本文假定(并强烈建议)仅使用密钥验证的ssh登录(建议使用4096位RSA加密)。

设置Root用户

如果已经设置好ssh公钥,先登录。

1
ssh root@YOUR_HOST

更改默认的编辑器,通常会预先安装vim,nano等。

1
update-alternatives --config editor

添加别名(可选)

1
2
3
editor .bashrc
# add those `alias` commands to that file or uncomment existing alias
source .bashrc

添加非root用户并开启sudo权限

这里以qoant用户为例,需替换为您自己的非root用户。

1
2
3
4
5
adduser qoant # add user, only password is needed
apt update
apt upgrade
apt install sudo
usermod -aG sudo qoant

设置非root用户使用ssh-key

方法1:切换用户

情况1:与root用户使用相同的ssh-key

1
2
3
4
5
su - qoant
mkdir .ssh
chmod 700 .ssh
sudo cat /root/.ssh/authorized_keys > .ssh/authorized_keys
chmod 600 .ssh/authorized_keys

情况2:与root用户使用不同的ssh-key

1
2
3
4
5
su - qoant
mkdir .ssh
chmod 700 .ssh
editor .ssh/authorized_keys # copy and paste the key
chmod 600 .ssh/authorized_keys

方法2:保持root用户

情况1:与root用户使用相同的ssh-key

1
2
3
4
cp -r ~/.ssh /home/qoant
chown -R qoant:qoant /home/qoant/.ssh
chmod 700 /home/qoant/.ssh
chmod 600 /home/qoant/.ssh/authorized_keys

情况2:与root用户使用不同的ssh-key

1
2
3
4
5
mkdir /home/qoant/.ssh
editor /home/qoant/.ssh/authorized_keys # copy and paste the key
chown -R qoant:qoant /home/qoant/.ssh
chmod 700 /home/qoant/.ssh
chmod 600 /home/qoant/.ssh/authorized_keys

完成后使用exit命令或Ctrl+D注销。

保护服务器

现在,使用刚创建的非root用户登录。

1
ssh qoant@YOUR_HOST

仅在极少数情况下,我们才需要以root用户登录(这并不安全)。

设置非root用户

添加别名。

1
2
editor .bash_aliases
source .bashrc

自定义bachrc(可选)

编辑~/.bashrc文件。

  • 更改提示符:终端窗口中的焦点应该放在命令的输出上,而不是提示上。
  • 将目录添加到PATH:请注意,某些发行版将~/bin自动添加到PATH中。
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
...
# customizations
force_color_prompt=yes
...
## customizations
my_color_prompt=$color_prompt
...
# customizations
if [ "$my_color_prompt" = yes ]; then
  PS1="\[\e[38;2;245;150;170m\]◟(*•᎑•*)ノ♡:\[\e[00m\]\[\e[34m\]\w\[\e[00m\]\[\e[32m\]\$\[\e[00m\] "
else
  PS1="♡◟(*•᎑•*):\w\\$ "
fi
unset my_color_prompt
...
# customizations
PATH=/docker/bin:$PATH

自定义Vim(可选)

编辑~/.vimrc文件。

1
2
3
4
# add color scheme etc.
# Example: wget -P ~/.vim/colors/ https://raw.githubusercontent.com/NLKNguyen/papercolor-theme/master/colors/PaperColor.vim
# change vimrc
vim .vimrc

示例:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
" syntax
syntax on
 
" history : how many lines of history VIM has to remember
set history=2000
 
" filetype
filetype on
" " Enable filetype plugins
filetype plugin on
filetype indent on
 
" base
set nocompatible                " don't bother with vi compatibility
set autoread                    " reload files when changed on disk, i.e. via `git checkout`
 
set magic                       " For regular expressions turn magic on
set title                       " change the terminal's title
 
set novisualbell                " turn off visual bell
set noerrorbells                " don't beep
set visualbell t_vb=            " turn off error beep/flash
set t_vb=
set tm=500
 
" show location
" set cursorcolumn
set cursorline
 
" show
set ruler                       " show the current row and column
set number                      " show line numbers
set nowrap
set showcmd                     " display incomplete commands
set showmode                    " display current modes
set showmatch                   " jump to matches when entering parentheses
set matchtime=2                 " tenths of a second to show the matching parenthesis
 
" search
set hlsearch                    " highlight searches
set incsearch                   " do incremental searching, search as you type
set ignorecase                  " ignore case when searching
set smartcase                   " no ignorecase if Uppercase char present
 
" tab
set expandtab                   " expand tabs to spaces
set smarttab
set shiftround
" indent
set autoindent smartindent shiftround
set shiftwidth=4
set tabstop=4
set softtabstop=4                " insert mode tab and backspace use 4 spaces
 
