\u8b93\u6211\u5011\u4f7f\u7528Ubuntu Server 22.04 LTS\u5efa\u7acb\u5b89\u5168\u57fa\u790e\u3002\u4ee5\u4e0b\u662f\u7372\u5f97SSH\u5b58\u53d6\u6b0a\u9650\u5f8c\u7684\u7b2c\u4e00\u7d44\u57fa\u672c\u547d\u4ee4\uff1a<\/p>\n

\r\n# \u66f4\u65b0\u7cfb\u7d71\u5957\u4ef6\r\nsudo apt update && sudo apt upgrade -y\r\n\r\n# \u5b89\u88dd\u57fa\u672c\u5b89\u5168\u5de5\u5177\r\nsudo apt install ufw fail2ban unattended-upgrades -y\r\n\r\n# \u914d\u7f6e\u81ea\u52d5\u5b89\u5168\u66f4\u65b0\r\nsudo dpkg-reconfigure --priority=low unattended-upgrades\r\n<\/code><\/pre>\n
\u5f37\u5316SSH\u5b58\u53d6<\/h3>\n
\u4f7f\u7528\u9019\u4e9b\u5b89\u5168\u6027\u53c3\u6578\u4fee\u6539\/etc\/ssh\/sshd_config\u4e2d\u7684SSH\u914d\u7f6e\uff1a<\/p>\n
\r\nPort 2222                    # \u66f4\u6539\u9810\u8a2dSSH\u57e0\r\nPermitRootLogin no          # \u505c\u7528root\u767b\u5165\r\nPasswordAuthentication no    # \u50c5\u4f7f\u7528\u57fa\u65bc\u91d1\u9470\u7684\u8eab\u4efd\u9a57\u8b49\r\nMaxAuthTries 3              # \u9650\u5236\u767b\u5165\u5617\u8a66\u6b21\u6578\r\nProtocol 2                  # \u50c5\u4f7f\u7528SSH\u5354\u5b9a2\r\n<\/code><\/pre>\n
Web\u4f3a\u670d\u5668\u914d\u7f6e<\/strong><\/h2>\n
\u6211\u5011\u5c07\u4ee5\u5b89\u5168\u512a\u5148\u7684\u65b9\u5f0f\u5be6\u65bdNginx\u3002\u4ee5\u4e0b\u662f\u5e73\u8861\u5b89\u5168\u6027\u548c\u6548\u80fd\u7684\u751f\u7522\u7d1a\u914d\u7f6e\uff1a<\/p>\n
\r\nserver {\r\n    listen 443 ssl http2;\r\n    server_name example.com;\r\n    \r\n    # SSL\u914d\u7f6e\r\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\r\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\r\n    ssl_protocols TLSv1.2 TLSv1.3;\r\n    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;\r\n    \r\n    # \u5b89\u5168\u6a19\u982d\r\n    add_header X-Frame-Options \"SAMEORIGIN\";\r\n    add_header X-XSS-Protection \"1; mode=block\";\r\n    add_header Content-Security-Policy \"default-src 'self';\";\r\n    \r\n    # \u6548\u80fd\u6700\u4f73\u5316\r\n    location ~* \\.(jpg|jpeg|png|gif|ico|css|js)$ {\r\n        expires 365d;\r\n        add_header Cache-Control \"public, no-transform\";\r\n    }\r\n}\r\n<\/code><\/pre>\n
DDoS\u9632\u8b77\u5be6\u65bd<\/strong><\/h2>\n
\u4f7f\u7528iptables\u548cNginx\u5be6\u65bd\u901f\u7387\u9650\u5236\u548c\u9023\u63a5\u63a7\u5236\u3002\u4ee5\u4e0b\u662f\u53ef\u9632\u6b62\u5927\u591a\u6578DDoS\u653b\u64ca\u7684\u5f37\u5065\u914d\u7f6e\uff1a<\/p>\n
