{"id":30064,"date":"2025-04-20T16:21:10","date_gmt":"2025-04-20T08:21:10","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/30064.html"},"modified":"2025-04-20T16:21:10","modified_gmt":"2025-04-20T08:21:10","slug":"%e6%9c%8d%e5%8a%a1%e5%99%a8%e6%93%8d%e4%bd%9c%e7%b3%bb%e7%bb%9f%e9%9d%a2%e8%af%95%e9%a2%98","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/30064.html","title":{"rendered":"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898"},"content":{"rendered":"<h3>1. \u8bf7\u89e3\u91ca\u4ec0\u4e48\u662f\u865a\u62df\u5185\u5b58&#xff0c;\u4ee5\u53ca\u5b83\u5728\u7cfb\u7edf\u4e2d\u7684\u4f5c\u7528\u3002<\/h3>\n<p>\u865a\u62df\u5185\u5b58\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u7cfb\u7edf\u5185\u5b58\u7ba1\u7406\u6280\u672f&#xff0c;\u5b83\u4f7f\u5f97\u5e94\u7528\u7a0b\u5e8f\u8ba4\u4e3a\u5b83\u62e5\u6709\u8fde\u7eed\u7684\u53ef\u7528\u5185\u5b58&#xff08;\u4e00\u4e2a\u8fde\u7eed\u5b8c\u6574\u7684\u5730\u5740\u7a7a\u95f4&#xff09;&#xff0c;\u800c\u5b9e\u9645\u4e0a&#xff0c;\u5b83\u901a\u5e38\u662f\u88ab\u5206\u9694\u6210\u591a\u4e2a\u7269\u7406\u5185\u5b58\u788e\u7247&#xff0c;\u8fd8\u6709\u90e8\u5206\u6682\u65f6\u5b58\u50a8\u5728\u5916\u90e8\u78c1\u76d8\u5b58\u50a8\u5668\u4e0a&#xff0c;\u5728\u9700\u8981\u65f6\u8fdb\u884c\u6570\u636e\u4ea4\u6362\u3002<\/p>\n<h4>\u4f5c\u7528&#xff1a;<\/h4>\n<li>\u6269\u5c55\u7269\u7406\u5185\u5b58&#xff1a;\u901a\u8fc7\u4f7f\u7528\u786c\u76d8\u7a7a\u95f4\u6a21\u62df\u989d\u5916\u7684RAM&#xff0c;\u4f7f\u5f97\u7cfb\u7edf\u80fd\u591f\u8fd0\u884c\u66f4\u591a\u7684\u5e94\u7528\u7a0b\u5e8f\u3002<\/li>\n<li>\u63d0\u9ad8\u7a33\u5b9a\u6027&#xff1a;\u5e94\u7528\u7a0b\u5e8f\u5404\u81ea\u5728\u81ea\u5df1\u7684\u8fdb\u7a0b\u7a7a\u95f4\u4e2d\u8fd0\u884c&#xff0c;\u4e0d\u4f1a\u76f8\u4e92\u5e72\u6270&#xff0c;\u589e\u5f3a\u4e86\u7a0b\u5e8f\u95f4\u7684\u9694\u79bb\u6027\u3002<\/li>\n<li>\u4f18\u5316\u5185\u5b58\u4f7f\u7528&#xff1a;\u64cd\u4f5c\u7cfb\u7edf\u53ef\u4ee5\u66f4\u6709\u6548\u5730\u7ba1\u7406\u5185\u5b58\u8d44\u6e90&#xff0c;\u5c06\u4e0d\u5e38\u7528\u7684\u6570\u636e\u9875\u9762\u4ea4\u6362\u5230\u786c\u76d8\u4e0a&#xff0c;\u4e3a\u5f53\u524d\u9700\u8981\u66f4\u591a\u8d44\u6e90\u7684\u5e94\u7528\u7a0b\u5e8f\u817e\u51fa\u7a7a\u95f4\u3002<\/li>\n<li>\u7b80\u5316\u5185\u5b58\u7ba1\u7406&#xff1a;\u7a0b\u5e8f\u5458\u65e0\u9700\u5173\u5fc3\u7269\u7406\u5185\u5b58\u7684\u9650\u5236&#xff0c;\u53ef\u4ee5\u5047\u8bbe\u6709\u6bd4\u5b9e\u9645\u7269\u7406\u5185\u5b58\u66f4\u5927\u7684\u5730\u5740\u7a7a\u95f4\u3002<\/li>\n<li>\u652f\u6301\u591a\u4efb\u52a1\u64cd\u4f5c&#xff1a;\u6bcf\u4e2a\u7a0b\u5e8f\u90fd\u5728\u81ea\u5df1\u72ec\u7acb\u7684\u865a\u62df\u5185\u5b58\u7a7a\u95f4\u4e2d\u8fd0\u884c&#xff0c;\u4f7f\u5f97\u591a\u4efb\u52a1\u5904\u7406\u6210\u4e3a\u53ef\u80fd\u3002<\/li>\n<h4>\u793a\u4f8b&#xff1a;<\/h4>\n<p>\u5047\u8bbe\u4e00\u4e2a\u7cfb\u7edf\u53ea\u67092GB\u7684\u7269\u7406\u5185\u5b58&#xff0c;\u4f46\u6709\u56db\u4e2a\u5e94\u7528\u7a0b\u5e8f\u540c\u65f6\u8fd0\u884c&#xff0c;\u6bcf\u4e2a\u5e94\u7528\u7a0b\u5e8f\u90fd\u5c1d\u8bd5\u4f7f\u7528512MB\u7684\u5185\u5b58\u3002\u5982\u679c\u4e0d\u4f7f\u7528\u865a\u62df\u5185\u5b58&#xff0c;\u8fd9\u5c06\u65e0\u6cd5\u5b9e\u73b0&#xff0c;\u56e0\u4e3a\u7269\u7406\u5185\u5b58\u4e0d\u8db3\u4ee5\u652f\u6301\u6240\u6709\u5e94\u7528\u7a0b\u5e8f\u7684\u9700\u6c42\u3002\u7136\u800c&#xff0c;\u501f\u52a9\u865a\u62df\u5185\u5b58\u6280\u672f&#xff0c;\u64cd\u4f5c\u7cfb\u7edf\u53ef\u4ee5\u5c06\u90e8\u5206\u4e0d\u6d3b\u8dc3\u7684\u5185\u5b58\u9875\u4ea4\u6362\u5230\u786c\u76d8\u4e0a\u7684\u9875\u9762\u6587\u4ef6\u4e2d&#xff0c;\u4ece\u800c\u91ca\u653e\u51fa\u8db3\u591f\u7684\u7269\u7406\u5185\u5b58\u4f9b\u5f53\u524d\u6d3b\u8dc3\u7684\u5e94\u7528\u7a0b\u5e8f\u4f7f\u7528\u3002\u8fd9\u6837&#xff0c;\u5373\u4f7f\u7269\u7406\u5185\u5b58\u6709\u9650&#xff0c;\u4e5f\u80fd\u4fdd\u8bc1\u7cfb\u7edf\u7684\u6d41\u7545\u8fd0\u884c\u3002<\/p>\n<h3>2. \u5982\u4f55\u67e5\u770b\u548c\u5206\u6790Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5&#xff1f;<\/h3>\n<p>\u8981\u67e5\u770b\u548c\u5206\u6790Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5&#xff0c;\u4f60\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c\u64cd\u4f5c\u3002\u8fd9\u4e9b\u6b65\u9aa4\u5c06\u5e2e\u52a9\u4f60\u4e86\u89e3\u5f53\u524d\u5185\u5b58\u7684\u4f7f\u7528\u60c5\u51b5\u3001\u54ea\u4e9b\u8fdb\u7a0b\u5728\u4f7f\u7528\u5185\u5b58\u4ee5\u53ca\u5982\u4f55\u4f18\u5316\u5185\u5b58\u4f7f\u7528\u3002<\/p>\n<h4>1. \u4f7f\u7528 free \u547d\u4ee4<\/h4>\n<p>free \u662f\u4e00\u4e2a\u5e38\u7528\u7684\u547d\u4ee4\u884c\u5de5\u5177&#xff0c;\u7528\u4e8e\u663e\u793a\u7cfb\u7edf\u4e2d\u7684\u53ef\u7528\u548c\u5df2\u7528\u5185\u5b58\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">free<\/span> <span class=\"token parameter variable\">-h<\/span><\/p>\n<p>\u8f93\u51fa\u793a\u4f8b&#xff1a;<\/p>\n<p>              total        used        free      shared  buff\/cache   available<br \/>\nMem:           7.8G        2.0G        3.4G        206M        2.3G        5.2G<br \/>\nSwap:          2.0G          0B        2.0G<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>total&#xff1a;\u603b\u5185\u5b58\u91cf<\/li>\n<li>used&#xff1a;\u5df2\u4f7f\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<li>free&#xff1a;\u672a\u4f7f\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<li>shared&#xff1a;\u5171\u4eab\u5185\u5b58\u91cf<\/li>\n<li>buff\/cache&#xff1a;\u7f13\u5b58\u548c\u7f13\u51b2\u533a\u5360\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<li>available&#xff1a;\u53ef\u4f9b\u65b0\u8fdb\u7a0b\u4f7f\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<\/ul>\n<h4>2. \u4f7f\u7528 top \u547d\u4ee4<\/h4>\n<p>top \u547d\u4ee4\u53ef\u4ee5\u5b9e\u65f6\u663e\u793a\u7cfb\u7edf\u7684\u4efb\u52a1\u4fe1\u606f&#xff0c;\u5305\u62ec\u5185\u5b58\u4f7f\u7528\u60c5\u51b5\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">top<\/span><\/p>\n<p>\u5728 top \u754c\u9762\u4e2d&#xff0c;\u4f60\u53ef\u4ee5\u770b\u5230\u7c7b\u4f3c\u5982\u4e0b\u7684\u4fe1\u606f&#xff1a;<\/p>\n<p>%Cpu(s):  1.2 us,  0.9 sy,  0.0 ni, 97.6 id,  0.0 wa,  0.0 hi,  0.3 si,  0.0 st<br \/>\nKiB Mem :  8179840 total,   2064368 free,   4184748 used,   1827624 buff\/cache<br \/>\nKiB Swap:  2097148 total,  2097148 free,        0 used.   5325520 avail Mem<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>KiB Mem&#xff1a;\u603b\u5185\u5b58\u3001\u7a7a\u95f2\u5185\u5b58\u3001\u5df2\u7528\u5185\u5b58\u3001\u7f13\u5b58\u548c\u7f13\u51b2\u533a\u5185\u5b58<\/li>\n<li>KiB Swap&#xff1a;\u4ea4\u6362\u7a7a\u95f4\u7684\u603b\u5927\u5c0f\u3001\u7a7a\u95f2\u5927\u5c0f\u3001\u5df2\u7528\u5927\u5c0f<\/li>\n<\/ul>\n<h4>3. \u4f7f\u7528 vmstat \u547d\u4ee4<\/h4>\n<p>vmstat \u63d0\u4f9b\u4e86\u5173\u4e8e\u865a\u62df\u5185\u5b58\u3001\u8fdb\u7a0b\u3001CPU\u6d3b\u52a8\u7b49\u7684\u7edf\u8ba1\u4fe1\u606f\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">vmstat<\/span> <span class=\"token parameter variable\">-s<\/span><\/p>\n<p>\u8f93\u51fa\u793a\u4f8b&#xff1a;<\/p>\n<p>       8179840 K total memory<br \/>\n       4184748 K used memory<br \/>\n       2064368 K active memory<br \/>\n        512340 K inactive memory<br \/>\n       2064368 K free memory<br \/>\n        532552 K buffer memory<br \/>\n       1827624 K swap cache<br \/>\n       2097148 K total swap<br \/>\n             0 K used swap<br \/>\n       2097148 K free swap<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>total memory&#xff1a;\u603b\u5185\u5b58\u91cf<\/li>\n<li>used memory&#xff1a;\u5df2\u4f7f\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<li>active memory&#xff1a;\u6d3b\u8dc3\u7684\u5185\u5b58\u91cf&#xff08;\u6b63\u5728\u4f7f\u7528\u7684&#xff09;<\/li>\n<li>inactive memory&#xff1a;\u4e0d\u6d3b\u8dc3\u7684\u5185\u5b58\u91cf&#xff08;\u957f\u65f6\u95f4\u672a\u4f7f\u7528\u7684&#xff09;<\/li>\n<li>free memory&#xff1a;\u672a\u4f7f\u7528\u7684\u5185\u5b58\u91cf<\/li>\n<li>buffer memory&#xff1a;\u7f13\u51b2\u533a\u5185\u5b58\u91cf<\/li>\n<li>swap cache&#xff1a;\u4ea4\u6362\u7f13\u5b58\u91cf<\/li>\n<li>total swap&#xff1a;\u4ea4\u6362\u7a7a\u95f4\u7684\u603b\u5927\u5c0f<\/li>\n<li>used swap&#xff1a;\u5df2\u4f7f\u7528\u7684\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f<\/li>\n<li>free swap&#xff1a;\u672a\u4f7f\u7528\u7684\u4ea4\u6362\u7a7a\u95f4\u5927\u5c0f<\/li>\n<\/ul>\n<h4>4. \u4f7f\u7528 ps \u547d\u4ee4\u7ed3\u5408 awk \u6216 grep<\/h4>\n<p>\u901a\u8fc7 ps \u547d\u4ee4\u53ef\u4ee5\u67e5\u770b\u7279\u5b9a\u8fdb\u7a0b\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">ps<\/span> aux <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%mem <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token number\">10<\/span><\/p>\n<p>\u8f93\u51fa\u793a\u4f8b&#xff1a;<\/p>\n<p>USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND<br \/>\nroot         1  0.0  0.1 166888  6364 ?        S&lt;s 10:15   0:05 \/sbin\/init splash<br \/>\nroot       316  0.0  0.1 166888  6364 ?        S&lt;s 10:15   0:05 [kthreadd]<br \/>\nroot       323  0.0  0.1 166888  6364 ?        S&lt;s 10:15   0:00 [rcu_gp]<br \/>\n&#8230;<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>%MEM&#xff1a;\u8fdb\u7a0b\u6240\u4f7f\u7528\u7684\u5185\u5b58\u767e\u5206\u6bd4<\/li>\n<li>VSZ&#xff1a;\u865a\u62df\u5185\u5b58\u5927\u5c0f<\/li>\n<li>RSS&#xff1a;\u9a7b\u7559\u96c6\u5927\u5c0f&#xff08;\u5b9e\u9645\u7269\u7406\u5185\u5b58&#xff09;<\/li>\n<li>COMMAND&#xff1a;\u547d\u4ee4\u540d\u79f0<\/li>\n<\/ul>\n<h4>5. \u4f7f\u7528 smem \u5de5\u5177&#xff08;\u53ef\u9009&#xff0c;\u9700\u8981\u5b89\u88c5&#xff09;<\/h4>\n<p>smem \u662f\u4e00\u4e2a\u66f4\u8be6\u7ec6\u7684\u5185\u5b58\u4f7f\u7528\u62a5\u544a\u5de5\u5177\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> smem <span class=\"token comment\"># \u5b89\u88c5smem<\/span><br \/>\n$ smem <span class=\"token parameter variable\">-t<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token parameter variable\">-s<\/span> <span class=\"token string\">&#034;rss&#034;<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;pid,user,command,percent,vsz,rss&#034;<\/span><\/p>\n<p>\u8f93\u51fa\u793a\u4f8b&#xff1a;<\/p>\n<p>PID User     Command              Percent VSZ    RSS<br \/>\n  1 root     \/sbin\/init            0.01%  166888K 6364K<br \/>\n316 root     kthreadd              0.01%  166888K 6364K<br \/>\n323 root     rcu_gp                0.01%  166888K 6364K<br \/>\n&#8230;<\/p>\n<p>\u89e3\u91ca&#xff1a;<\/p>\n<ul>\n<li>PID&#xff1a;\u8fdb\u7a0bID<\/li>\n<li>User&#xff1a;\u7528\u6237<\/li>\n<li>Command&#xff1a;\u547d\u4ee4\u540d\u79f0<\/li>\n<li>Percent&#xff1a;\u5185\u5b58\u4f7f\u7528\u767e\u5206\u6bd4<\/li>\n<li>VSZ&#xff1a;\u865a\u62df\u5185\u5b58\u5927\u5c0f<\/li>\n<li>RSS&#xff1a;\u9a7b\u7559\u96c6\u5927\u5c0f&#xff08;\u5b9e\u9645\u7269\u7406\u5185\u5b58&#xff09;<\/li>\n<\/ul>\n<h4>\u603b\u7ed3<\/h4>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u51e0\u79cd\u65b9\u6cd5&#xff0c;\u4f60\u53ef\u4ee5\u5168\u9762\u4e86\u89e3Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5&#xff0c;\u5e76\u627e\u5230\u53ef\u80fd\u7684\u5185\u5b58\u74f6\u9888\u3002\u6839\u636e\u5177\u4f53\u60c5\u51b5&#xff0c;\u53ef\u4ee5\u9009\u62e9\u4e0d\u540c\u7684\u5de5\u5177\u6765\u5206\u6790\u548c\u4f18\u5316\u5185\u5b58\u4f7f\u7528\u3002<\/p>\n<h3>3. \u5982\u4f55\u4f18\u5316Linux\u7cfb\u7edf\u7684Swap\u5206\u533a&#xff1f;<\/h3>\n<p>\u4f18\u5316Linux\u7cfb\u7edf\u7684Swap\u5206\u533a\u662f\u63d0\u9ad8\u7cfb\u7edf\u6027\u80fd\u548c\u7a33\u5b9a\u6027\u7684\u91cd\u8981\u6b65\u9aa4\u3002\u4e0b\u9762\u6211\u5c06\u8be6\u7ec6\u9610\u8ff0\u5982\u4f55\u4f18\u5316Swap\u5206\u533a&#xff0c;\u5e76\u63d0\u4f9b\u793a\u4f8b\u8bf4\u660e\u3002<\/p>\n<h4>1. \u68c0\u67e5\u5f53\u524dSwap\u5206\u533a\u4f7f\u7528\u60c5\u51b5<\/h4>\n<p>\u9996\u5148&#xff0c;\u9700\u8981\u4e86\u89e3\u5f53\u524d\u7684Swap\u5206\u533a\u4f7f\u7528\u60c5\u51b5&#xff0c;\u4ee5\u4fbf\u505a\u51fa\u5408\u7406\u7684\u8c03\u6574\u3002<\/p>\n<h5>\u547d\u4ee4&#xff1a;<\/h5>\n<p><span class=\"token function\">swapon<\/span> <span class=\"token parameter variable\">&#8211;show<\/span><br \/>\n<span class=\"token function\">free<\/span> <span class=\"token parameter variable\">-h<\/span><\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>$ <span class=\"token function\">swapon<\/span> <span class=\"token parameter variable\">&#8211;show<\/span><br \/>\nNAME      TYPE SIZE USED PRIO<br \/>\n\/dev\/sda2 partition 4G 0B <span class=\"token parameter variable\">-2<\/span><\/p>\n<p>$ <span class=\"token function\">free<\/span> <span class=\"token parameter variable\">-h<\/span><br \/>\n              total        used        <span class=\"token function\">free<\/span>      shared  buff\/cache   available<br \/>\nMem:           <span class=\"token number\">7<\/span>.6G        <span class=\"token number\">5<\/span>.3G        <span class=\"token number\">1<\/span>.1G         13M        <span class=\"token number\">1<\/span>.2G        <span class=\"token number\">1<\/span>.5G<br \/>\nSwap:          <span class=\"token number\">4<\/span>.0G          0B        <span class=\"token number\">4<\/span>.0G<\/p>\n<h4>2. \u589e\u52a0Swap\u7a7a\u95f4<\/h4>\n<p>\u5982\u679c\u53d1\u73b0Swap\u7a7a\u95f4\u4e0d\u8db3&#xff0c;\u53ef\u4ee5\u589e\u52a0Swap\u5206\u533a\u6216Swap\u6587\u4ef6\u3002<\/p>\n<h5>\u589e\u52a0Swap\u6587\u4ef6&#xff1a;<\/h5>\n<li>\u521b\u5efa\u4e00\u4e2a\u65b0\u7684Swap\u6587\u4ef6&#xff08;\u4f8b\u5982&#xff0c;\u521b\u5efa\u4e00\u4e2a2GB\u7684Swap\u6587\u4ef6&#xff09;&#xff1a;<\/li>\n<p><span class=\"token function\">sudo<\/span> fallocate <span class=\"token parameter variable\">-l<\/span> 2G \/swapfile<\/p>\n<li>\u8bbe\u7f6e\u6b63\u786e\u7684\u6743\u9650&#xff1a;<\/li>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">chmod<\/span> <span class=\"token number\">600<\/span> \/swapfile<\/p>\n<li>\u683c\u5f0f\u5316\u4e3aSwap\u683c\u5f0f&#xff1a;<\/li>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">mkswap<\/span> \/swapfile<\/p>\n<li>\u542f\u7528\u65b0\u7684Swap\u6587\u4ef6&#xff1a;<\/li>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">swapon<\/span> \/swapfile<\/p>\n<li>\u6c38\u4e45\u751f\u6548&#xff08;\u7f16\u8f91\/etc\/fstab&#xff09;&#xff1a;<\/li>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#039;\/swapfile none swap sw 0 0&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/fstab<\/p>\n<h4>3. \u8c03\u6574Swapiness\u53c2\u6570<\/h4>\n<p>Swapiness\u51b3\u5b9a\u4e86\u7cfb\u7edf\u5728\u591a\u5927\u7a0b\u5ea6\u4e0a\u4f7f\u7528Swap\u7a7a\u95f4\u3002\u503c\u7684\u8303\u56f4\u662f0\u5230100&#xff0c;\u503c\u8d8a\u9ad8\u8868\u793a\u8d8a\u503e\u5411\u4e8e\u4f7f\u7528Swap\u7a7a\u95f4\u3002<\/p>\n<h5>\u67e5\u770b\u5f53\u524dSwapiness&#xff1a;<\/h5>\n<p><span class=\"token function\">cat<\/span> \/proc\/sys\/vm\/swappiness<\/p>\n<h5>\u4e34\u65f6\u4fee\u6539Swapiness&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token assign-left variable\">vm.swappiness<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">10<\/span><\/p>\n<h5>\u6c38\u4e45\u4fee\u6539Swapiness&#xff1a;<\/h5>\n<p>\u7f16\u8f91\/etc\/sysctl.conf&#xff0c;\u6dfb\u52a0\u4ee5\u4e0b\u884c&#xff1a;<\/p>\n<p><span class=\"token assign-left variable\">vm.swappiness<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">10<\/span><\/p>\n<p>\u7136\u540e\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u4ee5\u5e94\u7528\u66f4\u6539&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span><\/p>\n<h4>4. \u7981\u7528\u4e0d\u5fc5\u8981\u7684Swapping<\/h4>\n<p>\u5bf9\u4e8e\u67d0\u4e9b\u9ad8\u6027\u80fd\u670d\u52a1\u5668&#xff0c;\u53ef\u80fd\u5e0c\u671b\u5b8c\u5168\u7981\u7528Swapping&#xff0c;\u4ee5\u907f\u514d\u78c1\u76d8I\/O\u5bf9\u6027\u80fd\u7684\u5f71\u54cd\u3002\u53ef\u4ee5\u901a\u8fc7\u8bbe\u7f6eSwappiness\u4e3a0\u6765\u5b9e\u73b0\u3002<\/p>\n<h5>\u4e34\u65f6\u7981\u7528Swapping&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token assign-left variable\">vm.swappiness<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span><\/p>\n<h5>\u6c38\u4e45\u7981\u7528Swapping&#xff1a;<\/h5>\n<p>\u7f16\u8f91\/etc\/sysctl.conf&#xff0c;\u6dfb\u52a0\u4ee5\u4e0b\u884c&#xff1a;<\/p>\n<p><span class=\"token assign-left variable\">vm.swappiness<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span><\/p>\n<p>\u7136\u540e\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u4ee5\u5e94\u7528\u66f4\u6539&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span><\/p>\n<h4>5. \u76d1\u63a7\u548c\u8c03\u4f18<\/h4>\n<p>\u5b9a\u671f\u76d1\u63a7\u7cfb\u7edf\u7684\u6027\u80fd\u548cSwap\u4f7f\u7528\u60c5\u51b5&#xff0c;\u6839\u636e\u5b9e\u9645\u9700\u6c42\u8fdb\u884c\u8c03\u6574\u3002\u53ef\u4ee5\u4f7f\u7528top\u3001htop\u3001vmstat\u7b49\u5de5\u5177\u8fdb\u884c\u76d1\u63a7\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u4f7f\u7528 top \u547d\u4ee4\u67e5\u770b\u5b9e\u65f6\u7cfb\u7edf\u72b6\u6001<\/span><br \/>\n$ <span class=\"token function\">top<\/span><\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u53ef\u4ee5\u6709\u6548\u5730\u4f18\u5316Linux\u7cfb\u7edf\u4e2d\u7684Swap\u5206\u533a&#xff0c;\u63d0\u5347\u7cfb\u7edf\u7684\u6574\u4f53\u6027\u80fd\u548c\u7a33\u5b9a\u6027\u3002<\/p>\n<h3>4. \u5982\u4f55\u8c03\u6574Linux\u7cfb\u7edf\u7684\u5185\u5b58\u53c2\u6570\u4ee5\u63d0\u9ad8\u6027\u80fd&#xff1f;<\/h3>\n<p>\u8c03\u6574Linux\u7cfb\u7edf\u7684\u5185\u5b58\u53c2\u6570\u4ee5\u63d0\u9ad8\u6027\u80fd\u662f\u4e00\u9879\u91cd\u8981\u7684\u4f18\u5316\u4efb\u52a1\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u4fee\u6539\/etc\/sysctl.conf\u6587\u4ef6<\/h4>\n<p>\/etc\/sysctl.conf\u6587\u4ef6\u5305\u542b\u5185\u6838\u7684\u8fd0\u884c\u65f6\u53c2\u6570&#xff0c;\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539\u8be5\u6587\u4ef6\u6765\u8c03\u6574\u5185\u5b58\u7ba1\u7406\u53c2\u6570\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u6253\u5f00 \/etc\/sysctl.conf \u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/sysctl.conf<\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u6216\u4fee\u6539\u4ee5\u4e0b\u884c\u4ee5\u8c03\u6574\u5185\u5b58\u53c2\u6570<\/span><br \/>\nvm.swappiness <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">10<\/span><br \/>\nvm.vfs_cache_pressure <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">50<\/span><\/p>\n<ul>\n<li>vm.swappiness: \u8fd9\u4e2a\u53c2\u6570\u63a7\u5236\u4e86\u7cfb\u7edf\u5728\u4ec0\u4e48\u65f6\u5019\u5f00\u59cb\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4&#xff08;swap&#xff09;\u3002\u9ed8\u8ba4\u503c\u901a\u5e38\u662f60&#xff0c;\u8868\u793a\u5f53\u7269\u7406\u5185\u5b58\u4f7f\u7528\u7387\u8fbe\u523040%\u65f6\u5f00\u59cb\u4f7f\u7528\u4ea4\u6362\u7a7a\u95f4\u3002\u5c06\u5176\u8bbe\u7f6e\u4e3a\u8f83\u4f4e\u7684\u503c\u53ef\u4ee5\u51cf\u5c11\u4ea4\u6362\u7a7a\u95f4\u7684\u4f7f\u7528&#xff0c;\u4ece\u800c\u63d0\u9ad8\u6027\u80fd\u3002<\/li>\n<li>vm.vfs_cache_pressure: \u8fd9\u4e2a\u53c2\u6570\u51b3\u5b9a\u4e86VFS\u7f13\u5b58\u7684\u91ca\u653e\u538b\u529b\u3002\u9ed8\u8ba4\u503c\u662f100&#xff0c;\u5c06\u5176\u964d\u4f4e\u523050\u53ef\u4ee5\u4fdd\u7559\u66f4\u591a\u7684\u7f13\u5b58\u6570\u636e&#xff0c;\u4ece\u800c\u52a0\u5feb\u6587\u4ef6\u8bbf\u95ee\u901f\u5ea6\u3002<\/li>\n<\/ul>\n<h5>\u4f7f\u66f4\u6539\u751f\u6548&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u5e94\u7528\u65b0\u7684 sysctl \u8bbe\u7f6e<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span><\/p>\n<h4>2. \u914d\u7f6e\/etc\/sysfs.conf<\/h4>\n<p>\u5728\u67d0\u4e9b\u53d1\u884c\u7248\u4e2d&#xff0c;\u4f60\u53ef\u80fd\u9700\u8981\u7f16\u8f91\/etc\/sysfs.conf\u6587\u4ef6\u6765\u6c38\u4e45\u4fdd\u5b58\u8fd9\u4e9b\u8bbe\u7f6e\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u6253\u5f00 \/etc\/sysfs.conf \u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/sysfs.conf<\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u6216\u4fee\u6539\u4ee5\u4e0b\u884c\u4ee5\u8c03\u6574\u5185\u5b58\u53c2\u6570<\/span><br \/>\nvm.swappiness <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">10<\/span><br \/>\nvm.vfs_cache_pressure <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">50<\/span><\/p>\n<h4>3. \u8c03\u6574ZRAM&#xff08;\u538b\u7f29\u5185\u5b58&#xff09;<\/h4>\n<p>ZRAM\u662f\u4e00\u79cd\u5c06\u5185\u5b58\u5185\u5bb9\u538b\u7f29\u540e\u5b58\u50a8\u5728RAM\u4e2d\u7684\u673a\u5236&#xff0c;\u53ef\u4ee5\u5728\u5185\u5b58\u4e0d\u8db3\u65f6\u63d0\u4f9b\u989d\u5916\u7684\u865a\u62df\u5185\u5b58\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u68c0\u67e5\u5f53\u524d\u7684 ZRAM \u914d\u7f6e<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/proc\/meminfo <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> Zram<\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u4e00\u4e2a\u65b0\u7684 ZRAM \u4ea4\u6362\u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">sudo<\/span> fallocate <span class=\"token parameter variable\">-l<\/span> 256M \/dev\/shm\/zram0<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">mkswap<\/span> \/dev\/shm\/zram0<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">swapon<\/span> \/dev\/shm\/zram0<\/p>\n<ul>\n<li>fallocate -l 256M \/dev\/shm\/zram0: \u521b\u5efa\u4e00\u4e2a\u5927\u5c0f\u4e3a256MB\u7684\u6587\u4ef6\u7528\u4e8eZRAM\u3002<\/li>\n<li>mkswap \/dev\/shm\/zram0: \u5c06\u8be5\u6587\u4ef6\u683c\u5f0f\u5316\u4e3a\u4ea4\u6362\u7a7a\u95f4\u3002<\/li>\n<li>swapon \/dev\/shm\/zram0: \u542f\u7528\u8fd9\u4e2a\u4ea4\u6362\u7a7a\u95f4\u3002<\/li>\n<\/ul>\n<h4>4. \u4f7f\u7528transparent_hugepage<\/h4>\n<p>\u900f\u660e\u5927\u9875\u9762&#xff08;THP&#xff09;\u53ef\u4ee5\u63d0\u9ad8\u5185\u5b58\u7ba1\u7406\u7684\u6548\u7387\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u6253\u5f00 \/etc\/rc.local \u6587\u4ef6&#xff08;\u6216\u8005\u4f60\u4f7f\u7528\u7684init\u7cfb\u7edf\u914d\u7f6e\u6587\u4ef6&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/rc.local<\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u4ee5\u4e0b\u884c\u4ee5\u542f\u7528\u900f\u660e\u5927\u9875\u9762<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> never <span class=\"token operator\">&gt;<\/span> \/sys\/kernel\/mm\/transparent_hugepage\/enabled<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token punctuation\">[<\/span>always<span class=\"token punctuation\">]<\/span> madvise <span class=\"token operator\">&gt;<\/span> \/sys\/kernel\/mm\/transparent_hugepage\/defrag<\/p>\n<h4>5. \u76d1\u63a7\u548c\u8c03\u8bd5\u5de5\u5177<\/h4>\n<p>\u4f7f\u7528\u4e00\u4e9b\u5de5\u5177\u53ef\u4ee5\u5e2e\u52a9\u4f60\u76d1\u63a7\u548c\u8c03\u6574\u5185\u5b58\u4f7f\u7528\u60c5\u51b5&#xff0c;\u4f8b\u5982top, htop, free, vmstat\u7b49\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5185\u5b58\u4f7f\u7528\u60c5\u51b5<\/span><br \/>\n<span class=\"token function\">free<\/span> <span class=\"token parameter variable\">-h<\/span><br \/>\n<span class=\"token function\">vmstat<\/span> <span class=\"token parameter variable\">-s<\/span><br \/>\n<span class=\"token function\">top<\/span><br \/>\n<span class=\"token