5\u4f7f\u7528\u57fa\u4e8e\u5bc6\u94a5\u7684\u8eab\u4efd\u9a8c\u8bc1\r\nMaxAuthTries 3              # \u9650\u5236\u767b\u5f55\u5c1d\u8bd5\u6b21\u6570\r\nProtocol 2                  # \u4ec5\u4f7f\u7528SSH\u534f\u8bae2\r\n<\/code><\/pre>\n
Web\u670d\u52a1\u5668\u914d\u7f6e<\/strong><\/h2>\n
\u6211\u4eec\u5c06\u4ee5\u5b89\u5168\u4f18\u5148\u7684\u65b9\u5f0f\u5b9e\u65bdNginx\u3002\u4ee5\u4e0b\u662f\u5e73\u8861\u5b89\u5168\u6027\u548c\u6027\u80fd\u7684\u751f\u4ea7\u7ea7\u914d\u7f6e\uff1a<\/p>\n
\r\nserver {\r\n    listen 443 ssl http2;\r\n    server_name example.com;\r\n    \r\n    # SSL\u914d\u7f6e\r\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\r\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\r\n    ssl_protocols TLSv1.2 TLSv1.3;\r\n    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;\r\n    \r\n    # \u5b89\u5168\u6807\u5934\r\n    add_header X-Frame-Options \"SAMEORIGIN\";\r\n    add_header X-XSS-Protection \"1; mode=block\";\r\n    add_header Content-Security-Policy \"default-src 'self';\";\r\n    \r\n    # \u6027\u80fd\u4f18\u5316\r\n    location ~* \\.(jpg|jpeg|png|gif|ico|css|js)$ {\r\n        expires 365d;\r\n        add_header Cache-Control \"public, no-transform\";\r\n    }\r\n}\r\n<\/code><\/pre>\n
DDoS\u9632\u62a4\u5b9e\u65bd<\/strong><\/h2>\n
\u4f7f\u7528iptables\u548cNginx\u5b9e\u65bd\u901f\u7387\u9650\u5236\u548c\u8fde\u63a5\u63a7\u5236\u3002\u4ee5\u4e0b\u662f\u53ef\u9632\u6b62\u5927\u591a\u6570DDoS\u653b\u51fb\u7684\u5f3a\u5927\u914d\u7f6e\uff1a<\/p>\n
\r\n# \u914d\u7f6eiptables\u901f\u7387\u9650\u5236\r\nsudo iptables -A INPUT -p tcp --dport 80 -m limit --limit 25\/minute --limit-burst 100 -j ACCEPT\r\n\r\n# Nginx\u901f\u7387\u9650\u5236\u914d\u7f6e\r\nhttp {\r\n    limit_req_zone $binary_remote_addr zone=one:10m rate=1r\/s;\r\n    limit_conn_zone $binary_remote_addr zone=addr:10m;\r\n    \r\n    server {\r\n        location \/ {\r\n            limit_req zone=one burst=5;\r\n            limit_conn addr 10;\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u6027\u80fd\u4f18\u5316\u7b56\u7565<\/strong><\/h2>\n
\u6570\u636e\u5e93\u4f18\u5316<\/h3>\n
\u5bf9\u4e8eMySQL\u6570\u636e\u5e93\uff0c\u4ee5\u4e0b\u662f16GB RAM\u670d\u52a1\u5668\u7684\u6027\u80fd\u4f18\u5316\u914d\u7f6e\uff1a<\/p>\n
\r\n[mysqld]\r\ninnodb_buffer_pool_size = 8G\r\ninnodb_log_file_size = 512M\r\ninnodb_flush_method = O_DIRECT\r\ninnodb_flush_log_at_trx_commit = 2\r\nmax_connections = 500\r\n\r\n# \u67e5\u8be2\u7f13\u5b58\u8bbe\u7f6e\uff08\u5982\u679c\u4f7f\u7528MySQL 5.7\uff09\r\nquery_cache_type = 1\r\nquery_cache_size = 128M\r\nquery_cache_limit = 2M\r\n<\/code><\/pre>\n
Redis\u7f13\u5b58\u5b9e\u65bd<\/h3>\n
\u4f7f\u7528\u6b64\u4f18\u5316\u914d\u7f6e\u5b9e\u65bdRedis\u4f5c\u4e3a\u7f13\u5b58\u5c42\uff1a<\/p>\n