\r\n# \u914d\u7f6eiptables\u901f\u7387\u9650\u5236\r\nsudo iptables -A INPUT -p tcp --dport 80 -m limit --limit 25\/minute --limit-burst 100 -j ACCEPT\r\n\r\n# Nginx\u901f\u7387\u9650\u5236\u914d\u7f6e\r\nhttp {\r\n    limit_req_zone $binary_remote_addr zone=one:10m rate=1r\/s;\r\n    limit_conn_zone $binary_remote_addr zone=addr:10m;\r\n    \r\n    server {\r\n        location \/ {\r\n            limit_req zone=one burst=5;\r\n            limit_conn addr 10;\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u6548\u80fd\u6700\u4f73\u5316\u7b56\u7565<\/strong><\/h2>\n
\u8cc7\u6599\u5eab\u6700\u4f73\u5316<\/h3>\n
\u5c0d\u65bcMySQL\u8cc7\u6599\u5eab\uff0c\u4ee5\u4e0b\u662f16GB RAM\u4f3a\u670d\u5668\u7684\u6548\u80fd\u6700\u4f73\u5316\u914d\u7f6e\uff1a<\/p>\n
\r\n[mysqld]\r\ninnodb_buffer_pool_size = 8G\r\ninnodb_log_file_size = 512M\r\ninnodb_flush_method = O_DIRECT\r\ninnodb_flush_log_at_trx_commit = 2\r\nmax_connections = 500\r\n\r\n# \u67e5\u8a62\u5feb\u53d6\u8a2d\u7f6e\uff08\u5982\u679c\u4f7f\u7528MySQL 5.7\uff09\r\nquery_cache_type = 1\r\nquery_cache_size = 128M\r\nquery_cache_limit = 2M\r\n<\/code><\/pre>\n
Redis\u5feb\u53d6\u5be6\u65bd<\/h3>\n
\u4f7f\u7528\u6b64\u6700\u4f73\u5316\u914d\u7f6e\u5be6\u65bdRedis\u4f5c\u70ba\u5feb\u53d6\u5c64\uff1a<\/p>\n
\r\nmaxmemory 4gb\r\nmaxmemory-policy allkeys-lru\r\nsave 900 1\r\nsave 300 10\r\nsave 60 10000\r\nappendonly yes\r\nappendfsync everysec\r\n<\/code><\/pre>\n
\u76e3\u63a7\u548c\u8b66\u5831\u8a2d\u7f6e<\/strong><\/h2>\n
\u90e8\u7f72Prometheus\u548cGrafana\u9032\u884c\u5168\u9762\u76e3\u63a7\u3002\u4ee5\u4e0b\u662f\u8a2d\u7f6e\u6574\u500b\u76e3\u63a7\u5806\u758a\u7684Docker Compose\u914d\u7f6e\uff1a<\/p>\n
\r\nversion: '3.8'\r\nservices:\r\n  prometheus:\r\n    image: prom\/prometheus:latest\r\n    volumes:\r\n      - .\/prometheus.yml:\/etc\/prometheus\/prometheus.yml\r\n    command:\r\n      - '--config.file=\/etc\/prometheus\/prometheus.yml'\r\n      - '--storage.tsdb.retention.time=15d'\r\n    ports:\r\n      - \"9090:9090\"\r\n\r\n  grafana:\r\n    image: grafana\/grafana:latest\r\n    environment:\r\n      - GF_SECURITY_ADMIN_PASSWORD=secure_password_here\r\n    ports:\r\n      - \"3000:3000\"\r\n    volumes:\r\n      - grafana-storage:\/var\/lib\/grafana\r\n\r\nvolumes:\r\n  grafana-storage:\r\n<\/code><\/pre>\n