function\">htop<\/span><\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u8c03\u6574Linux\u7cfb\u7edf\u7684\u5185\u5b58\u53c2\u6570&#xff0c;\u63d0\u9ad8\u7cfb\u7edf\u7684\u6027\u80fd\u548c\u54cd\u5e94\u901f\u5ea6\u3002\u8bf7\u6839\u636e\u5177\u4f53\u9700\u6c42\u8fdb\u884c\u9002\u5f53\u7684\u8c03\u6574\u548c\u6d4b\u8bd5\u3002<\/p>\n<h3>5. \u5982\u4f55\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5&#xff1f;<\/h3>\n<p>\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5\u662f\u786e\u4fdd\u670d\u52a1\u5668\u548c\u5e94\u7528\u7a0b\u5e8f\u9ad8\u6548\u8fd0\u884c\u7684\u5173\u952e\u4efb\u52a1\u3002\u4ee5\u4e0b\u662f\u5982\u4f55\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5\u7684\u6761\u7406\u6e05\u6670\u7684\u65b9\u6cd5&#xff0c;\u5e76\u9644\u5e26\u793a\u4f8b&#xff1a;<\/p>\n<h4>\u65b9\u6cd5\u4e00&#xff1a;\u4f7f\u7528\u64cd\u4f5c\u7cfb\u7edf\u81ea\u5e26\u7684\u5de5\u5177<\/h4>\n<h5>Windows\u7cfb\u7edf<\/h5>\n<li>\n<p>\u4efb\u52a1\u7ba1\u7406\u5668<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u6309\u4e0b Ctrl &#043; Shift &#043; Esc&#xff0c;\u6253\u5f00\u4efb\u52a1\u7ba1\u7406\u5668\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u5728\u201c\u6027\u80fd\u201d\u9009\u9879\u5361\u4e0b&#xff0c;\u53ef\u4ee5\u770b\u5230CPU\u7684\u4f7f\u7528\u7387\u3001\u901f\u5ea6\u3001\u6838\u5fc3\u6570\u7b49\u4fe1\u606f\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;CPU\u4f7f\u7528\u7387: 65%<br \/>\n\u7269\u7406\u5185\u5b58: 8GB (\u5df2\u4f7f\u752840%)<br \/>\n\u6838\u5fc3\u6570: 8\n <\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u8d44\u6e90\u76d1\u89c6\u5668<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u901a\u8fc7\u641c\u7d22\u201c\u8d44\u6e90\u76d1\u89c6\u5668\u201d\u6216\u6309 Ctrl &#043; Alt &#043; Del \u7136\u540e\u9009\u62e9\u201c\u542f\u52a8\u4efb\u52a1\u7ba1\u7406\u5668\u201d&#xff0c;\u518d\u70b9\u51fb\u201c\u6027\u80fd\u201d\u9009\u9879\u5361\u4e0b\u7684\u201c\u6253\u5f00\u8d44\u6e90\u76d1\u89c6\u5668\u201d\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u5728\u201c\u6982\u8ff0\u201d\u9009\u9879\u5361\u4e2d&#xff0c;\u53ef\u4ee5\u8be6\u7ec6\u67e5\u770bCPU\u7684\u4f7f\u7528\u60c5\u51b5&#xff0c;\u5305\u62ec\u5404\u4e2a\u8fdb\u7a0b\u5bf9CPU\u7684\u4f7f\u7528\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;\u8fdb\u7a0b\u540d\u79f0: java.exe, PID: 1234, CPU: 35%\n <\/li>\n<\/ul>\n<\/li>\n<h5>Linux\u7cfb\u7edf<\/h5>\n<li>\n<p>top\u547d\u4ee4<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u5728\u7ec8\u7aef\u4e2d\u8f93\u5165 top \u547d\u4ee4\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u4f1a\u663e\u793a\u5b9e\u65f6\u66f4\u65b0\u7684\u7cfb\u7edf\u4efb\u52a1\u5217\u8868&#xff0c;\u5305\u62ec\u6bcf\u4e2a\u8fdb\u7a0b\u7684CPU\u4f7f\u7528\u7387\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;top &#8211; 15:33:45 up  1:22,  2 users,  load average: 0.44, 0.25, 0.20<br \/>\nTasks: 185 total,   1 running, 184 sleeping,   0 stopped,   0 zombie<br \/>\n%Cpu(s):  2.3 us,  0.5 sy,  0.0 ni, 97.0 id,  0.2 wa,  0.0 hi,  0.0 si,  0.0 st<br \/>\nKiB Mem :  2048000 total,  1024000 free,   512000 used,   512000 buff\/cache<br \/>\n&#8230;\n <\/li>\n<\/ul>\n<\/li>\n<li>\n<p>htop\u547d\u4ee4<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u5b89\u88c5\u5e76\u8fd0\u884c htop&#xff08;\u5982\u679c\u5c1a\u672a\u5b89\u88c5&#xff0c;\u53ef\u4ee5\u901a\u8fc7\u5305\u7ba1\u7406\u5668\u5982 apt-get install htop \u8fdb\u884c\u5b89\u88c5&#xff09;\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u7c7b\u4f3c\u4e8e top&#xff0c;\u4f46\u754c\u9762\u66f4\u4e3a\u53cb\u597d&#xff0c;\u529f\u80fd\u66f4\u52a0\u5f3a\u5927\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;-<br \/>\n|   PID User      PRI  NI  VIRT   RES  %CPU %MEM     TIME&#043; S       COMMAND<br \/>\n|    1 root      20   0  22048   816   0.0  0.0   2:34.77 S     systemd<br \/>\n|  1234 user      20   0 1843272 123456  35.0  2.5  1:23.45 S     java<br \/>\n&#8230;\n <\/li>\n<\/ul>\n<\/li>\n<h4>\u65b9\u6cd5\u4e8c&#xff1a;\u4f7f\u7528\u7b2c\u4e09\u65b9\u76d1\u63a7\u5de5\u5177<\/h4>\n<li>\n<p>Nagios<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u5b89\u88c5Nagios\u5e76\u8fdb\u884c\u914d\u7f6e\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u901a\u8fc7Web\u754c\u9762\u67e5\u770b\u5404\u79cd\u76d1\u63a7\u6307\u6807&#xff0c;\u5305\u62ecCPU\u4f7f\u7528\u60c5\u51b5\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;Host: server1<br \/>\nService: CPU usage<br \/>\nStatus: OK &#8211; CPU usage is at 65%\n <\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Zabbix<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u5b89\u88c5Zabbix\u5e76\u8fdb\u884c\u914d\u7f6e\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u901a\u8fc7Zabbix\u7684Web\u754c\u9762\u67e5\u770b\u8be6\u7ec6\u7684\u76d1\u63a7\u6570\u636e\u548c\u56fe\u8868\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;Host: server1<br \/>\nItem: cpu_usage<br \/>\nLast Value: 65%<br \/>\nGraph: [Showing a line chart with CPU usage over time]\n <\/li>\n<\/ul>\n<\/li>\n<h4>\u65b9\u6cd5\u4e09&#xff1a;\u65e5\u5fd7\u6587\u4ef6\u5206\u6790<\/h4>\n<li>\n<p>syslog<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u68c0\u67e5\u7cfb\u7edf\u65e5\u5fd7\u6587\u4ef6&#xff0c;\u4f8b\u5982 \/var\/log\/syslog&#xff08;Linux&#xff09;\u6216 Event Viewer&#xff08;Windows&#xff09;\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u67e5\u627e\u4e0eCPU\u76f8\u5173\u7684\u65e5\u5fd7\u6761\u76ee\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;Jan 1 12:34:56 server1 kernel: [  123.456000] CPU0: Thermal idle due to T-states\n <\/li>\n<\/ul>\n<\/li>\n<li>\n<p>dmesg<\/p>\n<ul>\n<li>\u6b65\u9aa4&#xff1a;\u5728Linux\u7cfb\u7edf\u4e2d&#xff0c;\u4f7f\u7528 dmesg \u547d\u4ee4\u67e5\u770b\u5185\u6838\u73af\u7f13\u51b2\u533a\u65e5\u5fd7\u3002<\/li>\n<li>\u67e5\u770b&#xff1a;\u67e5\u627e\u4e0eCPU\u76f8\u5173\u7684\u6d88\u606f\u3002<\/li>\n<li>\u793a\u4f8b&#xff1a;[ 1234.567890] CPU1: Core temperature above threshold, throttling enabled\n <\/li>\n<\/ul>\n<\/li>\n<h4>\u603b\u7ed3<\/h4>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5&#xff0c;\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5&#xff0c;\u5e76\u6839\u636e\u9700\u8981\u91c7\u53d6\u76f8\u5e94\u7684\u63aa\u65bd\u6765\u4f18\u5316\u7cfb\u7edf\u6027\u80fd\u3002\u6bcf\u79cd\u65b9\u6cd5\u90fd\u6709\u5176\u72ec\u7279\u7684\u4f18\u70b9\u548c\u9002\u7528\u573a\u666f&#xff0c;\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u5408\u9002\u7684\u5de5\u5177\u548c\u65b9\u6cd5\u3002<\/p>\n<h3>6. \u5982\u4f55\u8bc6\u522b\u548c\u89e3\u51b3CPU\u74f6\u9888\u95ee\u9898&#xff1f;<\/h3>\n<p>\u8bc6\u522b\u548c\u89e3\u51b3CPU\u74f6\u9888\u95ee\u9898\u662f\u4e00\u9879\u5173\u952e\u7684\u8fd0\u7ef4\u4efb\u52a1&#xff0c;\u5b83\u6709\u52a9\u4e8e\u786e\u4fdd\u670d\u52a1\u5668\u548c\u5e94\u7528\u7684\u6027\u80fd\u7a33\u5b9a\u3002\u4ee5\u4e0b\u662f\u6761\u7406\u6e05\u6670\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u8bc6\u522bCPU\u74f6\u9888<\/h4>\n<h5>\u6b65\u9aa4&#xff1a;<\/h5>\n<li>\n<p>\u76d1\u63a7CPU\u4f7f\u7528\u7387&#xff1a;<\/p>\n<ul>\n<li>\u4f7f\u7528\u7cfb\u7edf\u5185\u7f6e\u5de5\u5177\u6216\u7b2c\u4e09\u65b9\u76d1\u63a7\u5de5\u5177\u67e5\u770bCPU\u7684\u4f7f\u7528\u60c5\u51b5\u3002<\/li>\n<li>\u4f8b\u5982&#xff1a;\u5728Linux\u7cfb\u7edf\u4e2d\u53ef\u4ee5\u4f7f\u7528top\u3001htop\u547d\u4ee4&#xff0c;Windows\u7cfb\u7edf\u4e2d\u53ef\u4ee5\u4f7f\u7528\u4efb\u52a1\u7ba1\u7406\u5668\u6216PowerShell\u4e2d\u7684Get-Counter\u7b49\u547d\u4ee4\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u5206\u6790\u6027\u80fd\u6570\u636e&#xff1a;<\/p>\n<ul>\n<li>\u68c0\u67e5CPU\u7684\u5229\u7528\u7387\u662f\u5426\u6301\u7eed\u8d85\u8fc780%-90%&#xff0c;\u5982\u679c\u662f&#xff0c;\u53ef\u80fd\u8868\u660e\u5b58\u5728\u74f6\u9888\u3002<\/li>\n<li>\u89c2\u5bdf\u7528\u6237\u6001&#xff08;User&#xff09;\u548c\u5185\u6838\u6001&#xff08;System&#xff09;\u7684CPU\u4f7f\u7528\u7387&#xff0c;\u4e86\u89e3\u662f\u5e94\u7528\u903b\u8f91\u8fd8\u662f\u7cfb\u7edf\u8c03\u7528\u5bfc\u81f4\u7684\u9ad8\u8d1f\u8f7d\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u68c0\u67e5\u8fdb\u7a0b\u548c\u7ebf\u7a0b\u4f7f\u7528\u60c5\u51b5&#xff1a;<\/p>\n<ul>\n<li>\u4f7f\u7528top\u547d\u4ee4\u7684P\u9009\u9879\u6309CPU\u4f7f\u7528\u7387\u6392\u5e8f&#xff0c;\u67e5\u770b\u54ea\u4e2a\u8fdb\u7a0b\u6d88\u8017\u4e86\u6700\u591a\u7684CPU\u8d44\u6e90\u3002<\/li>\n<li>\u5728Linux\u4e2d&#xff0c;\u53ef\u4ee5\u4f7f\u7528ps -eo pid,ppid,cmd,%mem,%cpu &#8211;sort&#061;-%cpu | head\u6765\u83b7\u53d6\u524d\u51e0\u4e2a\u6700\u8017CPU\u7684\u8fdb\u7a0b\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u5206\u6790\u7cfb\u7edf\u65e5\u5fd7&#xff1a;<\/p>\n<ul>\n<li>\u67e5\u770b\u7cfb\u7edf\u65e5\u5fd7\u6587\u4ef6&#xff08;\u5982\/var\/log\/messages\u3001\/var\/log\/syslog\u7b49&#xff09;&#xff0c;\u5bfb\u627e\u9519\u8bef\u4fe1\u606f\u6216\u8b66\u544a\u4fe1\u606f&#xff0c;\u8fd9\u4e9b\u53ef\u80fd\u4f1a\u63d0\u793a\u67d0\u4e9b\u5f02\u5e38\u60c5\u51b5\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u4f7f\u7528\u6027\u80fd\u5206\u6790\u5de5\u5177&#xff1a;<\/p>\n<ul>\n<li>\u4f7f\u7528\u5982perf\u3001oprofile\u3001strace\u7b49\u5de5\u5177\u8fdb\u884c\u66f4\u8be6\u7ec6\u7684\u6027\u80fd\u5206\u6790\u3002<\/li>\n<\/ul>\n<\/li>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u5728Linux\u4e2d\u4f7f\u7528top\u547d\u4ee4\u67e5\u770bCPU\u4f7f\u7528\u60c5\u51b5<\/span><br \/>\n<span class=\"token function\">top<\/span><\/p>\n<p><span class=\"token comment\"># \u6309CPU\u4f7f\u7528\u7387\u6392\u5e8f<\/span><br \/>\n<span class=\"token builtin class-name\">shift<\/span> &#043; P<\/p>\n<p><span class=\"token comment\"># \u5728Linux\u4e2d\u67e5\u770b\u7279\u5b9a\u8fdb\u7a0b\u7684CPU\u4f7f\u7528\u60c5\u51b5<\/span><br \/>\n<span class=\"token function\">ps<\/span> <span class=\"token parameter variable\">-eo<\/span> pid,ppid,cmd,%mem,%cpu <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%cpu <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span><\/p>\n<h4>2. \u89e3\u51b3CPU\u74f6\u9888<\/h4>\n<h5>\u6b65\u9aa4&#xff1a;<\/h5>\n<li>\n<p>\u4f18\u5316\u4ee3\u7801&#xff1a;<\/p>\n<ul>\n<li>\u5bf9\u6d88\u8017\u5927\u91cfCPU\u8d44\u6e90\u7684\u4ee3\u7801\u8fdb\u884c\u4f18\u5316&#xff0c;\u51cf\u5c11\u4e0d\u5fc5\u8981\u7684\u8ba1\u7b97\u548c\u5faa\u73af\u3002<\/li>\n<li>\u4f7f\u7528\u66f4\u9ad8\u6548\u7684\u7b97\u6cd5\u548c\u6570\u636e\u7ed3\u6784\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u589e\u52a0\u5e76\u884c\u5904\u7406&#xff1a;<\/p>\n<ul>\n<li>\u5982\u679c\u53ef\u4ee5&#xff0c;\u5c06\u4efb\u52a1\u5206\u89e3\u4e3a\u591a\u4e2a\u5b50\u4efb\u52a1\u5e76\u884c\u5904\u7406&#xff0c;\u5229\u7528\u591a\u6838CPU\u7684\u4f18\u52bf\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u8c03\u6574\u4f18\u5148\u7ea7&#xff1a;<\/p>\n<ul>\n<li>\u901a\u8fc7\u8c03\u6574\u8fdb\u7a0b\u6216\u7ebf\u7a0b\u7684\u4f18\u5148\u7ea7&#xff0c;\u786e\u4fdd\u5173\u952e\u4efb\u52a1\u83b7\u5f97\u8db3\u591f\u7684CPU\u65f6\u95f4\u3002<\/li>\n<li>\u5728Linux\u4e2d\u53ef\u4ee5\u4f7f\u7528nice\u3001renice\u547d\u4ee4\u8c03\u6574\u8fdb\u7a0b\u4f18\u5148\u7ea7\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u6269\u5c55\u786c\u4ef6\u8d44\u6e90&#xff1a;<\/p>\n<ul>\n<li>\u5982\u679c\u5355\u53f0\u670d\u52a1\u5668\u7684CPU\u5df2\u7ecf\u8fbe\u5230\u74f6\u9888&#xff0c;\u53ef\u4ee5\u8003\u8651\u589e\u52a0\u66f4\u591a\u7684\u670d\u52a1\u5668\u6216\u8005\u5347\u7ea7\u5230\u66f4\u9ad8\u914d\u7f6e\u7684\u670d\u52a1\u5668\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u8d1f\u8f7d\u5747\u8861&#xff1a;<\/p>\n<ul>\n<li>\u4f7f\u7528\u8d1f\u8f7d\u5747\u8861\u5668\u5206\u6563\u6d41\u91cf&#xff0c;\u907f\u514d\u5355\u4e2a\u670d\u52a1\u5668\u8fc7\u8f7d\u3002<\/li>\n<li>\u5e38\u89c1\u7684\u8d1f\u8f7d\u5747\u8861\u65b9\u6848\u6709Nginx\u3001HAProxy\u7b49\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u7f13\u5b58\u673a\u5236&#xff1a;<\/p>\n<ul>\n<li>\u5f15\u5165\u7f13\u5b58\u673a\u5236&#xff0c;\u51cf\u5c11\u91cd\u590d\u8ba1\u7b97\u548cI\/O\u64cd\u4f5c&#xff0c;\u63d0\u9ad8\u54cd\u5e94\u901f\u5ea6\u3002<\/li>\n<li>\u53ef\u4ee5\u4f7f\u7528Redis\u3001Memcached\u7b49\u7f13\u5b58\u89e3\u51b3\u65b9\u6848\u3002<\/li>\n<\/ul>\n<\/li>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u5728Linux\u4e2d\u8c03\u6574\u8fdb\u7a0b\u4f18\u5148\u7ea7<\/span><br \/>\n<span class=\"token function\">nice<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token number\">10<\/span> my_process    <span class=\"token comment\"># \u964d\u4f4e\u8fdb\u7a0b\u4f18\u5148\u7ea7&#xff0c;\u8ba9\u51fa\u66f4\u591aCPU\u7ed9\u5176\u4ed6\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">renice<\/span> <span class=\"token number\">10<\/span> <span class=\"token parameter variable\">-p<\/span> <span class=\"token operator\">&lt;<\/span>PID<span class=\"token operator\">&gt;<\/span>      <span class=\"token comment\"># \u8c03\u6574\u5df2\u8fd0\u884c\u8fdb\u7a0b\u7684\u4f18\u5148\u7ea7&#xff0c;\u6570\u503c\u8d8a\u5927\u4f18\u5148\u7ea7\u8d8a\u4f4e<\/span><\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4\u548c\u793a\u4f8b&#xff0c;\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u8bc6\u522b\u548c\u89e3\u51b3CPU\u74f6\u9888\u95ee\u9898&#xff0c;\u4ece\u800c\u63d0\u5347\u7cfb\u7edf\u7684\u6574\u4f53\u6027\u80fd\u3002<\/p>\n<h3>7. \u5982\u4f55\u4f18\u5316Linux\u7cfb\u7edf\u4e2d\u7684I\/O\u6027\u80fd&#xff1f;<\/h3>\n<p>\u4f18\u5316Linux\u7cfb\u7edf\u4e2d\u7684I\/O\u6027\u80fd\u53ef\u4ee5\u901a\u8fc7\u591a\u79cd\u65b9\u6cd5\u5b9e\u73b0&#xff0c;\u5305\u62ec\u786c\u4ef6\u914d\u7f6e\u3001\u64cd\u4f5c\u7cfb\u7edf\u8c03\u4f18\u548c\u5e94\u7528\u7a0b\u5e8f\u4f18\u5316\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5177\u4f53\u7684\u65b9\u6cd5\u53ca\u5176\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u8c03\u6574\u6587\u4ef6\u7cfb\u7edf\u53c2\u6570<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u8c03\u6574\u6587\u4ef6\u7cfb\u7edf\u7684\u6302\u8f7d\u9009\u9879<\/li>\n<li>\u4f7f\u7528\u66f4\u5feb\u7684\u6587\u4ef6\u7cfb\u7edf<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token comment\"># \u4fee\u6539\/etc\/fstab\u6587\u4ef6&#xff0c;\u6dfb\u52a0noatime\u9009\u9879\u4ee5\u51cf\u5c11\u5199\u64cd\u4f5c<\/span><br \/>\n\/dev\/sda1       \/               ext4    defaults,noatime        <span class=\"token number\">0<\/span> <span class=\"token number\">1<\/span><\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5\u5e76\u4f7f\u7528\u66f4\u5feb\u7684\u6587\u4ef6\u7cfb\u7edf\u5982XFS<\/span><br \/>\nmkfs.xfs \/dev\/sda1<br \/>\n<span class=\"token function\">mount<\/span> \/dev\/sda1 \/mnt<\/p>\n<h4>2. \u8c03\u6574I\/O\u8c03\u5ea6\u5668<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u9009\u62e9\u9002\u5408\u5e94\u7528\u573a\u666f\u7684I\/O\u8c03\u5ea6\u5668<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524dI\/O\u8c03\u5ea6\u5668<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/sys\/block\/sda\/queue\/scheduler<\/p>\n<p><span class=\"token comment\"># \u5207\u6362\u5230noop\u8c03\u5ea6\u5668&#xff08;\u9002\u7528\u4e8eSSD&#xff09;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> noop <span class=\"token operator\">&gt;<\/span> \/sys\/block\/sda\/queue\/scheduler<\/p>\n<h4>3. \u4f7f\u7528RAID\u548cLVM<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u914d\u7f6eRAID\u4ee5\u63d0\u9ad8I\/O\u6027\u80fd<\/li>\n<li>\u4f7f\u7528\u903b\u8f91\u5377\u7ba1\u7406&#xff08;LVM&#xff09;\u8fdb\u884c\u7075\u6d3b\u5b58\u50a8\u7ba1\u7406<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token comment\"># \u521b\u5efaRAID 0&#xff08;\u6761\u5e26\u5316&#xff09;<\/span><br \/>\n<span class=\"token function\">mdadm<\/span> <span class=\"token parameter variable\">&#8211;create<\/span> \/dev\/md0 <span class=\"token parameter variable\">&#8211;level<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span> &#8211;raid-devices<span class=\"token operator\">&#061;<\/span><span class=\"token number\">2<\/span> \/dev\/sda1 \/dev\/sdb1<\/p>\n<p><span class=\"token comment\"># \u521b\u5efaLVM\u7269\u7406\u5377\u3001\u5377\u7ec4\u548c\u903b\u8f91\u5377<\/span><br \/>\npvcreate \/dev\/sda1<br \/>\nvgcreate my_vol_group \/dev\/sda1<br \/>\nlvcreate <span class=\"token parameter variable\">-l<\/span> <span class=\"token number\">100<\/span>%FREE <span class=\"token parameter variable\">-n<\/span> my_logical_volume my_vol_group<\/p>\n<h4>4. \u8c03\u6574\u5185\u5b58\u548c\u7f13\u5b58\u8bbe\u7f6e<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u589e\u52a0\u7cfb\u7edf\u5185\u5b58\u6216\u8c03\u6574\u7f13\u5b58\u5927\u5c0f<\/li>\n<li>\u4f7f\u7528\u9002\u5f53\u7684\u7f13\u5b58\u7b56\u7565<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token comment\"># \u7f16\u8f91\/etc\/sysctl.conf\u6587\u4ef6&#xff0c;\u589e\u52a0\u4ee5\u4e0b\u5185\u5bb9<\/span><br \/>\nvm.dirty_ratio <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">60<\/span><br \/>\nvm.dirty_background_ratio <span class=\"token operator\">&#061;<\/span> <span class=\"token number\">20<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u66f4\u6539\u751f\u6548<\/span><br \/>\n<span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span><\/p>\n<h4>5. \u4f18\u5316\u5e94\u7528\u7a0b\u5e8fI\/O<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u8c03\u6574\u5e94\u7528\u7a0b\u5e8f\u7684I\/O\u6a21\u5f0f<\/li>\n<li>\u4f7f\u7528\u5f02\u6b65I\/O<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token keyword\">import<\/span> asyncio<\/p>\n<p><span class=\"token keyword\">async<\/span> <span class=\"token keyword\">def<\/span> <span class=\"token function\">read_file<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span><br \/>\n    <span class=\"token keyword\">with<\/span> <span class=\"token builtin\">open<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">&#039;\/path\/to\/file&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#039;r&#039;<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">as<\/span> f<span class=\"token punctuation\">:<\/span><br \/>\n        data <span class=\"token operator\">&#061;<\/span> <span class=\"token keyword\">await<\/span> f<span class=\"token punctuation\">.<\/span>read<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<p>asyncio<span class=\"token punctuation\">.<\/span>run<span class=\"token punctuation\">(<\/span>read_file<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<h4>6. \u76d1\u63a7\u548c\u5206\u6790I\/O\u6027\u80fd<\/h4>\n<h5>\u65b9\u6cd5:<\/h5>\n<ul>\n<li>\u4f7f\u7528\u5de5\u5177\u76d1\u63a7I\/O\u6027\u80fd<\/li>\n<li>\u5206\u6790I\/O\u74f6\u9888\u5e76\u505a\u51fa\u76f8\u5e94\u8c03\u6574<\/li>\n<\/ul>\n<h5>\u793a\u4f8b:<\/h5>\n<p><span class=\"token comment\"># \u4f7f\u7528iostat\u547d\u4ee4\u76d1\u63a7I\/O\u6027\u80fd<\/span><br \/>\niostat <span class=\"token parameter variable\">-x<\/span> <span class=\"token number\">1<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528dstat\u547d\u4ee4\u83b7\u53d6\u8be6\u7ec6\u7684I\/O\u7edf\u8ba1\u4fe1\u606f<\/span><br \/>\ndstat <span class=\"token parameter variable\">-d<\/span> &#8211;disk-util<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5&#xff0c;\u53ef\u4ee5\u663e\u8457\u63d0\u5347Linux\u7cfb\u7edf\u4e2d\u7684I\/O\u6027\u80fd\u3002\u6839\u636e\u5177\u4f53\u7684\u5e94\u7528\u573a\u666f\u548c\u9700\u6c42&#xff0c;\u53ef\u4ee5\u7075\u6d3b\u9009\u62e9\u5408\u9002\u7684\u4f18\u5316\u65b9\u6848\u3002<\/p>\n<h3>8. \u5982\u4f55\u5728Linux\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528RAID&#xff1f;<\/h3>\n<p>\u5728Linux\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528RAID&#xff08;Redundant Array of Independent Disks&#xff09;\u53ef\u4ee5\u901a\u8fc7\u8f6f\u4ef6RAID\u548c\u786c\u4ef6RAID\u4e24\u79cd\u65b9\u5f0f\u5b9e\u73b0\u3002\u8fd9\u91cc\u6211\u4eec\u4e3b\u8981\u8ba8\u8bba\u8f6f\u4ef6RAID\u7684\u914d\u7f6e\u65b9\u6cd5&#xff0c;\u56e0\u4e3a\u5b83\u4e0d\u9700\u8981\u989d\u5916\u7684\u786c\u4ef6\u652f\u6301&#xff0c;\u5e76\u4e14\u53ef\u4ee5\u5728\u5927\u591a\u6570Linux\u53d1\u884c\u7248\u4e0a\u5b9e\u73b0\u3002<\/p>\n<h4>\u4e00\u3001\u51c6\u5907\u5de5\u4f5c<\/h4>\n<li>\u786e\u4fdd\u786c\u76d8\u672a\u5206\u533a&#xff1a;\u5728\u914d\u7f6eRAID\u4e4b\u524d&#xff0c;\u8bf7\u786e\u4fdd\u4f60\u8ba1\u5212\u7528\u4e8eRAID\u7684\u786c\u76d8\u662f\u7a7a\u7684\u6216\u672a\u5206\u533a\u7684\u3002<\/li>\n<li>\u5b89\u88c5\u5fc5\u8981\u7684\u8f6f\u4ef6\u5305&#xff1a;\u5927\u591a\u6570Linux\u53d1\u884c\u7248\u90fd\u81ea\u5e26\u4e86\u914d\u7f6e\u8f6f\u4ef6RAID\u6240\u9700\u7684\u5de5\u5177&#xff0c;\u5982mdadm\u3002<\/li>\n<h4>\u4e8c\u3001\u6b65\u9aa4\u8bf4\u660e<\/h4>\n<h5>1. \u5b89\u88c5mdadm\u5de5\u5177<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> <span class=\"token function\">mdadm<\/span><\/p>\n<h5>2. \u521b\u5efaRAID\u9635\u5217<\/h5>\n<p>\u5047\u8bbe\u6211\u4eec\u8981\u521b\u5efa\u4e00\u4e2aRAID 1&#xff08;\u955c\u50cf&#xff09;\u9635\u5217&#xff0c;\u4f7f\u7528\/dev\/sda\u548c\/dev\/sdb\u4e24\u4e2a\u78c1\u76d8\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">mdadm<\/span> <span class=\"token parameter variable\">&#8211;create<\/span> \/dev\/md0 <span class=\"token parameter variable\">&#8211;level<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">1<\/span> &#8211;raid-devices<span class=\"token operator\">&#061;<\/span><span class=\"token number\">2<\/span> \/dev\/sda \/dev\/sdb<\/p>\n<ul>\n<li>\/dev\/md0: \u8868\u793a\u521b\u5efa\u7684RAID\u8bbe\u5907\u540d\u3002<\/li>\n<li>&#8211;level&#061;1: \u8868\u793aRAID\u7ea7\u522b\u4e3a1&#xff08;\u955c\u50cf&#xff09;\u3002<\/li>\n<li>&#8211;raid-devices&#061;2: \u8868\u793a\u53c2\u4e0eRAID\u7684\u78c1\u76d8\u6570\u91cf\u4e3a2\u3002<\/li>\n<li>\/dev\/sda \u548c \/dev\/sdb: \u53c2\u4e0eRAID\u7684\u78c1\u76d8\u8bbe\u5907\u3002<\/li>\n<\/ul>\n<h5>3. \u67e5\u770bRAID\u72b6\u6001<\/h5>\n<p><span class=\"token function\">cat<\/span> \/proc\/mdstat<\/p>\n<p>\u6216\u8005\u4f7f\u7528mdadm\u547d\u4ee4\u67e5\u770b\u8be6\u7ec6\u4fe1\u606f&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">mdadm<\/span> <span class=\"token parameter variable\">&#8211;detail<\/span> \/dev\/md0<\/p>\n<h5>4. \u683c\u5f0f\u5316RAID\u8bbe\u5907<\/h5>\n<p><span class=\"token function\">sudo<\/span> mkfs.ext4 \/dev\/md0<\/p>\n<h5>5. \u6302\u8f7dRAID\u8bbe\u5907<\/h5>\n<p>\u521b\u5efa\u4e00\u4e2a\u6302\u8f7d\u70b9\u5e76\u6302\u8f7dRAID\u8bbe\u5907&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">mkdir<\/span> <span class=\"token parameter variable\">-p<\/span> \/mnt\/raid<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">mount<\/span> \/dev\/md0 \/mnt\/raid<\/p>\n<h5>6. \u66f4\u65b0\/etc\/fstab\u6587\u4ef6\u4ee5\u4fbf\u7cfb\u7edf\u542f\u52a8\u65f6\u81ea\u52a8\u6302\u8f7d<\/h5>\n<p>\u7f16\u8f91\/etc\/fstab\u6587\u4ef6&#xff0c;\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9&#xff1a;<\/p>\n<p>\/dev\/md0    \/mnt\/raid    ext4    defaults    0    0<\/p>\n<h4>\u4e09\u3001\u793a\u4f8b<\/h4>\n<p>\u5047\u8bbe\u6211\u4eec\u6709\u4e24\u5757\u786c\u76d8\/dev\/sda\u548c\/dev\/sdb&#xff0c;\u4ee5\u4e0b\u662f\u5b8c\u6574\u7684\u64cd\u4f5c\u8fc7\u7a0b&#xff1a;<\/p>\n<li>\n<p>\u5b89\u88c5mdadm\u5de5\u5177<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> <span class=\"token function\">mdadm<\/span>\n <\/li>\n<li>\n<p>\u521b\u5efaRAID 