\r\nmaxmemory 4gb\r\nmaxmemory-policy allkeys-lru\r\nsave 900 1\r\nsave 300 10\r\nsave 60 10000\r\nappendonly yes\r\nappendfsync everysec\r\n<\/code><\/pre>\n
\u76d1\u63a7\u548c\u544a\u8b66\u8bbe\u7f6e<\/strong><\/h2>\n
\u90e8\u7f72Prometheus\u548cGrafana\u8fdb\u884c\u5168\u9762\u76d1\u63a7\u3002\u4ee5\u4e0b\u662f\u8bbe\u7f6e\u6574\u4e2a\u76d1\u63a7\u5806\u6808\u7684Docker Compose\u914d\u7f6e\uff1a<\/p>\n
\r\nversion: '3.8'\r\nservices:\r\n  prometheus:\r\n    image: prom\/prometheus:latest\r\n    volumes:\r\n      - .\/prometheus.yml:\/etc\/prometheus\/prometheus.yml\r\n    command:\r\n      - '--config.file=\/etc\/prometheus\/prometheus.yml'\r\n      - '--storage.tsdb.retention.time=15d'\r\n    ports:\r\n      - \"9090:9090\"\r\n\r\n  grafana:\r\n    image: grafana\/grafana:latest\r\n    environment:\r\n      - GF_SECURITY_ADMIN_PASSWORD=secure_password_here\r\n    ports:\r\n      - \"3000:3000\"\r\n    volumes:\r\n      - grafana-storage:\/var\/lib\/grafana\r\n\r\nvolumes:\r\n  grafana-storage:\r\n<\/code><\/pre>\n
\u5907\u4efd\u548c\u707e\u96be\u6062\u590d<\/strong><\/h2>\n
\u4f7f\u7528\u6b64bash\u811a\u672c\u5b9e\u65bd\u81ea\u52a8\u5907\u4efd\uff0c\u8be5\u811a\u672c\u540c\u65f6\u5904\u7406\u6570\u636e\u5e93\u548c\u6587\u4ef6\u7cfb\u7edf\u5907\u4efd\uff1a<\/p>\n
\r\n#!\/bin\/bash\r\n\r\n# \u914d\u7f6e\r\nBACKUP_DIR=\"\/backup\"\r\nMYSQL_USER=\"backup_user\"\r\nMYSQL_PASS=\"secure_password\"\r\nRETENTION_DAYS=7\r\n\r\n# \u6570\u636e\u5e93\u5907\u4efd\r\nmysqldump --user=$MYSQL_USER --password=$MYSQL_PASS --all-databases | \\\r\ngzip > \"$BACKUP_DIR\/db_backup_$(date +%Y%m%d).sql.gz\"\r\n\r\n# \u5e94\u7528\u7a0b\u5e8f\u6587\u4ef6\u5907\u4efd\r\ntar -czf \"$BACKUP_DIR\/app_backup_$(date +%Y%m%d).tar.gz\" \/var\/www\/\r\n\r\n# \u4e0a\u4f20\u5230S3\uff08\u5982\u679c\u5df2\u914d\u7f6e\uff09\r\naws s3 sync $BACKUP_DIR s3:\/\/your-bucket\/backups\/\r\n\r\n# \u6e05\u7406\u65e7\u5907\u4efd\r\nfind $BACKUP_DIR -type f -mtime +$RETENTION_DAYS -delete\r\n<\/code><\/pre>\n
\u6545\u969c\u6392\u9664\u5e38\u89c1\u95ee\u9898<\/strong><\/h2>\n
\u6027\u80fd\u964d\u7ea7\u5206\u6790<\/h3>\n
\r\n# \u68c0\u67e5\u5f53\u524d\u7cfb\u7edf\u8d1f\u8f7d\r\ntop -b -n 1\r\n\r\n# \u76d1\u63a7\u78c1\u76d8I\/O\r\niostat -xz 1\r\n\r\n# \u8ddf\u8e2a\u7f51\u7edc\u8fde\u63a5\r\nnetstat -tuln\r\n\r\n# \u5206\u6790MySQL\u6162\u67e5\u8be2\r\nmysqldumpslow \/var\/log\/mysql\/mysql-slow.log\r\n\r\n# \u76d1\u63a7PHP-FPM\u8fdb\u7a0b\r\npm.status_path = \/status\r\npm.max_children = 50\r\npm.start_servers = 5\r\npm.min_spare_servers = 5\r\npm.max_spare_servers = 35\r\n<\/code><\/pre>\n
\u5b89\u5168\u4e8b\u4ef6\u54cd\u5e94<\/strong><\/h2>\n
\u5f53\u68c0\u6d4b\u5230\u53ef\u7591\u6d3b\u52a8\u65f6\uff0c\u6267\u884c\u6b64\u4e8b\u4ef6\u54cd\u5e94\u65b9\u6848\uff1a<\/p>\n
