【自用】VPS 到手后必做的几件事

1
useradd -m -G sudo -s /bin/bash <你的用户名>

1
passwd <你的用户名>

1
passwd root

1
su <你的用户名> -

1
sudo vi /etc/ssh/sshd_config.d/me.conf

1
# 禁止 Root 用户通过密码远程登录
2
PermitRootLogin prohibit-password
3

4
# 关闭远程密码登录，允许密钥登录
5
PasswordAuthentication no
6
PubkeyAuthentication yes
7
AuthorizedKeysFile .ssh/authorized_keys
8

9
# 允许本地密码登录
10
UsePAM yes

1
sudo systemctl restart ssh

1
# 设置 SSH端口
2
Port <自拟> # 范围是 1-25565

1
sudo systemctl daemon-reload
2
sudo systemctl restart ssh.service

1
# Root 用户登录方式
2
sudo sshd -T | grep -i "PermitRootLogin"
3
# 密码认证
4
sudo sshd -T | grep -i "PasswordAuthentication"
5
# ssh 端口
6
sudo sshd -T | grep -i "Port"

1
sudo apt install fail2ban

1
sudo vi /etc/fail2ban/jail.local

1
[sshd]
2
ignoreip = 127.0.0.1/8 # 白名单
3
enabled = true
4
filter = sshd
5
port = 22 # 端口，改了的话这里也要改
6
maxretry = 5 # 最大尝试次数
7
findtime = 300 # 多少秒以内最大尝试次数规则生效
8
bantime = 600 # 封禁多少秒，-1是永久封禁（不建议永久封禁）
9
action = %(action_)s[port="%(port)s", protocol="%(protocol)s", logpath="%(logpath)s", chain="%(chain)s"] # 不需要发邮件通知就这样设置
10
banaction = iptables-multiport # 禁用方式
11
logpath = /var/log/auth.log # SSH 登陆日志位置

1
ssh-keygen -t ed25519

1
Generating public/private ed25519 key pair.
2
Enter file in which to save the key (C:\Users\<USER>/.ssh/id_ed25519): # 直接回车
3
Enter passphrase (empty for no passphrase): # 可以留空，也可以设置
4
Enter same passphrase again: # 和上一个一样
5
Your identification has been saved in C:\Users\<USER>/.ssh/id_ed25519
6
Your public key has been saved in C:\Users\<USER>/.ssh/id_ed25519.pub
7
The key fingerprint is:
8
SHA256:9JPnN/0VqqQFTQ5dIkBC+rdFysFijnzRmxWR1/Yh4kI <USER>@ANITSURIW
9
The key's randomart image is:

1
vi ~/.ssh/authorized_keys

1
sudo ufw default allow outgoing # 默认允许所有数据出站
2
sudo ufw default deny incoming # 默认禁止所有数据入站

1
sudo ufw status
2
sudo ufw status numbered <数字>

1
# 允许22端口的proto协议的流量入站
2
sudo ufw allow in 22/proto
3

4
#允许22端口的proto协议的流量出站
5
sudo ufw allow out 22/proto
6

7
# 在未指定in/out的情况下，默认为in
8
sudo ufw allow 22/proto
9

10
# 在未指定proto的情况下，默认为tcp和udp
11
sudo ufw allow 22
12

13
# 拒绝的话就把allow改成deny
14
sudo ufw deny 22
15

16
# 允许从start_port到end_port的端口
17
sudo ufw allow start_port:end_port
18

19
# 允许复数个端口，以英文逗号分隔
20
sudo ufw allow port1,port2
21

22
# 允许来自于特定ip或cidr段的流量
23
sudo ufw allow from ip/cidr
24

25
# 允许来自于特定ip或cidr段端口22的流量
26
sudo ufw allow from ip/cidr to any port 22
27

28
# 允许来自于特定ip或cidr段端口22的tcp协议的流量
29
sudo ufw allow from ip/cidr to any proto tcp port 22
30

31
# 如果指定复数个端口，则必须指定协议
32
sudo ufw allow from ip to any proto tcp port 80,443
33

34
# comment用于注释
35
sudo ufw allow from ip to any proto tcp port 80,443 comment "hello"

1
sudo ufw delete allow 22 # 在规则前面加个delete
2
sudo ufw delete 1 # 按照numbered的编号删除也行

1
# 成功连接 ssh 的也记一下日志备查比较好
2
ufw allow log <SSH端口号>/tcp

1
sudo apt install vim curl wget net-tools git screen nginx

1
# 添加 Docker 官方 GPG key:
2
sudo apt-get update
3
sudo apt-get install ca-certificates curl
4
sudo install -m 0755 -d /etc/apt/keyrings
5
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
6
sudo chmod a+r /etc/apt/keyrings/docker.asc
7