1\u9635\u5217<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">mdadm<\/span> <span class=\"token parameter variable\">&#8211;create<\/span> \/dev\/md0 <span class=\"token parameter variable\">&#8211;level<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">1<\/span> &#8211;raid-devices<span class=\"token operator\">&#061;<\/span><span class=\"token number\">2<\/span> \/dev\/sda \/dev\/sdb\n <\/li>\n<li>\n<p>\u67e5\u770bRAID\u72b6\u6001<\/p>\n<p> <span class=\"token function\">cat<\/span> \/proc\/mdstat\n <\/li>\n<li>\n<p>\u683c\u5f0f\u5316RAID\u8bbe\u5907<\/p>\n<p> <span class=\"token function\">sudo<\/span> mkfs.ext4 \/dev\/md0\n <\/li>\n<li>\n<p>\u6302\u8f7dRAID\u8bbe\u5907<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">mkdir<\/span> <span class=\"token parameter variable\">-p<\/span> \/mnt\/raid<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">mount<\/span> \/dev\/md0 \/mnt\/raid\n <\/li>\n<li>\n<p>\u66f4\u65b0\/etc\/fstab\u6587\u4ef6<\/p>\n<p> \/dev\/md0    \/mnt\/raid    ext4    defaults    0    0\n <\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u5c31\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528RAID\u3002\u5982\u679c\u9700\u8981\u5176\u4ed6RAID\u7ea7\u522b&#xff08;\u5982RAID 0, RAID 5\u7b49&#xff09;&#xff0c;\u53ea\u9700\u8c03\u6574\u76f8\u5e94\u7684\u53c2\u6570\u5373\u53ef\u3002<\/p>\n<h3>9. \u5982\u4f55\u4f18\u5316Linux\u6587\u4ef6\u7cfb\u7edf\u7684\u5b58\u50a8\u6027\u80fd&#xff1f;<\/h3>\n<p>\u4f18\u5316Linux\u6587\u4ef6\u7cfb\u7edf\u7684\u5b58\u50a8\u6027\u80fd\u662f\u4e00\u4e2a\u590d\u6742\u7684\u4efb\u52a1&#xff0c;\u6d89\u53ca\u591a\u4e2a\u5c42\u9762\u7684\u8c03\u6574\u3002\u4ee5\u4e0b\u662f\u4e00\u4e2a\u6761\u7406\u6e05\u6670\u7684\u6307\u5357&#xff0c;\u5305\u62ec\u4e00\u4e9b\u5177\u4f53\u7684\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u9009\u62e9\u5408\u9002\u7684\u6587\u4ef6\u7cfb\u7edf<\/h4>\n<p>\u4e0d\u540c\u7684\u6587\u4ef6\u7cfb\u7edf\u5728\u6027\u80fd\u4e0a\u6709\u4e0d\u540c\u7684\u8868\u73b0&#xff0c;\u9009\u62e9\u9002\u5408\u7684\u6587\u4ef6\u7cfb\u7edf\u662f\u7b2c\u4e00\u6b65\u3002<\/p>\n<ul>\n<li>Ext4: \u9002\u7528\u4e8e\u5927\u591a\u6570\u684c\u9762\u548c\u670d\u52a1\u5668\u73af\u5883&#xff0c;\u5177\u6709\u826f\u597d\u7684\u8bfb\u5199\u6027\u80fd\u3002<\/li>\n<li>XFS: \u9002\u7528\u4e8e\u5927\u6587\u4ef6\u548c\u5927\u5b58\u50a8\u5377&#xff0c;\u9002\u5408\u4f01\u4e1a\u7ea7\u5e94\u7528\u3002<\/li>\n<li>Btrfs: \u63d0\u4f9b\u9ad8\u7ea7\u529f\u80fd\u5982\u5feb\u7167\u3001\u5b50\u5377\u7b49&#xff0c;\u4f46\u53ef\u80fd\u4f1a\u5bf9\u6027\u80fd\u6709\u4e00\u5b9a\u5f71\u54cd\u3002<\/li>\n<\/ul>\n<h4>2. \u8c03\u6574\u6587\u4ef6\u7cfb\u7edf\u6302\u8f7d\u53c2\u6570<\/h4>\n<p>\u901a\u8fc7\u8c03\u6574\u6302\u8f7d\u53c2\u6570\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8\u6587\u4ef6\u7cfb\u7edf\u7684\u6027\u80fd\u3002<\/p>\n<ul>\n<li>noatime: \u7981\u7528\u8bbf\u95ee\u65f6\u95f4\u7684\u66f4\u65b0&#xff0c;\u51cf\u5c11\u5199\u64cd\u4f5c\u3002<span class=\"token function\">mount<\/span> <span class=\"token parameter variable\">-o<\/span> noatime \/dev\/sda1 \/mount\/point\n <\/li>\n<li>nodiratime: \u4ec5\u5bf9\u76ee\u5f55\u7981\u7528\u8bbf\u95ee\u65f6\u95f4\u7684\u66f4\u65b0\u3002<span class=\"token function\">mount<\/span> <span class=\"token parameter variable\">-o<\/span> nodiratime \/dev\/sda1 \/mount\/point\n <\/li>\n<li>data&#061;writeback: \u4f7f\u7528\u56de\u5199\u6a21\u5f0f&#xff0c;\u63d0\u9ad8\u5199\u5165\u6027\u80fd\u3002<span class=\"token function\">mount<\/span> <span class=\"token parameter variable\">-o<\/span> <span class=\"token assign-left variable\">data<\/span><span class=\"token operator\">&#061;<\/span>writeback \/dev\/sda1 \/mount\/point\n <\/li>\n<\/ul>\n<h4>3. \u4f7f\u7528\u78c1\u76d8\u8c03\u5ea6\u7b97\u6cd5<\/h4>\n<p>\u6839\u636e\u5de5\u4f5c\u8d1f\u8f7d\u9009\u62e9\u5408\u9002\u7684I\/O\u8c03\u5ea6\u5668\u3002<\/p>\n<ul>\n<li>noop: \u5bf9\u4e8eSSD\u63a8\u8350\u4f7f\u7528&#xff0c;\u51cf\u5c11\u4e0d\u5fc5\u8981\u7684\u5199\u64cd\u4f5c\u3002<span class=\"token builtin class-name\">echo<\/span> noop <span class=\"token operator\">&gt;<\/span> \/sys\/block\/sda\/queue\/scheduler\n <\/li>\n<li>deadline: \u9002\u7528\u4e8e\u673a\u68b0\u786c\u76d8&#xff0c;\u5e73\u8861\u4e86\u541e\u5410\u91cf\u548c\u54cd\u5e94\u65f6\u95f4\u3002<span class=\"token builtin class-name\">echo<\/span> deadline <span class=\"token operator\">&gt;<\/span> \/sys\/block\/sda\/queue\/scheduler\n <\/li>\n<li>cfq: \u5b8c\u5168\u516c\u5e73\u961f\u5217&#xff0c;\u9002\u7528\u4e8e\u684c\u9762\u73af\u5883\u3002<span class=\"token builtin class-name\">echo<\/span> cfq <span class=\"token operator\">&gt;<\/span> \/sys\/block\/sda\/queue\/scheduler\n <\/li>\n<\/ul>\n<h4>4. \u914d\u7f6e\u7f13\u5b58\u8bbe\u7f6e<\/h4>\n<p>\u8c03\u6574\u7f13\u5b58\u8bbe\u7f6e\u4ee5\u63d0\u9ad8\u6587\u4ef6\u7cfb\u7edf\u6027\u80fd\u3002<\/p>\n<ul>\n<li>vmtouch: \u5c06\u5e38\u7528\u6570\u636e\u9884\u52a0\u8f7d\u5230\u5185\u5b58\u4e2d\u3002vmtouch <span class=\"token parameter variable\">-l<\/span> 1G \/path\/to\/directory\n <\/li>\n<li>vfscache: \u4f7f\u7528VFS\u7f13\u5b58\u52a0\u901f\u6587\u4ef6\u8bbf\u95ee\u3002<span class=\"token function\">mount<\/span> <span class=\"token parameter variable\">-t<\/span> tmpfs none \/mnt\/ramdisk<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;none \/mnt\/ramdisk tmpfs defaults,size&#061;512M 0 0&#034;<\/span> <span class=\"token operator\">&gt;&gt;<\/span> \/etc\/fstab\n <\/li>\n<\/ul>\n<h4>5. \u5b9a\u671f\u8fdb\u884c\u6587\u4ef6\u7cfb\u7edf\u68c0\u67e5\u548c\u4f18\u5316<\/h4>\n<p>\u5b9a\u671f\u8fd0\u884c\u6587\u4ef6\u7cfb\u7edf\u68c0\u67e5\u5de5\u5177\u6765\u4fee\u590d\u6587\u4ef6\u7cfb\u7edf\u9519\u8bef&#xff0c;\u5e76\u4f7f\u7528\u6587\u4ef6\u7cfb\u7edf\u4f18\u5316\u5de5\u5177\u8fdb\u884c\u4f18\u5316\u3002<\/p>\n<ul>\n<li>fsck: \u6587\u4ef6\u7cfb\u7edf\u4e00\u81f4\u6027\u68c0\u67e5\u5de5\u5177\u3002<span class=\"token function\">fsck<\/span> \/dev\/sda1\n <\/li>\n<li>e4defrag: Ext4\u6587\u4ef6\u7cfb\u7edf\u788e\u7247\u6574\u7406\u5de5\u5177\u3002e4defrag \/dev\/sda1\n <\/li>\n<\/ul>\n<h4>6. \u4f7f\u7528RAID\u548cLVM<\/h4>\n<p>\u901a\u8fc7RAID\u548cLVM\u63d0\u9ad8\u5b58\u50a8\u6027\u80fd\u548c\u53ef\u9760\u6027\u3002<\/p>\n<ul>\n<li>RAID 0: \u6761\u5e26\u5316&#xff0c;\u63d0\u9ad8\u8bfb\u5199\u6027\u80fd&#xff0c;\u4f46\u4e0d\u63d0\u4f9b\u5197\u4f59\u3002<\/li>\n<li>RAID 1: \u955c\u50cf&#xff0c;\u63d0\u4f9b\u6570\u636e\u5197\u4f59&#xff0c;\u4f46\u4f1a\u51cf\u5c11\u4e00\u534a\u7684\u5b58\u50a8\u7a7a\u95f4\u3002<\/li>\n<li>LVM: \u903b\u8f91\u5377\u7ba1\u7406&#xff0c;\u5141\u8bb8\u52a8\u6001\u8c03\u6574\u5b58\u50a8\u7a7a\u95f4\u3002<\/li>\n<\/ul>\n<h4>\u793a\u4f8b&#xff1a;\u914d\u7f6e\u4e00\u4e2a\u9ad8\u6027\u80fd\u7684XFS\u6587\u4ef6\u7cfb\u7edf<\/h4>\n<p>\u5047\u8bbe\u4f60\u6709\u4e00\u4e2a\u8bbe\u5907\/dev\/sda1&#xff0c;\u4f60\u60f3\u5c06\u5176\u683c\u5f0f\u5316\u4e3aXFS\u5e76\u6302\u8f7d\u5230\/mnt\/data&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u683c\u5f0f\u5316\u8bbe\u5907\u4e3aXFS\u6587\u4ef6\u7cfb\u7edf<\/span><br \/>\nmkfs.xfs \/dev\/sda1<\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u6302\u8f7d\u70b9\u76ee\u5f55<\/span><br \/>\n<span class=\"token function\">mkdir<\/span> <span class=\"token parameter variable\">-p<\/span> \/mnt\/data<\/p>\n<p><span class=\"token comment\"># \u6302\u8f7d\u6587\u4ef6\u7cfb\u7edf&#xff0c;\u5e76\u6dfb\u52a0\u6302\u8f7d\u53c2\u6570<\/span><br \/>\n<span class=\"token function\">mount<\/span> <span class=\"token parameter variable\">-t<\/span> xfs <span class=\"token parameter variable\">-o<\/span> noatime,nodiratime,data<span class=\"token operator\">&#061;<\/span>writeback \/dev\/sda1 \/mnt\/data<\/p>\n<p><span class=\"token comment\"># \u6c38\u4e45\u6dfb\u52a0\u5230\/etc\/fstab<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;\/dev\/sda1 \/mnt\/data xfs noatime,nodiratime,data&#061;writeback 0 0&#034;<\/span> <span class=\"token operator\">&gt;&gt;<\/span> \/etc\/fstab<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4\u548c\u793a\u4f8b&#xff0c;\u4f60\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8Linux\u6587\u4ef6\u7cfb\u7edf\u7684\u5b58\u50a8\u6027\u80fd\u3002\u6bcf\u4e2a\u6b65\u9aa4\u90fd\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u8fdb\u884c\u8c03\u6574\u548c\u4f18\u5316\u3002<\/p>\n<h3>10. \u5982\u4f55\u5206\u6790\u548c\u89e3\u51b3\u78c1\u76d8I\/O\u74f6\u9888\u95ee\u9898&#xff1f;<\/h3>\n<p>\u5206\u6790\u548c\u89e3\u51b3\u78c1\u76d8I\/O\u74f6\u9888\u95ee\u9898\u9700\u8981\u7cfb\u7edf\u6027\u7684\u6b65\u9aa4\u548c\u65b9\u6cd5\u3002\u4ee5\u4e0b\u662f\u6761\u7406\u6e05\u6670\u7684\u5206\u6790\u4e0e\u89e3\u51b3\u65b9\u6848&#xff1a;<\/p>\n<h4>1. \u8bc6\u522b\u74f6\u9888<\/h4>\n<p>\u6307\u6807\u76d1\u63a7<\/p>\n<ul>\n<li>\u4f7f\u7528\u5de5\u5177: iostat, vmstat, dstat\u7b49\u7cfb\u7edf\u76d1\u63a7\u5de5\u5177\u3002<\/li>\n<li>\u5173\u952e\u6307\u6807: \u67e5\u770b\u78c1\u76d8\u7684\u8bfb\u5199\u901f\u7387&#xff08;tps, mb_read\/s, mb_wrtn\/s&#xff09;&#xff0c;I\/O\u7b49\u5f85\u65f6\u95f4&#xff08;await&#xff09;&#xff0c;\u961f\u5217\u957f\u5ea6&#xff08;avgqu-sz&#xff09;\u3002<\/li>\n<\/ul>\n<p>\u793a\u4f8b<\/p>\n<p><span class=\"token comment\"># iostat -x 1 3<\/span><br \/>\nLinux <span class=\"token number\">4.15<\/span>.0-29-generic <span class=\"token punctuation\">(<\/span>hostname<span class=\"token punctuation\">)<\/span> 07\/16\/2020  _x86_64_    <span class=\"token punctuation\">(<\/span><span class=\"token number\">4<\/span> CPU<span class=\"token punctuation\">)<\/span><\/p>\n<p>avg-cpu:  %user   %nice %system %iowait  %steal   %idle<br \/>\n           <span class=\"token number\">2.00<\/span>    <span class=\"token number\">0.00<\/span>    <span class=\"token number\">0.33<\/span>    <span class=\"token number\">0.00<\/span>    <span class=\"token number\">0.00<\/span>   <span class=\"token number\">97.67<\/span><\/p>\n<p>Device:         rrqm\/s   wrqm\/s     r\/s     w\/s    rkB\/s    wkB\/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util<br \/>\nsda              <span class=\"token number\">0.00<\/span>     <span class=\"token number\">0.00<\/span>    <span class=\"token number\">1.00<\/span>    <span class=\"token number\">0.00<\/span>     <span class=\"token number\">2.00<\/span>     <span class=\"token number\">0.00<\/span>    <span class=\"token number\">20.00<\/span>     <span class=\"token number\">0.00<\/span>    <span class=\"token number\">0.00<\/span>    <span class=\"token number\">0.00<\/span>    <span class=\"token number\">0.00<\/span>   <span class=\"token number\">0.00<\/span>   <span class=\"token number\">0.00<\/span><\/p>\n<h4>2. \u786e\u5b9a\u539f\u56e0<\/h4>\n<p>\u786c\u4ef6\u5c42\u9762<\/p>\n<ul>\n<li>\u78c1\u76d8\u6027\u80fd\u4e0d\u8db3: \u68c0\u67e5\u78c1\u76d8\u89c4\u683c&#xff0c;\u662f\u5426\u4e3a\u673a\u68b0\u786c\u76d8\u6216SSD\u3002<\/li>\n<li>RAID\u914d\u7f6e\u95ee\u9898: \u5982\u679c\u662fRAID\u9635\u5217&#xff0c;\u68c0\u67e5\u5176\u914d\u7f6e\u548c\u5065\u5eb7\u72b6\u6001\u3002<\/li>\n<\/ul>\n<p>\u8f6f\u4ef6\u5c42\u9762<\/p>\n<ul>\n<li>\u6587\u4ef6\u7cfb\u7edf\u95ee\u9898: \u68c0\u67e5\u6587\u4ef6\u7cfb\u7edf\u7c7b\u578b&#xff08;ext4, xfs\u7b49&#xff09;\u53ca\u5176\u8c03\u4f18\u53c2\u6570\u3002<\/li>\n<li>\u5e94\u7528\u7a0b\u5e8f\u884c\u4e3a: \u5206\u6790\u9ad8I\/O\u64cd\u4f5c\u7684\u5e94\u7528\u7a0b\u5e8f\u65e5\u5fd7\u548c\u914d\u7f6e\u6587\u4ef6\u3002<\/li>\n<\/ul>\n<p>\u793a\u4f8b<\/p>\n<p><span class=\"token comment\"># df -hT<\/span><br \/>\nFilesystem      Type      Size  Used Avail Use% Mounted on<br \/>\n\/dev\/sda1       ext4       50G   30G   20G  <span class=\"token number\">60<\/span>% \/<br \/>\ntmpfs           tmpfs      16G  <span class=\"token number\">1<\/span>.2M   16G   <span class=\"token number\">1<\/span>% \/dev\/shm<\/p>\n<h4>3. \u4f18\u5316\u63aa\u65bd<\/h4>\n<p>\u786c\u4ef6\u4f18\u5316<\/p>\n<ul>\n<li>\u5347\u7ea7\u78c1\u76d8: \u5c06\u673a\u68b0\u786c\u76d8\u66ff\u6362\u4e3aSSD\u3002<\/li>\n<li>\u8c03\u6574RAID\u7ea7\u522b: \u4eceRAID 5\u5347\u7ea7\u5230RAID 10\u4ee5\u63d0\u5347\u8bfb\u5199\u6027\u80fd\u3002<\/li>\n<\/ul>\n<p>\u8f6f\u4ef6\u4f18\u5316<\/p>\n<ul>\n<li>\u6587\u4ef6\u7cfb\u7edf\u8c03\u4f18: \u8c03\u6574\u6587\u4ef6\u7cfb\u7edf\u53c2\u6570\u5982noatime\u3001nodiratime\u7b49\u3002<\/li>\n<li>\u7f13\u5b58\u673a\u5236: \u4f7f\u7528\u7f13\u5b58\u673a\u5236\u5982cache\u6216buffer\u6765\u51cf\u5c11\u76f4\u63a5I\/O\u64cd\u4f5c\u3002<\/li>\n<li>\u5e94\u7528\u5c42\u4f18\u5316: \u4f18\u5316\u5e94\u7528\u7684I\/O\u6a21\u5f0f&#xff0c;\u4f8b\u5982\u6279\u91cf\u5904\u7406I\/O\u64cd\u4f5c\u3002<\/li>\n<\/ul>\n<p>\u793a\u4f8b<\/p>\n<p><span class=\"token comment\"># \u8c03\u6574\u6587\u4ef6\u7cfb\u7edf\u53c2\u6570<\/span><br \/>\n<span class=\"token function\">sudo<\/span> tune2fs <span class=\"token parameter variable\">-O<\/span> ^has_journal \/dev\/sda1<\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5\u5e76\u542f\u7528\u7f13\u5b58\u673a\u5236<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> cachefilesd<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> cachefilesd<br \/>\n<span class=\"token function\">sudo<\/span> systemctl start cachefilesd<\/p>\n<h4>4. \u6301\u7eed\u76d1\u63a7\u4e0e\u6539\u8fdb<\/h4>\n<p>\u5b9a\u671f\u68c0\u67e5<\/p>\n<ul>\n<li>\u81ea\u52a8\u5316\u76d1\u63a7: \u8bbe\u7f6ecron\u4efb\u52a1\u5b9a\u671f\u8fd0\u884c\u76d1\u63a7\u811a\u672c\u3002<\/li>\n<li>\u62a5\u8b66\u673a\u5236: \u914d\u7f6e\u90ae\u4ef6\u6216\u77ed\u4fe1\u63d0\u9192&#xff0c;\u5f53I\/O\u6307\u6807\u5f02\u5e38\u65f6\u53ca\u65f6\u901a\u77e5\u76f8\u5173\u4eba\u5458\u3002<\/li>\n<\/ul>\n<p>\u793a\u4f8b<\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0cron\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-e<\/span><br \/>\n*\/5 * * * * \/usr\/bin\/iostat <span class=\"token parameter variable\">-x<\/span> <span class=\"token operator\">|<\/span> mail <span class=\"token parameter variable\">-s<\/span> <span class=\"token string\">&#034;IOStat Report&#034;<\/span> admin&#064;example.com<\/p>\n<p>\u901a\u8fc7\u4e0a\u8ff0\u6b65\u9aa4&#xff0c;\u53ef\u4ee5\u6709\u6548\u5730\u5206\u6790\u548c\u89e3\u51b3\u78c1\u76d8I\/O\u74f6\u9888\u95ee\u9898&#xff0c;\u786e\u4fdd\u7cfb\u7edf\u7684\u7a33\u5b9a\u548c\u9ad8\u6548\u8fd0\u884c\u3002<\/p>\n<h3>11. \u5982\u4f55\u63d0\u9ad8Linux\u7cfb\u7edf\u7684\u7f51\u7edc\u6027\u80fd&#xff1f;<\/h3>\n<p>\u63d0\u9ad8Linux\u7cfb\u7edf\u7684\u7f51\u7edc\u6027\u80fd\u662f\u4e00\u4e2a\u6d89\u53ca\u591a\u4e2a\u65b9\u9762\u7684\u8fc7\u7a0b&#xff0c;\u5305\u62ec\u786c\u4ef6\u914d\u7f6e\u3001\u7f51\u7edc\u8bbe\u7f6e\u3001\u7cfb\u7edf\u4f18\u5316\u7b49\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5177\u4f53\u7684\u65b9\u6cd5&#xff1a;<\/p>\n<h4>1. \u4f18\u5316\u5185\u6838\u53c2\u6570<\/h4>\n<p>\u901a\u8fc7\u8c03\u6574\u5185\u6838\u53c2\u6570\u53ef\u4ee5\u63d0\u9ad8\u7f51\u7edc\u6027\u80fd\u3002\u53ef\u4ee5\u4f7f\u7528sysctl\u5de5\u5177\u6765\u67e5\u770b\u548c\u4fee\u6539\u8fd9\u4e9b\u53c2\u6570\u3002<\/p>\n<h5>\u793a\u4f8b<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u5185\u6838\u53c2\u6570<\/span><br \/>\n<span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-a<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> net.ipv4<\/p>\n<p><span class=\"token comment\"># \u589e\u52a0TCP\u53d1\u9001\u7f13\u51b2\u533a\u5927\u5c0f<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-w<\/span> <span class=\"token assign-left variable\">net.ipv4.tcp_send_buffer_size<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">1048576<\/span><\/p>\n<p><span class=\"token comment\"># \u589e\u52a0TCP\u63a5\u6536\u7f13\u51b2\u533a\u5927\u5c0f<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-w<\/span> <span class=\"token assign-left variable\">net.ipv4.tcp_recv_buffer_size<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">1048576<\/span><\/p>\n<p><span class=\"token comment\"># \u6c38\u4e45\u751f\u6548&#xff0c;\u7f16\u8f91\/etc\/sysctl.conf\u6587\u4ef6\u5e76\u6dfb\u52a0\u4e0a\u8ff0\u53c2\u6570<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;net.ipv4.tcp_send_buffer_size &#061; 1048576&#034;<\/span> <span class=\"token operator\">&gt;&gt;<\/span> \/etc\/sysctl.conf<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;net.ipv4.tcp_recv_buffer_size &#061; 1048576&#034;<\/span> <span class=\"token operator\">&gt;&gt;<\/span> \/etc\/sysctl.conf<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span>  <span class=\"token comment\"># \u4f7f\u914d\u7f6e\u6587\u4ef6\u751f\u6548<\/span><\/p>\n<h4>2. \u8c03\u6574\u7f51\u7edc\u63a5\u53e3\u961f\u5217\u89c4\u5219<\/h4>\n<p>\u53ef\u4ee5\u901a\u8fc7\u6539\u53d8\u7f51\u7edc\u63a5\u53e3\u7684\u961f\u5217\u89c4\u5219\u6765\u63d0\u9ad8\u7f51\u7edc\u6027\u80fd\u3002<\/p>\n<h5>\u793a\u4f8b<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u7684\u961f\u5217\u89c4\u5219<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/proc\/interrupts <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token operator\">&lt;<\/span>interface<span class=\"token operator\">&gt;<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528htb (Hierarchical Token Bucket) \u961f\u5217\u89c4\u5219<\/span><br \/>\ntc qdisc <span class=\"token function\">add<\/span> dev eth0 root handle <span class=\"token number\">1<\/span>: htb default <span class=\"token number\">30<\/span><\/p>\n<p><span class=\"token comment\"># \u8bbe\u7f6e\u6700\u5927\u5e26\u5bbd\u548c\u901f\u7387<\/span><br \/>\ntc class <span class=\"token function\">add<\/span> dev eth0 parent <span class=\"token number\">1<\/span>: classid <span class=\"token number\">1<\/span>:1 htb rate 10mbit ceil 10mbit<\/p>\n<h4>3. \u4f7f\u7528\u9ad8\u6548\u7684\u7f51\u7edc\u534f\u8bae<\/h4>\n<p>\u9009\u62e9\u9002\u5408\u7684\u9ad8\u6548\u7f51\u7edc\u534f\u8bae&#xff0c;\u5982Jumbo Frames\u3001iPerf\u7b49&#xff0c;\u53ef\u4ee5\u663e\u8457\u63d0\u5347\u7f51\u7edc\u6027\u80fd\u3002<\/p>\n<h5>\u793a\u4f8b<\/h5>\n<p><span class=\"token comment\"># \u542f\u7528Jumbo Frames&#xff08;\u9700\u8981\u4ea4\u6362\u673a\u652f\u6301&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">ifconfig<\/span> eth0 mtu <span class=\"token number\">9000<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528iPerf\u8fdb\u884c\u7f51\u7edc\u6027\u80fd\u6d4b\u8bd5<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> iperf3<br \/>\niperf3 <span class=\"token parameter variable\">-c<\/span> server_ip<\/p>\n<h4>4. \u8d1f\u8f7d\u5747\u8861\u4e0e\u5197\u4f59<\/h4>\n<p>\u901a\u8fc7\u914d\u7f6e\u591a\u7f51\u5361\u7ed1\u5b9a\u548c\u8d1f\u8f7d\u5747\u8861&#xff0c;\u63d0\u9ad8\u7f51\u7edc\u541e\u5410\u91cf\u548c\u5197\u4f59\u6027\u3002<\/p>\n<h5>\u793a\u4f8b<\/h5>\n<p><span class=\"token comment\"># \u5b89\u88c5ifenslave\u8f6f\u4ef6\u5305<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> ifenslave<\/p>\n<p><span class=\"token comment\"># \u914d\u7f6e\u7f51\u5361\u7ed1\u5b9a<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/network\/interfaces.d\/bonding<br \/>\n<span class=\"token comment\"># \u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9<\/span><br \/>\nauto bond0<br \/>\niface bond0 inet static<br \/>\n    address <span class=\"token number\">192.168<\/span>.1.100<br \/>\n    netmask <span class=\"token number\">255.255<\/span>.255.0<br \/>\n    gateway <span class=\"token number\">192.168<\/span>.1.1<br \/>\n    dns-nameservers <span class=\"token number\">8.8<\/span>.8.8<br \/>\n    bond-mode <span class=\"token number\">0<\/span>        <span class=\"token comment\"># \u8bbe\u5b9a\u4e3a0\u8868\u793around-robin\u6a21\u5f0f<\/span><br \/>\n    bond-miimon <span class=\"token number\">100<\/span>    <span class=\"token comment\"># \u6bcf100ms\u68c0\u6d4b\u94fe\u8def\u72b6\u6001<\/span><br \/>\n    bond-slaves none   <span class=\"token comment\"># \u52a8\u6001\u83b7\u53d6\u4ece\u8bbe\u5907<\/span><\/p>\n<p>auto eth0<br \/>\niface eth0 inet manual<br \/>\n    bond-master bond0<br \/>\n    bootproto off<\/p>\n<p>auto eth1<br \/>\niface eth1 inet manual<br \/>\n    bond-master bond0<br \/>\n    bootproto off<\/p>\n<h4>5. \u51cf\u5c11\u7f51\u7edc\u5ef6\u8fdf<\/h4>\n<p>\u4f18\u5316\u5e94\u7528\u7a0b\u5e8f\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u7684\u4ea4\u4e92&#xff0c;\u51cf\u5c11\u4e0d\u5fc5\u8981\u7684\u7f51\u7edc\u5ef6\u8fdf\u3002<\/p>\n<h5>\u793a\u4f8b<\/h5>\n<p><span class=\"token comment\"># \u5f00\u542fTCP\u5feb\u901f\u6253\u5f00\u529f\u80fd&#xff08;\u9700\u8981\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u7aef\u90fd\u652f\u6301&#xff09;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;1&#034;<\/span> <span class=\"token operator\">&gt;<\/span> \/proc\/sys\/net\/ipv4\/tcp_fastopen<\/p>\n<h4>\u603b\u7ed3<\/h4>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5&#xff0c;\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8Linux\u7cfb\u7edf\u7684\u7f51\u7edc\u6027\u80fd\u3002\u6839\u636e\u5b9e\u9645\u9700\u6c42\u548c\u73af\u5883&#xff0c;\u53ef\u4ee5\u9009\u62e9\u9002\u5408\u7684\u4f18\u5316\u7b56\u7565\u8fdb\u884c\u5b9e\u65bd\u3002<\/p>\n<h3>12. \u5982\u4f55\u5206\u6790\u548c\u4f18\u5316\u7f51\u7edc\u5ef6\u8fdf\u95ee\u9898&#xff1f;<\/h3>\n<p>\u8981\u5206\u6790\u548c\u4f18\u5316\u7f51\u7edc\u5ef6\u8fdf\u95ee\u9898&#xff0c;\u53ef\u4ee5\u6309\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c&#xff1a;<\/p>\n<h4>1. \u786e\u5b9a\u5ef6\u8fdf\u7684\u6e90\u5934<\/h4>\n<p>\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u786e\u5b9a\u662f\u54ea\u91cc\u51fa\u73b0\u4e86\u5ef6\u8fdf\u95ee\u9898\u3002\u8fd9\u53ef\u80fd\u6d89\u53ca\u5230\u591a\u4e2a\u5c42\u9762&#xff0c;\u5305\u62ec\u786c\u4ef6\u3001\u8f6f\u4ef6\u548c\u7f51\u7edc\u914d\u7f6e\u7b49\u3002<\/p>\n<p>\u793a\u4f8b:<\/p>\n<ul>\n<li>\u786c\u4ef6\u95ee\u9898&#xff1a;\u68c0\u67e5\u7f51\u7edc\u8bbe\u5907&#xff08;\u5982\u8def\u7531\u5668\u3001\u4ea4\u6362\u673a&#xff09;\u662f\u5426\u5b58\u5728\u6545\u969c\u6216\u8fc7\u8f7d\u3002<\/li>\n<li>\u8f6f\u4ef6\u95ee\u9898&#xff1a;\u67e5\u770b\u662f\u5426\u6709\u5e94\u7528\u7a0b\u5e8f\u6216\u670d\u52a1\u6d88\u8017\u4e86\u8fc7\u591a\u7684\u8d44\u6e90\u3002<\/li>\n<li>\u7f51\u7edc\u914d\u7f6e\u95ee\u9898&#xff1a;\u5206\u6790\u8def\u7531\u8868\u3001DNS\u914d\u7f6e\u7b49\u662f\u5426\u6b63\u786e\u8bbe\u7f6e\u3002<\/li>\n<\/ul>\n<h4>2. \u4f7f\u7528\u5de5\u5177\u8fdb\u884c\u8bca\u65ad<\/h4>\n<p>\u5229\u7528\u5404\u79cd\u7f51\u7edc\u76d1\u63a7\u548c\u5206\u6790\u5de5\u5177\u6765\u8bca\u65ad\u95ee\u9898\u3002<\/p>\n<p>\u793a\u4f8b:<\/p>\n<ul>\n<li>Ping\u547d\u4ee4&#xff1a;\u7528\u4e8e\u6d4b\u8bd5\u4e24\u4e2a\u8282\u70b9\u4e4b\u95f4\u7684\u8fde\u901a\u6027\u548c\u5ef6\u8fdf\u3002<span class=\"token function\">ping<\/span> www.example.com\n <\/li>\n<li>Traceroute\u547d\u4ee4&#xff1a;\u8ffd\u8e2a\u6570\u636e\u5305\u5728\u7f51\u7edc\u4e2d\u7684\u8def\u5f84&#xff0c;\u627e\u51fa\u5728\u54ea\u4e00\u8df3\u51fa\u73b0\u4e86\u5ef6\u8fdf\u3002<span class=\"token function\">traceroute<\/span> www.example.com\n <\/li>\n<li>Wireshark&#xff1a;\u6355\u83b7\u548c\u5206\u6790\u7f51\u7edc\u6d41\u91cf&#xff0c;\u4ee5\u67e5\u627e\u53ef\u80fd\u7684\u95ee\u9898\u3002<\/li>\n<\/ul>\n<h4>3. \u5206\u6790\u7f51\u7edc\u6d41\u91cf<\/h4>\n<p>\u4e86\u89e3\u7f51\u7edc\u6d41\u91cf\u7684\u6a21\u5f0f\u548c\u74f6\u9888\u6240\u5728\u3002<\/p>\n<p>\u793a\u4f8b:<\/p>\n<ul>\n<li>\u5e26\u5bbd\u5229\u7528\u7387&#xff1a;\u68c0\u67e5\u7f51\u7edc\u5e26\u5bbd\u662f\u5426\u88ab\u5360\u6ee1\u3002<\/li>\n<li>\u534f\u8bae\u5206\u5e03&#xff1a;\u5206\u6790\u54ea\u4e9b\u534f\u8bae\u5360\u7528\u4e86\u5927\u91cf\u7684\u5e26\u5bbd\u3002<\/li>\n<li>\u6d41\u91cf\u6a21\u5f0f&#xff1a;\u8bc6\u522b\u51fa\u9ad8\u5cf0\u65f6\u6bb5\u548c\u4f4e\u8c37\u65f6\u6bb5\u3002<\/li>\n<\/ul>\n<h4>4. \u4f18\u5316\u7f51\u7edc\u914d\u7f6e<\/h4>\n<p>\u6839\u636e\u5206\u6790\u7ed3\u679c\u8c03\u6574\u7f51\u7edc\u914d\u7f6e\u3002<\/p>\n<p>\u793a\u4f8b:<\/p>\n<ul>\n<li>QoS\u914d\u7f6e&#xff1a;\u5b9e\u65bd\u670d\u52a1\u8d28\u91cf&#xff08;Quality of Service, QoS&#xff09;\u7b56\u7565&#xff0c;\u4f18\u5148\u5904\u7406\u5173\u952e\u5e94\u7528\u7684\u6d41\u91cf\u3002<\/li>\n<li>\u8def\u7531\u4f18\u5316&#xff1a;\u8c03\u6574\u8def\u7531\u7b56\u7565&#xff0c;\u907f\u514d\u4e0d\u5fc5\u8981\u7684\u8df3\u6570\u3002<\/li>\n<li>\u8d1f\u8f7d\u5747\u8861&#xff1a;\u5206\u6563\u6d41\u91cf\u5230\u591a\u4e2a\u8def\u5f84\u4e0a&#xff0c;\u907f\u514d\u5355\u70b9\u8fc7\u8f7d\u3002<\/li>\n<\/ul>\n<h4>5. \u6301\u7eed\u76d1\u63a7\u548c\u7ef4\u62a4<\/h4>\n<p>\u786e\u4fdd\u7f51\u7edc\u6027\u80fd\u5f97\u5230\u6301\u7eed\u7684\u76d1\u63a7\u548c\u7ef4\u62a4\u3002<\/p>\n<p>\u793a\u4f8b:<\/p>\n<ul>\n<li>\u81ea\u52a8\u5316\u76d1\u63a7\u811a\u672c&#xff1a;\u7f16\u5199\u811a\u672c\u5b9a\u671f\u68c0\u67e5\u7f51\u7edc\u72b6\u6001&#xff0c;\u5e76\u5728\u68c0\u6d4b\u5230\u5f02\u5e38\u65f6\u53d1\u51fa\u8b66\u62a5\u3002<\/li>\n<li>\u65e5\u5fd7\u5206\u6790&#xff1a;\u5b9a\u671f\u5ba1\u67e5\u7cfb\u7edf\u548c\u5e94\u7528\u65e5\u5fd7&#xff0c;\u5bfb\u627e\u6f5c\u5728\u7684\u95ee\u9898\u8ff9\u8c61\u3002<\/li>\n<li>\u5907\u4efd\u548c\u6062\u590d\u8ba1\u5212&#xff1a;\u786e\u4fdd\u6709\u6709\u6548\u7684\u5907\u4efd\u548c\u707e\u96be\u6062\u590d\u8ba1\u5212&#xff0c;\u4ee5\u4fbf\u5728\u51fa\u73b0\u95ee\u9898\u65f6\u5feb\u901f\u6062\u590d\u3002<\/li>\n<\/ul>\n<p>\u901a\u8fc7\u4e0a\u8ff0\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u7cfb\u7edf\u5730\u5206\u6790\u548c\u4f18\u5316\u7f51\u7edc\u5ef6\u8fdf\u95ee\u9898\u3002\u8bb0\u4f4f&#xff0c;\u8fd9\u662f\u4e00\u4e2a\u6301\u7eed\u7684\u8fc7\u7a0b&#xff0c;\u9700\u8981\u5b9a\u671f\u8bc4\u4f30\u548c\u8c03\u6574\u7b56\u7565\u4ee5\u9002\u5e94\u4e0d\u65ad\u53d8\u5316\u7684\u7f51\u7edc\u73af\u5883\u3002<\/p>\n<h3>13. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f18\u5316TCP\/IP\u53c2\u6570&#xff1f;<\/h3>\n<p>\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f18\u5316TCP\/IP\u53c2\u6570&#xff0c;\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c&#xff1a;<\/p>\n<h4>1. \u68c0\u67e5\u5f53\u524d\u7684TCP\/IP\u8bbe\u7f6e<\/h4>\n<p>\u9996\u5148&#xff0c;\u9700\u8981\u4e86\u89e3\u7cfb\u7edf\u5f53\u524d\u7684TCP\/IP\u53c2\u6570\u3002\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u67e5\u770b&#xff1a;<\/p>\n<p><span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-a<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> net.ipv4<br \/>\n<span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-a<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> net.ipv6<\/p>\n<h4>2. \u4fee\u6539\/etc\/sysctl.conf\u6587\u4ef6<\/h4>\n<p>\u7f16\u8f91\/etc\/sysctl.conf\u6587\u4ef6&#xff0c;\u6dfb\u52a0\u6216\u4fee\u6539\u76f8\u5173\u53c2\u6570\u3002\u4f8b\u5982&#xff1a;<\/p>\n<p># \u589e\u52a0\u6700\u5927\u4f20\u8f93\u5355\u5143&#xff08;MTU&#xff09;<br \/>\nnet.core.wmem_max &#061; 8388608<br \/>\nnet.core.rmem_max &#061; 8388608<\/p>\n<p># \u542f\u7528TCP\u7a97\u53e3\u7f29\u653e<br \/>\nnet.ipv4.tcp_window_scaling &#061; 1<\/p>\n<p># \u51cf\u5c11TIME_WAIT\u5957\u63a5\u5b57\u7684\u8d85\u65f6\u65f6\u95f4<br \/>\nnet.ipv4.tcp_fin_timeout &#061; 30<\/p>\n<p># \u542f\u7528TCP\u62e5\u585e\u63a7\u5236\u7b97\u6cd5 BBR (Bottleneck Bandwidth and Round-trip propagation time)<br \/>\nnet.core.default_qdisc &#061; fq<br \/>\nnet.ipv4.tcp_congestion_control &#061; bbr<\/p>\n<h4>3. \u5e94\u7528\u65b0\u7684\u8bbe\u7f6e<\/h4>\n<p>\u4fdd\u5b58\u5e76\u5173\u95ed\u6587\u4ef6\u540e&#xff0c;\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u4f7f\u66f4\u6539\u751f\u6548&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">sysctl<\/span> <span class=\"token parameter variable\">-p<\/span><\/p>\n<h4>4. \u6301\u4e45\u5316\u8bbe\u7f6e<\/h4>\n<p>\u5982\u679c\u5e0c\u671b\u8fd9\u4e9b\u8bbe\u7f6e\u5728\u91cd\u542f\u540e\u4ecd\u7136\u6709\u6548&#xff0c;\u53ef\u4ee5\u5c06\u5b83\u4eec\u6dfb\u52a0\u5230\/etc\/sysctl.conf\u4e2d\u3002\u5982\u679c\u4f7f\u7528\u7684\u662f\u57fa\u4e8esystemd\u7684\u7cfb\u7edf&#xff0c;\u8fd8\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a\u81ea\u5b9a\u4e49\u7684\u914d\u7f6e\u6587\u4ef6&#xff0c;\u4f8b\u5982\/etc\/sysctl.d\/99-custom.conf&#xff0c;\u5e76\u5728\u5176\u4e2d\u6dfb\u52a0\u76f8\u5e94\u7684\u8bbe\u7f6e\u3002<\/p>\n<h4>5. \u8c03\u6574\u7f51\u7edc\u63a5\u53e3\u53c2\u6570<\/h4>\n<p>\u6709\u65f6\u8fd8\u9700\u8981\u8c03\u6574\u7279\u5b9a\u7f51\u7edc\u63a5\u53e3\u7684\u53c2\u6570\u3002\u53ef\u4ee5\u4f7f\u7528ifconfig\u6216ip\u547d\u4ee4\u6765\u67e5\u770b\u548c\u4fee\u6539\u7f51\u7edc\u63a5\u53e3\u53c2\u6570\u3002\u4f8b\u5982&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">ifconfig<\/span> eth0 mtu <span class=\"token number\">9000<\/span><\/p>\n<p>\u6216\u8005\u4f7f\u7528ip\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">ip<\/span> <span class=\"token function\">link<\/span> <span class=\"token builtin class-name\">set<\/span> dev eth0 mtu <span class=\"token number\">9000<\/span><\/p>\n<h4>\u793a\u4f8b&#xff1a;\u4f18\u5316TCP\/IP\u53c2\u6570\u4ee5\u63d0\u5347\u6027\u80fd<\/h4>\n<p>\u5047\u8bbe\u6211\u4eec\u6709\u4e00\u4e2aWeb\u670d\u52a1\u5668&#xff0c;\u5e0c\u671b\u901a\u8fc7\u8c03\u6574TCP\/IP\u53c2\u6570\u6765\u63d0\u9ad8\u5176\u6027\u80fd&#xff0c;\u53ef\u4ee5\u8fdb\u884c\u5982\u4e0b\u8bbe\u7f6e&#xff1a;<\/p>\n<li>\n<p>\u589e\u52a0\u5185\u5b58\u7f13\u51b2\u533a&#xff1a;<\/p>\n<p> net.core.wmem_max &#061; 8388608<br \/>\nnet.core.rmem_max &#061; 8388608<\/p>\n<p>\u8fd9\u4f1a\u5c06\u53d1\u9001\u548c\u63a5\u6536\u7f13\u51b2\u533a\u7684\u5927\u5c0f\u589e\u52a0\u52308MB\u3002<\/p>\n<\/li>\n<li>\n<p>\u542f\u7528TCP\u7a97\u53e3\u7f29\u653e&#xff1a;<\/p>\n<p> net.ipv4.tcp_window_scaling &#061; 1<\/p>\n<p>\u8fd9\u5c06\u5141\u8bb8\u66f4\u5927\u7684TCP\u7a97\u53e3&#xff0c;\u63d0\u9ad8\u6570\u636e\u4f20\u8f93\u6548\u7387\u3002<\/p>\n<\/li>\n<li>\n<p>\u51cf\u5c11TIME_WAIT\u8d85\u65f6\u65f6\u95f4&#xff1a;<\/p>\n<p> net.ipv4.tcp_fin_timeout &#061; 30<\/p>\n<p>\u8fd9\u5c06\u51cf\u5c11TIME_WAIT\u72b6\u6001\u7684\u6301\u7eed\u65f6\u95f4&#xff0c;\u91ca\u653e\u8d44\u6e90\u3002<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528BBR\u62e5\u585e\u63a7\u5236\u7b97\u6cd5&#xff1a;<\/p>\n<p> net.core.default_qdisc &#061; fq<br \/>\nnet.ipv4.tcp_congestion_control &#061; bbr<\/p>\n<p>BBR\u7b97\u6cd5\u80fd\u591f\u66f4\u597d\u5730\u5229\u7528\u5e26\u5bbd\u5e76\u51cf\u5c11\u5ef6\u8fdf\u3002<\/p>\n<\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u914d\u7f6e\u548c\u4f18\u5316Linux\u7cfb\u7edf\u4e2d\u7684TCP\/IP\u53c2\u6570&#xff0c;\u4ee5\u6ee1\u8db3\u4e0d\u540c\u7684\u6027\u80fd\u9700\u6c42\u3002<\/p>\n<h3>14. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u9632\u706b\u5899\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027&#xff1f;<\/h3>\n<p>\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u9632\u706b\u5899\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027&#xff0c;\u4f60\u53ef\u4ee5\u4f7f\u7528iptables\u6216firewalld\u5de5\u5177\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>\u4f7f\u7528 iptables<\/h4>\n<li>\n<p>\u5b89\u88c5 iptables&#xff08;\u5982\u679c\u5c1a\u672a\u5b89\u88c5&#xff09;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> iptables <span class=\"token parameter variable\">-y<\/span>  <span class=\"token comment\"># \u5bf9\u4e8eDebian\/Ubuntu\u7cfb\u7edf<\/span><br \/>\n<span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> iptables <span class=\"token parameter variable\">-y<\/span>      <span class=\"token comment\"># \u5bf9\u4e8eCentOS\/RHEL\u7cfb\u7edf<\/span>\n <\/li>\n<li>\n<p>\u8bbe\u7f6e\u9ed8\u8ba4\u7b56\u7565 \u5c06\u9ed8\u8ba4\u7684INPUT\u3001FORWARD\u94fe\u7684\u7b56\u7565\u8bbe\u7f6e\u4e3aDROP&#xff0c;\u8fd9\u610f\u5473\u7740\u62d2\u7edd\u6240\u6709\u672a\u660e\u786e\u5141\u8bb8\u7684\u6d41\u91cf\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> INPUT DROP<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> FORWARD DROP<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> OUTPUT ACCEPT\n <\/li>\n<li>\n<p>\u5141\u8bb8\u56de\u73af\u63a5\u53e3\u6d41\u91cf \u5141\u8bb8\u672c\u5730\u56de\u73af\u63a5\u53e3&#xff08;localhost&#xff09;\u7684\u6d41\u91cf\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-i<\/span> lo <span class=\"token parameter variable\">-j<\/span> ACCEPT<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> OUTPUT <span class=\"token parameter variable\">-o<\/span> lo <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\n<p>\u5141\u8bb8\u5df2\u5efa\u7acb\u7684\u8fde\u63a5\u548c\u76f8\u5173\u6d41\u91cf \u5141\u8bb8\u5df2\u7ecf\u5efa\u7acb\u7684\u8fde\u63a5\u548c\u4e0e\u5176\u76f8\u5173\u7684\u6d41\u91cf\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-m<\/span> state <span class=\"token parameter variable\">&#8211;state<\/span> ESTABLISHED,RELATED <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\n<p>\u5141\u8bb8\u7279\u5b9a\u7aef\u53e3 \u4f8b\u5982&#xff0c;\u5141\u8bb8SSH&#xff08;\u7aef\u53e322&#xff09;\u548cHTTP&#xff08;\u7aef\u53e380&#xff09;\u6d41\u91cf\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">22<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">80<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\n<p>\u4fdd\u5b58\u89c4\u5219 \u5c06\u89c4\u5219\u4fdd\u5b58\u5230\u6587\u4ef6&#xff0c;\u4ee5\u4fbf\u5728\u91cd\u542f\u540e\u4ecd\u7136\u6709\u6548\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">sh<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#039;iptables-save &gt; \/etc\/iptables\/rules.v4&#039;<\/span>\n <\/li>\n<li>\n<p>\u67e5\u770b\u5f53\u524d\u89c4\u5219 \u786e\u8ba4\u89c4\u5219\u662f\u5426\u751f\u6548\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-L<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token parameter variable\">-n<\/span>\n <\/li>\n<h4>\u4f7f\u7528 firewalld<\/h4>\n<li>\n<p>\u5b89\u88c5 firewalld&#xff08;\u5982\u679c\u5c1a\u672a\u5b89\u88c5&#xff09;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> firewalld <span class=\"token parameter variable\">-y<\/span>  <span class=\"token comment\"># \u5bf9\u4e8eDebian\/Ubuntu\u7cfb\u7edf<\/span><br \/>\n<span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> firewalld <span class=\"token parameter variable\">-y<\/span>      <span class=\"token comment\"># \u5bf9\u4e8eCentOS\/RHEL\u7cfb\u7edf<\/span>\n <\/li>\n<li>\n<p>\u542f\u52a8\u5e76\u542f\u7528 firewalld<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl start firewalld<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> firewalld\n <\/li>\n<li>\n<p>\u8bbe\u7f6e\u9ed8\u8ba4\u533a\u57df \u5c06\u9ed8\u8ba4\u533a\u57df\u8bbe\u7f6e\u4e3a\u201cstrict\u201d&#xff0c;\u8fd9\u5c06\u62d2\u7edd\u6240\u6709\u8f93\u5165\u8fde\u63a5&#xff0c;\u53ea\u5141\u8bb8\u67d0\u4e9b\u57fa\u672c\u670d\u52a1\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> firewall-cmd &#8211;set-default-zone<span class=\"token operator\">&#061;<\/span>strict\n <\/li>\n<li>\n<p>\u5f00\u653e\u7279\u5b9a\u7aef\u53e3 \u4f8b\u5982&#xff0c;\u5141\u8bb8SSH&#xff08;\u7aef\u53e322&#xff09;\u548cHTTP&#xff08;\u7aef\u53e380&#xff09;\u6d41\u91cf\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> firewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-port<span class=\"token operator\">&#061;<\/span><span class=\"token number\">22<\/span>\/tcp<br \/>\n<span class=\"token function\">sudo<\/span> firewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-port<span class=\"token operator\">&#061;<\/span><span class=\"token number\">80<\/span>\/tcp<br \/>\n<span class=\"token function\">sudo<\/span> firewall-cmd <span class=\"token parameter variable\">&#8211;reload<\/span>\n <\/li>\n<li>\n<p>\u68c0\u67e5\u5f53\u524d\u89c4\u5219 \u786e\u8ba4\u89c4\u5219\u662f\u5426\u751f\u6548\u3002<\/p>\n<p> <span class=\"token function\">sudo<\/span> firewall-cmd &#8211;list-all\n <\/li>\n<h4>\u603b\u7ed3<\/h4>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u60a8\u53ef\u4ee5\u6709\u6548\u5730\u914d\u7f6eLinux\u7cfb\u7edf\u7684\u9632\u706b\u5899&#xff0c;\u4ece\u800c\u63d0\u9ad8\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002\u65e0\u8bba\u662f\u4f7f\u7528iptables\u8fd8\u662ffirewalld&#xff0c;\u90fd\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u8fdb\u884c\u7075\u6d3b\u914d\u7f6e\u3002<\/p>\n<h3>15. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6eSELinux\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027&#xff1f;<\/h3>\n<p>\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6eSELinux\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027&#xff0c;\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c&#xff1a;<\/p>\n<h4>1. \u68c0\u67e5SELinux\u5f53\u524d\u72b6\u6001<\/h4>\n<p>\u9996\u5148\u9700\u8981\u68c0\u67e5SELinux\u662f\u5426\u542f\u7528&#xff0c;\u4ee5\u53ca\u5f53\u524d\u7684\u8fd0\u884c\u6a21\u5f0f\u3002<\/p>\n<h5>\u547d\u4ee4\u793a\u4f8b&#xff1a;<\/h5>\n<p>getenforce<br \/>\nsestatus<\/p>\n<ul>\n<li>getenforce: \u663e\u793a\u5f53\u524dSELinux\u7684\u6267\u884c\u6a21\u5f0f&#xff08;Enforcing\u6216Permissive&#xff09;\u3002<\/li>\n<li>sestatus: \u63d0\u4f9b\u66f4\u8be6\u7ec6\u7684SELinux\u72b6\u6001\u4fe1\u606f\u3002<\/li>\n<\/ul>\n<h4>2. \u7f16\u8f91SELinux\u914d\u7f6e\u6587\u4ef6<\/h4>\n<p>\u8981\u6c38\u4e45\u66f4\u6539SELinux\u7684\u6a21\u5f0f&#xff0c;\u9700\u8981\u7f16\u8f91\u914d\u7f6e\u6587\u4ef6 \/etc\/selinux\/config\u3002<\/p>\n<h5>\u793a\u4f8b\u5185\u5bb9&#xff1a;<\/h5>\n<p># This file controls the state of SELinux on the system.<br \/>\n# SELINUX&#061; can take one of these three values:<br \/>\n#     enforcing &#8211; SELinux security policies are enforced.<br \/>\n#     permissive &#8211; SELinux prints warnings instead of enforcing.<br \/>\n#     disabled &#8211; No SELinux policy is loaded.<br \/>\nSELINUX&#061;enforcing<br \/>\n# SELINUXTYPE&#061; can take one of these two values:<br \/>\n#     targeted &#8211; Targeted processes are protected,<br \/>\n#     minimum &#8211; Minimum possible protections<br \/>\nSELINUXTYPE&#061;targeted<\/p>\n<h4>3. \u91cd\u542f\u7cfb\u7edf\u6216\u91cd\u65b0\u52a0\u8f7dSELinux\u7b56\u7565<\/h4>\n<p>\u5728\u4fee\u6539\u914d\u7f6e\u6587\u4ef6\u540e&#xff0c;\u53ef\u4ee5\u9009\u62e9\u91cd\u542f\u7cfb\u7edf\u6216\u8005\u91cd\u65b0\u52a0\u8f7dSELinux\u7b56\u7565\u6765\u5e94\u7528\u66f4\u6539\u3002<\/p>\n<h5>\u547d\u4ee4\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token comment\"># \u7acb\u5373\u751f\u6548&#xff0c;\u4e0d\u91cd\u542f\u7cfb\u7edf<\/span><br \/>\nsetenforce <span class=\"token number\">1<\/span><\/p>\n<p><span class=\"token comment\"># \u91cd\u542f\u7cfb\u7edf<\/span><br \/>\n<span class=\"token function\">reboot<\/span><\/p>\n<h4>4. \u521b\u5efa\u548c\u7ba1\u7406SELinux\u7b56\u7565<\/h4>\n<p>\u4e3a\u4e86\u8fdb\u4e00\u6b65\u7ec6\u5316\u548c\u589e\u5f3a\u5b89\u5168\u6027&#xff0c;\u53ef\u4ee5\u521b\u5efa\u81ea\u5b9a\u4e49\u7684SELinux\u7b56\u7565\u3002\u8fd9\u901a\u5e38\u6d89\u53ca\u7f16\u5199\u548c\u7ba1\u7406.te\u6587\u4ef6&#xff0c;\u5e76\u4f7f\u7528checkpolicy\u548csemodule\u7b49\u5de5\u5177\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p>\u521b\u5efa\u4e00\u4e2a\u65b0\u7b56\u7565\u6a21\u5757&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u7b56\u7565\u5305\u76ee\u5f55<\/span><br \/>\n<span class=\"token function\">mkdir<\/span> <span class=\"token parameter variable\">-p<\/span> mypolicy\/modules<\/p>\n<p><span class=\"token comment\"># \u7f16\u8f91\u7b56\u7565\u6587\u4ef6 mypolicy\/modules\/mypolicy.te<\/span><br \/>\npolicy_module<span class=\"token punctuation\">(<\/span>mypolicy, <span class=\"token number\">0.1<\/span><span class=\"token punctuation\">)<\/span><\/p>\n<p>require <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">type<\/span> unconfined_t<span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><br \/>\nallow unconfined_t self:process <span class=\"token punctuation\">{<\/span> getpid getppid getpgid getpgrp setpgid setpgrp <span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u7f16\u8bd1\u548c\u5b89\u88c5\u7b56\u7565\u6a21\u5757&#xff1a;<\/p>\n<p><span class=\"token function\">make<\/span> <span class=\"token parameter variable\">-f<\/span> \/usr\/share\/selinux\/devel\/Makefile mypolicy.pp<br \/>\nsemodule <span class=\"token parameter variable\">-i<\/span> mypolicy.pp<\/p>\n<h4>5. \u65e5\u5fd7\u548c\u5ba1\u8ba1<\/h4>\n<p>\u542f\u7528SELinux\u7684\u5ba1\u8ba1\u529f\u80fd&#xff0c;\u53ef\u4ee5\u5e2e\u52a9\u4f60\u76d1\u63a7\u548c\u8bb0\u5f55\u5b89\u5168\u4e8b\u4ef6\u3002<\/p>\n<h5>\u547d\u4ee4\u793a\u4f8b&#xff1a;<\/h5>\n<p>auditctl <span class=\"token parameter variable\">-l<\/span>  <span class=\"token comment\"># \u5217\u51fa\u6240\u6709\u5f53\u524d\u7684\u5ba1\u8ba1\u89c4\u5219<\/span><br \/>\nauditctl <span class=\"token parameter variable\">-a<\/span> always,exit <span class=\"token parameter variable\">-F<\/span> <span class=\"token assign-left variable\">arch<\/span><span class=\"token operator\">&#061;<\/span>b64 <span class=\"token parameter variable\">-S<\/span> openat <span class=\"token parameter variable\">-S<\/span> <span class=\"token function\">open<\/span> <span class=\"token parameter variable\">-S<\/span> openat <span class=\"token parameter variable\">-S<\/span> creat <span class=\"token parameter variable\">-S<\/span> creat <span class=\"token parameter variable\">-S<\/span> <span class=\"token function\">open<\/span> <span class=\"token parameter variable\">-S<\/span> openat <span class=\"token parameter variable\">-S<\/span> creat <span class=\"token parameter variable\">-k<\/span> SELinuxAuditRule  <span class=\"token comment\"># \u6dfb\u52a0\u65b0\u7684\u5ba1\u8ba1\u89c4\u5219<\/span><\/p>\n<h4>6. \u5b9a\u671f\u68c0\u67e5\u548c\u66f4\u65b0SELinux\u7b56\u7565<\/h4>\n<p>\u4e3a\u4e86\u786e\u4fdd\u7cfb\u7edf\u7684\u5b89\u5168\u6027&#xff0c;\u5e94\u5b9a\u671f\u68c0\u67e5\u548c\u66f4\u65b0SELinux\u7b56\u7565\u3002\u53ef\u4ee5\u4f7f\u7528ausearch\u3001auditctl\u7b49\u5de5\u5177\u67e5\u770b\u548c\u5206\u6790\u5ba1\u8ba1\u65e5\u5fd7\u3002<\/p>\n<h5>\u547d\u4ee4\u793a\u4f8b&#xff1a;<\/h5>\n<p>ausearch <span class=\"token parameter variable\">-m<\/span> AVC <span class=\"token parameter variable\">-ts<\/span> today  <span class=\"token comment\"># \u67e5\u627e\u4eca\u5929\u7684AVC\u6d88\u606f<\/span><\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6709\u6548\u5730\u914d\u7f6e\u548c\u7ba1\u7406SELinux&#xff0c;\u4ece\u800c\u663e\u8457\u63d0\u9ad8\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002<\/p>\n<h3>16. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6eAppArmor\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d&#xff0c;AppArmor&#xff08;Application Armor&#xff09;\u662f\u4e00\u79cd\u5f3a\u5927\u7684\u5b89\u5168\u6a21\u5757&#xff0c;\u7528\u4e8e\u9650\u5236\u5e94\u7528\u7a0b\u5e8f\u7684\u6743\u9650\u548c\u8bbf\u95ee\u63a7\u5236\u3002\u914d\u7f6eAppArmor\u53ef\u4ee5\u63d0\u9ad8\u7cfb\u7edf\u7684\u5b89\u5168\u6027&#xff0c;\u9632\u6b62\u6f5c\u5728\u7684\u6076\u610f\u884c\u4e3a\u548c\u6f0f\u6d1e\u5229\u7528\u3002\u4e0b\u9762\u5c06\u8be6\u7ec6\u4ecb\u7ecd\u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6eAppArmor\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027\u3002<\/p>\n<h4>1. \u5b89\u88c5AppArmor<\/h4>\n<p>\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u786e\u4fdd\u4f60\u7684\u7cfb\u7edf\u5df2\u7ecf\u5b89\u88c5\u4e86AppArmor\u3002\u5982\u679c\u6ca1\u6709\u5b89\u88c5&#xff0c;\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u8fdb\u884c\u5b89\u88c5&#xff1a;<\/p>\n<p>\u5bf9\u4e8eDebian\/Ubuntu\u7cfb\u7edf&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> apparmor<\/p>\n<p>\u5bf9\u4e8eCentOS\/RHEL\u7cfb\u7edf&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> epel-release<br \/>\n<span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> apparmor<\/p>\n<h4>2. \u68c0\u67e5AppArmor\u72b6\u6001<\/h4>\n<p>\u5b89\u88c5\u5b8c\u6210\u540e&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u6765\u68c0\u67e5AppArmor\u7684\u72b6\u6001&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl status apparmor<\/p>\n<h4>3. \u914d\u7f6eAppArmor<\/h4>\n<p>AppArmor\u7684\u914d\u7f6e\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e\/etc\/apparmor.d\/\u76ee\u5f55\u4e0b\u3002\u4e3b\u8981\u914d\u7f6e\u6587\u4ef6\u662f\/etc\/apparmor.d\/system_profile\u548c\/etc\/apparmor.d\/usr.bin.nginx\u7b49\u3002<\/p>\n<h5>\u793a\u4f8b&#xff1a;\u914d\u7f6eNginx\u5e94\u7528<\/h5>\n<p>\u5047\u8bbe\u6211\u4eec\u8981\u4e3aNginx\u5e94\u7528\u914d\u7f6eAppArmor&#xff0c;\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c&#xff1a;<\/p>\n<li>\n<p>\u521b\u5efa\u65b0\u7684\u914d\u7f6e\u6587\u4ef6 \u5728\/etc\/apparmor.d\/\u76ee\u5f55\u4e0b\u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u914d\u7f6e\u6587\u4ef6&#xff0c;\u4f8b\u5982nginx.profile&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/apparmor.d\/nginx.profile\n <\/li>\n<li>\n<p>\u7f16\u8f91\u914d\u7f6e\u6587\u4ef6 \u5728\u6253\u5f00\u7684\u6587\u4ef6\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9&#xff1a;<\/p>\n<p> \/usr\/sbin\/nginx {<br \/>\n    # Allow Nginx to read its configuration files<br \/>\n    \/etc\/nginx\/ r,<br \/>\n    \/etc\/nginx\/conf.d\/ r,<br \/>\n    \/etc\/nginx\/sites-available\/ r,<br \/>\n    \/etc\/nginx\/sites-enabled\/ r,<\/p>\n<p>    # Allow Nginx to write logs<br \/>\n    \/var\/log\/nginx\/ w,<br \/>\n    \/var\/log\/nginx\/** w,<\/p>\n<p>    # Allow network access on port 80 and 443<br \/>\n    capability net_bind_service,<br \/>\n    listen 80,<br \/>\n    listen 443,<br \/>\n}\n <\/li>\n<li>\n<p>\u52a0\u8f7d\u914d\u7f6e\u6587\u4ef6 \u4fdd\u5b58\u5e76\u5173\u95ed\u6587\u4ef6\u540e&#xff0c;\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u52a0\u8f7d\u65b0\u914d\u7f6e&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> apparmor_parser <span class=\"token parameter variable\">-r<\/span> <span class=\"token parameter variable\">-W<\/span> \/etc\/apparmor.d\/nginx.profile\n <\/li>\n<li>\n<p>\u542f\u7528\u914d\u7f6e\u6587\u4ef6 \u6700\u540e&#xff0c;\u5c06\u8fd9\u4e2a\u914d\u7f6e\u6587\u4ef6\u94fe\u63a5\u5230\/etc\/apparmor.d\/enable\u76ee\u5f55&#xff0c;\u4f7f\u5176\u5728\u542f\u52a8\u65f6\u81ea\u52a8\u52a0\u8f7d&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">ln<\/span> <span class=\"token parameter variable\">-s<\/span> \/etc\/apparmor.d\/nginx.profile \/etc\/apparmor.d\/enable\/\n <\/li>\n<h4>4. \u9a8c\u8bc1AppArmor\u914d\u7f6e<\/h4>\n<p>\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u9a8c\u8bc1AppArmor\u7684\u914d\u7f6e\u662f\u5426\u6b63\u786e\u52a0\u8f7d&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> apparmor_status<\/p>\n<p>\u4f60\u5e94\u8be5\u80fd\u770b\u5230\u7c7b\u4f3c\u4ee5\u4e0b\u7684\u8f93\u51fa&#xff0c;\u663e\u793aNginx\u7684\u914d\u7f6e\u6587\u4ef6\u5df2\u52a0\u8f7d&#xff1a;<\/p>\n<p>profiles: (6 entries)<br \/>\n&#8230;<br \/>\n\/usr\/sbin\/nginx (107 profiles)<br \/>\n&#8230;<\/p>\n<h4>5. \u91cd\u542f\u670d\u52a1\u548c\u5e94\u7528<\/h4>\n<p>\u5728\u5b8c\u6210\u4e0a\u8ff0\u914d\u7f6e\u540e&#xff0c;\u5efa\u8bae\u91cd\u542f\u76f8\u5173\u7684\u670d\u52a1\u4ee5\u786e\u4fdd\u66f4\u6539\u751f\u6548&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl restart nginx<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6eAppArmor\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027\u3002\u6839\u636e\u5177\u4f53\u9700\u6c42&#xff0c;\u4f60\u53ef\u4ee5\u4e3a\u5176\u4ed6\u5e94\u7528\u7a0b\u5e8f\u521b\u5efa\u7c7b\u4f3c\u7684\u914d\u7f6e\u6587\u4ef6\u4ee5\u589e\u5f3a\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002<\/p>\n<h3>17. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528iptables&#xff1f;<\/h3>\n<p>\u597d\u7684&#xff0c;\u4f5c\u4e3a\u4e00\u540d\u4e13\u5bb6\u7ea7\u522b\u7684\u8fd0\u7ef4\u4eba\u5458&#xff0c;\u6211\u4f1a\u7ed9\u4f60\u63d0\u4f9b\u4e00\u4e2a\u6761\u7406\u6e05\u6670\u7684\u6307\u5357\u6765\u914d\u7f6e\u548c\u4f7f\u7528Linux\u7cfb\u7edf\u4e2d\u7684iptables\u3002<\/p>\n<h4>1. \u4ec0\u4e48\u662fiptables&#xff1f;<\/h4>\n<p>iptables \u662f\u4e00\u4e2a\u7528\u4e8e\u5728 Linux \u5185\u6838\u4e2d\u8bbe\u7f6e\u3001\u7ef4\u62a4\u548c\u68c0\u67e5 IP \u6570\u636e\u5305\u8fc7\u6ee4\u8868\u7684\u5de5\u5177\u3002\u5b83\u5141\u8bb8\u7cfb\u7edf\u7ba1\u7406\u5458\u5bf9\u8fdb\u5165\u3001\u79bb\u5f00\u4ee5\u53ca\u7ecf\u8fc7\u7cfb\u7edf\u7684\u7f51\u7edc\u6570\u636e\u5305\u8fdb\u884c\u7ec6\u7c92\u5ea6\u7684\u63a7\u5236\u3002\u8fd9\u4e9b\u63a7\u5236\u53ef\u4ee5\u57fa\u4e8e\u6e90\u5730\u5740\u3001\u76ee\u7684\u5730\u5740\u3001\u534f\u8bae\u7c7b\u578b\u7b49\u591a\u79cd\u56e0\u7d20\u3002<\/p>\n<h4>2. \u5b89\u88c5iptables<\/h4>\n<p>\u5927\u591a\u6570\u73b0\u4ee3\u7684 Linux \u53d1\u884c\u7248\u5df2\u7ecf\u9884\u88c5\u4e86 iptables\u3002\u5982\u679c\u6ca1\u6709\u7684\u8bdd&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u5305\u7ba1\u7406\u5668\u8fdb\u884c\u5b89\u88c5\u3002\u4f8b\u5982&#xff0c;\u5728 Debian\/Ubuntu \u7cfb\u7edf\u4e2d\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> iptables<\/p>\n<p>\u5728 CentOS\/RHEL \u7cfb\u7edf\u4e2d\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> iptables-services<\/p>\n<h4>3. \u914d\u7f6eiptables<\/h4>\n<h5>\u67e5\u770b\u5f53\u524d\u89c4\u5219<\/h5>\n<p>\u8981\u67e5\u770b\u5f53\u524d\u6240\u6709\u7684 iptables \u89c4\u5219&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-L<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token parameter variable\">-n<\/span><\/p>\n<h5>\u6dfb\u52a0\u89c4\u5219<\/h5>\n<p>\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5e38\u89c1\u7684 iptables \u89c4\u5219\u793a\u4f8b&#xff1a;<\/p>\n<li>\n<p>\u5141\u8bb8\u6240\u6709\u6d41\u91cf\u901a\u8fc7&#xff08;\u9ed8\u8ba4\u7b56\u7565&#xff09;<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> INPUT ACCEPT<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> FORWARD ACCEPT<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> OUTPUT ACCEPT\n <\/li>\n<li>\n<p>\u62d2\u7edd\u6240\u6709\u8f93\u5165\u6d41\u91cf&#xff0c;\u4f46\u5141\u8bb8\u7279\u5b9aIP<\/p>\n<p> <span class=\"token comment\"># \u62d2\u7edd\u6240\u6709\u8f93\u5165\u6d41\u91cf<\/span><br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> INPUT DROP<\/p>\n<p><span class=\"token comment\"># \u5141\u8bb8\u7279\u5b9aIP\u5730\u5740&#xff08;\u4f8b\u5982&#xff0c;192.168.1.100&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-s<\/span> <span class=\"token number\">192.168<\/span>.1.100 <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\n<p>\u5141\u8bb8\u7279\u5b9a\u7aef\u53e3\u7684\u8f93\u5165\u6d41\u91cf<\/p>\n<p> <span class=\"token comment\"># \u5141\u8bb8SSH\u8fde\u63a5&#xff08;\u9ed8\u8ba4\u662f\u7aef\u53e322&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">22<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT<\/p>\n<p><span class=\"token comment\"># \u5141\u8bb8HTTP\u6d41\u91cf&#xff08;\u9ed8\u8ba4\u662f\u7aef\u53e380&#xff09;<\/span><br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">80<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\n<p>\u8bb0\u5f55\u5339\u914d\u5230\u7684\u89c4\u5219<\/p>\n<p> <span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">22<\/span> <span class=\"token parameter variable\">-j<\/span> LOG &#8211;log-prefix <span class=\"token string\">&#034;SSH Access: &#034;<\/span>\n <\/li>\n<h4>4. \u4fdd\u5b58\u914d\u7f6e<\/h4>\n<p>\u4e0d\u540c\u7684 Linux \u53d1\u884c\u7248\u6709\u4e0d\u540c\u7684\u65b9\u6cd5\u6765\u4fdd\u5b58 iptables \u914d\u7f6e\u3002<\/p>\n<ul>\n<li>\n<p>Debian\/Ubuntu:<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">sh<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#039;iptables-save &gt; \/etc\/iptables\/rules.v4&#039;<\/span>\n <\/li>\n<li>\n<p>CentOS\/RHEL:<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">service<\/span> iptables save\n <\/li>\n<\/ul>\n<h4>5. \u542f\u52a8\u548c\u542f\u7528\u670d\u52a1<\/h4>\n<p>\u5728\u4e00\u4e9b\u53d1\u884c\u7248\u4e2d&#xff0c;\u9700\u8981\u624b\u52a8\u542f\u52a8\u5e76\u542f\u7528 iptables \u670d\u52a1\u3002<\/p>\n<ul>\n<li>\n<p>Debian\/Ubuntu:<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl start netfilter-persistent<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> netfilter-persistent\n <\/li>\n<li>\n<p>CentOS\/RHEL:<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl start iptables<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> iptables\n <\/li>\n<\/ul>\n<h4>6. \u9a8c\u8bc1\u914d\u7f6e\u662f\u5426\u751f\u6548<\/h4>\n<p>\u91cd\u542f\u670d\u52a1\u5668\u540e&#xff0c;\u518d\u6b21\u67e5\u770b iptables \u914d\u7f6e\u4ee5\u786e\u8ba4\u5176\u662f\u5426\u751f\u6548&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-L<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token parameter variable\">-n<\/span><\/p>\n<h4>7. \u5220\u9664\u89c4\u5219<\/h4>\n<p>\u5982\u679c\u9700\u8981\u5220\u9664\u67d0\u6761\u89c4\u5219&#xff0c;\u53ef\u4ee5\u4f7f\u7528 -D&#xff08;Delete&#xff09;\u9009\u9879\u3002\u4f8b\u5982&#xff0c;\u5220\u9664\u521a\u624d\u6dfb\u52a0\u7684 SSH \u89c4\u5219&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-D<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">22<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT<\/p>\n<h4>\u793a\u4f8b\u603b\u7ed3<\/h4>\n<p>\u5047\u8bbe\u4f60\u5e0c\u671b\u914d\u7f6e\u4e00\u4e2a\u57fa\u672c\u9632\u706b\u5899&#xff0c;\u53ea\u5141\u8bb8 SSH \u548c HTTP \u6d41\u91cf&#xff0c;\u5e76\u4e14\u62d2\u7edd\u5176\u4ed6\u6240\u6709\u8f93\u5165\u6d41\u91cf&#xff1a;<\/p>\n<li>\u8bbe\u7f6e\u9ed8\u8ba4\u7b56\u7565\u4e3a\u62d2\u7edd\u6240\u6709\u8f93\u5165\u6d41\u91cf&#xff1a;<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-P<\/span> INPUT DROP\n <\/li>\n<li>\u5141\u8bb8\u6765\u81ea\u7279\u5b9a IP&#xff08;\u5982192.168.1.100&#xff09;\u7684\u6240\u6709\u6d41\u91cf&#xff1a;<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-s<\/span> <span class=\"token number\">192.168<\/span>.1.100 <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\u5141\u8bb8 SSH \u548c HTTP \u6d41\u91cf&#xff1a;<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">22<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT<br \/>\n<span class=\"token function\">sudo<\/span> iptables <span class=\"token parameter variable\">-A<\/span> INPUT <span class=\"token parameter variable\">-p<\/span> tcp <span class=\"token parameter variable\">&#8211;dport<\/span> <span class=\"token number\">80<\/span> <span class=\"token parameter variable\">-j<\/span> ACCEPT\n <\/li>\n<li>\u4fdd\u5b58\u914d\u7f6e\u5e76\u91cd\u65b0\u542f\u52a8\u670d\u52a1&#xff1a;<span class=\"token function\">sudo<\/span> iptables-save <span class=\"token operator\">&gt;<\/span> \/etc\/iptables\/rules.v4 <span class=\"token comment\"># Ubuntu\/Debian specific command<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">service<\/span> netfilter-persistent restart     <span class=\"token comment\"># Ubuntu\/Debian specific command<\/span><br \/>\n \u6216\u8005\u5728 CentOS\/RHEL&#xff1a;<span class=\"token function\">sudo<\/span> <span class=\"token function\">service<\/span> iptables save<br \/>\n<span class=\"token function\">sudo<\/span> systemctl restart iptables\n <\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u6210\u529f\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528iptables\u3002<\/p>\n<h3>18. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528fail2ban&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528fail2ban\u7684\u6b65\u9aa4\u5982\u4e0b&#xff1a;<\/p>\n<li>\n<p>\u5b89\u88c5fail2ban&#xff1a;\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u5728\u4f60\u7684Linux\u7cfb\u7edf\u4e0a\u5b89\u88c5fail2ban\u3002\u5728Debian\/Ubuntu\u7cfb\u7edf\u4e0a&#xff0c;\u4f60\u53ef\u4ee5\u4f7f\u7528apt-get\u547d\u4ee4\u8fdb\u884c\u5b89\u88c5&#xff0c;\u5982sudo apt-get install fail2ban\u3002\u5728CentOS\/RHEL\u7cfb\u7edf\u4e0a&#xff0c;\u4f60\u53ef\u4ee5\u4f7f\u7528yum\u547d\u4ee4\u8fdb\u884c\u5b89\u88c5&#xff0c;\u5982sudo yum install fail2ban\u3002<\/p>\n<\/li>\n<li>\n<p>\u914d\u7f6efail2ban&#xff1a;fail2ban\u7684\u914d\u7f6e\u6587\u4ef6\u4f4d\u4e8e\/etc\/fail2ban\/\u76ee\u5f55\u4e0b\u3002\u4e3b\u914d\u7f6e\u6587\u4ef6\u662fjail.conf&#xff0c;\u5b83\u5b9a\u4e49\u4e86\u54ea\u4e9b\u670d\u52a1\u5e94\u8be5\u88ab\u4fdd\u62a4&#xff0c;\u4ee5\u53ca\u5982\u4f55\u4fdd\u62a4\u3002\u4f8b\u5982&#xff0c;\u5982\u679c\u4f60\u60f3\u4fdd\u62a4sshd\u670d\u52a1&#xff0c;\u4f60\u53ef\u4ee5\u5728[DEFAULT]\u90e8\u5206\u8bbe\u7f6eignoreip &#061; 127.0.0.1\u6765\u5ffd\u7565\u672c\u5730\u8fde\u63a5&#xff0c;\u7136\u540e\u5728[sshd]\u90e8\u5206\u8bbe\u7f6emaxretry &#061; 3\u6765\u9650\u5236\u6bcf\u4e2aIP\u7684\u6700\u5927\u5c1d\u8bd5\u6b21\u6570\u4e3a3\u6b21\u3002<\/p>\n<\/li>\n<li>\n<p>\u542f\u52a8fail2ban&#xff1a;\u914d\u7f6e\u5b8c\u6210\u540e&#xff0c;\u4f60\u9700\u8981\u542f\u52a8fail2ban\u670d\u52a1\u3002\u5728Debian\/Ubuntu\u7cfb\u7edf\u4e0a&#xff0c;\u4f60\u53ef\u4ee5\u4f7f\u7528sudo service fail2ban start\u547d\u4ee4\u3002\u5728CentOS\/RHEL\u7cfb\u7edf\u4e0a&#xff0c;\u4f60\u53ef\u4ee5\u4f7f\u7528sudo systemctl start fail2ban\u547d\u4ee4\u3002<\/p>\n<\/li>\n<li>\n<p>\u67e5\u770bfail2ban\u72b6\u6001&#xff1a;\u4f60\u53ef\u4ee5\u4f7f\u7528sudo iptables -L -n -v\u547d\u4ee4\u6765\u67e5\u770b\u5f53\u524d\u7684iptables\u89c4\u5219&#xff0c;\u8fd9\u4e9b\u89c4\u5219\u662f\u7531fail2ban\u521b\u5efa\u7684\u3002\u4f60\u4e5f\u53ef\u4ee5\u4f7f\u7528sudo fail2ban-client status\u547d\u4ee4\u6765\u67e5\u770bfail2ban\u7684\u72b6\u6001\u3002<\/p>\n<\/li>\n<li>\n<p>\u6d4b\u8bd5fail2ban&#xff1a;\u4f60\u53ef\u4ee5\u901a\u8fc7\u5c1d\u8bd5\u591a\u6b21\u9519\u8bef\u7684\u5bc6\u7801\u767b\u5f55\u5230\u53d7\u4fdd\u62a4\u7684\u670d\u52a1\u6765\u6d4b\u8bd5fail2ban\u3002\u5982\u679c\u5931\u8d25\u7684\u6b21\u6570\u8d85\u8fc7\u4e86\u4f60\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u8bbe\u7f6e\u7684\u6700\u5927\u5c1d\u8bd5\u6b21\u6570&#xff0c;\u90a3\u4e48\u8be5IP\u5730\u5740\u5c06\u88ab\u6dfb\u52a0\u5230iptables\u7684\u9ed1\u540d\u5355\u4e2d&#xff0c;\u4ece\u800c\u963b\u6b62\u8fdb\u4e00\u6b65\u7684\u8fde\u63a5\u5c1d\u8bd5\u3002<\/p>\n<\/li>\n<p>\u4ee5\u4e0a\u5c31\u662f\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528fail2ban\u7684\u57fa\u672c\u6b65\u9aa4\u3002<\/p>\n<h3>19. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u65e5\u5fd7\u5ba1\u8ba1&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u65e5\u5fd7\u5ba1\u8ba1\u662f\u4e00\u9879\u91cd\u8981\u7684\u4efb\u52a1&#xff0c;\u5b83\u6709\u52a9\u4e8e\u76d1\u63a7\u7cfb\u7edf\u6d3b\u52a8\u3001\u68c0\u6d4b\u5b89\u5168\u6f0f\u6d1e\u548c\u8fdb\u884c\u6545\u969c\u6392\u9664\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u5b89\u88c5\u548c\u914d\u7f6e\u5ba1\u8ba1\u5de5\u5177<\/h4>\n<h5>1.1 \u5b89\u88c5auditd<\/h5>\n<p>auditd\u662fLinux\u7cfb\u7edf\u4e2d\u7684\u4e00\u4e2a\u7528\u6237\u7a7a\u95f4\u5ba1\u8ba1\u5b88\u62a4\u8fdb\u7a0b\u3002\u9996\u5148\u9700\u8981\u786e\u4fdd\u7cfb\u7edf\u5df2\u7ecf\u5b89\u88c5\u4e86auditd\u3002<\/p>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> auditd audispd-plugins <span class=\"token parameter variable\">-y<\/span><\/p>\n<h5>1.2 \u542f\u52a8\u5e76\u542f\u7528auditd\u670d\u52a1<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl start auditd<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> auditd<\/p>\n<h4>2. \u914d\u7f6eauditd\u89c4\u5219<\/h4>\n<p>\u5ba1\u8ba1\u89c4\u5219\u5b9a\u4e49\u4e86\u54ea\u4e9b\u4e8b\u4ef6\u5c06\u88ab\u5ba1\u8ba1\u3002\u8fd9\u4e9b\u89c4\u5219\u901a\u5e38\u5199\u5165\/etc\/audit\/audit.rules\u6587\u4ef6\u4e2d\u3002<\/p>\n<h5>2.1 \u7f16\u8f91audit.rules\u6587\u4ef6<\/h5>\n<p>\u4f7f\u7528\u6587\u672c\u7f16\u8f91\u5668\u6253\u5f00\u914d\u7f6e\u6587\u4ef6&#xff1a;<\/p>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/audit\/audit.rules<\/p>\n<h5>2.2 \u6dfb\u52a0\u5ba1\u8ba1\u89c4\u5219<\/h5>\n<p>\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5e38\u89c1\u7684\u5ba1\u8ba1\u89c4\u5219\u793a\u4f8b&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u8bb0\u5f55\u6240\u6709\u7528\u6237\u767b\u5f55\u4e8b\u4ef6&#xff1a;<\/p>\n<p> -w \/var\/log\/lastlog -p wa -k login\n <\/li>\n<li>\n<p>\u8bb0\u5f55\u6240\u6709\u6210\u529f\u548c\u5931\u8d25\u7684sudo\u547d\u4ee4&#xff1a;<\/p>\n<p> -w \/var\/log\/auth.log -p wa -k sudo<br \/>\n-w \/var\/log\/authpriv.log -p wa -k sudo\n <\/li>\n<li>\n<p>\u8bb0\u5f55\u6240\u6709\u88ab\u4fee\u6539\u7684\u6587\u4ef6&#xff08;\u4f8b\u5982&#xff1a;\/etc\/passwd&#xff09;&#xff1a;<\/p>\n<p> -w \/etc\/passwd -p wa -k passwd_modifications\n <\/li>\n<\/ul>\n<h4>3. \u7ba1\u7406\u5ba1\u8ba1\u65e5\u5fd7<\/h4>\n<p>\u5ba1\u8ba1\u65e5\u5fd7\u5b58\u50a8\u5728\/var\/log\/audit\/audit.log\u6587\u4ef6\u4e2d\u3002\u53ef\u4ee5\u4f7f\u7528ausearch\u548caureport\u7b49\u5de5\u5177\u6765\u67e5\u8be2\u548c\u751f\u6210\u5ba1\u8ba1\u62a5\u544a\u3002<\/p>\n<h5>3.1 \u67e5\u770b\u5b9e\u65f6\u5ba1\u8ba1\u65e5\u5fd7<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-f<\/span> \/var\/log\/audit\/audit.log<\/p>\n<h5>3.2 \u4f7f\u7528ausearch\u67e5\u8be2\u5ba1\u8ba1\u65e5\u5fd7<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> ausearch <span class=\"token parameter variable\">-k<\/span> login<\/p>\n<p>\u4e0a\u9762\u7684\u547d\u4ee4\u4f1a\u663e\u793a\u6240\u6709\u4e0e&#034;login&#034;\u5173\u952e\u5b57\u76f8\u5173\u7684\u5ba1\u8ba1\u6761\u76ee\u3002<\/p>\n<h5>3.3 \u4f7f\u7528aureport\u751f\u6210\u5ba1\u8ba1\u62a5\u544a<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> aureport <span class=\"token parameter variable\">-i<\/span> <span class=\"token parameter variable\">-m<\/span> <span class=\"token assign-left variable\">endtime<\/span><span class=\"token operator\">&#061;<\/span>now-60m,starttime<span class=\"token operator\">&#061;<\/span>now-1h <span class=\"token parameter variable\">-x<\/span> <span class=\"token parameter variable\">&#8211;summary<\/span><\/p>\n<p>\u8fd9\u4e2a\u547d\u4ee4\u751f\u6210\u8fc7\u53bb\u4e00\u5c0f\u65f6\u5185\u7684\u4e8b\u4ef6\u6458\u8981\u62a5\u544a\u3002<\/p>\n<h4>4. \u5b9a\u671f\u8f6e\u8f6c\u548c\u538b\u7f29\u5ba1\u8ba1\u65e5\u5fd7<\/h4>\n<p>\u4e3a\u4e86\u786e\u4fdd\u5ba1\u8ba1\u65e5\u5fd7\u4e0d\u4f1a\u5360\u7528\u8fc7\u591a\u7684\u78c1\u76d8\u7a7a\u95f4&#xff0c;\u53ef\u4ee5\u914d\u7f6e\u65e5\u5fd7\u8f6e\u8f6c\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7logrotate\u6765\u5b9e\u73b0\u3002<\/p>\n<h5>4.1 \u7f16\u8f91logrotate\u914d\u7f6e\u6587\u4ef6<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/logrotate.d\/audit<\/p>\n<h5>4.2 \u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u5230\u914d\u7f6e\u6587\u4ef6\u4e2d&#xff1a;<\/h5>\n<p>\/var\/log\/audit\/audit.log {<br \/>\n    daily<br \/>\n    rotate 7<br \/>\n    copytruncate<br \/>\n    compress<br \/>\n    missingok<br \/>\n    notifempty<br \/>\n}<\/p>\n<p>\u4e0a\u8ff0\u914d\u7f6e\u8868\u793a\u6bcf\u5929\u8f6e\u8f6c\u4e00\u6b21\u65e5\u5fd7&#xff0c;\u4fdd\u7559\u6700\u8fd17\u5929\u7684\u65e5\u5fd7&#xff0c;\u538b\u7f29\u65e7\u7684\u65e5\u5fd7\u6587\u4ef6\u3002<\/p>\n<h4>5. \u9a8c\u8bc1\u914d\u7f6e\u548c\u6d4b\u8bd5<\/h4>\n<p>\u6700\u540e\u4e00\u6b65\u662f\u9a8c\u8bc1\u914d\u7f6e\u662f\u5426\u6b63\u786e&#xff0c;\u5e76\u8fdb\u884c\u6d4b\u8bd5\u4ee5\u786e\u4fdd\u6240\u6709\u8bbe\u7f6e\u90fd\u6309\u9884\u671f\u5de5\u4f5c\u3002<\/p>\n<h5>5.1 \u91cd\u65b0\u52a0\u8f7dauditd\u914d\u7f6e<\/h5>\n<p>\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl restart auditd<\/p>\n<h5>5.2 \u6267\u884c\u4e00\u4e9b\u64cd\u4f5c\u5e76\u68c0\u67e5\u5ba1\u8ba1\u65e5\u5fd7<\/h5>\n<p>\u4f8b\u5982&#xff0c;\u4fee\u6539\/etc\/passwd\u6587\u4ef6&#xff0c;\u7136\u540e\u68c0\u67e5\u5ba1\u8ba1\u65e5\u5fd7\u662f\u5426\u8bb0\u5f55\u4e86\u8fd9\u4e00\u64cd\u4f5c&#xff1a;<\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;testuser:x:1001:1001::\/home\/testuser:\/bin\/bash&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/passwd <span class=\"token operator\">&gt;<\/span> \/dev\/null<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-f<\/span> \/var\/log\/audit\/audit.log <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> passwd_modifications<\/p>\n<p>\u5982\u679c\u4e00\u5207\u6b63\u5e38&#xff0c;\u4f60\u5e94\u8be5\u80fd\u770b\u5230\u76f8\u5173\u7684\u5ba1\u8ba1\u8bb0\u5f55\u3002<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u65e5\u5fd7\u5ba1\u8ba1&#xff0c;\u786e\u4fdd\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u548c\u53ef\u8ffd\u6eaf\u6027\u3002<\/p>\n<h3>20. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;&#xff1f;<\/h3>\n<p>\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;&#xff0c;\u53ef\u4ee5\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c&#xff1a;<\/p>\n<h4>1. \u9009\u62e9\u9002\u5408\u7684IDS\/IPS\u5de5\u5177<\/h4>\n<p>\u5e38\u89c1\u7684IDS\/IPS\u5de5\u5177\u5305\u62ec&#xff1a;<\/p>\n<ul>\n<li>Snort: \u5f00\u6e90\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\/\u9632\u5fa1\u7cfb\u7edf\u3002<\/li>\n<li>Suricata: \u53e6\u4e00\u4e2a\u5f00\u6e90\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u5f15\u64ce&#xff0c;\u652f\u6301IPS\u529f\u80fd\u3002<\/li>\n<li>Bro\/Zeek: \u7528\u4e8e\u7f51\u7edc\u6d41\u91cf\u5206\u6790\u7684\u5de5\u5177&#xff0c;\u4e5f\u5177\u5907\u4e00\u5b9a\u7684IDS\u529f\u80fd\u3002<\/li>\n<\/ul>\n<h4>2. \u5b89\u88c5\u548c\u57fa\u672c\u914d\u7f6e<\/h4>\n<p>\u4ee5Snort\u4e3a\u4f8b&#xff0c;\u4ee5\u4e0b\u662f\u5728Ubuntu\u7cfb\u7edf\u4e2d\u5b89\u88c5\u548c\u914d\u7f6e\u7684\u57fa\u672c\u6b65\u9aa4&#xff1a;<\/p>\n<h5>\u5b89\u88c5Snort<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> snort<\/p>\n<h5>\u542f\u52a8Snort\u670d\u52a1<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl start snort<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> snort<\/p>\n<h4>3. \u914d\u7f6e\u6587\u4ef6\u4fee\u6539<\/h4>\n<p>Snort\u7684\u4e3b\u8981\u914d\u7f6e\u6587\u4ef6\u662f\/etc\/snort\/snort.conf\u3002\u9700\u8981\u6839\u636e\u5177\u4f53\u9700\u6c42\u8fdb\u884c\u914d\u7f6e&#xff0c;\u4f8b\u5982\u8bbe\u7f6e\u7f51\u7edc\u63a5\u53e3\u3001\u6307\u5b9a\u89c4\u5219\u6587\u4ef6\u7b49\u3002<\/p>\n<p>\u793a\u4f8b\u914d\u7f6e&#xff1a;<\/p>\n<p># \u5b9a\u4e49\u7f51\u7edc\u53d8\u91cf<br \/>\nvar HOME_NET [192.168.1.0\/24]<br \/>\nvar EXTERNAL_NET any<\/p>\n<p># \u8bbe\u7f6e\u9884\u5904\u7406\u5668&#xff08;\u9884\u5904\u7406\u89c4\u5219&#xff09;<br \/>\npreprocessor frag3_global:<br \/>\n    fragment_size 500<br \/>\n    overlap_min 200<br \/>\n    overlap_max 300<br \/>\n    memcap 20000000<br \/>\n    expire_time 300<br \/>\n    check_overlaps yes<br \/>\n    check_fragments yes<\/p>\n<p># \u52a0\u8f7d\u89c4\u5219\u6587\u4ef6<br \/>\ninclude $RULE_PATH\/local.rules<\/p>\n<h4>4. \u914d\u7f6e\u89c4\u5219\u96c6<\/h4>\n<p>Snort\u4f7f\u7528\u89c4\u5219\u96c6\u6765\u5b9a\u4e49\u68c0\u6d4b\u548c\u9632\u5fa1\u7b56\u7565\u3002\u89c4\u5219\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e\/etc\/snort\/rules\u76ee\u5f55\u4e0b\u3002\u53ef\u4ee5\u6839\u636e\u9700\u6c42\u81ea\u5b9a\u4e49\u89c4\u5219\u6216\u4e0b\u8f7d\u793e\u533a\u63d0\u4f9b\u7684\u89c4\u5219\u96c6\u3002<\/p>\n<p>\u793a\u4f8b\u89c4\u5219&#xff1a;<\/p>\n<p>alert tcp any any -&gt; $HOME_NET 80 (msg:&#034;Possible SQL Injection Attack&#034;; flow:to_server,established; uricontent:&#034;union&#034;; nocase; classtype:web-application-attack; sid:1000001; rev:1;)<\/p>\n<h4>5. \u65e5\u5fd7\u548c\u62a5\u544a<\/h4>\n<p>Snort\u53ef\u4ee5\u5c06\u68c0\u6d4b\u7ed3\u679c\u8bb0\u5f55\u5230\u6587\u4ef6\u4e2d\u6216\u53d1\u9001\u5230\u5176\u4ed6\u65e5\u5fd7\u7ba1\u7406\u7cfb\u7edf&#xff08;\u5982Syslog&#xff09;\u3002\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539\u914d\u7f6e\u6587\u4ef6\u4e2d\u7684\u8f93\u51fa\u63d2\u4ef6\u6765\u5b9e\u73b0\u3002<\/p>\n<p>\u793a\u4f8b\u914d\u7f6e&#xff1a;<\/p>\n<p>output alert_fast: logdir\/alerts.ids<br \/>\noutput log_tcp: tcp, 192.168.1.100:5000<br \/>\noutput unified2: filename snort.log, limit 128MB<\/p>\n<h4>6. \u6d4b\u8bd5\u548c\u8c03\u8bd5<\/h4>\n<p>\u786e\u4fddSnort\u6b63\u5e38\u8fd0\u884c\u5e76\u6309\u9884\u671f\u5de5\u4f5c\u540e&#xff0c;\u53ef\u4ee5\u8fdb\u884c\u4e00\u4e9b\u6d4b\u8bd5\u548c\u8c03\u8bd5\u3002\u53ef\u4ee5\u4f7f\u7528\u6a21\u62df\u653b\u51fb\u5de5\u5177&#xff08;\u5982hping3\u3001nmap\u7b49&#xff09;\u751f\u6210\u6d41\u91cf&#xff0c;\u89c2\u5bdfSnort\u7684\u53cd\u5e94\u3002<\/p>\n<p>\u793a\u4f8b\u6d4b\u8bd5\u547d\u4ee4&#xff1a;<\/p>\n<p>hping3 <span class=\"token parameter variable\">-V<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token number\">10<\/span> <span class=\"token parameter variable\">-d<\/span> <span class=\"token number\">100<\/span> <span class=\"token parameter variable\">-p<\/span> <span class=\"token number\">80<\/span> <span class=\"token parameter variable\">&#8211;syn<\/span> <span class=\"token number\">192.168<\/span>.1.100 <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;sendto&#034;<\/span><\/p>\n<h4>7. \u76d1\u63a7\u548c\u7ef4\u62a4<\/h4>\n<p>\u5b9a\u671f\u68c0\u67e5Snort\u7684\u65e5\u5fd7\u6587\u4ef6&#xff0c;\u66f4\u65b0\u89c4\u5219\u96c6&#xff0c;\u5e76\u6839\u636e\u5b89\u5168\u9700\u6c42\u8c03\u6574\u914d\u7f6e\u3002\u53ef\u4ee5\u4f7f\u7528\u81ea\u52a8\u5316\u811a\u672c\u6216\u76d1\u63a7\u7cfb\u7edf&#xff08;\u5982Nagios\u3001Zabbix&#xff09;\u6765\u7b80\u5316\u7ba1\u7406\u8fc7\u7a0b\u3002<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;\u3002\u6839\u636e\u5177\u4f53\u9700\u6c42\u548c\u73af\u5883&#xff0c;\u53ef\u80fd\u9700\u8981\u8fdb\u4e00\u6b65\u8c03\u6574\u548c\u4f18\u5316\u914d\u7f6e\u3002<\/p>\n<h3>21. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u589e\u5f3a\u5de5\u5177&#xff08;\u5982grsecurity&#xff09;&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u589e\u5f3a\u5de5\u5177&#xff08;\u5982grsecurity&#xff09;\u53ef\u4ee5\u663e\u8457\u63d0\u9ad8\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002\u4e0b\u9762\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff0c;\u5e2e\u52a9\u4f60\u5b8c\u6210\u8fd9\u4e00\u4efb\u52a1\u3002<\/p>\n<h4>1. \u4e86\u89e3grsecurity<\/h4>\n<p>grsecurity\u662f\u4e00\u4e2a\u9488\u5bf9Linux\u5185\u6838\u7684\u5b89\u5168\u8865\u4e01\u96c6&#xff0c;\u65e8\u5728\u589e\u5f3a\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002\u5b83\u63d0\u4f9b\u4e86\u591a\u79cd\u5b89\u5168\u529f\u80fd&#xff0c;\u5305\u62ec\u5730\u5740\u7a7a\u95f4\u5e03\u5c40\u968f\u673a\u5316&#xff08;ASLR&#xff09;\u3001\u975e\u6267\u884c\u5806\u6808&#xff08;NX&#xff09;\u3001\u6307\u9488\u6df7\u6dc6\u3001\u6808\u4fdd\u62a4\u7b49\u3002<\/p>\n<h4>2. \u5b89\u88c5\u4f9d\u8d56\u5305<\/h4>\n<p>\u5728\u5f00\u59cb\u4e4b\u524d&#xff0c;\u786e\u4fdd\u4f60\u7684\u7cfb\u7edf\u5df2\u7ecf\u5b89\u88c5\u4e86\u5fc5\u8981\u7684\u7f16\u8bd1\u5de5\u5177\u548c\u5e93\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> build-essential libncurses5-dev bison flex libssl-dev makedeb<\/p>\n<h4>3. \u83b7\u53d6Linux\u5185\u6838\u6e90\u7801<\/h4>\n<p>\u4f60\u9700\u8981\u4e0b\u8f7d\u9002\u7528\u4e8e\u4f60\u7cfb\u7edf\u7684Linux\u5185\u6838\u6e90\u7801\u4ee5\u53ca\u76f8\u5e94\u7684grsecurity\u8865\u4e01\u3002<\/p>\n<p><span class=\"token function\">wget<\/span> http:\/\/kernel.ubuntu.com\/~kernel-ppa\/mainline\/v5.4.17\/linux-5.4.17.tar.xz<br \/>\n<span class=\"token function\">wget<\/span> https:\/\/github.com\/PaX-Projects\/GRSecurity\/archive\/master.zip<\/p>\n<h4>4. \u89e3\u538b\u5e76\u5e94\u7528\u8865\u4e01<\/h4>\n<p>\u89e3\u538b\u4e0b\u8f7d\u7684\u5185\u6838\u6e90\u7801\u548cgrsecurity\u8865\u4e01\u3002<\/p>\n<p><span class=\"token function\">tar<\/span> <span class=\"token parameter variable\">-xf<\/span> linux-5.4.17.tar.xz<br \/>\n<span class=\"token function\">unzip<\/span> master.zip<br \/>\n<span class=\"token builtin class-name\">cd<\/span> GRSecurity-master<\/p>\n<p>\u5c06grsecurity\u8865\u4e01\u5e94\u7528\u5230\u5185\u6838\u6e90\u7801\u4e2d\u3002<\/p>\n<p>patch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/base\/base.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/base\/base-4.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/arch\/x86\/configs\/x86_64.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax-4.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax-x86_64.diff<\/p>\n<h4>5. \u7f16\u8bd1\u5e76\u5b89\u88c5\u5185\u6838<\/h4>\n<p>\u8fdb\u5165\u5185\u6838\u6e90\u7801\u76ee\u5f55&#xff0c;\u5f00\u59cb\u914d\u7f6e\u3001\u7f16\u8bd1\u548c\u5b89\u88c5\u65b0\u7684\u5185\u6838\u3002<\/p>\n<p><span class=\"token builtin class-name\">cd<\/span> <span class=\"token punctuation\">..<\/span>\/linux-5.4.17<br \/>\n<span class=\"token function\">make<\/span> menuconfig<\/p>\n<p>\u5728\u83dc\u5355\u914d\u7f6e\u754c\u9762\u4e2d&#xff0c;\u52a0\u8f7dgrsecurity\u63d0\u4f9b\u7684.config\u6587\u4ef6&#xff1a;<\/p>\n<p>Load &#8211;<span class=\"token operator\">&gt;<\/span> <span class=\"token punctuation\">..<\/span>\/GRSecurity-master\/base-configs\/config-4.14-x86_64-grsec<\/p>\n<p>\u4fdd\u5b58\u5e76\u9000\u51fa\u914d\u7f6e\u754c\u9762\u540e&#xff0c;\u5f00\u59cb\u7f16\u8bd1\u5185\u6838\u3002<\/p>\n<p><span class=\"token function\">make<\/span> -j<span class=\"token variable\"><span class=\"token variable\">$(<\/span>nproc<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">make<\/span> modules_install<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">make<\/span> <span class=\"token function\">install<\/span><\/p>\n<h4>6. \u66f4\u65b0GRUB\u914d\u7f6e<\/h4>\n<p>\u66f4\u65b0GRUB\u914d\u7f6e\u4ee5\u4f7f\u7528\u65b0\u5185\u6838\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">update-grub<\/span><\/p>\n<p>\u91cd\u542f\u7cfb\u7edf\u4ee5\u5e94\u7528\u65b0\u5185\u6838\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">reboot<\/span><\/p>\n<h4>7. \u9a8c\u8bc1grsecurity\u662f\u5426\u751f\u6548<\/h4>\n<p>\u91cd\u542f\u540e&#xff0c;\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u68c0\u67e5\u65b0\u5185\u6838\u662f\u5426\u5305\u542bgrsecurity\u6a21\u5757&#xff1a;<\/p>\n<p>lsmod <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> pax_modules<\/p>\n<p>\u5982\u679c\u770b\u5230\u7c7b\u4f3cpax_modules\u7684\u8f93\u51fa&#xff0c;\u8bf4\u660egrsecurity\u5df2\u6210\u529f\u52a0\u8f7d\u3002<\/p>\n<h4>\u793a\u4f8b\u603b\u7ed3<\/h4>\n<p>\u4ee5\u4e0b\u662f\u5b8c\u6574\u7684\u64cd\u4f5c\u6d41\u7a0b\u793a\u4f8b&#xff1a;<\/p>\n<p><span class=\"token comment\"># 1. \u5b89\u88c5\u4f9d\u8d56\u5305<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> build-essential libncurses5-dev bison flex libssl-dev makedeb<\/p>\n<p><span class=\"token comment\"># 2. \u83b7\u53d6Linux\u5185\u6838\u6e90\u7801\u548cgrsecurity\u8865\u4e01<\/span><br \/>\n<span class=\"token function\">wget<\/span> http:\/\/kernel.ubuntu.com\/~kernel-ppa\/mainline\/v5.4.17\/linux-5.4.17.tar.xz<br \/>\n<span class=\"token function\">wget<\/span> https:\/\/github.com\/PaX-Projects\/GRSecurity\/archive\/master.zip<\/p>\n<p><span class=\"token comment\"># 3. \u89e3\u538b\u5e76\u5e94\u7528\u8865\u4e01<\/span><br \/>\n<span class=\"token function\">tar<\/span> <span class=\"token parameter variable\">-xf<\/span> linux-5.4.17.tar.xz<br \/>\n<span class=\"token function\">unzip<\/span> master.zip<br \/>\n<span class=\"token builtin class-name\">cd<\/span> GRSecurity-master<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/base\/base.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/base\/base-4.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/arch\/x86\/configs\/x86_64.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax-4.diff<br \/>\npatch <span class=\"token parameter variable\">-p1<\/span> <span class=\"token operator\">&lt;<\/span> <span class=\"token punctuation\">..<\/span>\/grsecurity\/common\/configs\/pro\/pax-x86_64.diff<\/p>\n<p><span class=\"token comment\"># 4. \u7f16\u8bd1\u5e76\u5b89\u88c5\u5185\u6838<\/span><br \/>\n<span class=\"token builtin class-name\">cd<\/span> <span class=\"token punctuation\">..<\/span>\/linux-5.4.17<br \/>\n<span class=\"token function\">make<\/span> menuconfig<br \/>\n<span class=\"token comment\"># \u5728\u83dc\u5355\u914d\u7f6e\u754c\u9762\u4e2d&#xff0c;\u52a0\u8f7d grsecurity \u63d0\u4f9b\u7684 .config \u6587\u4ef6:<\/span><br \/>\n<span class=\"token comment\"># Load -&gt; ..\/GRSecurity-master\/base-configs\/config-4.14-x86_64-grsec<\/span><br \/>\n<span class=\"token function\">make<\/span> -j<span class=\"token variable\"><span class=\"token variable\">$(<\/span>nproc<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">make<\/span> modules_install<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">make<\/span> <span class=\"token function\">install<\/span><\/p>\n<p><span class=\"token comment\"># 5. \u66f4\u65b0GRUB\u914d\u7f6e\u5e76\u91cd\u542f\u7cfb\u7edf<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">update-grub<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">reboot<\/span><\/p>\n<p><span class=\"token comment\"># 6. \u9a8c\u8bc1grsecurity\u662f\u5426\u751f\u6548<\/span><br \/>\nlsmod <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> pax_modules<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u5e94\u8be5\u80fd\u591f\u6210\u529f\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528grsecurity&#xff0c;\u4ece\u800c\u63d0\u5347\u7cfb\u7edf\u7684\u6574\u4f53\u5b89\u5168\u6027\u3002<\/p>\n<h3>22. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u7ba1\u7406\u7528\u6237\u6743\u9650\u548c\u8bbf\u95ee\u63a7\u5236&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u7ba1\u7406\u7528\u6237\u6743\u9650\u548c\u8bbf\u95ee\u63a7\u5236\u662f\u786e\u4fdd\u7cfb\u7edf\u5b89\u5168\u7684\u91cd\u8981\u90e8\u5206\u3002\u4ee5\u4e0b\u662f\u5982\u4f55\u8fdb\u884c\u7ba1\u7406\u7684\u8be6\u7ec6\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u6dfb\u52a0\u3001\u5220\u9664\u548c\u4fee\u6539\u7528\u6237<\/h4>\n<h5>\u6dfb\u52a0\u7528\u6237<\/h5>\n<p>\u4f7f\u7528useradd\u547d\u4ee4\u53ef\u4ee5\u6dfb\u52a0\u65b0\u7528\u6237\u3002\u4f8b\u5982&#xff0c;\u8981\u6dfb\u52a0\u4e00\u4e2a\u540d\u4e3anewuser\u7684\u7528\u6237&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">useradd<\/span> newuser<\/p>\n<h5>\u5220\u9664\u7528\u6237<\/h5>\n<p>\u4f7f\u7528userdel\u547d\u4ee4\u53ef\u4ee5\u5220\u9664\u7528\u6237\u3002\u4f8b\u5982&#xff0c;\u8981\u5220\u9664\u4e00\u4e2a\u540d\u4e3aolduser\u7684\u7528\u6237&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">userdel<\/span> olduser<\/p>\n<p>\u5982\u679c\u8fd8\u9700\u8981\u5220\u9664\u7528\u6237\u7684\u4e3b\u76ee\u5f55&#xff0c;\u53ef\u4ee5\u4f7f\u7528-r\u9009\u9879&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">userdel<\/span> <span class=\"token parameter variable\">-r<\/span> olduser<\/p>\n<h5>\u4fee\u6539\u7528\u6237\u4fe1\u606f<\/h5>\n<p>\u4f7f\u7528usermod\u547d\u4ee4\u53ef\u4ee5\u4fee\u6539\u73b0\u6709\u7528\u6237\u7684\u4fe1\u606f\u3002\u4f8b\u5982&#xff0c;\u8981\u4fee\u6539newuser\u7684\u767b\u5f55shell\u4e3a\/bin\/zsh&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">usermod<\/span> <span class=\"token parameter variable\">-s<\/span> \/bin\/zsh newuser<\/p>\n<h4>2. \u7ba1\u7406\u7528\u6237\u7ec4<\/h4>\n<h5>\u521b\u5efa\u7528\u6237\u7ec4<\/h5>\n<p>\u4f7f\u7528groupadd\u547d\u4ee4\u53ef\u4ee5\u521b\u5efa\u65b0\u7684\u7528\u6237\u7ec4\u3002\u4f8b\u5982&#xff0c;\u8981\u521b\u5efa\u4e00\u4e2a\u540d\u4e3adevelopers\u7684\u7528\u6237\u7ec4&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">groupadd<\/span> developers<\/p>\n<h5>\u6dfb\u52a0\u7528\u6237\u5230\u7ec4<\/h5>\n<p>\u4f7f\u7528usermod\u547d\u4ee4\u53ef\u4ee5\u5c06\u7528\u6237\u6dfb\u52a0\u5230\u7ec4\u4e2d\u3002\u4f8b\u5982&#xff0c;\u8981\u5c06newuser\u6dfb\u52a0\u5230developers\u7ec4&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">usermod<\/span> <span class=\"token parameter variable\">-aG<\/span> developers newuser<\/p>\n<h4>3. \u8bbe\u7f6e\u6587\u4ef6\u548c\u76ee\u5f55\u6743\u9650<\/h4>\n<h5>\u66f4\u6539\u6587\u4ef6\u6216\u76ee\u5f55\u7684\u6240\u6709\u8005<\/h5>\n<p>\u4f7f\u7528chown\u547d\u4ee4\u53ef\u4ee5\u66f4\u6539\u6587\u4ef6\u6216\u76ee\u5f55\u7684\u6240\u6709\u8005\u3002\u4f8b\u5982&#xff0c;\u8981\u5c06\u6587\u4ef6example.txt\u7684\u6240\u6709\u8005\u6539\u4e3anewuser&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">chown<\/span> newuser example.txt<\/p>\n<p>\u8981\u9012\u5f52\u5730\u66f4\u6539\u76ee\u5f55\u53ca\u5176\u5185\u5bb9\u7684\u6240\u6709\u8005&#xff0c;\u53ef\u4ee5\u4f7f\u7528-R\u9009\u9879&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">chown<\/span> <span class=\"token parameter variable\">-R<\/span> newuser:developers \/path\/to\/directory<\/p>\n<h5>\u66f4\u6539\u6587\u4ef6\u6216\u76ee\u5f55\u7684\u6743\u9650<\/h5>\n<p>\u4f7f\u7528chmod\u547d\u4ee4\u53ef\u4ee5\u66f4\u6539\u6587\u4ef6\u6216\u76ee\u5f55\u7684\u6743\u9650\u3002\u4f8b\u5982&#xff0c;\u8981\u7ed9\u4e88\u6240\u6709\u7528\u6237\u5bf9\u6587\u4ef6example.txt\u7684\u8bfb\u53d6\u6743\u9650&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">chmod<\/span> a&#043;r example.txt<\/p>\n<p>\u8981\u7ed9\u4e88\u6240\u6709\u8005\u8bfb\u5199\u6267\u884c\u6743\u9650&#xff0c;\u4f46\u53ea\u7ed9\u4e88\u5176\u4ed6\u7528\u6237\u8bfb\u53d6\u6743\u9650&#xff0c;\u53ef\u4ee5\u4f7f\u7528&#xff1a;<\/p>\n<p><span class=\"token function\">chmod<\/span> <span class=\"token number\">744<\/span> example.txt<\/p>\n<h4>4. \u4f7f\u7528ACL&#xff08;\u8bbf\u95ee\u63a7\u5236\u5217\u8868&#xff09;<\/h4>\n<h5>\u8bbe\u7f6eACL<\/h5>\n<p>\u4f7f\u7528setfacl\u547d\u4ee4\u53ef\u4ee5\u4e3a\u6587\u4ef6\u6216\u76ee\u5f55\u8bbe\u7f6e\u66f4\u7ec6\u7c92\u5ea6\u7684\u6743\u9650\u3002\u4f8b\u5982&#xff0c;\u8981\u4e3a\u7528\u6237alice\u6388\u4e88\u5bf9\u6587\u4ef6example.txt\u7684\u8bfb\u53d6\u548c\u5199\u5165\u6743\u9650&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p>setfacl <span class=\"token parameter variable\">-m<\/span> u:alice:rw example.txt<\/p>\n<p>\u8981\u9012\u5f52\u5730\u8bbe\u7f6e\u76ee\u5f55\u53ca\u5176\u5185\u5bb9\u7684ACL&#xff0c;\u53ef\u4ee5\u4f7f\u7528-R\u9009\u9879&#xff1a;<\/p>\n<p>setfacl <span class=\"token parameter variable\">-R<\/span> <span class=\"token parameter variable\">-m<\/span> u:alice:rw \/path\/to\/directory<\/p>\n<h5>\u67e5\u770bACL<\/h5>\n<p>\u4f7f\u7528getfacl\u547d\u4ee4\u53ef\u4ee5\u67e5\u770b\u6587\u4ef6\u6216\u76ee\u5f55\u7684ACL\u3002\u4f8b\u5982&#xff0c;\u8981\u67e5\u770b\u6587\u4ef6example.txt\u7684ACL&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4&#xff1a;<\/p>\n<p>getfacl example.txt<\/p>\n<h4>5. sudoers \u6587\u4ef6\u914d\u7f6e<\/h4>\n<h5>\u7f16\u8f91sudoers\u6587\u4ef6<\/h5>\n<p>\u4f7f\u7528visudo\u547d\u4ee4\u53ef\u4ee5\u5b89\u5168\u5730\u7f16\u8f91\/etc\/sudoers\u6587\u4ef6\u3002\u4f8b\u5982&#xff0c;\u8981\u6388\u4e88\u7528\u6237newuser\u65e0\u5bc6\u7801\u7684sudo\u6743\u9650&#xff0c;\u53ef\u4ee5\u5728\u6587\u4ef6\u4e2d\u6dfb\u52a0\u5982\u4e0b\u884c&#xff1a;<\/p>\n<p>newuser ALL&#061;(ALL) NOPASSWD: ALL<\/p>\n<p>\u4fdd\u5b58\u5e76\u9000\u51fa\u7f16\u8f91\u5668\u540e&#xff0c;\u65b0\u7684sudo\u914d\u7f6e\u5c06\u7acb\u5373\u751f\u6548\u3002<\/p>\n<p>\u4ee5\u4e0a\u662f\u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u7ba1\u7406\u7528\u6237\u6743\u9650\u548c\u8bbf\u95ee\u63a7\u5236\u7684\u8be6\u7ec6\u6b65\u9aa4\u548c\u793a\u4f8b\u3002\u901a\u8fc7\u8fd9\u4e9b\u65b9\u6cd5&#xff0c;\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u63a7\u5236\u7528\u6237\u5bf9\u7cfb\u7edf\u7684\u8bbf\u95ee\u6743\u9650&#xff0c;\u4ece\u800c\u63d0\u5347\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u548c\u7ba1\u7406\u6548\u7387\u3002<\/p>\n<h3>23. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u52a0\u5bc6\u6587\u4ef6\u7cfb\u7edf&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u52a0\u5bc6\u6587\u4ef6\u7cfb\u7edf\u53ef\u4ee5\u901a\u8fc7\u591a\u79cd\u65b9\u5f0f\u5b9e\u73b0&#xff0c;\u5176\u4e2d\u6700\u5e38\u89c1\u548c\u63a8\u8350\u7684\u65b9\u5f0f\u662f\u4f7f\u7528dm-crypt\u548cLUKS&#xff08;Linux Unified Key Setup&#xff09;\u3002\u4e0b\u9762\u6211\u5c06\u8be6\u7ec6\u89e3\u91ca\u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u52a0\u5bc6\u6587\u4ef6\u7cfb\u7edf&#xff0c;\u5e76\u63d0\u4f9b\u4e00\u4e9b\u793a\u4f8b\u3002<\/p>\n<h4>1. \u51c6\u5907\u5de5\u4f5c<\/h4>\n<p>\u786e\u4fdd\u4f60\u7684\u7cfb\u7edf\u5df2\u7ecf\u5b89\u88c5\u4e86\u5fc5\u8981\u7684\u8f6f\u4ef6\u5305&#xff0c;\u5982cryptsetup\u3001lvm2\u7b49\u3002\u4f60\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u5b89\u88c5\u8fd9\u4e9b\u8f6f\u4ef6\u5305&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> cryptsetup lvm2<\/p>\n<h4>2. \u521b\u5efa\u52a0\u5bc6\u5206\u533a<\/h4>\n<p>\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u521b\u5efa\u4e00\u4e2a\u672a\u5206\u914d\u7684\u5206\u533a\u7528\u4e8e\u52a0\u5bc6\u3002\u4f60\u53ef\u4ee5\u4f7f\u7528fdisk\u6216parted\u5de5\u5177\u6765\u521b\u5efa\u65b0\u7684\u5206\u533a\u3002\u4f8b\u5982&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">fdisk<\/span> \/dev\/sdX<\/p>\n<p>\u5047\u8bbe\u65b0\u521b\u5efa\u7684\u5206\u533a\u4e3a\/dev\/sdX1\u3002<\/p>\n<h4>3. \u8bbe\u7f6e\u52a0\u5bc6\u5377<\/h4>\n<p>\u4f7f\u7528cryptsetup\u547d\u4ee4\u5c06\u65b0\u521b\u5efa\u7684\u5206\u533a\u521d\u59cb\u5316\u4e3a\u4e00\u4e2a\u52a0\u5bc6\u7269\u7406\u5377&#xff08;PV&#xff09;&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> cryptsetup luksFormat \/dev\/sdX1<\/p>\n<p>\u7cfb\u7edf\u4f1a\u63d0\u793a\u4f60\u8f93\u5165\u5e76\u786e\u8ba4\u4e00\u4e2a\u5bc6\u7801\u3002\u8bf7\u8bb0\u4f4f\u8fd9\u4e2a\u5bc6\u7801&#xff0c;\u56e0\u4e3a\u89e3\u5bc6\u65f6\u9700\u8981\u7528\u5230\u5b83\u3002<\/p>\n<h4>4. \u6253\u5f00\u52a0\u5bc6\u5377<\/h4>\n<p>\u63a5\u4e0b\u6765&#xff0c;\u4f7f\u7528cryptsetup open\u547d\u4ee4\u6253\u5f00\u52a0\u5bc6\u5377&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> cryptsetup <span class=\"token function\">open<\/span> \/dev\/sdX1 my_encrypted_volume<\/p>\n<p>\u8fd9\u5c06\u521b\u5efa\u4e00\u4e2a\u8bbe\u5907\u6620\u5c04&#xff0c;\u6bd4\u5982\/dev\/mapper\/my_encrypted_volume\u3002<\/p>\n<h4>5. \u521b\u5efa\u6587\u4ef6\u7cfb\u7edf<\/h4>\n<p>\u5728\u6253\u5f00\u7684\u52a0\u5bc6\u5377\u4e0a\u521b\u5efa\u6587\u4ef6\u7cfb\u7edf\u3002\u4f8b\u5982&#xff0c;\u521b\u5efa\u4e00\u4e2aext4\u6587\u4ef6\u7cfb\u7edf&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> mkfs.ext4 \/dev\/mapper\/my_encrypted_volume<\/p>\n<h4>6. \u6302\u8f7d\u6587\u4ef6\u7cfb\u7edf<\/h4>\n<p>\u521b\u5efa\u4e00\u4e2a\u6302\u8f7d\u70b9\u5e76\u5c06\u6587\u4ef6\u7cfb\u7edf\u6302\u8f7d\u5230\u8be5\u6302\u8f7d\u70b9&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">mkdir<\/span> \/mnt\/my_encrypted_volume<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">mount<\/span> \/dev\/mapper\/my_encrypted_volume \/mnt\/my_encrypted_volume<\/p>\n<p>\u73b0\u5728\u4f60\u53ef\u4ee5\u8bbf\u95ee\/mnt\/my_encrypted_volume&#xff0c;\u5e76\u4e14\u6240\u6709\u6570\u636e\u90fd\u4f1a\u88ab\u52a0\u5bc6\u5b58\u50a8\u3002<\/p>\n<h4>7. \u914d\u7f6e\u81ea\u52a8\u6302\u8f7d&#xff08;\u53ef\u9009&#xff09;<\/h4>\n<p>\u4e3a\u4e86\u65b9\u4fbf\u8d77\u89c1&#xff0c;\u53ef\u4ee5\u5728\/etc\/crypttab\u4e2d\u6dfb\u52a0\u4e00\u884c\u6765\u914d\u7f6e\u5f00\u673a\u81ea\u52a8\u89e3\u9501\u548c\u6302\u8f7d&#xff1a;<\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#039;my_encrypted_volume \/dev\/sdX1 none luks&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/crypttab<\/p>\n<p>\u7136\u540e\u5728\/etc\/fstab\u4e2d\u6dfb\u52a0\u4e00\u884c\u6765\u914d\u7f6e\u81ea\u52a8\u6302\u8f7d\u6587\u4ef6\u7cfb\u7edf&#xff1a;<\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#039;\/dev\/mapper\/my_encrypted_volume \/mnt\/my_encrypted_volume ext4 defaults 0 2&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/fstab<\/p>\n<h4>8. \u5173\u95ed\u52a0\u5bc6\u5377<\/h4>\n<p>\u5982\u679c\u4f60\u4e0d\u518d\u9700\u8981\u8bbf\u95ee\u52a0\u5bc6\u5377&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5c06\u5176\u5173\u95ed&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> cryptsetup close my_encrypted_volume<\/p>\n<h4>\u793a\u4f8b\u603b\u7ed3<\/h4>\n<p>\u4ee5\u4e0b\u662f\u4e00\u4e2a\u5b8c\u6574\u7684\u793a\u4f8b\u6d41\u7a0b&#xff1a;<\/p>\n<li>\n<p>\u521b\u5efa\u5206\u533a&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">fdisk<\/span> \/dev\/sdX<\/p>\n<p>\u521b\u5efa\u5206\u533a\/dev\/sdX1\u3002<\/p>\n<\/li>\n<li>\n<p>\u521d\u59cb\u5316\u52a0\u5bc6\u5377&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> cryptsetup luksFormat \/dev\/sdX1<\/p>\n<p>\u8f93\u5165\u5e76\u786e\u8ba4\u5bc6\u7801\u3002<\/p>\n<\/li>\n<li>\n<p>\u6253\u5f00\u52a0\u5bc6\u5377&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> cryptsetup <span class=\"token function\">open<\/span> \/dev\/sdX1 my_encrypted_volume\n <\/li>\n<li>\n<p>\u521b\u5efa\u6587\u4ef6\u7cfb\u7edf&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> mkfs.ext4 \/dev\/mapper\/my_encrypted_volume\n <\/li>\n<li>\n<p>\u6302\u8f7d\u6587\u4ef6\u7cfb\u7edf&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">mkdir<\/span> \/mnt\/my_encrypted_volume<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">mount<\/span> \/dev\/mapper\/my_encrypted_volume \/mnt\/my_encrypted_volume\n <\/li>\n<li>\n<p>\u914d\u7f6e\u81ea\u52a8\u6302\u8f7d&#xff08;\u53ef\u9009&#xff09;&#xff1a;<\/p>\n<p> <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#039;my_encrypted_volume \/dev\/sdX1 none luks&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/crypttab<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#039;\/dev\/mapper\/my_encrypted_volume \/mnt\/my_encrypted_volume ext4 defaults 0 2&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/fstab\n <\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528\u52a0\u5bc6\u6587\u4ef6\u7cfb\u7edf\u3002<\/p>\n<h3>24. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528VPN&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528VPN&#xff08;\u865a\u62df\u4e13\u7528\u7f51\u7edc&#xff09;\u53ef\u4ee5\u901a\u8fc7\u591a\u79cd\u65b9\u5f0f\u5b9e\u73b0&#xff0c;\u5177\u4f53\u53d6\u51b3\u4e8e\u4f60\u4f7f\u7528\u7684VPN\u534f\u8bae\u548c\u9700\u6c42\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5e38\u89c1\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u4f7f\u7528OpenVPN\u914d\u7f6eVPN<\/h4>\n<h5>\u5b89\u88c5OpenVPN\u53caeasy-rsa\u5de5\u5177<\/h5>\n<p>\u9996\u5148\u9700\u8981\u5b89\u88c5OpenVPN\u8f6f\u4ef6\u5305\u548ceasy-rsa\u5de5\u5177\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> openvpn easy-rsa <span class=\"token parameter variable\">-y<\/span><\/p>\n<h5>\u751f\u6210\u8bc1\u4e66\u548c\u5bc6\u94a5<\/h5>\n<p>\u63a5\u4e0b\u6765&#xff0c;\u4f7f\u7528easy-rsa\u751f\u6210\u670d\u52a1\u5668\u548c\u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u53ca\u5bc6\u94a5\u3002<\/p>\n<p><span class=\"token comment\"># \u8bbe\u7f6e\u73af\u5883\u53d8\u91cf<\/span><br \/>\nmake-cadir ~\/openvpn-ca<br \/>\n<span class=\"token builtin class-name\">cd<\/span> ~\/openvpn-ca<\/p>\n<p><span class=\"token comment\"># \u7f16\u8f91vars\u6587\u4ef6&#xff0c;\u8bbe\u7f6e\u56fd\u5bb6\u3001\u7701\u4efd\u7b49\u4fe1\u606f<\/span><br \/>\n<span class=\"token function\">vim<\/span> vars<\/p>\n<p><span class=\"token comment\"># \u751f\u6210CA\u79c1\u94a5\u548c\u81ea\u7b7e\u540d\u6839\u8bc1\u4e66<\/span><br \/>\n<span class=\"token builtin class-name\">source<\/span> vars<br \/>\n.\/clean-all<br \/>\n.\/build-ca<\/p>\n<p><span class=\"token comment\"># \u751f\u6210\u670d\u52a1\u7aef\u79c1\u94a5\u548c\u8bc1\u4e66<\/span><br \/>\n.\/build-key-server server<\/p>\n<p><span class=\"token comment\"># \u751f\u6210Diffie-Hellman\u53c2\u6570<\/span><br \/>\n.\/build-dh<\/p>\n<p><span class=\"token comment\"># \u751f\u6210HMAC\u7b7e\u540d\u5bc6\u94a5<\/span><br \/>\n.