\r\n# \u68c0\u67e5\u672a\u6388\u6743\u8fdb\u7a0b\r\nps aux | grep -i suspicious_process\r\n\r\n# \u67e5\u770b\u8ba4\u8bc1\u5c1d\u8bd5\r\ngrep \"Failed password\" \/var\/log\/auth.log\r\n\r\n# \u68c0\u67e5\u7f51\u7edc\u8fde\u63a5\r\nlsof -i | grep ESTABLISHED\r\n\r\n# \u9a8c\u8bc1\u6587\u4ef6\u5b8c\u6574\u6027\r\nfind \/var\/www -type f -mtime -1 -ls\r\n<\/code><\/pre>\n
\u6700\u4f73\u5b9e\u8df5\u548c\u672a\u6765\u8003\u8651<\/strong><\/h2>\n
\u968f\u7740Web\u5e94\u7528\u7a0b\u5e8f\u90e8\u7f72\u7b56\u7565\u7684\u53d1\u5c55\uff0c\u8bf7\u8003\u8651\u4ee5\u4e0b\u9ad8\u7ea7\u5b9e\u8df5\uff1a<\/p>\n
\n
\u4f7f\u7528Terraform\u5b9e\u65bd\u57fa\u7840\u8bbe\u65bd\u5373\u4ee3\u7801<\/li>\n
\u4f7f\u7528\u5bb9\u5668\u5316\u548cKubernetes\u90e8\u7f72\u5e94\u7528\u7a0b\u5e8f<\/li>\n
\u5229\u7528GitOps\u5de5\u4f5c\u6d41\u8fdb\u884c\u81ea\u52a8\u90e8\u7f72<\/li>\n
\u5b9e\u65bd\u96f6\u4fe1\u4efb\u5b89\u5168\u67b6\u6784<\/li>\n<\/ul>\n
\u57fa\u7840\u8bbe\u65bd\u5373\u4ee3\u7801\u793a\u4f8b<\/h3>\n
\r\nprovider \"aws\" {\r\n  region = \"us-east-1\"\r\n}\r\n\r\nresource \"aws_instance\" \"web_server\" {\r\n  ami           = \"ami-0c55b159cbfafe1f0\"\r\n  instance_type = \"t3.medium\"\r\n\r\n  tags = {\r\n    Name = \"WebApp-Production\"\r\n    Environment = \"Production\"\r\n  }\r\n\r\n  root_block_device {\r\n    volume_size = 50\r\n    encrypted   = true\r\n  }\r\n\r\n  vpc_security_group_ids = [aws_security_group.web.id]\r\n}\r\n<\/code><\/pre>\n
\u7ed3\u8bba<\/strong><\/h2>\n
\u6210\u529f\u90e8\u7f72\u548c\u4fdd\u62a4Web\u5e94\u7528\u7a0b\u5e8f\u9700\u8981\u5168\u9762\u7406\u89e3\u57fa\u7840\u8bbe\u65bd\u3001\u5b89\u5168\u6027\u548c\u6027\u80fd\u4f18\u5316\u3002\u901a\u8fc7\u9075\u5faa\u672c\u6307\u5357\u7684\u6280\u672f\u5b9e\u65bd\u548c\u6700\u4f73\u5b9e\u8df5\uff0c\u60a8\u5df2\u4e3a\u6784\u5efa\u5f3a\u5927\u3001\u5b89\u5168\u548c\u9ad8\u6027\u80fd\u7684Web\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u5960\u5b9a\u4e86\u57fa\u7840\u3002\u8bf7\u8bb0\u4f4f\u5b9a\u671f\u68c0\u67e5\u548c\u66f4\u65b0\u60a8\u7684\u914d\u7f6e\uff0c\u4ee5\u5e94\u5bf9\u65b0\u51fa\u73b0\u7684\u5b89\u5168\u6311\u6218\u548c\u6027\u80fd\u4f18\u5316\u6280\u672f\u3002<\/p>\n
\u5bf9\u4e8e\u5e0c\u671b\u6df1\u5165\u7814\u7a76\u7684\u4eba\u6765\u8bf4\uff0c\u53ef\u4ee5\u8003\u8651\u63a2\u7d22\u670d\u52a1\u7f51\u683c\u67b6\u6784\u3001\u65e0\u670d\u52a1\u5668\u8ba1\u7b97\u548cAI\u9a71\u52a8\u7684\u5b89\u5168\u76d1\u63a7\u7cfb\u7edf\u7b49\u9ad8\u7ea7\u4e3b\u9898\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row][vc_column][vc_column_text