\u5099\u4efd\u548c\u707d\u96e3\u5fa9\u539f<\/strong><\/h2>\n
\u4f7f\u7528\u6b64bash\u6307\u4ee4\u78bc\u5be6\u65bd\u81ea\u52d5\u5099\u4efd\uff0c\u8a72\u6307\u4ee4\u78bc\u540c\u6642\u8655\u7406\u8cc7\u6599\u5eab\u548c\u6a94\u6848\u7cfb\u7d71\u5099\u4efd\uff1a<\/p>\n
\r\n#!\/bin\/bash\r\n\r\n# \u914d\u7f6e\r\nBACKUP_DIR=\"\/backup\"\r\nMYSQL_USER=\"backup_user\"\r\nMYSQL_PASS=\"secure_password\"\r\nRETENTION_DAYS=7\r\n\r\n# \u8cc7\u6599\u5eab\u5099\u4efd\r\nmysqldump --user=$MYSQL_USER --password=$MYSQL_PASS --all-databases | \\\r\ngzip > \"$BACKUP_DIR\/db_backup_$(date +%Y%m%d).sql.gz\"\r\n\r\n# \u61c9\u7528\u7a0b\u5f0f\u6a94\u6848\u5099\u4efd\r\ntar -czf \"$BACKUP_DIR\/app_backup_$(date +%Y%m%d).tar.gz\" \/var\/www\/\r\n\r\n# \u4e0a\u50b3\u81f3S3\uff08\u5982\u679c\u5df2\u914d\u7f6e\uff09\r\naws s3 sync $BACKUP_DIR s3:\/\/your-bucket\/backups\/\r\n\r\n# \u6e05\u7406\u820a\u5099\u4efd\r\nfind $BACKUP_DIR -type f -mtime +$RETENTION_DAYS -delete\r\n<\/code><\/pre>\n
\u6545\u969c\u6392\u9664\u5e38\u898b\u554f\u984c<\/strong><\/h2>\n
\u6548\u80fd\u964d\u7d1a\u5206\u6790<\/h3>\n
\r\n# \u6aa2\u67e5\u7576\u524d\u7cfb\u7d71\u8ca0\u8f09\r\ntop -b -n 1\r\n\r\n# \u76e3\u63a7\u78c1\u789fI\/O\r\niostat -xz 1\r\n\r\n# \u8ffd\u8e64\u7db2\u8def\u9023\u63a5\r\nnetstat -tuln\r\n\r\n# \u5206\u6790MySQL\u6162\u67e5\u8a62\r\nmysqldumpslow \/var\/log\/mysql\/mysql-slow.log\r\n\r\n# \u76e3\u63a7PHP-FPM\u7a0b\u5e8f\r\npm.status_path = \/status\r\npm.max_children = 50\r\npm.start_servers = 5\r\npm.min_spare_servers = 5\r\npm.max_spare_servers = 35\r\n<\/code><\/pre>\n
\u5b89\u5168\u4e8b\u4ef6\u61c9\u8b8a<\/strong><\/h2>\n
\u7576\u6aa2\u6e2c\u5230\u53ef\u7591\u6d3b\u52d5\u6642\uff0c\u57f7\u884c\u6b64\u4e8b\u4ef6\u61c9\u8b8a\u65b9\u6848\uff1a<\/p>\n
\r\n# \u6aa2\u67e5\u672a\u6388\u6b0a\u7a0b\u5e8f\r\nps aux | grep -i suspicious_process\r\n\r\n# \u67e5\u770b\u8a8d\u8b49\u5617\u8a66\r\ngrep \"Failed password\" \/var\/log\/auth.log\r\n\r\n# \u6aa2\u67e5\u7db2\u8def\u9023\u63a5\r\nlsof -i | grep ESTABLISHED\r\n\r\n# \u9a57\u8b49\u6a94\u6848\u5b8c\u6574\u6027\r\nfind \/var\/www -type f -mtime -1 -ls\r\n<\/code><\/pre>\n
\u6700\u4f73\u5be6\u8e10\u548c\u672a\u4f86\u8003\u91cf<\/strong><\/h2>\n
\u96a8\u8457Web\u61c9\u7528\u7a0b\u5f0f\u90e8\u7f72\u7b56\u7565\u7684\u767c\u5c55\uff0c\u8acb\u8003\u616e\u4ee5\u4e0b\u9032\u968e\u5be6\u8e10\uff1a<\/p>\n
\n