\/build-hmac<\/p>\n<h5>\u914d\u7f6eOpenVPN\u670d\u52a1\u7aef<\/h5>\n<p>\u521b\u5efa\u5e76\u7f16\u8f91OpenVPN\u914d\u7f6e\u6587\u4ef6\/etc\/openvpn\/server.conf\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">vim<\/span> \/etc\/openvpn\/server.conf<\/p>\n<p>\u793a\u4f8b\u914d\u7f6e\u6587\u4ef6\u5185\u5bb9\u5982\u4e0b&#xff1a;<\/p>\n<p>port 1194<br \/>\nproto udp<br \/>\ndev tun<br \/>\nca ca.crt<br \/>\ncert server.crt<br \/>\nkey server.key<br \/>\ndh dh2048.pem<br \/>\nserver 10.8.0.0 255.255.255.0<br \/>\nifconfig-pool-persist ipp.txt<br \/>\nkeepalive 10 120<br \/>\ncipher AES-256-CBC<br \/>\nuser nobody<br \/>\ngroup nogroup<br \/>\npersist-key<br \/>\npersist-tun<br \/>\nstatus openvpn-status.log<br \/>\nverb 3<\/p>\n<h5>\u542f\u52a8OpenVPN\u670d\u52a1<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl start openvpn&#064;server<br \/>\n<span class=\"token function\">sudo<\/span> systemcv <span class=\"token builtin class-name\">enable<\/span> openvpn&#064;server<\/p>\n<h4>2. \u4f7f\u7528WireGuard\u914d\u7f6eVPN<\/h4>\n<h5>\u5b89\u88c5WireGuard<\/h5>\n<p>\u9996\u5148\u9700\u8981\u5b89\u88c5WireGuard\u8f6f\u4ef6\u5305\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> wireguard <span class=\"token parameter variable\">-y<\/span><\/p>\n<h5>\u751f\u6210\u5bc6\u94a5\u5bf9<\/h5>\n<p>\u751f\u6210\u670d\u52a1\u7aef\u548c\u5ba2\u6237\u7aef\u7684\u516c\u79c1\u94a5\u5bf9\u3002<\/p>\n<p><span class=\"token comment\"># \u751f\u6210\u670d\u52a1\u7aef\u79c1\u94a5<\/span><br \/>\nwg genkey <span class=\"token operator\">|<\/span> <span class=\"token function\">tee<\/span> privatekey <span class=\"token operator\">|<\/span> wg pubkey <span class=\"token operator\">&gt;<\/span> publickey<\/p>\n<p><span class=\"token comment\"># \u751f\u6210\u5ba2\u6237\u7aef\u79c1\u94a5<\/span><br \/>\nwg genkey <span class=\"token operator\">|<\/span> <span class=\"token function\">tee<\/span> client-privatekey <span class=\"token operator\">|<\/span> wg pubkey <span class=\"token operator\">&gt;<\/span> client-publickey<\/p>\n<h5>\u914d\u7f6eWireGuard\u670d\u52a1\u7aef<\/h5>\n<p>\u521b\u5efa\u5e76\u7f16\u8f91WireGuard\u914d\u7f6e\u6587\u4ef6\/etc\/wireguard\/wg0.conf\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">vim<\/span> \/etc\/wireguard\/wg0.conf<\/p>\n<p>\u793a\u4f8b\u914d\u7f6e\u6587\u4ef6\u5185\u5bb9\u5982\u4e0b&#xff1a;<\/p>\n<p>[Interface]<br \/>\nPrivateKey &#061; &lt;\u670d\u52a1\u7aef\u79c1\u94a5&gt;<br \/>\nAddress &#061; 10.0.0.1\/24<br \/>\nListenPort &#061; 51820<br \/>\nPostUp &#061; iptables-restore &lt;(iptables-save)<br \/>\nPostDown &#061; iptables-restore &lt;(iptables-save)<\/p>\n<p>[Peer]<br \/>\nPublicKey &#061; &lt;\u5ba2\u6237\u7aef\u516c\u94a5&gt;<br \/>\nAllowedIPs &#061; 10.0.0.2\/32, fddd:db8::\/64<\/p>\n<h5>\u542f\u52a8WireGuard\u670d\u52a1<\/h5>\n<p><span class=\"token function\">sudo<\/span> wg-quick up wg0<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> wg-quick&#064;wg0<\/p>\n<h4>3. \u5ba2\u6237\u7aef\u914d\u7f6e<\/h4>\n<p>\u65e0\u8bba\u662fOpenVPN\u8fd8\u662fWireGuard&#xff0c;\u5ba2\u6237\u7aef\u90fd\u9700\u8981\u76f8\u5e94\u7684\u914d\u7f6e\u6587\u4ef6\u6765\u8fde\u63a5\u3002\u4ee5\u4e0b\u662fWireGuard\u5ba2\u6237\u7aef\u914d\u7f6e\u6587\u4ef6\u7684\u793a\u4f8b\u3002<\/p>\n<p>[Interface]<br \/>\nPrivateKey &#061; &lt;\u5ba2\u6237\u7aef\u79c1\u94a5&gt;<br \/>\nAddress &#061; 10.0.0.2\/24, fddd:db8::\/64<\/p>\n<p>[Peer]<br \/>\nPublicKey &#061; &lt;\u670d\u52a1\u7aef\u516c\u94a5&gt;<br \/>\nEndpoint &#061; &lt;\u670d\u52a1\u5668IP\u5730\u5740&gt;:51820<br \/>\nAllowedIPs &#061; 0.0.0.0\/0, ::\/0<\/p>\n<p>\u5c06\u6b64\u914d\u7f6e\u6587\u4ef6\u4fdd\u5b58\u4e3a\u4f8b\u5982client.conf&#xff0c;\u7136\u540e\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u542f\u52a8WireGuard\u5ba2\u6237\u7aef\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> wg-quick up client<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u5c31\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528VPN\u4e86\u3002\u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u5408\u9002\u7684VPN\u534f\u8bae\u548c\u914d\u7f6e\u65b9\u6cd5\u3002<\/p>\n<h3>25. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528SSL\/TLS\u52a0\u5bc6\u901a\u4fe1&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528SSL\/TLS\u52a0\u5bc6\u901a\u4fe1\u662f\u4e00\u9879\u5e38\u89c1\u7684\u4efb\u52a1&#xff0c;\u7279\u522b\u662f\u5728\u9700\u8981\u786e\u4fdd\u6570\u636e\u5b89\u5168\u4f20\u8f93\u7684\u573a\u666f\u4e2d\u3002\u4e0b\u9762\u6211\u5c06\u8be6\u7ec6\u8bf4\u660e\u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528SSL\/TLS\u52a0\u5bc6\u901a\u4fe1&#xff0c;\u5e76\u63d0\u4f9b\u793a\u4f8b\u3002<\/p>\n<h4>1. \u751f\u6210SSL\/TLS\u8bc1\u4e66\u548c\u79c1\u94a5<\/h4>\n<p>\u9996\u5148&#xff0c;\u60a8\u9700\u8981\u751f\u6210SSL\/TLS\u8bc1\u4e66\u548c\u79c1\u94a5\u3002\u8fd9\u901a\u5e38\u901a\u8fc7OpenSSL\u5de5\u5177\u6765\u5b8c\u6210\u3002<\/p>\n<h5>\u6b65\u9aa4&#xff1a;<\/h5>\n<li>\n<p>\u5b89\u88c5OpenSSL&#xff08;\u5982\u679c\u5c1a\u672a\u5b89\u88c5&#xff09;&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> openssl\n <\/li>\n<li>\n<p>\u751f\u6210\u79c1\u94a5&#xff1a;<\/p>\n<p> openssl genpkey <span class=\"token parameter variable\">-algorithm<\/span> RSA <span class=\"token parameter variable\">-out<\/span> server.key <span class=\"token parameter variable\">-aes256<\/span><\/p>\n<p>\u8fd9\u5c06\u751f\u6210\u4e00\u4e2a\u540d\u4e3aserver.key\u7684RSA\u79c1\u94a5\u6587\u4ef6&#xff0c;\u5e76\u4f7f\u7528AES-256\u8fdb\u884c\u52a0\u5bc6\u3002<\/p>\n<\/li>\n<li>\n<p>\u751f\u6210\u8bc1\u4e66\u7b7e\u540d\u8bf7\u6c42&#xff08;CSR&#xff09;&#xff1a;<\/p>\n<p> openssl req <span class=\"token parameter variable\">-new<\/span> <span class=\"token parameter variable\">-key<\/span> server.key <span class=\"token parameter variable\">-out<\/span> server.csr<\/p>\n<p>\u6309\u7167\u63d0\u793a\u8f93\u5165\u76f8\u5173\u4fe1\u606f&#xff0c;\u5982\u56fd\u5bb6\u3001\u7ec4\u7ec7\u540d\u79f0\u7b49\u3002<\/p>\n<\/li>\n<li>\n<p>\u81ea\u7b7e\u7f72\u8bc1\u4e66&#xff1a;<\/p>\n<p> openssl x509 <span class=\"token parameter variable\">-req<\/span> <span class=\"token parameter variable\">-days<\/span> <span class=\"token number\">365<\/span> <span class=\"token parameter variable\">-in<\/span> server.csr <span class=\"token parameter variable\">-signkey<\/span> server.key <span class=\"token parameter variable\">-out<\/span> server.crt<\/p>\n<p>\u8fd9\u5c06\u751f\u6210\u4e00\u4e2a\u6709\u6548\u671f\u4e3a365\u5929\u7684\u81ea\u7b7e\u7f72\u8bc1\u4e66server.crt\u3002<\/p>\n<\/li>\n<h4>2. \u914d\u7f6eWeb\u670d\u52a1\u5668\u4ee5\u4f7f\u7528SSL\/TLS<\/h4>\n<p>\u5047\u8bbe\u60a8\u4f7f\u7528\u7684\u662fApache\u6216Nginx Web\u670d\u52a1\u5668\u3002<\/p>\n<h5>\u5bf9\u4e8eApache&#xff1a;<\/h5>\n<li>\n<p>\u542f\u7528mod_ssl\u6a21\u5757&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> a2enmod ssl<br \/>\n<span class=\"token function\">sudo<\/span> systemctl restart apache2\n <\/li>\n<li>\n<p>\u7f16\u8f91Apache\u914d\u7f6e\u6587\u4ef6&#xff1a; \u6253\u5f00\/etc\/apache2\/sites-available\/default-ssl.conf\u6587\u4ef6&#xff0c;\u5e76\u8fdb\u884c\u4ee5\u4e0b\u4fee\u6539&#xff1a;<\/p>\n<p> &lt;IfModule mod_ssl.c&gt;<br \/>\n    &lt;VirtualHost _default_:443&gt;<br \/>\n        ServerAdmin webmaster&#064;localhost<br \/>\n        DocumentRoot \/var\/www\/html<br \/>\n        SSLEngine on<br \/>\n        SSLCertificateFile      \/etc\/ssl\/certs\/server.crt<br \/>\n        SSLCertificateKeyFile   \/etc\/ssl\/private\/server.key<br \/>\n        &lt;FilesMatch &#034;\\\\.(cgi|shtml|phtml|php)$&#034;&gt;<br \/>\n            SSLOptions &#043;StdEnvVars<br \/>\n        &lt;\/FilesMatch&gt;<br \/>\n        &lt;Directory \/usr\/lib\/cgi-bin&gt;<br \/>\n            SSLOptions &#043;StdEnvVars<br \/>\n        &lt;\/Directory&gt;<br \/>\n        &#8230;<br \/>\n    &lt;\/VirtualHost&gt;<br \/>\n&lt;\/IfModule&gt;\n <\/li>\n<li>\n<p>\u91cd\u542fApache\u670d\u52a1&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl restart apache2\n <\/li>\n<h5>\u5bf9\u4e8eNginx&#xff1a;<\/h5>\n<li>\n<p>\u7f16\u8f91Nginx\u914d\u7f6e\u6587\u4ef6&#xff1a; \u6253\u5f00\/etc\/nginx\/sites-available\/default\u6587\u4ef6&#xff0c;\u5e76\u8fdb\u884c\u4ee5\u4e0b\u4fee\u6539&#xff1a;<\/p>\n<p> server {<br \/>\n    listen 80 default_server;<br \/>\n    listen [::]:80 default_server;<br \/>\n    server_name _;<br \/>\n    location \/ {<br \/>\n        proxy_pass http:\/\/localhost:8080;<br \/>\n        proxy_set_header Host $host;<br \/>\n        proxy_set_header X-Real-IP $remote_addr;<br \/>\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<br \/>\n        proxy_set_header X-Forwarded-Proto $scheme;<br \/>\n    }<br \/>\n}<\/p>\n<p>server {<br \/>\n    listen 443 ssl default_server;<br \/>\n    listen [::]:443 ssl default_server;<br \/>\n    server_name _;<br \/>\n    ssl_certificate \/etc\/ssl\/certs\/server.crt;<br \/>\n    ssl_certificate_key \/etc\/ssl\/private\/server.key;<br \/>\n    &#8230;<br \/>\n    location \/ {<br \/>\n        proxy_pass http:\/\/localhost:8080;<br \/>\n        proxy_set_header Host $host;<br \/>\n        proxy_set_header X-Real-IP $remote_addr;<br \/>\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<br \/>\n        proxy_set_header X-Forwarded-Proto $scheme;<br \/>\n    }<br \/>\n}\n <\/li>\n<li>\n<p>\u6d4b\u8bd5Nginx\u914d\u7f6e&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> nginx <span class=\"token parameter variable\">-t<\/span>\n <\/li>\n<li>\n<p>\u5982\u679c\u914d\u7f6e\u6b63\u786e&#xff0c;\u91cd\u542fNginx\u670d\u52a1&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl restart nginx\n <\/li>\n<h4>3. \u9a8c\u8bc1SSL\/TLS\u8bbe\u7f6e<\/h4>\n<p>\u6700\u540e&#xff0c;\u9a8c\u8bc1\u60a8\u7684Web\u670d\u52a1\u5668\u662f\u5426\u6210\u529f\u914d\u7f6e\u4e86SSL\/TLS\u3002<\/p>\n<li>\u4f7f\u7528\u6d4f\u89c8\u5668\u8bbf\u95ee\u60a8\u7684\u7f51\u7ad9&#xff0c;\u4f8b\u5982https:\/\/your_domain_or_IP\u3002<\/li>\n<li>\u67e5\u770b\u6d4f\u89c8\u5668\u5730\u5740\u680f\u4e2d\u7684\u9501\u5f62\u56fe\u6807&#xff0c;\u70b9\u51fb\u4ee5\u67e5\u770b\u8bc1\u4e66\u8be6\u60c5\u3002<\/li>\n<li>\u4f7f\u7528\u547d\u4ee4\u884c\u5de5\u5177curl\u68c0\u67e5&#xff1a;<span class=\"token function\">curl<\/span> <span class=\"token parameter variable\">-I<\/span> https:\/\/your_domain_or_IP<br \/>\n \u5982\u679c\u8fd4\u56de\u7684\u54cd\u5e94\u5934\u4fe1\u606f\u5305\u542bHTTP\/1.1 200 OK&#xff0c;\u5219\u8bf4\u660eSSL\/TLS\u914d\u7f6e\u6210\u529f\u3002<\/li>\n<p>\u901a\u8fc7\u4e0a\u8ff0\u6b65\u9aa4&#xff0c;\u60a8\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528SSL\/TLS\u52a0\u5bc6\u901a\u4fe1&#xff0c;\u4ee5\u786e\u4fdd\u6570\u636e\u4f20\u8f93\u7684\u5b89\u5168\u6027\u3002<\/p>\n<h3>26. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u66f4\u65b0\u548c\u8865\u4e01\u7ba1\u7406&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u66f4\u65b0\u548c\u8865\u4e01\u7ba1\u7406&#xff0c;\u662f\u786e\u4fdd\u7cfb\u7edf\u5b89\u5168\u7684\u91cd\u8981\u6b65\u9aa4\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u64cd\u4f5c\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u68c0\u67e5\u5e76\u66f4\u65b0\u8f6f\u4ef6\u5305\u7d22\u5f15<\/h4>\n<p>\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u786e\u4fdd\u7cfb\u7edf\u80fd\u591f\u83b7\u53d6\u6700\u65b0\u7684\u5b89\u5168\u66f4\u65b0\u548c\u8865\u4e01\u4fe1\u606f\u3002<\/p>\n<h5>\u547d\u4ee4&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update  <span class=\"token comment\"># \u5bf9\u4e8e\u57fa\u4e8eDebian\u7684\u7cfb\u7edf&#xff0c;\u5982Ubuntu<\/span><br \/>\n<span class=\"token function\">sudo<\/span> yum check-update <span class=\"token comment\"># \u5bf9\u4e8e\u57fa\u4e8eRedHat\u7684\u7cfb\u7edf&#xff0c;\u5982CentOS<\/span><\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<\/p>\n<h4>2. \u81ea\u52a8\u66f4\u65b0\u914d\u7f6e<\/h4>\n<p>\u914d\u7f6e\u7cfb\u7edf\u81ea\u52a8\u4e0b\u8f7d\u5e76\u5e94\u7528\u5b89\u5168\u66f4\u65b0&#xff0c;\u53ef\u4ee5\u8282\u7701\u624b\u52a8\u66f4\u65b0\u7684\u65f6\u95f4&#xff0c;\u5e76\u51cf\u5c11\u9057\u6f0f\u7684\u98ce\u9669\u3002<\/p>\n<h5>\u57fa\u4e8eDebian\u7cfb\u7edf&#xff08;\u5982Ubuntu&#xff09;&#xff1a;<\/h5>\n<p>\u7f16\u8f91 \/etc\/apt\/apt.conf.d\/20auto-upgrades \u6587\u4ef6&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/apt\/apt.conf.d\/20auto-upgrades<\/p>\n<p>\u6dfb\u52a0\u6216\u4fee\u6539\u5982\u4e0b\u5185\u5bb9&#xff1a;<\/p>\n<p>APT::Periodic::Update-Package-Lists &#034;1&#034;;<br \/>\nAPT::Periodic::Unattended-Upgrade &#034;1&#034;;<\/p>\n<p>\u4fdd\u5b58\u5e76\u9000\u51fa\u3002<\/p>\n<h5>\u57fa\u4e8eRedHat\u7cfb\u7edf&#xff08;\u5982CentOS&#xff09;&#xff1a;<\/h5>\n<p>\u5b89\u88c5 yum-cron \u670d\u52a1&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> yum-cron<\/p>\n<p>\u542f\u7528\u5e76\u542f\u52a8 yum-cron \u670d\u52a1&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> yum-cron<br \/>\n<span class=\"token function\">sudo<\/span> systemctl start yum-cron<\/p>\n<h4>3. \u624b\u52a8\u5e94\u7528\u66f4\u65b0<\/h4>\n<p>\u6709\u65f6\u4f60\u53ef\u80fd\u5e0c\u671b\u624b\u52a8\u68c0\u67e5\u548c\u5e94\u7528\u66f4\u65b0\u3002<\/p>\n<h5>\u57fa\u4e8eDebian\u7cfb\u7edf&#xff08;\u5982Ubuntu&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> upgrade   <span class=\"token comment\"># \u4ec5\u5347\u7ea7\u5df2\u5b89\u88c5\u7684\u8f6f\u4ef6\u5305<\/span><br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> dist-upgrade  <span class=\"token comment\"># \u5347\u7ea7\u6240\u6709\u8f6f\u4ef6\u5305&#xff0c;\u5305\u62ec\u79fb\u9664\u8fc7\u65f6\u7684\u8f6f\u4ef6\u5305<\/span><\/p>\n<h5>\u57fa\u4e8eRedHat\u7cfb\u7edf&#xff08;\u5982CentOS&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> yum update<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> upgrade<\/p>\n<h4>4. \u5b89\u5168\u8865\u4e01\u9a8c\u8bc1<\/h4>\n<p>\u5728\u5e94\u7528\u66f4\u65b0\u4e4b\u524d&#xff0c;\u6700\u597d\u5148\u9a8c\u8bc1\u8fd9\u4e9b\u66f4\u65b0\u662f\u5426\u786e\u5b9e\u89e3\u51b3\u4e86\u5df2\u77e5\u7684\u5b89\u5168\u6f0f\u6d1e\u3002<\/p>\n<h5>\u4f7f\u7528 unattended-upgrades \u65e5\u5fd7&#xff1a;<\/h5>\n<p>\u67e5\u770b \/var\/log\/unattended-upgrades\/ \u4e0b\u7684\u65e5\u5fd7\u6587\u4ef6&#xff0c;\u4e86\u89e3\u6700\u8fd1\u5e94\u7528\u4e86\u54ea\u4e9b\u66f4\u65b0\u3002<\/p>\n<p><span class=\"token function\">cat<\/span> \/var\/log\/unattended-upgrades\/unattended-upgrades.log<\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p><span class=\"token function\">cat<\/span> \/var\/log\/unattended-upgrades\/unattended-upgrades.log<\/p>\n<h4>5. \u5b9a\u671f\u5ba1\u8ba1\u548c\u76d1\u63a7<\/h4>\n<p>\u5b9a\u671f\u68c0\u67e5\u7cfb\u7edf\u65e5\u5fd7\u548c\u5e94\u7528\u7684\u5b89\u5168\u8865\u4e01\u60c5\u51b5&#xff0c;\u4ee5\u786e\u4fdd\u6ca1\u6709\u9057\u6f0f\u7684\u66f4\u65b0\u3002<\/p>\n<h5>\u67e5\u770b\u5df2\u5b89\u88c5\u7684\u66f4\u65b0&#xff1a;<\/h5>\n<p>dpkg <span class=\"token parameter variable\">-l<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token string\">&#039;linux-image&#039;<\/span> <span class=\"token comment\"># \u67e5\u770b\u5185\u6838\u66f4\u65b0<\/span><br \/>\ndpkg <span class=\"token parameter variable\">-l<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token string\">&#039;security&#039;<\/span>    <span class=\"token comment\"># \u67e5\u770b\u4e0e\u5b89\u5168\u76f8\u5173\u7684\u66f4\u65b0<\/span><\/p>\n<h5>\u793a\u4f8b&#xff1a;<\/h5>\n<p>dpkg <span class=\"token parameter variable\">-l<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token string\">&#039;security&#039;<\/span><\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6709\u6548\u5730\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u66f4\u65b0\u548c\u8865\u4e01\u7ba1\u7406&#xff0c;\u4ece\u800c\u63d0\u5347\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u548c\u7a33\u5b9a\u6027\u3002<\/p>\n<h3>27. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u9632\u75c5\u6bd2\u8f6f\u4ef6&#xff1f;<\/h3>\n<h4>1. \u9009\u62e9\u5408\u9002\u7684\u9632\u75c5\u6bd2\u8f6f\u4ef6<\/h4>\n<p>\u5728Linux\u4e2d&#xff0c;\u6709\u591a\u79cd\u9632\u75c5\u6bd2\u8f6f\u4ef6\u53ef\u4f9b\u9009\u62e9&#xff0c;\u5982ClamAV\u3001Sophos Anti-Virus for Linux\u3001Comodo Antivirus for Linux\u7b49\u3002\u4ee5\u4e0b\u662f\u4f7f\u7528ClamAV\u4f5c\u4e3a\u793a\u4f8b\u7684\u6b65\u9aa4\u3002<\/p>\n<h4>2. \u5b89\u88c5ClamAV<\/h4>\n<h5>2.1 \u66f4\u65b0\u7cfb\u7edf\u5305\u5217\u8868<\/h5>\n<p>\u9996\u5148&#xff0c;\u786e\u4fdd\u4f60\u7684\u7cfb\u7edf\u5305\u5217\u8868\u662f\u6700\u65b0\u7684&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update   <span class=\"token comment\"># Debian\/Ubuntu<\/span><br \/>\n<span class=\"token function\">sudo<\/span> yum check-update   <span class=\"token comment\"># CentOS\/RHEL<\/span><br \/>\n<span class=\"token function\">sudo<\/span> dnf check-update   <span class=\"token comment\"># Fedora<\/span><\/p>\n<h5>2.2 \u5b89\u88c5ClamAV\u53ca\u5176\u76f8\u5173\u5de5\u5177<\/h5>\n<p>\u63a5\u4e0b\u6765&#xff0c;\u5b89\u88c5ClamAV\u53ca\u5176\u76f8\u5173\u7684\u5de5\u5177&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> clamav clamav-daemon   <span class=\"token comment\"># Debian\/Ubuntu<\/span><br \/>\n<span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> clamav clamav-scanner   <span class=\"token comment\"># CentOS\/RHEL<\/span><br \/>\n<span class=\"token function\">sudo<\/span> dnf <span class=\"token function\">install<\/span> clamav clamav-scanner   <span class=\"token comment\"># Fedora<\/span><\/p>\n<h4>3. \u914d\u7f6eClamAV<\/h4>\n<h5>3.1 \u914d\u7f6eClamd\u5b88\u62a4\u8fdb\u7a0b&#xff08;\u53ef\u9009&#xff09;<\/h5>\n<p>\u5982\u679c\u4f60\u5e0c\u671bClamAV\u4ee5\u5b88\u62a4\u8fdb\u7a0b\u6a21\u5f0f\u8fd0\u884c&#xff0c;\u53ef\u4ee5\u7f16\u8f91\u914d\u7f6e\u6587\u4ef6\/etc\/clamav\/freshclam.conf&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/clamav\/freshclam.conf<\/p>\n<p>\u786e\u4fdd\u4ee5\u4e0b\u884c\u672a\u88ab\u6ce8\u91ca\u6389&#xff1a;<\/p>\n<p>ScanArchive&#061;yes<br \/>\nScanPE&#061;yes<br \/>\nScanOLE2&#061;yes<br \/>\nAllowDangerousFiles&#061;no<br \/>\nScanELFs&#061;yes<br \/>\nMaxRecursionDepth&#061;10<br \/>\nMaxFileSize&#061;100M<br \/>\nMaxDirectorySize&#061;500M<br \/>\nFollowSymbolicLinks&#061;yes<\/p>\n<p>\u4fdd\u5b58\u5e76\u5173\u95ed\u6587\u4ef6\u3002<\/p>\n<h5>3.2 \u542f\u52a8\u548c\u542f\u7528clamd\u670d\u52a1<\/h5>\n<p>\u542f\u52a8clamd\u5b88\u62a4\u8fdb\u7a0b\u5e76\u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u542f&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl start clamd   <span class=\"token comment\"># \u542f\u52a8clamd<\/span><br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> clamd   <span class=\"token comment\"># \u8bbe\u7f6e\u5f00\u673a\u81ea\u542f<\/span><\/p>\n<h4>4. \u66f4\u65b0\u75c5\u6bd2\u5e93<\/h4>\n<p>\u5b9a\u671f\u66f4\u65b0\u75c5\u6bd2\u5b9a\u4e49\u5e93\u662f\u975e\u5e38\u91cd\u8981\u7684&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> freshclam   <span class=\"token comment\"># \u4e0b\u8f7d\u6700\u65b0\u7684\u75c5\u6bd2\u5b9a\u4e49\u5e93<\/span><\/p>\n<p>\u4f60\u53ef\u4ee5\u5c06\u8fd9\u4e2a\u547d\u4ee4\u6dfb\u52a0\u5230crontab\u4e2d&#xff0c;\u4ee5\u4fbf\u5b9a\u65f6\u6267\u884c&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-e<\/span><\/p>\n<p>\u6dfb\u52a0\u4ee5\u4e0b\u884c\u4ee5\u6bcf\u5929\u66f4\u65b0\u4e00\u6b21\u75c5\u6bd2\u5b9a\u4e49\u5e93&#xff1a;<\/p>\n<p>0 3 * * * \/usr\/bin\/freshclam<\/p>\n<p>\u4fdd\u5b58\u5e76\u9000\u51fa\u7f16\u8f91\u5668\u3002<\/p>\n<h4>5. \u626b\u63cf\u6587\u4ef6\u548c\u76ee\u5f55<\/h4>\n<p>\u4f7f\u7528ClamAV\u626b\u63cf\u6587\u4ef6\u548c\u76ee\u5f55&#xff1a;<\/p>\n<p>clamscan <span class=\"token parameter variable\">-r<\/span> \/path\/to\/directory   <span class=\"token comment\"># \u9012\u5f52\u626b\u63cf\u6307\u5b9a\u76ee\u5f55<\/span><br \/>\nclamscan \/path\/to\/file           <span class=\"token comment\"># \u626b\u63cf\u5355\u4e2a\u6587\u4ef6<\/span><\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>clamscan <span class=\"token parameter variable\">-r<\/span> \/home\/user\/Documents   <span class=\"token comment\"># \u9012\u5f52\u626b\u63cf\u7528\u6237\u7684\u6587\u6863\u76ee\u5f55<\/span><br \/>\nclamscan \/var\/log\/syslog          <span class=\"token comment\"># \u626b\u63cf\u7cfb\u7edf\u65e5\u5fd7\u6587\u4ef6<\/span><\/p>\n<h4>6. \u67e5\u770b\u626b\u63cf\u7ed3\u679c<\/h4>\n<p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b&#xff0c;ClamAV\u4f1a\u8f93\u51fa\u626b\u63cf\u7ed3\u679c\u5230\u7ec8\u7aef\u3002\u4f60\u4e5f\u53ef\u4ee5\u91cd\u5b9a\u5411\u8f93\u51fa\u5230\u4e00\u4e2a\u6587\u4ef6\u4e2d&#xff1a;<\/p>\n<p>clamscan <span class=\"token parameter variable\">-r<\/span> \/home\/user\/Documents <span class=\"token operator\">&gt;<\/span> scan_results.txt<\/p>\n<h4>7. \u914d\u7f6e\u81ea\u52a8\u90ae\u4ef6\u901a\u77e5&#xff08;\u53ef\u9009&#xff09;<\/h4>\n<p>\u4f60\u53ef\u4ee5\u901a\u8fc7\u4fee\u6539\/etc\/clamav\/local.conf\u6765\u914d\u7f6e\u81ea\u52a8\u90ae\u4ef6\u901a\u77e5&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/clamav\/local.conf<\/p>\n<p>\u627e\u5230\u5e76\u4fee\u6539\u4ee5\u4e0b\u90e8\u5206&#xff1a;<\/p>\n<p>EmailReport virus&#064;example.com,admin&#064;example.com   # \u66ff\u6362\u4e3a\u4f60\u7684\u90ae\u7bb1\u5730\u5740<\/p>\n<p>\u4fdd\u5b58\u5e76\u5173\u95ed\u6587\u4ef6\u3002<\/p>\n<h4>8. \u603b\u7ed3<\/h4>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u5df2\u7ecf\u6210\u529f\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u5e76\u4f7f\u7528\u4e86ClamAV\u9632\u75c5\u6bd2\u8f6f\u4ef6\u3002\u5b9a\u671f\u66f4\u65b0\u75c5\u6bd2\u5b9a\u4e49\u5e93\u5e76\u6267\u884c\u626b\u63cf\u4efb\u52a1&#xff0c;\u53ef\u4ee5\u6709\u6548\u4fdd\u62a4\u7cfb\u7edf\u5b89\u5168\u3002<\/p>\n<h3>28. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;\u662f\u786e\u4fdd\u7f51\u7edc\u5b89\u5168\u7684\u4e00\u9879\u91cd\u8981\u4efb\u52a1\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff0c;\u4ee5\u5e2e\u52a9\u4f60\u5b8c\u6210\u8fd9\u4e00\u4efb\u52a1\u3002<\/p>\n<h4>\u4e00\u3001\u9009\u62e9\u9002\u5408\u7684IDS\/IPS\u5de5\u5177<\/h4>\n<h5>1. Snort<\/h5>\n<p>Snort\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u548c\u9632\u5fa1\u7cfb\u7edf&#xff0c;\u652f\u6301\u591a\u79cd\u534f\u8bae&#xff0c;\u5305\u62ecTCP\u3001UDP\u548cICMP\u7b49\u3002<\/p>\n<h5>2. Suricata<\/h5>\n<p>Suricata\u662f\u4e00\u4e2a\u9ad8\u6027\u80fd\u7684\u7f51\u7edc\u5a01\u80c1\u68c0\u6d4b\u5f15\u64ce&#xff0c;\u652f\u6301IDS\u3001IPS\u548c\u5b89\u5168\u76d1\u63a7\u3002<\/p>\n<h4>\u4e8c\u3001\u5b89\u88c5\u548c\u914d\u7f6eSnort<\/h4>\n<h5>1. \u5b89\u88c5Snort<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> snort<\/p>\n<h5>2. \u57fa\u672c\u914d\u7f6e<\/h5>\n<p>\u914d\u7f6e\u6587\u4ef6\u4f4d\u4e8e \/etc\/snort\/snort.conf\u3002\u4f60\u9700\u8981\u7f16\u8f91\u8fd9\u4e2a\u6587\u4ef6\u6765\u6ee1\u8db3\u4f60\u7684\u9700\u6c42\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/snort\/snort.conf<\/p>\n<h6>\u914d\u7f6e\u793a\u4f8b&#xff1a;<\/h6>\n<p># \u8bbe\u7f6e\u7f51\u7edc\u53d8\u91cf<br \/>\nvar HOME_NET [192.168.1.0\/24]<\/p>\n<p># \u8bbe\u7f6e\u89c4\u5219\u8def\u5f84<br \/>\nrule_path \/etc\/snort\/rules<\/p>\n<p># \u8f93\u51fa\u914d\u7f6e<br \/>\noutput alert_syslog:LOG_LOCAL0<br \/>\noutput log_tcp:\/var\/log\/snort\/tcp.log<\/p>\n<h5>3. \u542f\u52a8Snort<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl start snort<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> snort<\/p>\n<h4>\u4e09\u3001\u5b89\u88c5\u548c\u914d\u7f6eSuricata<\/h4>\n<h5>1. \u5b89\u88c5Suricata<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> suricata<\/p>\n<h5>2. \u57fa\u672c\u914d\u7f6e<\/h5>\n<p>\u914d\u7f6e\u6587\u4ef6\u4f4d\u4e8e \/etc\/suricata\/suricata.yaml\u3002\u4f60\u9700\u8981\u7f16\u8f91\u8fd9\u4e2a\u6587\u4ef6\u6765\u6ee1\u8db3\u4f60\u7684\u9700\u6c42\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/suricata\/suricata.yaml<\/p>\n<h6>\u914d\u7f6e\u793a\u4f8b&#xff1a;<\/h6>\n<p><span class=\"token comment\"># Network variables<\/span><br \/>\n<span class=\"token key atrule\">home-net<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">[<\/span>192.168.1.0\/24<span class=\"token punctuation\">]<\/span><\/p>\n<p><span class=\"token comment\"># Rules directory<\/span><br \/>\n<span class=\"token key atrule\">rule-files<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string\">&#034;\/etc\/suricata\/rules&#034;<\/span><span class=\"token punctuation\">]<\/span><\/p>\n<p><span class=\"token comment\"># Output options<\/span><br \/>\n<span class=\"token key atrule\">alert-outputs<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string\">&#034;file:\/var\/log\/suricata\/alert.log&#034;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">&#034;afpacket&#034;<\/span><span class=\"token punctuation\">]<\/span><br \/>\n<span class=\"token key atrule\">eve-log<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string\">&#034;file:\/var\/log\/suricata\/eve.json&#034;<\/span><span class=\"token punctuation\">]<\/span><\/p>\n<h5>3. \u542f\u52a8Suricata<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl start suricata<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> suricata<\/p>\n<h4>\u56db\u3001\u65e5\u5fd7\u5206\u6790\u4e0e\u7ba1\u7406<\/h4>\n<h5>1. \u67e5\u770b\u65e5\u5fd7\u6587\u4ef6<\/h5>\n<p>Snort\u65e5\u5fd7\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e \/var\/log\/snort&#xff0c;Suricata\u65e5\u5fd7\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e \/var\/log\/suricata\u3002\u4f60\u53ef\u4ee5\u4f7f\u7528 cat, less \u6216 tail \u547d\u4ee4\u67e5\u770b\u8fd9\u4e9b\u65e5\u5fd7\u6587\u4ef6\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-f<\/span> \/var\/log\/snort\/alert.ids<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-f<\/span> \/var\/log\/suricata\/alert.log<\/p>\n<h4>\u4e94\u3001\u5b9a\u671f\u66f4\u65b0\u89c4\u5219\u5e93<\/h4>\n<p>\u4e3a\u4e86\u4fdd\u6301\u7cfb\u7edf\u7684\u6709\u6548\u6027&#xff0c;\u5b9a\u671f\u66f4\u65b0IDS\/IPS\u7684\u89c4\u5219\u5e93\u662f\u975e\u5e38\u91cd\u8981\u7684\u3002<\/p>\n<h5>1. \u66f4\u65b0Snort\u89c4\u5219\u5e93<\/h5>\n<p><span class=\"token function\">sudo<\/span> snortrules-update <span class=\"token parameter variable\">&#8211;reload<\/span><\/p>\n<h5>2. \u66f4\u65b0Suricata\u89c4\u5219\u5e93<\/h5>\n<p><span class=\"token function\">sudo<\/span> suricatagrep <span class=\"token parameter variable\">-u<\/span><\/p>\n<h4>\u516d\u3001\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1<\/h4>\n<h5>1. \u751f\u6210\u6d41\u91cf\u8fdb\u884c\u6d4b\u8bd5<\/h5>\n<p>\u4f7f\u7528\u5de5\u5177\u5982 hping3 \u6216 tcpreplay \u751f\u6210\u7f51\u7edc\u6d41\u91cf\u6765\u6d4b\u8bd5\u4f60\u7684IDS\/IPS\u914d\u7f6e\u662f\u5426\u6b63\u786e\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt<\/span> <span class=\"token function\">install<\/span> hping3<br \/>\nhping3 <span class=\"token parameter variable\">-V<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token number\">5<\/span> <span class=\"token parameter variable\">-d<\/span> <span class=\"token number\">100<\/span> <span class=\"token parameter variable\">-p<\/span> <span class=\"token number\">80<\/span> <span class=\"token number\">192.168<\/span>.1.1<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf&#xff08;IDS&#xff09;\u548c\u5165\u4fb5\u9632\u5fa1\u7cfb\u7edf&#xff08;IPS&#xff09;\u3002\u8bf7\u6839\u636e\u4f60\u7684\u5177\u4f53\u9700\u6c42\u548c\u73af\u5883\u8fdb\u884c\u8c03\u6574\u548c\u4f18\u5316\u3002<\/p>\n<h3>29. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u5ba1\u8ba1\u5de5\u5177&#xff08;\u5982auditd&#xff09;&#xff1f;<\/h3>\n<p>\u5728Linux\u7cfb\u7edf\u4e2d&#xff0c;\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u5ba1\u8ba1\u5de5\u5177\u5982auditd\u662f\u4e00\u4e2a\u5173\u952e\u6b65\u9aa4&#xff0c;\u53ef\u4ee5\u5e2e\u52a9\u4f60\u8ddf\u8e2a\u548c\u8bb0\u5f55\u7cfb\u7edf\u6d3b\u52a8\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u6b65\u9aa4\u548c\u793a\u4f8b&#xff1a;<\/p>\n<h4>1. \u5b89\u88c5 auditd<\/h4>\n<p>\u9996\u5148&#xff0c;\u786e\u4fdd\u4f60\u7684\u7cfb\u7edf\u5df2\u7ecf\u5b89\u88c5\u4e86auditd\u3002\u5982\u679c\u6ca1\u6709\u5b89\u88c5&#xff0c;\u53ef\u4ee5\u4f7f\u7528\u5305\u7ba1\u7406\u5668\u8fdb\u884c\u5b89\u88c5\u3002<\/p>\n<h5>\u5bf9\u4e8e\u57fa\u4e8eDebian\u7684\u7cfb\u7edf&#xff08;\u5982Ubuntu&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> auditd audispd-plugins<\/p>\n<h5>\u5bf9\u4e8e\u57fa\u4e8eRedHat\u7684\u7cfb\u7edf&#xff08;\u5982CentOS&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> audit audit-libs<\/p>\n<h4>2. \u542f\u52a8\u5e76\u542f\u7528 auditd \u670d\u52a1<\/h4>\n<p>\u63a5\u4e0b\u6765&#xff0c;\u542f\u52a8auditd\u670d\u52a1\u5e76\u8bbe\u7f6e\u4e3a\u5f00\u673a\u81ea\u542f\u3002<\/p>\n<h5>\u4f7f\u7528 systemd \u7684\u7cfb\u7edf&#xff08;\u5982Ubuntu 18.04&#043;, CentOS 7&#043;&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl start auditd<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> auditd<\/p>\n<h5>\u4f7f\u7528 service \u547d\u4ee4\u7684\u7cfb\u7edf&#xff08;\u5982\u65e7\u7248\u672c\u7684Linux\u53d1\u884c\u7248&#xff09;&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">service<\/span> auditd start<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">chkconfig<\/span> auditd on<\/p>\n<h4>3. \u914d\u7f6e auditd<\/h4>\n<p>auditd\u7684\u914d\u7f6e\u4e3b\u8981\u901a\u8fc7\u7f16\u8f91\/etc\/audit\/auditd.conf\u6587\u4ef6\u6765\u5b8c\u6210\u3002\u4f60\u53ef\u4ee5\u6839\u636e\u9700\u8981\u4fee\u6539\u4ee5\u4e0b\u53c2\u6570&#xff1a;<\/p>\n<ul>\n<li>log_file: \u5b9a\u4e49\u5ba1\u8ba1\u65e5\u5fd7\u6587\u4ef6\u7684\u4f4d\u7f6e\u3002<\/li>\n<li>log_format: \u5b9a\u4e49\u65e5\u5fd7\u683c\u5f0f&#xff08;\u5982raw, enriched\u7b49&#xff09;\u3002<\/li>\n<li>action_mail_acct: \u5982\u679c\u8bbe\u7f6e\u4e86\u90ae\u4ef6\u8d26\u6237&#xff0c;\u5f53\u5ba1\u8ba1\u65e5\u5fd7\u6587\u4ef6\u8f6e\u8f6c\u65f6\u4f1a\u53d1\u9001\u90ae\u4ef6\u901a\u77e5\u3002<\/li>\n<li>space_left: \u8bbe\u7f6e\u78c1\u76d8\u7a7a\u95f4\u9608\u503c&#xff0c;\u5f53\u53ef\u7528\u7a7a\u95f4\u4f4e\u4e8e\u8be5\u503c\u65f6&#xff0c;\u4f1a\u89e6\u53d1\u52a8\u4f5c&#xff08;\u5982\u53d1\u9001\u90ae\u4ef6\u6216\u505c\u6b62\u5199\u5165&#xff09;\u3002<\/li>\n<\/ul>\n<p>\u4f8b\u5982&#xff0c;\u7f16\u8f91\u914d\u7f6e\u6587\u4ef6&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/audit\/auditd.conf<\/p>\n<p>\u5c06\u4ee5\u4e0b\u5185\u5bb9\u6dfb\u52a0\u5230\u914d\u7f6e\u6587\u4ef6\u4e2d&#xff1a;<\/p>\n<p>log_file &#061; \/var\/log\/audit\/audit.log<br \/>\nlog_format &#061; RAW<\/p>\n<p>\u4fdd\u5b58\u5e76\u5173\u95ed\u6587\u4ef6\u3002<\/p>\n<h4>4. \u6dfb\u52a0\u5ba1\u8ba1\u89c4\u5219<\/h4>\n<p>\u5ba1\u8ba1\u89c4\u5219\u5b9a\u4e49\u4e86\u54ea\u4e9b\u4e8b\u4ef6\u4f1a\u88ab\u8bb0\u5f55\u3002\u4f60\u53ef\u4ee5\u624b\u52a8\u7f16\u8f91\u89c4\u5219\u6587\u4ef6\u6216\u8005\u4f7f\u7528\u547d\u4ee4\u884c\u5de5\u5177auditctl\u6765\u6dfb\u52a0\u89c4\u5219\u3002<\/p>\n<h5>\u6dfb\u52a0\u89c4\u5219\u5230\u6587\u4ef6 \/etc\/audit\/rules.d\/audit.rules&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/audit\/rules.d\/audit.rules<\/p>\n<p>\u6dfb\u52a0\u5982\u4e0b\u89c4\u5219\u793a\u4f8b&#xff1a;<\/p>\n<p><span class=\"token parameter variable\">-w<\/span> \/etc\/passwd <span class=\"token parameter variable\">-p<\/span> wa <span class=\"token parameter variable\">-k<\/span> passwd_changes<br \/>\n<span class=\"token parameter variable\">-w<\/span> \/var\/log\/auth.log <span class=\"token parameter variable\">-p<\/span> wa <span class=\"token parameter variable\">-k<\/span> auth_logs<\/p>\n<p>\u4e0a\u8ff0\u89c4\u5219\u8868\u793a&#xff1a;<\/p>\n<ul>\n<li>\u76d1\u89c6\/etc\/passwd\u6587\u4ef6\u7684\u6240\u6709\u5199\u64cd\u4f5c&#xff0c;\u5e76\u6807\u8bb0\u4e3apasswd_changes\u3002<\/li>\n<li>\u76d1\u89c6\/var\/log\/auth.log\u6587\u4ef6\u7684\u6240\u6709\u5199\u64cd\u4f5c&#xff0c;\u5e76\u6807\u8bb0\u4e3aauth_logs\u3002<\/li>\n<\/ul>\n<h5>\u4f7f\u7528 auditctl \u547d\u4ee4\u6dfb\u52a0\u89c4\u5219&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> auditctl <span class=\"token parameter variable\">-w<\/span> \/etc\/passwd <span class=\"token parameter variable\">-p<\/span> wa <span class=\"token parameter variable\">-k<\/span> passwd_changes<br \/>\n<span class=\"token function\">sudo<\/span> auditctl <span class=\"token parameter variable\">-w<\/span> \/var\/log\/auth.log <span class=\"token parameter variable\">-p<\/span> wa <span class=\"token parameter variable\">-k<\/span> auth_logs<\/p>\n<h4>5. \u91cd\u542f auditd \u4ee5\u5e94\u7528\u66f4\u6539<\/h4>\n<p>\u6bcf\u6b21\u4fee\u6539\u5b8c\u914d\u7f6e\u6587\u4ef6\u6216\u6dfb\u52a0\u65b0\u7684\u5ba1\u8ba1\u89c4\u5219\u540e&#xff0c;\u90fd\u9700\u8981\u91cd\u542fauditd\u670d\u52a1\u6765\u5e94\u7528\u66f4\u6539\u3002<\/p>\n<p><span class=\"token function\">sudo<\/span> systemctl restart auditd<\/p>\n<h4>6. \u67e5\u770b\u5ba1\u8ba1\u65e5\u5fd7<\/h4>\n<p>\u5ba1\u8ba1\u65e5\u5fd7\u5b58\u50a8\u5728\/var\/log\/audit\/audit.log\u6587\u4ef6\u4e2d\u3002\u4f60\u53ef\u4ee5\u4f7f\u7528ausearch\u3001aureport\u7b49\u5de5\u5177\u6765\u67e5\u8be2\u548c\u5206\u6790\u5ba1\u8ba1\u65e5\u5fd7\u3002<\/p>\n<h5>\u67e5\u770b\u5ba1\u8ba1\u65e5\u5fd7&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> ausearch <span class=\"token parameter variable\">-i<\/span><\/p>\n<h5>\u751f\u6210\u62a5\u544a&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> aureport <span class=\"token parameter variable\">-i<\/span><\/p>\n<h4>\u793a\u4f8b\u603b\u7ed3<\/h4>\n<p>\u5047\u8bbe\u4f60\u9700\u8981\u76d1\u89c6\u7528\u6237\u767b\u5f55\u6d3b\u52a8\u548c\u5bc6\u7801\u6587\u4ef6\u7684\u66f4\u6539&#xff0c;\u53ef\u4ee5\u6309\u5982\u4e0b\u6b65\u9aa4\u64cd\u4f5c&#xff1a;<\/p>\n<li>\n<p>\u5b89\u88c5auditd&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> auditd audispd-plugins\n <\/li>\n<li>\n<p>\u542f\u52a8\u5e76\u542f\u7528\u670d\u52a1&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl start auditd<br \/>\n<span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> auditd\n <\/li>\n<li>\n<p>\u914d\u7f6eauditd&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/audit\/auditd.conf<br \/>\n<span class=\"token comment\"># \u6dfb\u52a0 log_file &#061; \/var\/log\/audit\/audit.log<\/span><br \/>\n<span class=\"token comment\"># \u6dfb\u52a0 log_format &#061; RAW<\/span>\n <\/li>\n<li>\n<p>\u6dfb\u52a0\u5ba1\u8ba1\u89c4\u5219&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/etc\/audit\/rules.d\/audit.rules<br \/>\n<span class=\"token comment\"># \u6dfb\u52a0 -w \/etc\/passwd -p wa -k passwd_changes<\/span><br \/>\n<span class=\"token comment\"># \u6dfb\u52a0 -w \/var\/log\/auth.log -p wa -k auth_logs<\/span>\n <\/li>\n<li>\n<p>\u91cd\u542f\u670d\u52a1&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> systemctl restart auditd\n <\/li>\n<li>\n<p>\u67e5\u770b\u65e5\u5fd7&#xff1a;<\/p>\n<p> <span class=\"token function\">sudo<\/span> ausearch <span class=\"token parameter variable\">-i<\/span><br \/>\n<span class=\"token function\">sudo<\/span> aureport <span class=\"token parameter variable\">-i<\/span>\n <\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u53ef\u4ee5\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528auditd\u6765\u8fdb\u884c\u5b89\u5168\u5ba1\u8ba1\u3002<\/p>\n<h3>30. \u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u76d1\u63a7\u5de5\u5177&#xff08;\u5982ossec&#xff09;&#xff1f;<\/h3>\n<p>\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u914d\u7f6e\u548c\u4f7f\u7528\u5b89\u5168\u76d1\u63a7\u5de5\u5177&#xff08;\u5982ossec&#xff09;&#xff0c;\u4f60\u9700\u8981\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c\u64cd\u4f5c&#xff1a;<\/p>\n<h4>1. \u5b89\u88c5OSSEC<\/h4>\n<p>\u9996\u5148&#xff0c;\u4f60\u9700\u8981\u5728\u4f60\u7684Linux\u7cfb\u7edf\u4e0a\u5b89\u88c5OSSEC\u3002\u4ee5\u4e0b\u662f\u5728Ubuntu\u548cCentOS\u4e0a\u7684\u5b89\u88c5\u793a\u4f8b&#xff1a;<\/p>\n<h5>Ubuntu:<\/h5>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> update<br \/>\n<span class=\"token function\">sudo<\/span> <span class=\"token function\">apt-get<\/span> <span class=\"token function\">install<\/span> ossec-hids<\/p>\n<h5>CentOS:<\/h5>\n<p><span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> epel-release<br \/>\n<span class=\"token function\">sudo<\/span> yum <span class=\"token function\">install<\/span> ossec-hids<\/p>\n<h4>2. \u914d\u7f6eOSSEC<\/h4>\n<p>\u5b89\u88c5\u5b8c\u6210\u540e&#xff0c;\u4f60\u9700\u8981\u5bf9OSSEC\u8fdb\u884c\u57fa\u672c\u914d\u7f6e\u3002\u914d\u7f6e\u6587\u4ef6\u901a\u5e38\u4f4d\u4e8e\/var\/ossec\/etc\/ossec.conf\u3002<\/p>\n<h5>\u4fee\u6539\u914d\u7f6e\u6587\u4ef6&#xff1a;<\/h5>\n<p>\u4f7f\u7528\u6587\u672c\u7f16\u8f91\u5668\u6253\u5f00\u914d\u7f6e\u6587\u4ef6&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> <span class=\"token function\">nano<\/span> \/var\/ossec\/etc\/ossec.conf<\/p>\n<h5>\u793a\u4f8b\u914d\u7f6e&#xff1a;<\/h5>\n<p>&lt;ossec_config&gt;<br \/>\n    &lt;syscheck&gt;<br \/>\n        &lt;directories watch&#061;&#034;yes&#034; realtime&#061;&#034;yes&#034;&gt;\/etc\/passwd,\/etc\/shadow,\/etc\/group&lt;\/directories&gt;<br \/>\n    &lt;\/syscheck&gt;<br \/>\n    &lt;localfile&gt;<br \/>\n        &lt;location&gt;\/var\/log\/messages&lt;\/location&gt;<br \/>\n        &lt;log_format&gt;linux&lt;\/log_format&gt;<br \/>\n    &lt;\/localfile&gt;<br \/>\n    &lt;remote_syslog&gt;<br \/>\n        &lt;server&gt;192.168.1.100&lt;\/server&gt;<br \/>\n        &lt;port&gt;514&lt;\/port&gt;<br \/>\n        &lt;protocol&gt;tcp&lt;\/protocol&gt;<br \/>\n    &lt;\/remote_syslog&gt;<br \/>\n&lt;\/ossec_config&gt;<\/p>\n<h4>3. \u542f\u52a8\u548c\u542f\u7528OSSEC\u670d\u52a1<\/h4>\n<p>\u914d\u7f6e\u5b8c\u6210\u540e&#xff0c;\u4f60\u9700\u8981\u542f\u52a8\u5e76\u8bbe\u7f6eOSSEC\u670d\u52a1\u5728\u7cfb\u7edf\u542f\u52a8\u65f6\u81ea\u52a8\u8fd0\u884c\u3002<\/p>\n<h5>\u542f\u52a8OSSEC\u670d\u52a1&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> \/var\/ossec\/bin\/ossec-control start<\/p>\n<h5>\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f&#xff1a;<\/h5>\n<p><span class=\"token function\">sudo<\/span> systemctl <span class=\"token builtin class-name\">enable<\/span> ossec<\/p>\n<h4>4. \u9a8c\u8bc1OSSEC\u662f\u5426\u6b63\u5e38\u8fd0\u884c<\/h4>\n<p>\u4f60\u53ef\u4ee5\u901a\u8fc7\u68c0\u67e5OSSEC\u7684\u65e5\u5fd7\u6587\u4ef6\u6765\u9a8c\u8bc1\u5176\u662f\u5426\u6b63\u5e38\u5de5\u4f5c&#xff1a;<\/p>\n<p><span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-f<\/span> \/var\/ossec\/logs\/ossec.log<\/p>\n<h4>5. \u6d4b\u8bd5OSSEC\u914d\u7f6e<\/h4>\n<p>\u4e3a\u4e86\u786e\u4fdd\u4f60\u7684\u914d\u7f6e\u751f\u6548&#xff0c;\u4f60\u53ef\u4ee5\u624b\u52a8\u89e6\u53d1\u4e00\u4e9b\u4e8b\u4ef6\u6765\u6d4b\u8bd5OSSEC\u7684\u54cd\u5e94\u3002\u4f8b\u5982&#xff0c;\u5c1d\u8bd5\u7f16\u8f91\/etc\/passwd\u6587\u4ef6&#xff1a;<\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;testuser:x:1001:1001::\/home\/testuser:\/bin\/bash&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sudo<\/span> <span class=\"token function\">tee<\/span> <span class=\"token parameter variable\">-a<\/span> \/etc\/passwd <span class=\"token operator\">&gt;<\/span> \/dev\/null<\/p>\n<h4>6. \u67e5\u770b\u8b66\u62a5\u4fe1\u606f<\/h4>\n<p>\u4f60\u53ef\u4ee5\u5728OSSEC\u7684Web\u63a7\u5236\u53f0\u4e2d\u67e5\u770b\u5b9e\u65f6\u8b66\u62a5\u4fe1\u606f\u3002\u9ed8\u8ba4\u60c5\u51b5\u4e0b&#xff0c;Web\u63a7\u5236\u53f0\u4f4d\u4e8ehttp:\/\/localhost:7000\u3002\u4f7f\u7528\u7ba1\u7406\u5458\u8d26\u6237\u767b\u5f55\u540e&#xff0c;\u53ef\u4ee5\u67e5\u770b\u8be6\u7ec6\u7684\u8b66\u62a5\u4fe1\u606f\u3002<\/p>\n<h4>7. \u5b9a\u671f\u66f4\u65b0\u89c4\u5219\u548c\u6570\u636e\u5e93<\/h4>\n<p>\u4e3a\u4e86\u4fdd\u6301OSSEC\u7684\u6700\u65b0\u72b6\u6001&#xff0c;\u5b9a\u671f\u66f4\u65b0\u5176\u89c4\u5219\u548c\u6570\u636e\u5e93\u975e\u5e38\u91cd\u8981&#xff1a;<\/p>\n<p><span class=\"token function\">sudo<\/span> \/var\/ossec\/bin\/ossec-update<\/p>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u6b65\u9aa4&#xff0c;\u4f60\u5e94\u8be5\u80fd\u591f\u5728Linux\u7cfb\u7edf\u4e2d\u6210\u529f\u914d\u7f6e\u548c\u4f7f\u7528OSSEC\u4f5c\u4e3a\u5b89\u5168\u76d1\u63a7\u5de5\u5177\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb2.9k\u6b21\uff0c\u70b9\u8d5e15\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u865a\u62df\u5185\u5b58\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u7cfb\u7edf\u5185\u5b58\u7ba1\u7406\u6280\u672f\uff0c\u5b83\u4f7f\u5f97\u5e94\u7528\u7a0b\u5e8f\u8ba4\u4e3a\u5b83\u62e5\u6709\u8fde\u7eed\u7684\u53ef\u7528\u5185\u5b58\uff08\u4e00\u4e2a\u8fde\u7eed\u5b8c\u6574\u7684\u5730\u5740\u7a7a\u95f4\uff09\uff0c\u800c\u5b9e\u9645\u4e0a\uff0c\u5b83\u901a\u5e38\u662f\u88ab\u5206\u9694\u6210\u591a\u4e2a\u7269\u7406\u5185\u5b58\u788e\u7247\uff0c\u8fd8\u6709\u90e8\u5206\u6682\u65f6\u5b58\u50a8\u5728\u5916\u90e8\u78c1\u76d8\u5b58\u50a8\u5668\u4e0a\uff0c\u5728\u9700\u8981\u65f6\u8fdb\u884c\u6570\u636e\u4ea4\u6362\u3002\u901a\u8fc7\u4ee5\u4e0a\u51e0\u79cd\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u5168\u9762\u4e86\u89e3Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u627e\u5230\u53ef\u80fd\u7684\u5185\u5b58\u74f6\u9888\u3002\u6839\u636e\u5177\u4f53\u60c5\u51b5\uff0c\u53ef\u4ee5\u9009\u62e9\u4e0d\u540c\u7684\u5de5\u5177\u6765\u5206\u6790\u548c\u4f18\u5316\u5185\u5b58\u4f7f\u7528\u3002\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u6839\u636e\u9700\u8981\u91c7\u53d6\u76f8\u5e94\u7684\u63aa\u65bd\u6765\u4f18\u5316\u7cfb\u7edf\u6027\u80fd\u3002\u6bcf\u79cd\u65b9\u6cd5\u90fd\u6709\u5176\u72ec\u7279\u7684\u4f18\u70b9\u548c\u9002\u7528\u573a\u666f\uff0c\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u5408\u9002\u7684\u5de5\u5177\u548c\u65b9\u6cd5\u3002_\u670d\u52a1\u5668\u9762\u8bd5\u9898<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[43,44],"topic":[],"class_list":["post-30064","post","type-post","status-publish","format-standard","hentry","category-server","tag-43","tag-44"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/30064.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb2.9k\u6b21\uff0c\u70b9\u8d5e15\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u865a\u62df\u5185\u5b58\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u7cfb\u7edf\u5185\u5b58\u7ba1\u7406\u6280\u672f\uff0c\u5b83\u4f7f\u5f97\u5e94\u7528\u7a0b\u5e8f\u8ba4\u4e3a\u5b83\u62e5\u6709\u8fde\u7eed\u7684\u53ef\u7528\u5185\u5b58\uff08\u4e00\u4e2a\u8fde\u7eed\u5b8c\u6574\u7684\u5730\u5740\u7a7a\u95f4\uff09\uff0c\u800c\u5b9e\u9645\u4e0a\uff0c\u5b83\u901a\u5e38\u662f\u88ab\u5206\u9694\u6210\u591a\u4e2a\u7269\u7406\u5185\u5b58\u788e\u7247\uff0c\u8fd8\u6709\u90e8\u5206\u6682\u65f6\u5b58\u50a8\u5728\u5916\u90e8\u78c1\u76d8\u5b58\u50a8\u5668\u4e0a\uff0c\u5728\u9700\u8981\u65f6\u8fdb\u884c\u6570\u636e\u4ea4\u6362\u3002\u901a\u8fc7\u4ee5\u4e0a\u51e0\u79cd\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u5168\u9762\u4e86\u89e3Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u627e\u5230\u53ef\u80fd\u7684\u5185\u5b58\u74f6\u9888\u3002\u6839\u636e\u5177\u4f53\u60c5\u51b5\uff0c\u53ef\u4ee5\u9009\u62e9\u4e0d\u540c\u7684\u5de5\u5177\u6765\u5206\u6790\u548c\u4f18\u5316\u5185\u5b58\u4f7f\u7528\u3002\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u6839\u636e\u9700\u8981\u91c7\u53d6\u76f8\u5e94\u7684\u63aa\u65bd\u6765\u4f18\u5316\u7cfb\u7edf\u6027\u80fd\u3002\u6bcf\u79cd\u65b9\u6cd5\u90fd\u6709\u5176\u72ec\u7279\u7684\u4f18\u70b9\u548c\u9002\u7528\u573a\u666f\uff0c\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u5408\u9002\u7684\u5de5\u5177\u548c\u65b9\u6cd5\u3002_\u670d\u52a1\u5668\u9762\u8bd5\u9898\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/30064.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-20T08:21:10+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"31 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/30064.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/30064.html\",\"name\":\"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2025-04-20T08:21:10+00:00\",\"dateModified\":\"2025-04-20T08:21:10+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/30064.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/30064.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/30064.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/30064.html","og_locale":"zh_CN","og_type":"article","og_title":"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb2.9k\u6b21\uff0c\u70b9\u8d5e15\u6b21\uff0c\u6536\u85cf30\u6b21\u3002\u865a\u62df\u5185\u5b58\u662f\u4e00\u79cd\u8ba1\u7b97\u673a\u7cfb\u7edf\u5185\u5b58\u7ba1\u7406\u6280\u672f\uff0c\u5b83\u4f7f\u5f97\u5e94\u7528\u7a0b\u5e8f\u8ba4\u4e3a\u5b83\u62e5\u6709\u8fde\u7eed\u7684\u53ef\u7528\u5185\u5b58\uff08\u4e00\u4e2a\u8fde\u7eed\u5b8c\u6574\u7684\u5730\u5740\u7a7a\u95f4\uff09\uff0c\u800c\u5b9e\u9645\u4e0a\uff0c\u5b83\u901a\u5e38\u662f\u88ab\u5206\u9694\u6210\u591a\u4e2a\u7269\u7406\u5185\u5b58\u788e\u7247\uff0c\u8fd8\u6709\u90e8\u5206\u6682\u65f6\u5b58\u50a8\u5728\u5916\u90e8\u78c1\u76d8\u5b58\u50a8\u5668\u4e0a\uff0c\u5728\u9700\u8981\u65f6\u8fdb\u884c\u6570\u636e\u4ea4\u6362\u3002\u901a\u8fc7\u4ee5\u4e0a\u51e0\u79cd\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u5168\u9762\u4e86\u89e3Linux\u7cfb\u7edf\u7684\u5185\u5b58\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u627e\u5230\u53ef\u80fd\u7684\u5185\u5b58\u74f6\u9888\u3002\u6839\u636e\u5177\u4f53\u60c5\u51b5\uff0c\u53ef\u4ee5\u9009\u62e9\u4e0d\u540c\u7684\u5de5\u5177\u6765\u5206\u6790\u548c\u4f18\u5316\u5185\u5b58\u4f7f\u7528\u3002\u901a\u8fc7\u4ee5\u4e0a\u65b9\u6cd5\uff0c\u4f60\u53ef\u4ee5\u6709\u6548\u5730\u76d1\u63a7\u7cfb\u7edf\u7684CPU\u4f7f\u7528\u60c5\u51b5\uff0c\u5e76\u6839\u636e\u9700\u8981\u91c7\u53d6\u76f8\u5e94\u7684\u63aa\u65bd\u6765\u4f18\u5316\u7cfb\u7edf\u6027\u80fd\u3002\u6bcf\u79cd\u65b9\u6cd5\u90fd\u6709\u5176\u72ec\u7279\u7684\u4f18\u70b9\u548c\u9002\u7528\u573a\u666f\uff0c\u53ef\u4ee5\u6839\u636e\u5177\u4f53\u9700\u6c42\u9009\u62e9\u5408\u9002\u7684\u5de5\u5177\u548c\u65b9\u6cd5\u3002_\u670d\u52a1\u5668\u9762\u8bd5\u9898","og_url":"https:\/\/www.wsisp.com\/helps\/30064.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2025-04-20T08:21:10+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"31 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/30064.html","url":"https:\/\/www.wsisp.com\/helps\/30064.html","name":"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2025-04-20T08:21:10+00:00","dateModified":"2025-04-20T08:21:10+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/30064.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/30064.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/30064.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u9762\u8bd5\u9898"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/30064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=30064"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/30064\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=30064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=30064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=30064"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=30064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}