https:\/\/www.itdog.cn\/ping\/<\/p>\n
\u4e00\u952eDD\u811a\u672c-debian12<\/p>\n
bash<\/span> <<\/span>(<\/span>wget<\/span> –no-check-certificate -qO- 'https:\/\/raw.githubusercontent.com\/leitbogioro\/Tools\/master\/Linux_reinstall\/InstallNET.sh'<\/span>)<\/span> -debian<\/span> 12<\/span> -pwd<\/span> 123456<\/span> -port<\/span> 22<\/span><\/p>\n \u8fd0\u884c\u7ed3\u675f\u663e\u793a<\/p>\n [<\/span>Finish]<\/span> Input 'reboot'<\/span> to continue<\/span> the subsequential installation.<\/p>\n reboot<\/span><\/p>\n \u7b49\u5f85<\/p>\n root@mail:~# cat \/etc\/os-release<\/span> apt<\/span> update -y<\/span> &&<\/span> apt<\/span> upgrade -y<\/span><\/p>\n \u4e5f\u6709\u53ef\u80fd\u9ed8\u8ba4\u5b89\u88c5<\/p>\n apt<\/span> install<\/span> sudo<\/span> curl<\/span> wget<\/span> nano<\/span><\/p>\n \u5c06\u65f6\u533a\u66f4\u6539\u4e3a\u4e0a\u6d77<\/p>\n sudo<\/span> timedatectl set-timezone Asia\/Shanghai<\/p>\n \u67e5\u770b\u5f53\u524d\u65f6\u533a<\/p>\n root@mail:~# timedatectl<\/span> \u8fd9\u4e2a\u529f\u80fd\u901a\u8fc7\u8c03\u6574\u5404\u79cd\u7cfb\u7edf\u548c\u7f51\u7edc\u53c2\u6570\u6765\u4f18\u5316\u670d\u52a1\u5668\u7684\u6027\u80fd\u3002<\/p>\n \u5b9e\u73b0\u65b9\u6cd5：<\/p>\n \u901a\u8fc7\u8fd9\u4e9b\u529f\u80fd，\u4f60\u7684\u670d\u52a1\u5668\u4e0d\u4ec5\u80fd\u591f\u66f4\u6709\u6548\u5730\u7ba1\u7406\u8d44\u6e90，\u8fd8\u80fd\u63d0\u9ad8\u5bf9\u5916\u90e8\u5a01\u80c1\u7684\u9632\u62a4\u80fd\u529b，\u4fdd\u969c\u7cfb\u7edf\u7a33\u5b9a\u8fd0\u884c\u3002<\/p>\n bash<\/span> <<\/span>(<\/span>wget<\/span> -qO- https:\/\/raw.githubusercontent.com\/jerry048\/Tune\/main\/tune.sh)<\/span> -t<\/span><\/p>\n BBR \u662f Google \u63d0\u51fa\u7684\u4e00\u79cd\u65b0\u578b\u62e5\u585e\u63a7\u5236\u7b97\u6cd5（Bottleneck Bandwidth and RTT），\u5168\u79f0\u4e3a\u74f6\u9888\u5e26\u5bbd\u548c\u5f80\u8fd4\u4f20\u64ad\u65f6\u95f4\u3002<\/p>\n \u5728 Linux \u7cfb\u7edf\u4e2d，BBR \u4e3b\u8981\u6709\u4ee5\u4e0b\u7279\u70b9\u548c\u4f5c\u7528：<\/p>\n BBRx\u662f\u4e00\u4f4d\u5927\u4f6c\u81ea\u5df1\u9b54\u6539\u7684BBR\u7248\u672c\u3002\u8be5\u7248\u672c\u8c03\u6574\u4e86\u7c7b\u4f3c startup（\u542f\u52a8\u9636\u6bb5）\u3001drain（\u6392\u7a7a\u9636\u6bb5）\u3001probe_bw（\u63a2\u6d4b\u5e26\u5bbd\u9636\u6bb5）\u3001probe_rtt（\u63a2\u6d4b\u5f80\u8fd4\u65f6\u95f4\u9636\u6bb5）\u7b49\u72b6\u6001\u4e0b\u7684\u4e00\u4e9b\u5173\u952e\u53c2\u6570，\u5982 