" encoding
set encoding=utf-8
set fileencodings=ucs-bom,utf-8,cp936,gb18030,big5,euc-jp,euc-kr,latin1
set termencoding=utf-8
set ffs=unix,dos,mac
set formatoptions+=m
set formatoptions+=B
 
" select and compare
set selection=inclusive
set selectmode=mouse,key
 
set completeopt=longest,menu
set wildmenu                           " show a navigable menu for tab completion"
set wildmode=longest,list,full
set wildignore=*.o,*~,*.pyc,*.class

" disable cndent for yml
au FileType yaml setlocal nocindent
 
" ============================ theme and status line ============================
 
" theme
set background=light
colorscheme PaperColor
 
" set mark column color
hi! link SignColumn   LineNr
hi! link ShowMarksHLl DiffAdd
hi! link ShowMarksHLu DiffChange
 
" status line
set statusline=%<%f\%h%m%r%=%k[%{(&fenc==\"\")?&enc:&fenc}%{(&bomb?\",BOM\":\"\")}]\%-14.(%l,%c%V%)\ %P
set laststatus=2   " Always show the status line - use 2 lines for the status bar

使用Vundle管理vim插件(可选)。

1
2
3
sudo apt install git
git clone https://github.com/VundleVim/Vundle.vim.git ~/.vim/bundle/Vundle.vim
vim +PluginInstall +qall

加强SSH

1
sudo editor /etc/ssh/sshd_config

更改配置:

  • 更改默认的SSH端口
  • 禁用root用户登录ssh,PermitRootLogin no
  • 禁用密码登录ssh,PasswordAuthentication no
1
2
3
Port <some-other-number>
PermitRootLogin no
PasswordAuthentication no

确保您不会将自己锁定在服务器之外并应用更改。

1
sudo systemctl restart sshd

现在注销,然后使用新设置重新登录。

添加apt源列表(可选)

如果要使用默认源中未包含的软件或较新版本。

1
2
3
4
5
6
sudo editor /etc/apt/sources.list
wget http://nginx.org/keys/nginx_signing.key
sudo apt-key add nginx_signing.key
wget https://www.dotdeb.org/dotdeb.gpg
sudo apt-key add dotdeb.gpg
sudo aptitude update

配置防火墙(nftables)

列出当前规则集:

1
nft list ruleset

编辑配置文件(位于/etc/nftables.conf)。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # established/related
        ct state established,related accept

        # invalid
        ct state invalid drop

        # loopback
        iifname lo accept

        # ssh
        tcp dport 22 ct state new accept # change to your ssh port

        # icmp
        ip protocol icmp accept
        ip6 nexthdr ipv6-icmp accept

        # http(s)
        tcp dport {http, https} accept
        udp dport {http, https} accept

        # uncomment to enable log
        #log prefix "[nftables] Input Drop: " flags all counter drop
    }
    chain forward {
        # drop everything (if not a router)
        type filter hook forward priority 0; policy drop;

        # uncomment to enable log
        #log prefix "[nftables] Forward Drop: " flags all counter drop
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

启用nftables。

1
2
3
sudo systemctl enable nftables
sudo systemctl start nftables
sudo systemctl status nftables

希望nftable能更加易于使用(当前许多软件仍不支持它)。

安装fail2ban

简而言之,fail2ban将阻止某些ip过于频繁地访问服务器,此工具可以使攻击者更难破解。

请注意,如果有必要,可能需要配置fail2ban使用nftables而不使用iptables。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
sudo apt install fail2ban
cd /etc/fail2ban
sudo cp fail2ban.conf fail2ban.local
sudo cp jail.conf jail.local

# edit the 2 local conf files accordingly
# can delete anything but customized configs (see example below)
sudo editor fail2ban.local
sudo editor jail.local

# restart to apply changes
sudo systemctl restart fail2ban

其中fail2ban.local内容为空,jail.local内容如下。

1
2
3
4
5
6
[DEFAULT]
bantime = 100m

[sshd]
enabled = true
port    = <some-ssh-port>

安装Docker(可选)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
# install docker
sudo apt update
sudo apt install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable"

# start on boot
sudo systemctl enable docker

# add current user to docker group (so that no `sudo` required)
sudo groupadd docker # group might already exist
sudo usermod -aG docker $USER
## log out and log back in to apply this change

安装kubectl(可选)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list
sudo apt update
sudo apt install -y kubectl

# bash completion (optional)
echo 'source <(kubectl completion bash)' >> ~/.bashrc
source <(kubectl completion bash) # load it for current shell

# add my own kubeconfig file
echo "KUBECONFIG=/PATH/TO/MY/KUBECONFIG/" >> ~/.bashrc