ubuntu 12.04系统服务器安全配置介绍

$ sudo addgroup admin
Adding group 'admin' (GID 1001)
Done.
 
$ sudo adduser spenserj
Adding user `spenserj' ...
Adding new group `spenserj' (1002) ...
Adding new user `spenserj' (1001) with group `spenserj' ...
Creating home directory `/home/spenserj' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for spenserj
Enter the new value, or press ENTER for the default
    Full Name []: Spenser Jones
    Room Number []:
    Work Phone []:
    Home Phone []:
    Other []:
Is the information correct? [Y/n] y
 
$ sudo usermod -a -G admin spenserj

$ mkdir ~/.ssh

$ echo "ssh-rsa [your public key]" > ~/.ssh/authorized_keys

/etc/ssh/sshd_config

PermitRootLogin no 
PermitEmptyPasswords no 
PasswordAuthentication no 
AllowUsers spenserj

$ sudo service ssh restart 

ssh stop/waiting 

ssh start/running, process 1599

sudo apt-get update 

sudo apt-get upgrade

$ sudo mkdir /etc/iptables
/etc/iptables/rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
 
# Accept any related or established connections
-I INPUT  1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-I OUTPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
# Allow all traffic on the loopback interface
-A INPUT  -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
 
# Allow outbound DHCP request - Some hosts (Linode) automatically assign the primary IP
#-A OUTPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT
 
# Outbound DNS lookups
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
 
# Outbound PING requests
-A OUTPUT -p icmp -j ACCEPT
 
# Outbound Network Time Protocol (NTP) request
-A OUTPUT -p udp --dport 123 --sport 123 -j ACCEPT
 
# SSH
-A INPUT  -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
 
# Outbound HTTP
-A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
 
COMMIT

$ sudo iptables-apply /etc/iptables/rules

/etc/network/if-pre-up.d/iptables

#!/bin/sh 

iptables-restore < /etc/iptables/rules

$ sudo chmod +x /etc/network/if-pre-up.d/iptables 

$ sudo /etc/network/if-pre-up.d/iptables

Install Fail2ban

sudo apt-get install fail2ban

sudo cp /etc/fail2ban/jail.{conf,local}

/etc/fail2ban/jail.local

[DEFAULT]
 
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
bantime  = 600
maxretry = 3
 
# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = auto
 
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

/etc/fail2ban/jail.local

/etc/fail2ban/jail.local

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6
[ssh-ddos]
enabled  = true
port     = ssh
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

Banned IPs

DROP       all  --  204.50.33.22         anywhere
DROP       all  --  195.128.126.114      anywhere

1.

2.    $link = mysql_connect("localhost","root","mysql密码");

3.    

4.    if (!$link)

5.    

6.    {

7.    

8.    die('Could not connect: ' . mysql_error());

9.    

10.    }

11.    

12.    else echo "Mysql已经正确配置";

13.    

14.    mysql_close($link);

15.    

16.    ?>