-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
471 lines (398 loc) · 22.6 KB
/
Copy pathindex.html
File metadata and controls
471 lines (398 loc) · 22.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
<!DOCTYPE html>
<html lang="en" >
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="author" content="wedojava" />
<title>Linode 的 CentOS-7.1 初始化操作 ｜ 回风舞雪</title>
<meta name="description" content=" 参考文献:https://www.linode.com/docs/
前面内容不再多说,直接说我开始的地方:
" />
<meta name="keywords" content="Hugo, theme, zozo, huifeng" />
<link rel="shortcut icon" href="https://huifeng.me/images/favicon.ico" />
<link rel="stylesheet" type="text/css" media="screen" href="https://huifeng.me/css/normalize.css" />
<link rel="stylesheet" type="text/css" media="screen" href="https://cdn.jsdelivr.net/npm/animate.css@4.1.0/animate.min.css" />
<link rel="stylesheet" type="text/css" media="screen" href="https://huifeng.me/css/zozo.css" />
<link rel="stylesheet" type="text/css" media="screen" href="https://huifeng.me/css/search.css" />
<link rel="stylesheet" type="text/css" media="screen" href="https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.css" />
<link rel="stylesheet" type="text/css" media="screen" href="https://huifeng.me/css/highlight.css" />
</head>
<body>
<div class="main animate__animated animate__fadeInDown">
<div class="nav_container animated fadeInDown">
<div class="site_nav" id="site_nav">
<ul>
<li>
<a href="/">Home</a>
</li>
<li>
<a href="/posts/">Archive</a>
</li>
<li>
<a href="/tags/">Tags</a>
</li>
<li>
<a href="/about/">About</a>
</li>
</ul>
</div>
<div class="menu_icon">
<a id="menu_icon"><i class="ri-menu-line"></i></a>
</div>
</div>
<div class="header animated fadeInDown">
<div class="site_title_container">
<div class="site_title">
<h1>
<a href="https://huifeng.me">
<span>回风舞雪</span>
</a>
</h1>
</div>
<div class="description">
<p class="sub_title">Love My Love</p>
<div class="my_socials">
<a href="https://github.com/wedojava" title="github" target="_blank"><i class="ri-github-fill"></i></a>
<a href="https://weibo.com/wedojava" title="weibo" target="_blank"><i class="ri-weibo-fill"></i></a>
<a href="https://huifeng.me/index.xml" type="application/rss+xml" title="rss" target="_blank"><i
class="ri-rss-fill"></i></a>
</div>
</div>
</div>
</div>
<div class="content">
<div class="post_page">
<div class="post animate__animated animate__fadeInDown">
<div class="post_title post_detail_title">
<h2><a href='/posts/linode-centos-init/'>Linode 的 CentOS-7.1 初始化操作</a></h2>
<span class="date">2015.08.15</span>
</div>
<div class="post_content markdown"><blockquote>
<p>参考文献:https://www.linode.com/docs/</p>
</blockquote>
<blockquote>
<p>前面内容不再多说,直接说我开始的地方:</p>
</blockquote>
<h2 id="getting-started">Getting Started</h2>
<h3 id="登录vps">登录VPS</h3>
<p>首先是第一次登录,这里主要谈登陆失败的情况:
我之前做过一个vps,然后听说日本的好,然后就把之前的那个服务器删了,删除后才发现日本机房的根本买不上,买上的很多也是IP被封了.当时自己还刷了很久linode网站,无果,最终选择了美国西海岸机房.据说除了日本机房最好选它.于是重新添加硬盘,Rebuild,等等,系统起来了,准备ssh登录了,然后就报错了,“That’s because SSH clients try to match the remote host with the known keys on your desktop computer. When you rebuild your Linode, the remote host key changes. “下面动手删了那一行:</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">vim ~/.ssh/known_hosts
</code></pre></div><p>找到之前的记录内容,删除掉就好了</p>
<h3 id="setting-the-hostname">Setting the hostname</h3>
<p>CentOS 7 / Fedora version 18 and above</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">hostnamectl set-hostname hostname
</code></pre></div><p>Ubuntu 15.04 / Debian 8</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">hostnamectl set-hostname hostname
</code></pre></div><h3 id="setting-the-timezone">Setting the Timezone</h3>
<p>Arch Linux and CentOS 7</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">timedatectl list-timezones
</code></pre></div><p>then</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">timedatectl set-timezone Asia/Shanghai
</code></pre></div><p>Ubuntu / Debian</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">dpkg-reconfigure tzdata
</code></pre></div><p>checking the time</p>
<p>Now try entering the following command to view the current date and time according to your server:</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">date