pacing_gain（\u53d1\u9001\u901f\u7387\u589e\u76ca）\u3001cwnd_gain（\u62e5\u585e\u7a97\u53e3\u589e\u76ca）\u7b49，\u4e2a\u4eba\u6765\u8bf4\u89c9\u5f97\u6bd4\u539f\u7248BBR\u7684\u6548\u679c\u66f4\u597d，\u5982\u679c\u4e0d\u559c\u6b22\u7684\u8bdd，\u53ef\u4ee5\u9009\u62e9\u539f\u7248BBR\u8fdb\u884c\u5b89\u88c5\u3002<\/p>\n bash<\/span> <<\/span>(<\/span>wget<\/span> -qO- https:\/\/raw.githubusercontent.com\/jerry048\/Tune\/main\/tune.sh)<\/span> -x<\/span><\/p>\n \u5b8c\u6210\u540e\u91cd\u542fVPS\u3001\u4f7f\u5185\u6838\u66f4\u65b0\u548cBBR\u8bbe\u7f6e\u90fd\u751f\u6548<\/p>\n root@mail:~# lsmod | grep bbr<\/span> \u5728 Linux \u7cfb\u7edf\u4e2d，SWAP（\u4ea4\u6362\u7a7a\u95f4）\u662f\u6307\u4e00\u5757\u78c1\u76d8\u7a7a\u95f4，\u7528\u4e8e\u5728\u7269\u7406\u5185\u5b58（RAM）\u4e0d\u8db3\u65f6，\u4f5c\u4e3a\u4e34\u65f6\u7684\u6269\u5c55\u5185\u5b58\u6765\u4f7f\u7528\u3002\u5f53\u7cfb\u7edf\u7684\u7269\u7406\u5185\u5b58\u4f7f\u7528\u91cf\u63a5\u8fd1\u9971\u548c，Linux \u5185\u6838\u4f1a\u5c06\u4e00\u4e9b\u4e0d\u5e38\u4f7f\u7528\u7684\u5185\u5b58\u9875\u4ea4\u6362\u5230 SWAP \u5206\u533a\u4e2d，\u4ece\u800c\u4e3a\u5f53\u524d\u8fd0\u884c\u7684\u7a0b\u5e8f\u817e\u51fa\u66f4\u591a\u7684\u7269\u7406\u5185\u5b58\u3002\u5f53\u8fd9\u4e9b\u88ab\u4ea4\u6362\u51fa\u53bb\u7684\u5185\u5b58\u9875\u518d\u6b21\u88ab\u9700\u8981\u65f6，\u5b83\u4eec\u4f1a\u88ab\u91cd\u65b0\u6362\u56de\u5230\u7269\u7406\u5185\u5b58\u4e2d\u3002SWAP \u5206\u533a\u7684\u5b58\u5728\u53ef\u4ee5\u5728\u4e00\u5b9a\u7a0b\u5ea6\u4e0a\u907f\u514d\u7531\u4e8e\u7269\u7406\u5185\u5b58\u4e0d\u8db3\u5bfc\u81f4\u7cfb\u7edf\u6027\u80fd\u4e25\u91cd\u4e0b\u964d\u6216\u8fdb\u7a0b\u88ab\u5f3a\u5236\u7ec8\u6b62\u7684\u60c5\u51b5\u3002<\/p>\n \u56e0\u6b64，SWAP\u5bf9\u4e8e\u5185\u5b58\u5c0f\u7684VPS\u975e\u5e38\u6709\u5fc5\u8981，\u53ef\u4ee5\u63d0\u9ad8\u6211\u4eec\u7684\u8fd0\u884c\u6548\u7387\u3002<\/p>\n wget<\/span> -O<\/span> swap.sh https:\/\/raw.githubusercontent.com\/yuju520\/Script\/main\/swap.sh &&<\/span> chmod<\/span> +x swap.sh &&<\/span> clear<\/span> &&<\/span> .