Linux 服务器基础安全加固 Print

服务器安全是运维的基础。本文系统性地介绍安全加固的各项措施。

1. 系统更新

sudo apt update && sudo apt upgrade -y
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

2. SSH 安全

编辑 /etc/ssh/sshd_config：

Port 2222                    # 修改默认端口
PermitRootLogin no           # 禁止 root 直接登录
PasswordAuthentication no    # 禁用密码认证
AllowUsers username          # 仅允许指定用户

sudo systemctl restart sshd

3. 防火墙

sudo ufw default deny incoming
sudo ufw allow 2222/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable

4. Fail2ban

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

5. 内核参数优化

编辑 /etc/sysctl.conf：

net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1

sudo sysctl -p

6. 监控与审计

sudo apt install auditd
sudo apt install lynis
sudo lynis audit system