</code></pre></div><h3 id="installing-software-update">installing software update</h3>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">yum update
</code></pre></div><h2 id="securing-your-server">Securing Your Server</h2>
<h3 id="add-a-new-user">Add a New User</h3>
<blockquote>
<p>The problem with logging in as root is that you can execute any command - even a command that could accidentally break your server. For this reason and others, we recommend creating another user account and using that at all times.</p>
</blockquote>
<ol>
<li>
<p>Open a terminal window and log in your linode server</p>
</li>
<li>
<p>Create the user by entering the following command.Replace <code>exampleuser</code> to your desired username:</p>
</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">adduser exampleuser
</code></pre></div><ol start="3">
<li>Set the password for your new user by entering the following command. Replace <code>exampleuser</code> with your desired username:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">passwd exampleuser
</code></pre></div><ol start="4">
<li>You will now need to edit your sudoers file to grant your new user the correct permissions. Enter the following command to open your sudoers file for editing:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">visudo
</code></pre></div><ol start="5">
<li>add an entry for your user below the root user, granting all permissions. Replace exampleuser with your username:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">## Allow root to run any commands anywhere
root ALL=(ALL) ALL
exampleuser ALL=(ALL) ALL
</code></pre></div><ol start="6">
<li>Enter the command <code>logout</code> And then log in your linode again by the following command,Replace exampleuser with your username, and the example IP address with your Linode’s IP address:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">ssh exampleuser@123.456.78.90
</code></pre></div><h3 id="using-ssh-key-pair-authenticationssh认证配对">Using SSH Key Pair Authentication(SSH认证配对)</h3>
<ol>
<li>linux Or Mac OS, Entering the following command in a terminal window</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">ssh-keygen
</code></pre></div><ol start="2">
<li>copy the public key <code>~/.ssh/id_rsa.pub</code> to your linode,you can entering the following command in a terminal window.Replace <code>example_user</code> with your username, and <code>123.456.78.90</code> with your Linode’s IP address.</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">scp ~/.ssh/id_rsa.pub example_user@123.456.78.90:
</code></pre></div><ol start="3">
<li>Create a directory for public key in your home directory (<code>/home/yourusername</code>) by entering the following command ** on your linode: **</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">mkdir .ssh
</code></pre></div><ol start="4">
<li>move the file which is on your linode’s home directory to the directory your just create:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">mv id_rsa.pub .ssh/authorized_keys
</code></pre></div><ol start="5">
<li>Modify the permissions on the public key by entering the following commands, one by one, on your linode. Replace <code>example_user</code> with your username.</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">chown -R example_user:example_user .ssh
chmod 700 .ssh
chmod 600 .ssh/authorized_keys
</code></pre></div><h3 id="disabling-ssh-password-authentication-and-root-login禁止ssh的密码登录和root登陆">Disabling SSH Password Authentication and Root Login(禁止SSH的密码登录和root登陆)</h3>
<blockquote>
<p>First, you’ll disable password authentication to require all users connecting via SSH to use key authentication. Next, you’ll disable root login to prevent the root user from logging in via SSH. These steps are optional, but are strongly recommended.</p>
</blockquote>
<ol>
<li>Open the SSH configuration file for editing by entring the following command:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo vim /etc/ssh/sshd_config
</code></pre></div><ol start="2">
