注册
登录控制台
→
➔
➔
| ➔ | Debian以其稳定性和安全性著称，是许多服务器的首选操作系统。本文以Debian 12为例，介绍初始化配置和安全加固。 |
▶▶▶一、基础配置
code
code
code
# 更新系统
apt update && apt full-upgrade -y
# 安装基础工具
apt install -y sudo curl wget vim git htop net-tools
# 创建管理用户
adduser admin
usermod -aG sudo admin
# 配置时区
timedatectl set-timezone Asia/Shanghai
apt install -y ntpsec
systemctl enable --now ntpsec▶▶▶二、SSH安全加固
code
code
code
apt install -y openssh-server
systemctl enable --now ssh
# /etc/ssh/sshd_config
Port 2222
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
systemctl restart ssh▶▶▶三、防火墙配置
code
code
code
apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp comment 'SSH'
ufw allow 80,443/tcp comment 'Web'
ufw --force enable▶▶▶四、Fail2ban防暴力破解
code
code
code
apt install -y fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
[sshd]
enabled = true
port = 2222
maxretry = 3
EOF
systemctl restart fail2ban▶▶▶五、自动安全更新
code
code
code
apt install -y unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades▶▶▶六、入侵检测
code
code
code
apt install -y auditd
systemctl enable --now auditd
apt install -y rkhunter
rkhunter --propupd
rkhunter --check▶▶▶七、系统监控配置
code
code
code
# 安装监控工具
apt install -y htop iotop iftop nethogs
# 安装系统资源监控
apt install -y sysstat
systemctl enable --now sysstat
# 配置sar日志保留
sed -i 's/HISTORY=7/HISTORY=30/' /etc/default/sysstat
# 查看历史性能
sar -u # CPU使用
sar -r # 内存使用
sar -n DEV # 网络流量▶▶▶八、Docker安全配置
code
code
code
# 安装Docker
apt install -y docker.io docker-compose-v2
# Docker安全配置
cat > /etc/docker/daemon.json << 'EOF'
{
"icc": false,
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
},
"live-restore": true,
"userland-proxy": false,
"no-new-privileges": true
}
EOF
systemctl restart docker
# 使用非root用户运行Docker
usermod -aG docker admin▶▶▶九、APT安全配置
code
code
code
# 配置APT签名验证
# /etc/apt/apt.conf.d/99-security
cat > /etc/apt/apt.conf.d/99-security << 'EOF'
APT::Get::AllowUnauthenticated "false";
APT::Authentication::TrustCDROM "false";
Acquire::AllowInsecureRepositories "false";
Acquire::AllowDowngradeToInsecureRepositories "false";
EOF
# 只使用安全源
# 编辑 /etc/apt/sources.list
# deb https://deb.debian.org/debian bookworm main
# deb https://security.debian.org/debian-security bookworm-security main