\u4f7f\u7528Terraform\u5be6\u65bd\u57fa\u790e\u8a2d\u65bd\u5373\u7a0b\u5f0f\u78bc<\/li>\n
\u4f7f\u7528\u5bb9\u5668\u5316\u548cKubernetes\u90e8\u7f72\u61c9\u7528\u7a0b\u5f0f<\/li>\n
\u904b\u7528GitOps\u5de5\u4f5c\u6d41\u9032\u884c\u81ea\u52d5\u90e8\u7f72<\/li>\n
\u5be6\u65bd\u96f6\u4fe1\u4efb\u5b89\u5168\u67b6\u69cb<\/li>\n<\/ul>\n
\u57fa\u790e\u8a2d\u65bd\u5373\u7a0b\u5f0f\u78bc\u7bc4\u4f8b<\/h3>\n
\r\nprovider \"aws\" {\r\n  region = \"us-east-1\"\r\n}\r\n\r\nresource \"aws_instance\" \"web_server\" {\r\n  ami           = \"ami-0c55b159cbfafe1f0\"\r\n  instance_type = \"t3.medium\"\r\n\r\n  tags = {\r\n    Name = \"WebApp-Production\"\r\n    Environment = \"Production\"\r\n  }\r\n\r\n  root_block_device {\r\n    volume_size = 50\r\n    encrypted   = true\r\n  }\r\n\r\n  vpc_security_group_ids = [aws_security_group.web.id]\r\n}\r\n<\/code><\/pre>\n
\u7d50\u8ad6<\/strong><\/h2>\n
\u6210\u529f\u90e8\u7f72\u548c\u4fdd\u8b77Web\u61c9\u7528\u7a0b\u5f0f\u9700\u8981\u5168\u9762\u7406\u89e3\u57fa\u790e\u8a2d\u65bd\u3001\u5b89\u5168\u6027\u548c\u6548\u80fd\u6700\u4f73\u5316\u3002\u900f\u904e\u9075\u5faa\u672c\u6307\u5357\u7684\u6280\u8853\u5be6\u65bd\u548c\u6700\u4f73\u5be6\u8e10\uff0c\u60a8\u5df2\u70ba\u5efa\u69cb\u5f37\u5065\u3001\u5b89\u5168\u548c\u9ad8\u6548\u80fd\u7684Web\u61c9\u7528\u7a0b\u5f0f\u74b0\u5883\u5960\u5b9a\u57fa\u790e\u3002\u8acb\u8a18\u4f4f\u5b9a\u671f\u6aa2\u67e5\u548c\u66f4\u65b0\u60a8\u7684\u914d\u7f6e\uff0c\u4ee5\u61c9\u5c0d\u65b0\u51fa\u73fe\u7684\u5b89\u5168\u6311\u6230\u548c\u6548\u80fd\u6700\u4f73\u5316\u6280\u8853\u3002<\/p>\n
\u5c0d\u65bc\u5e0c\u671b\u6df1\u5165\u7814\u7a76\u7684\u4eba\u4f86\u8aaa\uff0c\u53ef\u4ee5\u8003\u616e\u63a2\u7d22\u670d\u52d9\u7db2\u683c\u67b6\u69cb\u3001\u7121\u4f3a\u670d\u5668\u904b\u7b97\u548cAI\u9a45\u52d5\u7684\u5b89\u5168\u76e3\u63a7\u7cfb\u7d71\u7b49\u9032\u968e\u4e3b\u984c\u3002<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
[vc_row][vc_column][vc_column_text css=””]  […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":2,"featured_media":22226,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4815],"tags":[6454,6455,4849,3342,765],"class_list":["post-22230","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-tc","tag-web-app-deployment-tc","tag-server-hardening-tc","tag-us-hosting-tc","tag-web-application-security-tc","tag-server-configuration-tc"],"acf":[],"yoast_head":"\n