8
# 添加仓库到 apt 源:
9
echo \
10
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
11
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
12
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
13
sudo apt-get update

1
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

1
bash <(curl -Ls https://Check.Place) -I

1
bash <(curl -L -s check.unlock.media)

1
bash <(curl https://raw.githubusercontent.com/vpslog/benchframe/main/benchframe.sh)

1
sudo hostnamectl set-hostname <给VPS起的名字> # eg: JP4C, HK8G, SG1C

1
sudo timedatectl set-timezone Asia/Shanghai

1
# 检查时间同步状态
2
sudo timedatectl status
3
# 启用自动时间同步
4
sudo timedatectl set-ntp true
5
# 重启时间同步
6
sudo systemctl restart systemd-timesyncd

1
# 安装NTP
2
sudo apt install ntp
3
# 启动并启用NTP服务
4
sudo systemctl enable --now ntp
5
# 查看NTP同步状态
6
ntpq -p

1
uname -r

1
sudo vim /etc/sysctl.d/myself-bbr.conf

1
net.core.default_qdisc=fq
2
net.ipv4.tcp_congestion_control=bbr

1
sudo sysctl -p /etc/sysctl.d/myself-bbr.conf

1
# 查看当前使用的拥塞控制算法
2
sysctl net.ipv4.tcp_congestion_control
3
# 查看系统支持的所有拥塞控制算法
4
sysctl net.ipv4.tcp_available_congestion_control
5
# 查看默认的队列调度器
6
sysctl net.core.default_qdisc
7
# 检查BBR模块是否加载
8
lsmod | grep bbr

1
# 在 root 用户
2
su -
3
wget -O swap.sh https://box.anitsuri.top/swap.sh && chmod +x swap.sh && clear && ./swap.sh

1
free -h

1
sudo apt install zsh

1
which zsh

1
chsh -s $(which zsh)

1
This is the Z Shell configuration function for new users,
2
zsh-newuser-install.
3
You are seeing this message because you have no zsh startup files
4
(the files .zshenv, .zprofile, .zshrc, .zlogin in the directory
5
~).  This function can help you with a few settings that should
6
make your use of the shell easier.
7

8
You can:
9

10
(q)  Quit and do nothing.  The function will be run again next time.
11

12
(0)  Exit, creating the file ~/.zshrc containing just a comment.
13
     That will prevent this function being run again.
14

15
(1)  Continue to the main menu.
16

17
(2)  Populate your ~/.zshrc with the configuration recommended
18
     by the system administrator and exit (you will need to edit
19
     the file by hand, if so desired).
20

21
--- Type one of the keys in parentheses ---

1
Please pick one of the following options:
2

3
(1)  Configure settings for history, i.e. command lines remembered
4
     and saved by the shell.  (Recommended.)
5

6
(2)  Configure the new completion system.  (Recommended.)
7

8
(3)  Configure how keys behave when editing command lines.  (Recommended.)
9

10
(4)  Pick some of the more common shell options.  These are simple "on"
11
     or "off" switches controlling the shell's features.
12

13
(0)  Exit, creating a blank ~/.zshrc file.
14

15
(a)  Abort all settings and start from scratch.  Note this will overwrite
16
     any settings from zsh-newuser-install already in the startup file.
17
     It will not alter any of your other settings, however.
18

19
(q)  Quit and do nothing else.  The function will be run again next time.
20
--- Type one of the keys in parentheses ---

1
curl -fsSL https://raw.githubusercontent.com/zimfw/install/master/install.zsh | zsh

1
% curl -fsSL https://raw.githubusercontent.com/zimfw/install/master/install.zsh | zsh
2
) Using Zsh version 5.9
3
) ZIM_HOME not set, using the default one.
4
) Zsh is your default shell.
5
! You seem to be already calling compinit in /etc/zsh/zshrc. Please remove it, because Zim Framework's completion module will call compinit for you.
6
) Downloaded the Zim Framework script to /home/<USER>/.zim/zimfw.zsh
7
) Prepended Zim Framework template to /home/<USER>/.zimrc
8
) Prepended Zim Framework template to /home/<USER>/.zshrc
9
) Installed modules.
10
All done. Enjoy your Zsh IMproved! Restart your terminal for changes to take effect.

