美国VPS近期服务器频繁有被入侵的，大致分析了一下入侵行为，整理了需要做的安全策略：管理机端设置：1.跳板机权限只开放运维人?a.运维人员密码必须重新设置,密码长度不小于8位b.密码设置必须要有大小写，数字，特殊字符组合。c.强制90天更改密码d.设置密码避免重复使用e.个人账户设定登录失败次数为6次，一旦超过6次，将会锁定账号。2.跳板机禁止root登录，每周update3.禁止在跳板机上保存登录密码，ip列表等信息，将history记录默认设置为500条。4.修改PPTPvpn?务器账户密码，定期更新补丁。服务端设置：a.登录段配置同之前配置。b.定期修改密码。c.服务器端每周update补丁。d.禁用root直接登录，创建运维人员单独账号。必要时使用sudo成为root进行管理e.服务器禁止ping操作，增加安全性。d.隐藏系统版本号，防止版本信息泄露d.优化sysct.conf预防DDoS攻击e.定时检查主要配置文件，系统主要目录是否有异常，可通过MD5校验如发现有变动重新分发一份。如/etc/passwd/etc/shadow/etc/group/etc/sysctl.conf,/bin/sbin等。具体细节如下：#设定用户90天修改密码，提前7天提醒UserList=$(ls/home/|awk'{print$NF}'|grep-vlost+found)foruserin$UserListdochage-M90-W7$userdone#禁pingecho1>/proc/sys/net/ipv4/icmp_echo_ignore_all#设定用户过期时间90默认密码长度8位cp/etc/login.defs/etc/login.defs.baksed-i'/PASS_MIN_LEN/s/[0-9]{1,6}/90/'/etc/login.defssed-i'/PASS_MIN_LEN/s/[0-9]{1,3}/8/'/etc/login.defs#设定用户登录，普通用户登录识别超过6次锁定300s.echo"accountrequiredpam_tally.sodeny=100no_magic_rootreset">>/etc/pam.d/system-authecho"authrequiredpam_tally.soonerr=faildeny=6unlock_time=300">>/etc/pam.d/system-auth#隐藏系统版本号mv/etc/issue/etc/isseumv/etc/issue.net/etc/isseu.netmv/etc/redhat-release/etc/rehdat-release#优化内核参数echo'#KernelsysctlconfigurationfileforRedHatLinux##Forbinaryvalues,0isdisabled,1isenabled.Seesysctl(8)and#sysctl.conf(5)formoredetails.#ControlsIPpacketforwardingnet.ipv4.ip_forward=0#Controlssourcerouteverificationnet.ipv4.conf.default.rp_filter=1#Donotacceptsourceroutingnet.ipv4.conf.default.accept_source_route=0#ControlstheSystemRequestdebuggingfunctionalityofthekernelkernel.sysrq=0#ControlswhethercoredumpswillappendthePIDtothecorefilename#Usefulfordebuggingmulti-threadedapplicationskernel.core_uses_pid=1#ControlstheuseofTCPsyncookiesnet.ipv4.tcp_syncookies=1#Controlsthemaximumsizeofamessage,inbyteskernel.msgmnb=65536#Controlsthedefaultmaxmimumsizeofamesagequeuekernel.msgmax=65536#Controlsthemaximumsharedsegmentsize,inbyteskernel.shmmax=68719476736#Controlsthemaximumnumberofsharedmemorysegments,inpageskernel.shmall=4294967296#-------------KernelOptimization-------------net.ipv4.tcp_max_tw_buckets=60000net.ipv4.tcp_sack=1net.ipv4.tcp_window_scaling=1net.ipv4.tcp_rmem=4096873804194304net.ipv4.tcp_wmem=4096163844194304net.core.wmem_default=8388608net.core.rmem_default=8388608net.core.rmem_max=16777216net.core.wmem_max=16777216net.core.netdev_max_backlog=262144net.core.somaxconn=262144net.ipv4.tcp_max_orphans=3276800net.ipv4.tcp_max_syn_backlog=262144net.ipv4.tcp_timestamps=0net.ipv4.tcp_synack_retries=1net.ipv4.tcp_syn_retries=1net.ipv4.tcp_tw_recycle=1net.ipv4.tcp_tw_reuse=1net.ipv4.tcp_mem=94500000915000000927000000net.ipv4.tcp_fin_timeout=1net.ipv4.tcp_keepalive_time=30net.ipv4.ip_local_port_range=102465000net.ipv4.ip_conntrack_max=655360net.ipv4.netfilter.ip_conntrack_max=655360net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=180'>>/etc/sysctl.conf#生效sysctl-p#记录histtory日志echo'#historyexportHISTTIMEFORMAT="%F%T`whoami`"USER_IP=`who-uami2>/dev/null|awk'{print$NF}'|sed-e's/[()]//g'`HISTDIR=/usr/local/bin/.historyif[-z$USER_IP]thenUSER_IP=`hostname`fiif[!-d$HISTDIR]thenmkdir-p$HISTDIRchmod777$HISTDIRfiif[!-d$HISTDIR/${LOGNAME}]thenmkdir-p$HISTDIR/${LOGNAME}chmod300$HISTDIR/${LOGNAME}fiexportHISTSIZE=4000DT=`date+%Y%m%d_%H%M%S`exportHISTFILE="$HISTDIR/${LOGNAME}/${USER_IP}.history.$DT"chmod600$HISTDIR/${LOGNAME}/*.history*2>/dev/null'>>/etc/profile#安全登录/etc/hosts.allow##hosts.allowThisfiledescribesthenamesofthehostswhichare#allowedtousethelocalINETservices,asdecided#bythe'/usr/sbin/tcpd'server.#sshd:192.168.1.101/etc/hosts.deny##hosts.denyThisfiledescribesthenamesofthehostswhichare#*not*allowedtousethelocalINETservices,asdecided#bythe'/usr/sbin/tcpd'server.##Theportmaplineisredundant,butitislefttoremindyouthat#thenewsecureportmapuseshosts.denyandhosts.allow.Inparticular#youshouldknowthatNFSusesportmap!sshd:all#检查防火墙配置（开放指定用户地址登录|服务地址开放用户地址段）iptables-save#创建普通用户useraddmdfecho-e'pwd123456'|passwdmdf--stdin#禁止root登录权限sed-i's/#PermitRootLoginyes/PermitRootLoginno/g'/etc/ssh/sshd_config#优化ssh链接慢问题sed-i's/GSSAPIAuthenticationyes/GSSAPIAuthenticationno/'/etc/ssh/sshd_configsed-i'/#UseDNSyes/aUseDNSno'/etc/ssh/sshd_config/etc/init.d/sshdrestart购买使用一诺网络美国VPS，可以极大降低初创企业、中小企业以及个人开发者等用户群体的整体IT使用成本，无需亲自搭建基础设施、简化了运维和管理的日常工作量，使用户能够更专注于自身的业务发展和创新。美国VPS低至49元/月，购买链接：https://www.enuoidc.com/vpszq.html?typeid=3