apt-get install fail2ban
useradd dummy
mkdir /home/dummy
mkdir /home/dummy/.ssh
chmod 700 /home/dummy/.ssh
vim /home/dummy/.ssh/authorized_keys
chmod 400 /home/dummy/.ssh/authorized_keys
chown dummy:dummy /home/dummy -R
passwd dummy
visudo
# lock ssh to particular IPs:
vim /etc/ssh/sshd_config
# adding these lines to the file
PermitRootLogin no
PasswordAuthentication no
AllowUsers deploy@(your-ip) deploy@(another-ip-if-any)
# restart ssh
service ssh restart
# set up a firewall
# ubuntu provides ufw
ufw allow from {your-ip} to any port 22
ufw allow 80
ufw allow 443
ufw enable
# Automated security updates
apt-get install unattended-upgrades
vim /etc/apt/apt.conf.d/10periodic
# update the file to look like this
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
# edit
vim /etc/apt/apt.conf.d/50unattended-upgrades
# update the file to this
Unattended-Upgrade::Allowed-Origins {
"Ubuntu lucid-security";
// "Ubuntu lucid-updates";
};
# Install Logwatch to keep an eye on things
apt-get install logwatch
vim /etc/cron.daily/00logwatch
# add this line
/usr/sbin/logwatch --output mail --mailto test@gmail.com --detail high
# All Done!
Linux Server 安全配置
©著作权归作者所有,转载或内容合作请联系作者
- 文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
- 文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
- 文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
推荐阅读更多精彩内容
- AWS认证介绍 AWS Certified Solutions Architect 系列认证是亚马逊从2013年开...
- 【MySQL】Linux下MySQL 5.5、5.6和5.7的RPM、二进制和源码安装 1.1BLOG文档结构图 ...
- 整个过程使用虚拟机在CentOS Linux release 7.2.1511 (Core)安装成功。 安装the...
