VPS 维护配置

快速开始

1. 换源加速

# 备份原始源
cp /etc/apt/sources.list /etc/apt/sources.list.backup

# 获取系统版本代号
CODENAME=$(lsb_release -cs)

# 国内源（推荐国内用户）
cat > /etc/apt/sources.list <<EOF
deb http://mirrors.aliyun.com/debian/ ${CODENAME} main contrib non-free non-free-firmware
deb http://mirrors.aliyun.com/debian-security ${CODENAME}-security main contrib non-free non-free-firmware
deb http://mirrors.aliyun.com/debian/ ${CODENAME}-updates main contrib non-free non-free-firmware
EOF

# 国外用户用官方源
# deb https://deb.debian.org/debian/ ${CODENAME} main ...

apt update

2. 账户安全

# 创建普通用户（禁止直接用 root）
useradd -m -s /bin/bash username
echo "username:StrongPassword123!" | chpasswd
usermod -aG sudo username

# 配置 SSH 密钥
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "你的公钥" > ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

3. SSH 加固

# 备份配置
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# 修改默认端口（防扫描）
sed -i 's/^#*Port .*/Port 54321/' /etc/ssh/sshd_config

# 加固配置
cat >> /etc/ssh/sshd_config <<EOF
PasswordAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
LoginGraceTime 30
MaxAuthTries 3
EOF

systemctl restart ssh

4. 防火墙 (nftables)

# 安装 nftables（替代 ufw）
apt-get install -y nftables

# 配置规则（只开放 SSH）
cat > /etc/nftables.conf <<EOF
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
  chain input {
    type filter hook input priority 0;
    policy drop;
    iif lo accept;
    ct state established,related accept;
    tcp dport 54321 accept;
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output { type filter hook output priority 0; policy accept; }
}
EOF

systemctl enable --now nftables

5. 性能优化

# BBR + 网络参数
cat > /etc/sysctl.d/99-custom.conf <<EOF
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
net.core.rmem_max = 33554432
net.core.wmem_max = 33554432
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_fastopen = 3
vm.swappiness = 3
kernel.panic = 1
EOF

sysctl --system

# Swap 配置（内存 < 4GB 时）
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo "/swapfile none swap sw 0 0" >> /etc/fstab

6. 时间同步

# 时区
timedatectl set-timezone Asia/Shanghai

# NTP（国内用阿里云/清华）
cat > /etc/systemd/timesyncd.conf <<EOF
[Time]
NTP=ntp.aliyun.com ntp.ntsc.ac.cn time1.cloud.tencent.com
FallbackNTP=ntp1.aliyun.com ntp2.aliyun.com
EOF

systemctl enable --now systemd-timesyncd
timedatectl set-ntp yes

7. 安全加固

# Fail2Ban 防暴力破解
apt-get install -y fail2ban

cat > /etc/fail2ban/jail.d/sshd.local <<EOF
[sshd]
enabled = true
port = 54321
filter = sshd
maxretry = 5
findtime = 10m
bantime = 30m
EOF

systemctl enable --now fail2ban

# 自动安全更新
apt-get install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# 可选：禁用 ICMP ping
echo "net.ipv4.icmp_echo_ignore_all = 1" > /etc/sysctl.d/99-disable-ping.conf
sysctl -w net.ipv4.icmp_echo_ignore_all=1

8. 系统清理

# 1. 清理 apt 缓存
apt-get clean
apt-get autoclean
apt-get autoremove -y

# 2. 清理旧内核（Debian/Ubuntu）
dpkg -l 'linux-*' 2>/dev/null | grep '^ii' | grep -v "$(uname -r | sed 's/-.*//')" | awk '{print $2}' | xargs apt-get -y purge 2>/dev/null

# 3. 清理日志（保留最近 7 天）
journalctl --vacuum-time=7d
find /var/log -type f -name "*.log" -mtime +7 -delete 2>/dev/null
find /var/log -type f -name "*.gz" -mtime +30 -delete 2>/dev/null
find /var/log -type f -name "*.old" -delete 2>/dev/null

# 4. 清理临时文件
rm -rf /tmp/* 2>/dev/null
rm -rf /var/tmp/* 2>/dev/null

# 5. 清理用户缓存
rm -rf ~/.cache/* 2>/dev/null

---

日常维护命令

任务	命令
查看负载/内存	uptime && free -h
查看磁盘	df -h
查看登录日志	last / journalctl -u ssh
查看被封 IP	fail2ban-client status sshd
解封 IP	fail2ban-client set sshd unbanip <IP>
查看防火墙规则	nft list ruleset
重启服务	systemctl restart ssh
检查开放端口	ss -tulnp

定期清理脚本

#!/bin/bash
# vps-cleanup.sh - 定期清理脚本

echo "=== VPS 清理开始 ==="

# apt 清理
apt-get clean
apt-get autoremove -y

# 清理日志
journalctl --vacuum-time=7d
find /var/log -type f -name "*.log" -mtime +7 -delete 2>/dev/null

# 清理临时文件
rm -rf /tmp/* 2>/dev/null
rm -rf /var/tmp/* 2>/dev/null

echo "=== 清理完成 ==="
df -h

---

安全检查清单

• SSH 端口已改为非 22
• 禁用密码登录，使用密钥
• 禁用 root 直接登录
• 防火墙默认 DROP，只开必要端口
• Fail2Ban 已启用
• BBR 已启用
• 时区正确（NTP 同步）
• 自动安全更新已配置
• Swap 已配置（低内存 VPS）