css=””] \u5728\u7f8e\u56fd\u670d\u52a1\u5668\u4e0a\u90e8\u7f72Web\u5e94\u7528\u7a0b\u5e8f\u9700\u8981\u4ed4\u7ec6\u89c4\u5212\uff0c\u5e76\u6df1\u5165\u7406\u89e3\u57fa\u7840\u8bbe\u65bd\u548c\u5b89\u5168\u6027\u8003\u8651\u56e0\u7d20\u3002\u8fd9\u4efd\u5168\u9762\u7684\u6307\u5357\u6df1\u5165\u63a2\u8ba8\u4e86\u670d\u52a1\u5668\u8bbe\u7f6e\u3001\u5b89\u5168\u52a0\u56fa\u548c\u6027\u80fd\u4f18\u5316\u7684\u6280\u672f\u65b9\u9762\u3002\u65e0\u8bba\u60a8\u662f\u6b63\u5728\u521b\u5efa\u521d\u521b\u4f01\u4e1a\u8fd8\u662f\u6269\u5c55\u4f01\u4e1a\u5e94\u7528\u7a0b\u5e8f\uff0c\u8fd9\u4e9b\u7ecf\u8fc7\u5b9e\u6218\u68c0\u9a8c\u7684\u505a\u6cd5\u90fd\u5c06\u5e2e\u52a9\u60a8\u5efa\u7acb\u4e00\u4e2a\u5f3a\u5927\u7684\u6258\u7ba1\u73af\u5883\u3002 \u9009\u62e9\u6b63\u786e\u7684\u670d\u52a1\u5668\u57fa\u7840\u8bbe\u65bd \u670d\u52a1\u5668\u57fa\u7840\u8bbe\u65bd\u7684\u9009\u62e9\u5bf9Web\u5e94\u7528\u7a0b\u5e8f\u7684\u6027\u80fd\u81f3\u5173\u91cd\u8981\u3002\u5728\u505a\u51fa\u9009\u62e9\u65f6\uff0c\u8bf7\u8003\u8651\u4ee5\u4e0b\u6280\u672f\u56e0\u7d20\uff1a \u72ec\u7acb\u670d\u52a1\u5668\uff1a \u5b8c\u6574\u7684\u786c\u4ef6\u8d44\u6e90\u5206\u914d \u5bf9\u670d\u52a1\u5668\u914d\u7f6e\u7684\u5b8c\u5168\u63a7\u5236 \u9002\u5408\u9ad8\u6027\u80fd\u9700\u6c42 \u6700\u9002\u5408\u9700\u8981\u6700\u9ad8\u5b89\u5168\u6027\u7684\u5e94\u7528\u7a0b\u5e8f \u865a\u62df\u4e13\u7528\u670d\u52a1\u5668\uff08VPS\uff09\uff1a \u5e73\u8861\u7684\u8d44\u6e90\u5206\u914d \u826f\u597d\u7684\u6027\u80fd\u6210\u672c\u6bd4 \u9002\u5408\u4e2d\u7b49\u6d41\u91cf\u7684\u5e94\u7528\u7a0b\u5e8f \u7075\u6d3b\u7684\u6269\u5c55\u9009\u9879 \u4e91\u57fa\u7840\u8bbe\u65bd\uff1a \u6309\u9700\u8d44\u6e90\u6269\u5c55 \u6309\u4f7f\u7528\u4ed8\u8d39\u6a21\u5f0f \u5168\u7403\u53ef\u7528\u533a \u96c6\u6210\u670d\u52a1\u548c\u5de5\u5177 \u521d\u59cb\u670d\u52a1\u5668\u8bbe\u7f6e\u548c\u5b89\u5168\u57fa\u51c6 \u8ba9\u6211\u4eec\u4f7f\u7528Ubuntu Server 22.04 LTS\u5efa\u7acb\u5b89\u5168\u57fa\u7840\u3002\u4ee5\u4e0b\u662f\u83b7\u5f97SSH\u8bbf\u95ee\u6743\u9650\u540e\u7684\u7b2c\u4e00\u7ec4\u57fa\u672c\u547d\u4ee4\uff1a # \u66f4\u65b0\u7cfb\u7edf\u5305 sudo apt update && sudo apt upgrade -y # \u5b89\u88c5\u57fa\u672c\u5b89\u5168\u5de5\u5177 sudo apt install ufw fail2ban unattended-upgrades -y # \u914d\u7f6e\u81ea\u52a8\u5b89\u5168\u66f4\u65b0 sudo dpkg-reconfigure –priority=low unattended-upgrades \u52a0\u56faSSH\u8bbf\u95ee \u4f7f\u7528\u8fd9\u4e9b\u5b89\u5168\u6027\u53c2\u6570\u4fee\u6539\/etc\/ssh\/sshd_config\u4e2d\u7684SSH\u914d\u7f6e\uff1a Port 2222 # […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":22227,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4816],"tags":[6456,6457,4853,3345,770],"class_list":["post-22231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-sc","tag-web-app-deployment-sc","tag-server-hardening-sc","tag-us-hosting-sc","tag-web-application-security-sc","tag-server-configuration-sc"],"acf":[],"yoast_head":"\n