\/swap.sh<\/p>\n # \u589e\u52a0\u865a\u62df\u5185\u5b58\u4e3a2G，\u9002\u5408\u5c0f\u5185\u5b58vps,\u6559\u7a0bhttps:\/\/blog.laoda.de\/archives\/vps-swap\u4e0e\u4e0b\u9762\u547d\u4ee4\u540c\u7406<\/span> root@mail:~# free -m<\/span> nano<\/span> \/etc\/ssh\/sshd_config<\/p>\n \u4f7f\u7528 ctrl+w \u8fdb\u5165\u641c\u7d22\u6a21\u5f0f，\u7136\u540e\u8f93\u5165 Port 22 \u5e76\u56de\u8f66<\/p>\n \u4fee\u6539\u7aef\u53e3<\/p>\n \u4fdd\u5b58ctrl+o+\u56de\u8f66\u6587\u4ef6\u5e76\u9000\u51factrl+x<\/p>\n sudo<\/span> service<\/span> sshd restart<\/p>\n \u8bf4\u660e：\u4e3a\u4e86\u9632\u6b62\u5931\u8054，\u4e0d\u8981\u5173\u95ed\u5f53\u524dssh\u7a97\u53e3，\u65b0\u5f00\u4e00\u4e2a\u8fdb\u884c\u6d4b\u8bd5<\/p>\n passwd<\/span><\/p>\n \u590d\u6742\u5bc6\u7801\u91c7\u7528bitwardern\u670d\u52a1\u751f\u6210<\/p>\n adduser <<\/span>username><\/span><\/p>\n visudo<\/p>\n User Privilege Specification \u4e0b\u52a0\u5165\u4e00\u884c <username> ALL=(ALL) NOPASSWD: ALL<\/p>\n ssh-keygen -t<\/span> rsa -b<\/span> 4096<\/span> -C<\/span> "myvps"<\/span><\/p>\n scp<\/span> -P<\/span> <<\/span>port><\/span> .\/.ssh\/id_rsa.pub root@<<\/span>ip><\/span>:\/root\/.ssh\/authorized_keys<\/p>\n \u8f93\u5165\u670d\u52a1\u5668\u767b\u5f55\u5bc6\u7801<\/p>\n chmod<\/span> 600<\/span> ~\/.ssh\/authorized_keys<\/p>\n nano<\/span> \/etc\/ssh\/sshd_config #\u641c\u7d22PasswordAuthentication，\u628ayes\u6539\u6210no<\/span><\/p>\n Ubuntu\u9ed8\u8ba4\u81ea\u5df1\u5df2\u7ecf\u662f\u81ea\u5e26ufw\u9632\u706b\u5899\u4e86，\u53ea\u662f\u6ca1\u6709\u542f\u52a8\u800c\u5df2（\u5982\u679c\u662fDebian\u7684\u8bdd，\u9700\u8981\u5b89\u88c5）<\/p>\n sudo<\/span> apt<\/span> install<\/span> ufw -y<\/span><\/p>\n root@mail:~# sudo ufw status<\/span> sudo<\/span> ufw default deny incoming sudo<\/span> ufw allow <<\/span>port><\/span>\/tcp comment 'SSH'<\/span><\/p>\n sudo<\/span> ufw allow http<\/p>\n sudo<\/span> ufw allow https<\/p>\n sudo<\/span> ufw enable<\/span><\/p>\n sudo<\/span> ufw status numbered sudo<\/span> ufw reload<\/p>\n apt<\/span> install<\/span> fail2ban<\/p>\n fail2ban\u7684\u914d\u7f6e\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e \/etc\/fail2ban\/ \u76ee\u5f55\u4e0b，fail2ban\u7684.conf\u914d\u7f6e\u6587\u4ef6\u90fd\u662f\u53ef\u4ee5\u88ab.local\u8986\u76d6，\u6240\u4ee5\u914d\u7f6e\u65b9\u5f0f\u5efa\u8bae\u662f\u6dfb\u52a0.local\u6587\u4ef6，\u4e0d\u4fee\u6539\u539f\u6765\u7684\u914d\u7f6e\u6587\u4ef6\u3002<\/p>\n nano<\/span> \/etc\/fail2ban\/jail.local<\/p>\n \u914d\u7f6e\u5982\u4e0b<\/p>\n [DEFAULT] #\u5141\u8bb8ipv6 #\u65e5\u5fd7\u4fee\u6539\u68c0\u6d4b\u673a\u5236（gamin\u3001polling\u548cauto\u8fd9\u4e09\u79cd） #\u9488\u5bf9\u5404\u670d\u52a1\u7684\u68c0\u67e5\u914d\u7f6e，\u5982\u8bbe\u7f6ebantime\u3001findtime\u3001maxretry\u548c\u5168\u5c40\u51b2\u7a81，\u670d\u52a1\u4f18\u5148\u7ea7\u5927\u4e8e\u5168\u5c40\u8bbe\u7f6e<\/p>\n [sshd]<\/p>\n #\u662f\u5426\u6fc0\u6d3b\u6b64\u9879（true\/false） #\u8fc7\u6ee4\u89c4\u5219filter\u7684\u540d\u5b57，\u5bf9\u5e94filter.d\u76ee\u5f55\u4e0b\u7684sshd.conf #ssh\u7aef\u53e3 #\u52a8\u4f5c\u7684\u76f8\u5173\u53c2\u6570 #\u68c0\u6d4b\u7684\u7cfb\u7edf\u7684\u767b\u9646\u65e5\u5fd7\u6587\u4ef6 #\u5c4f\u853d\u65f6\u95f4，\u5355\u4f4d：\u79d2 #\u8fd9\u4e2a\u65f6\u95f4\u6bb5\u5185\u8d85\u8fc7\u89c4\u5b9a\u6b21\u6570\u4f1a\u88abban\u6389 #\u6700\u5927\u5c1d\u8bd5\u6b21\u6570 sudo<\/span> systemctl enable<\/span> fail2ban<\/p>\n sudo<\/span> systemctl restart fail2ban<\/p>\n sudo<\/span> systemctl status fail2ban<\/p>\n fail2ban–<\/span>client status<\/p>\n wget –<\/span>qO–<\/span> get<\/span>.<\/span>docker.<\/span>com |<\/span> bash<\/p>\n \u6216<\/p>\n curl –<\/span>fsSL https:\/\/get.docker.com -o get-docker.sh && sh get-docker.sh<\/span><\/p>\n curl<\/span> https:\/\/install.1panel.live\/docker-install -o<\/span> docker-install &&<\/span> sudo<\/span> bash<\/span> .\/docker-install &&<\/span> rm<\/span> -f<\/span> .\/docker-install<\/p>\n docker -v<\/p>\n sudo<\/span> systemctl enable<\/span> docker<\/span><\/p>\n sudo<\/span> apt-get<\/span> purge docker-ce docker-ce-cli containerd.io \u4ee5\u4e0b\u914d\u7f6e\u4f1a\u589e\u52a0\u4e00\u6bb5\u81ea\u5b9a\u4e49\u5185\u7f51 IPv6 \u5730\u5740，\u5f00\u542f\u5bb9\u5668\u7684 IPv6 \u529f\u80fd，\u4ee5\u53ca\u9650\u5236\u65e5\u5fd7\u6587\u4ef6\u5927\u5c0f，\u9632\u6b62 Docker \u65e5\u5fd7\u585e\u6ee1\u786c\u76d8：<\/p>\n cat<\/span> ><\/span> \/etc\/docker\/daemon.json <<<\/span>EOF \u4fee\u6539\u540e\u91cd\u542fdocker\u670d\u52a1<\/p>\n systemctl restart docker<\/span><\/p>\n
\nPRETTY_NAME<\/span>=<\/span>"Debian GNU\/Linux 12 (bookworm)"<\/span>
\nNAME<\/span>=<\/span>"Debian GNU\/Linux"<\/span>
\nVERSION_ID<\/span>=<\/span>"12"<\/span>
\nVERSION<\/span>=<\/span>"12 (bookworm)"<\/span>
\nVERSION_CODENAME<\/span>=<\/span>bookworm
\nID<\/span>=<\/span>debian
