🔒 Security Hardener / 服务器安全加固
Hardening your Linux server against common attacks. Step-by-step guide from basic to strict. 加固你的 Linux 服务器抵御常见攻击。从基础到严格的分步指南。
Quick Hardening / 一键加固
#!/bin/bash
echo "=== Hardening SSH / SSH加固 ==="
sed -i 's/PermitRootLogin yes/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
echo "=== Installing fail2ban ==="
apt install -y fail2ban && systemctl enable fail2ban --now
echo "=== Configuring firewall / 配置防火墙 ==="
ufw --force reset
ufw default deny incoming && ufw default allow outgoing
ufw limit 2222/tcp && ufw --force enable
echo "=== Auto updates / 自动更新 ==="
apt install -y unattended-upgrades
dpkg-reconfigure -f noninteractive unattended-upgrades
echo "✅ Done / 完成！"
Security Levels / 安全等级
| Level / 等级 | Actions / 措施 | Time / 耗时 |
|---|---|---|
| ⭐ Basic | SSH port, disable password, firewall | 10min |
| ⭐⭐ Standard | + fail2ban, auto-updates, audit | 30min |
| ⭐⭐⭐ Hardened | + rkhunter, AIDE, Docker security | 1h |
| ⭐⭐⭐⭐ Strict | + SELinux, centralized logs, WAF | Half day |
Key Configs / 关键配置
SSH Hardening
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
# Change port / 改端口: Port 2222
# Disable root password / 禁止root密码: PermitRootLogin prohibit-password
# Key only / 仅密钥: PasswordAuthentication no
systemctl restart sshd
Firewall
ufw limit 2222/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw --force enable
fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
[sshd]
enabled = true
port = 2222
[nginx-http-auth]
enabled = true
EOF
systemctl restart fail2ban
📞 Contact / 联系方式
QQ: 3292957
Email: snowdu@gmail.com
QR Code: see
assets/qr-contact.pngin this package 微信/QQ 二维码见本技能包assets/qr-contact.png文件
For paid services / 需要付费服务请直接联系