1
echo 'skip_global_compinit=1' > ~/.zshenv

1
sudo vim ~/.zshrc

1
# Set editor default keymap to emacs (`-e`) or vi (`-v`)
2
bindkey -v # 把 `-e` 改成 `-v`

1
vim ~/.zimrc

1
# Start configuration added by Zim Framework install {{{
2
#
3
# This is not sourced during shell startup and is only used to configure zimfw.
4
#
5

6
#
7
# Modules
8
#
9

10
# Sets sane Zsh built-in environment options.
11
zmodule environment
12
# Provides handy git aliases and functions.
13
zmodule git
14
# Applies correct bindkeys for input events.
15
zmodule input
16
# Sets a custom terminal title.
17
zmodule termtitle
18
# Utility aliases and functions. Adds colour to ls, grep and less.
19
zmodule utility
20

21
# <-- Normally new modules should be added here. Check each module documentation
22
# for any caveats.
23

24
#
25
# Prompt
26
#
27

28
# Exposes how long the last command took to run to prompts.
29
zmodule duration-info
30
# Exposes git repository status information to prompts.
31
zmodule git-info
32
# A heavily reduced, ASCII-only version of the Spaceship and Starship prompts.
33
zmodule bira
34

35
#
36
# Completion
37
#
38

39
# Additional completion definitions for Zsh.
40
zmodule zsh-users/zsh-completions --fpath src
41
# Enables and configures smart and extensive tab completion, must be sourced
42
# after all modules that add completion definitions.
43
zmodule completion
44

45
#
46
# Modules that must be initialized last
47
#
48

49
# 语法高亮插件
50
zmodule zdharma-continuum/fast-syntax-highlighting
51
# Fish-like history search for Zsh, must be sourced after
52
# zsh-users/zsh-syntax-highlighting. Bind keyboard shortcuts in your ~/.zshrc:
53
# https://github.com/zsh-users/zsh-history-substring-search/blob/master/README.md#usage
54
zmodule zsh-users/zsh-history-substring-search
55
# Fish-like autosuggestions for Zsh. Add the following to your ~/.zshrc to boost
56
# performance: ZSH_AUTOSUGGEST_MANUAL_REBIND=1
57
zmodule zsh-users/zsh-autosuggestions
58
# }}} End configuration added by Zim Framework install
59

60
# 书签管理插件
61
zmodule pabloariasal/zfm
62
# 在 Tab 补全中使用 fzf 搜索的插件
63
zmodule Aloxaf/fzf-tab

1
zimfw install

1
zimfw clean

1
~/.fzf/install

1
$ ~/.fzf/install
2
Downloading bin/fzf ...
3
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
4
                                 Dload  Upload   Total   Spent    Left  Speed
5
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
6
100 1757k  100 1757k    0     0   882k      0  0:00:01  0:00:01 --:--:-- 1343k
7
  - Checking fzf executable ... 0.66.1
8
# 是否开启模糊补全
9
Do you want to enable fuzzy auto-completion? ([y]/n) # 这里回车/按 y 即可
10
# 是否开启按键绑定
11
Do you want to enable key bindings? ([y]/n) # 同上
12

13
Generate /home/<USER>/.fzf.bash ... OK
14
Generate /home/<USER>/.fzf.zsh ... OK
15

16
# 是否自动更新主配置文件
17
Do you want to update your shell configuration files? ([y]/n) # 同上
18

19
Update /home/<USER>/.bashrc:
20
  - [ -f ~/.fzf.bash ] && source ~/.fzf.bash
21
    + Added
22

23
Update /home/<USER>/.zshrc:
24
  - [ -f ~/.fzf.zsh ] && source ~/.fzf.zsh
25
    + Added
26

27
Finished. Restart your shell or reload config file.
28
   source ~/.bashrc  # bash
29
   source ~/.zshrc   # zsh
30

31
Use uninstall script to remove fzf.
32

33
For more information, see: https://github.com/junegunn/fzf

1
source ~/.zshrc

1
sudo apt install rsync

1
curl https://box.anitsuri.top/cert_sync.sh -O cert_sync.sh

1
ssh -p ${REMOTE_PORT} ${REMOTE_USER}@${REMOTE_HOST}

1
# 这里由于脚本的默认日志地址 `/var/log/cert_sync.log` 需要 root 用户才可以写入，所以需要开 sudo
2
sudo bash cert_sync.sh

1
cat /var/log/cert_sync.log

1
crontab -e

1
$ crontab -e
2
no crontab for <USER> - using an empty one
3

4
Select an editor.  To change later, run 'select-editor'.
5
  1. /bin/nano        <---- easiest
6
  2. /usr/bin/vim.basic
7
  3. /usr/bin/vim.tiny
8
  4. /bin/ed
9

10
Choose 1-4 [1]: # 这里选择 2，使用 vim 来编辑

1
00 19 1 * * /usr/local/bin/sync_cert.sh >> /var/log/sync_cert.log 2>&1