<li>Entring <code>/</code>, then <code>PasswordAuthentication</code> and push Enter key, push <code>n</code> to search the key word,change the keyword’s setting to <code>no</code>,Verify that the line is uncommented by removing the # in front of line:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">PasswordAuthentication no
</code></pre></div><ol start="3">
<li>Change the <code>PermitRootLogin</code> setting to <code>no</code> as shown below:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">PermitRootLogin no
</code></pre></div><ol start="4">
<li>save the configuration file (<code>:wq</code>) and restart the SSH service to load the new configuration:</li>
</ol>
<p>Fedora/CentOS:</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo systemctl restart sshd
</code></pre></div><p>Debian/Ubuntu Users:</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo service ssh restart
</code></pre></div><h3 id="creating-a-firewall">Creating a Firewall</h3>
<blockquote>
<p>This step is optional, but we strongly recommend that you use the example below to block traffic to ports that are not commonly used. It’s a good way to deter would-be intruders! You can always modify the rules or disable the firewall later.</p>
</blockquote>
<ul>
<li>Check your Linode’s default firewall rules by entering the following command:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo iptables -L
</code></pre></div><ul>
<li>Examine the output. If you haven’t implemented any firewall rules yet, you should see an empty ruleset, as shown below:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
</code></pre></div><ul>
<li>Create a file to hold your firewall rules by entering the following command:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo vim /etc/iptables.firewall.rules
</code></pre></div><ul>
<li>We’ve created some basic rules to get you started. Copy and paste the rules shown below in to the <code>iptables.firewall.rules</code> file you just created.</li>
</ul>
<p>By default, the rules will allow traffic to the following services and ports: HTTP (80), HTTPS (443), SSH (22), and ping. All other ports will be blocked.</p>
<p><em>File:/etc/iptables.firewall.rules</em></p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">*filter
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# Allow SSH connections
#
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT
</code></pre></div><p><strong>Be sure to revise these rules if you add new services later.</strong></p>
<ul>
<li><strong>Optional:</strong> If you plan on using the Linode Longview service, add these additional lines above the <code># Drop all other inbound</code> section:</li>
</ul>
<p>File:/etc/iptables.firewall.rules</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback"># Allow incoming Longview connections
-A INPUT -s longview.linode.com -j ACCEPT
# Allow metrics to be provided Longview
-A OUTPUT -d longview.linode.com -j ACCEPT
</code></pre></div><ul>
<li>Save the changes by pressing <code>:wq</code> and then activate the firewall rules by entring the following command:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo iptables-restore < /etc/iptables.firewall.rules
</code></pre></div><ul>
<li>Recheck your Linode’s firewall rules by entering the following command:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo iptables -L
</code></pre></div><ul>
<li>Examine the output. The new ruleset should look like the one shown below:</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback"> Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere 127.0.0.0/8 reject-with icmp-port-unreachable
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT icmp -- anywhere anywhere
LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
</code></pre></div><ul>
<li>
<p>Now you need to ensure that the firewall rules are activated every time you restart your Linode.</p>
</li>
<li>
<p>CentOS 6.2 or 6.5: <code>/sbin/service iptables save</code></p>
</li>
<li>
<p>CentOS 7 or Fedora 20:</p>
</li>
</ul>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">yum install -y iptables-services
systemctl enable iptables
systemctl start iptables
</code></pre></div><p>To save your current rule set use the following command:</p>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">/usr/libexec/iptables/iptables.init save