\nHOME_URL<\/span>=<\/span>"https:\/\/www.debian.org\/"<\/span>
\nSUPPORT_URL<\/span>=<\/span>"https:\/\/www.debian.org\/support"<\/span>
\nBUG_REPORT_URL<\/span>=<\/span>"https:\/\/bugs.debian.org\/"<\/span><\/p>\n3.\u7cfb\u7edf\u8bbe\u7f6e<\/h3>\n
\u66f4\u65b0\u8f6f\u4ef6\u5e93<\/h4>\n
\u66f4\u65b0\u3001\u5b89\u88c5\u5fc5\u5907\u8f6f\u4ef6<\/h4>\n
\u6821\u6b63\u7cfb\u7edf\u65f6\u95f4<\/h4>\n
\n Local time: Wed 2024<\/span>-11-27 21<\/span>:11:18 CST
\n Universal time: Wed 2024<\/span>-11-27 13<\/span>:11:18 UTC
\n RTC time: Wed 2024<\/span>-11-27 13<\/span>:11:18
\n Time zone: Asia\/Shanghai (<\/span>CST, +0800)<\/span>
\nSystem clock synchronized: no
\n NTP service: n\/a
\n RTC in<\/span> local<\/span> TZ: no<\/p>\n\u7cfb\u7edf\u53c2\u6570\u8c03\u4f18<\/h4>\n
\n
4.BBR<\/h3>\n
\n
\u5f00\u542fBBRX\u52a0\u901f<\/h4>\n
\u4e00\u952e\u811a\u672c<\/h5>\n
\u786e\u8ba4BBR\u5f00\u542f<\/h4>\n
\ntcp_bbrx 20480<\/span> 2<\/span>
\ntcp_bbr 20480<\/span> 2<\/span><\/p>\n5.\u6dfb\u52a0SWAP<\/h3>\n
\u4e00\u952e\u811a\u672c<\/h4>\n
\u624b\u52a8<\/h4>\n
\n# \u6839\u636e\u81ea\u5df1vps\u5185\u5b58\u4fee\u6539，2G\u4ee5\u4e0b\u5efa\u8bae\u5b9e\u9645\u5185\u5b582\u500d，2-4G\u5efa\u8bae1.5\u500d<\/span>
\nsudo<\/span> swapon<\/span> –show<\/span> # \u67e5\u770b\u5f53\u524d\u7cfb\u7edf\u7684\u4ea4\u6362\u7a7a\u95f4\u914d\u7f6e，\u53ef\u4ee5\u91cd\u542f\u518d\u8fd0\u884c\u8fd9\u4e2a\u547d\u4ee4\u770b\u662f\u5426\u751f\u6548<\/span>
\nsudo<\/span> fallocate -l<\/span> 2G \/swapfile
\nsudo<\/span> chmod<\/span> 600<\/span> \/swapfile
\nsudo<\/span> mkswap<\/span> \/swapfile
\nsudo<\/span> swapon<\/span> \/swapfile
\necho<\/span> '\/swapfile none swap sw 0 0'<\/span> |<\/span> sudo<\/span> tee<\/span> -a<\/span> \/etc\/fstab # \u56fa\u5316<\/span><\/p>\n\u67e5\u770b\u5f53\u524d\u5185\u5b58<\/h4>\n
\n total used free<\/span> shared buff\/cache available
\nMem: 4425<\/span> 353<\/span> 3671<\/span> 0<\/span> 623<\/span> 4072<\/span>
\nSwap: 9215<\/span> 0<\/span> 9215<\/span><\/p>\n6.\u5b89\u5168\u8bbe\u7f6e<\/h3>\n
\u66f4\u6539SSH\u7aef\u53e3<\/h4>\n
\u91cd\u542fssh\u670d\u52a1<\/h5>\n
\u4f7f\u7528\u590d\u6742\u5bc6\u7801<\/h4>\n
\u65b0\u5efa\u666e\u901a\u7528\u6237<\/h4>\n
\u5c06\u7528\u6237\u6dfb\u52a0\u5230sudo\u540d\u5355\u4e2d<\/h5>\n
\u542f\u7528RSA\u5bc6\u94a5\u9a8c\u8bc1\u767b\u5f55\u5e76\u7981\u6b62\u5bc6\u7801\u767b\u5f55<\/h4>\n