</code></pre></div><h3 id="installing-and-configuring-fail2ban">Installing and Configuring Fail2Ban</h3>
<blockquote>
<p>Fail2Ban is an application that prevents dictionary attacks on your server. When Fail2Ban detects multiple failed login attempts from the same IP address, it creates temporary firewall rules that block traffic from the attacker’s IP address. Attempted logins can be monitored on a variety of protocols, including SSH, HTTP, and SMTP. By default, Fail2Ban monitors SSH only.</p>
</blockquote>
<ol>
<li>Install Fail2Ban by entering the following command:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo yum install epel-release
sudo yum install fail2ban
</code></pre></div><ol start="2">
<li>Optionally, you can override the default Fail2Ban configuration by creating a new jail.local file. Enter the following command to create the file:</li>
</ol>
<div class="highlight"><pre class="chroma"><code class="language-fallback" data-lang="fallback">sudo nano /etc/fail2ban/jail.local
</code></pre></div><blockquote>
<p>To learn more about Fail2Ban configuration options, see <a href="http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration">this article</a> on the Fail2Ban website.</p>
</blockquote>
<ol start="3">
<li>
<p>Set the <code>bantime</code> variable to specify how long (in seconds) bans should last.</p>
</li>
<li>
<p>Set the <code>maxretry</code> variable to specify the default number of tries a connection may be attempted before an attacker’s IP address is banned.</p>
</li>
<li>
<p>Press <code>Control-x</code> and then press <code>y</code> to save the changes to the Fail2Ban configuration file.</p>
</li>
<li>
<p>Restart Fail2Ban by using <code>sudo service fail2ban restart</code>.</p>
</li>
</ol></div>
<div class="post_footer">
<div class="meta">
<div class="info">
<span class="field tags">
<i class="ri-stack-line"></i>
<a href="https://huifeng.me/tags/linux/">linux</a>
<a href="https://huifeng.me/tags/centos/"> centos</a>
<a href="https://huifeng.me/tags/linode/"> linode</a>
<a href="https://huifeng.me/tags/iptables/"> iptables</a>
<a href="https://huifeng.me/tags/fail2ban/"> fail2ban</a>
</span>
</div>
</div>
</div>
</div>
<div class="doc_comments">
<div class="comments_block_title">发表评论</div>
<div id="vcomments"></div>
</div>
<link rel="stylesheet" href="https://huifeng.me/css/comments.css" />
<script src="//cdn1.lncld.net/static/js/3.0.4/av-min.js"></script>
<script src='//unpkg.com/valine/dist/Valine.min.js'></script>
<script type="text/javascript">
new Valine({
el: '#vcomments',
appId: 'yusajl3uDsnB888cn1ulQeKz-gzGzoHsz',
appKey: 'jYjHeNB1qVYREHe1zX4bRx7z',
placeholder: ' ',
visitor: 'true',
})
</script>
</div>
</div>
</div>
<a id="back_to_top" href="#" class="back_to_top"><i class="ri-arrow-up-s-line"></i></a>
<footer class="footer">
<div class="powered_by">
<a href="https://varkai.com">Designed by VarKai,</a>
<a href="http://www.gohugo.io/">Proudly published with Hugo</a>
</div>
<div class="footer_slogan">
<span>>_ Simple Is Correct.</span>
</div>
</footer>
<div id="fastSearch">
<input id="searchInput" tabindex="0">
<ul id="searchResults">
</ul>
</div>
<script src="/js/fuse.js"></script>
<script src="/js/fastsearch.js"></script>
<script src="https://huifeng.me/js/jquery-3.5.1.min.js"></script>
<link href="https://huifeng.me/css/fancybox.min.css" rel="stylesheet">
<script src="https://huifeng.me/js/fancybox.min.js"></script>
<script src="https://huifeng.me/js/zozo.js"></script>
<script type="text/javascript" async
src="https://cdn.bootcss.com/mathjax/2.7.5/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
MathJax.Hub.Config({
tex2jax: {
inlineMath: [['$', '$'], ['\\(', '\\)']],
displayMath: [['$$', '$$'], ['\[\[', '\]\]']],
processEscapes: true,
processEnvironments: true,
skipTags: ['script', 'noscript', 'style', 'textarea', 'pre'],
TeX: {
equationNumbers: { autoNumber: "AMS" },
extensions: ["AMSmath.js", "AMSsymbols.js"]
}
}
});
MathJax.Hub.Queue(function () {
var all = MathJax.Hub.getAllJax(), i;
for (i = 0; i < all.length; i += 1) {
all[i].SourceElement().parentNode.className += ' has-jax';
}
});
</script>
<style>
code.has-jax {
font: inherit;
font-size: 100%;
background: inherit;
border: inherit;
color: #515151;
}
</style>
</body>
</html>