\u5728\u672c\u5730\u4f7f\u7528keygen\u751f\u6210\u5bc6\u94a5\u5bf9<\/h5>\n
\u4e0a\u4f20\u516c\u94a5（win11）<\/h5>\n
\u4fee\u6539authorized_keys\u6587\u4ef6\u6743\u9650\u4e3a600 （\u4ec5\u6240\u6709\u8005\u53ef\u8bfb\u53ef\u5199）<\/h5>\n
\u7f16\u8f91ssh\u914d\u7f6e\u6587\u4ef6\u7981\u6b62\u5bc6\u7801\u767b\u5f55<\/h5>\n
\u5b89\u88c5UFW\u9632\u706b\u5899<\/h4>\n
\u68c0\u67e5\u9632\u706b\u5899\u72b6\u6001<\/h5>\n
\nStatus: inactive<\/p>\n\u8bbe\u7f6eufw\u4f7f\u7528\u9ed8\u8ba4\u503c<\/h5>\n
\nsudo<\/span> ufw default allow outgoing<\/p>\n\u5141\u8bb8SSH\u8fde\u63a5<\/h5>\n
\u5141\u8bb8http\u8fde\u63a5<\/h5>\n
\u5141\u8bb8https\u8fde\u63a5<\/h5>\n
\u542f\u52a8ufw\u9632\u706b\u5899<\/h5>\n
\u5220\u9664\u89c4\u5219<\/h5>\n
\nsudo<\/span> ufw delete 5<\/span><\/p>\n\u91cd\u8f7d\u914d\u7f6e<\/h5>\n
\u5b89\u88c5fail2ban<\/h4>\n
\u5b89\u88c5<\/h5>\n
\u914d\u7f6e<\/h5>\n
\n#\u5ffd\u7565\u7684IP\u5217\u8868,\u4e0d\u53d7\u8bbe\u7f6e\u9650\u5236（\u767d\u540d\u5355）
\nignoreip = 127.0.0.1<\/p>\n
\nallowipv6 = auto<\/p>\n
\nbackend = systemd<\/p>\n
\nenabled = true<\/p>\n
\nfilter = sshd<\/p>\n
\nport = ssh<\/p>\n
\naction = iptables[name=SSH, port=ssh, protocol=tcp]<\/p>\n
\nlogpath = \/var\/log\/secure<\/p>\n
\nbantime = 86400<\/p>\n
\nfindtime = 86400<\/p>\n
\nmaxretry = 3<\/p>\n\u8bbe\u7f6e\u5f00\u673a\u81ea\u52a8\u542f\u52a8fail2ban<\/h5>\n
\u91cd\u65b0\u542f\u52a8fail2ban<\/h5>\n
\u67e5\u770bfail2ban\u7684\u72b6\u6001<\/h5>\n
\u67e5\u770b\u6240\u6709\u53ef\u7528jail\u7684\u72b6\u6001<\/h5>\n
7.\u5b89\u88c5docker\u3001docker-compose<\/h3>\n
Docker\u5b89\u88c5<\/h4>\n
\u975e\u5927\u9646\u670d\u52a1\u5668<\/h5>\n
\u5927\u9646\u670d\u52a1\u5668Docker\u5b89\u88c5<\/h5>\n
\u67e5\u770bDocker\u7248\u672c<\/h5>\n
\u5f00\u673a\u81ea\u52a8\u542f\u52a8<\/h5>\n
\u5378\u8f7dDocker<\/h5>\n
\nsudo<\/span> apt-get<\/span> remove docker<\/span> docker-engine
\nsudo<\/span> rm<\/span> -rf<\/span> \/var\/lib\/docker
\nsudo<\/span> rm<\/span> -rf<\/span> \/var\/lib\/containerd<\/p>\n\u4fee\u6539Docker\u914d\u7f6e<\/h5>\n
\n{
\n "log-driver": "json-file",
\n "log-opts": {
\n "max-size": "20m",
\n "max-file": "3"
\n },
\n "ipv6": true,
\n "fixed-cidr-v6": "fd00:dead:beef:c0::\/80",
\n "experimental":true,
\n "ip6tables":true
\n}
\nEOF<\/span><\/p>\n