S7｜安全加固：把门锁好

sudo grep "Failed password" /var/log/auth.log | wc -l
sudo grep "Failed password" /var/log/auth.log | tail -5
sudo lastb | head -20

# 在本地（不是服务器）
ssh-copy-id 用户@服务器IP

# 测试：应该不问密码就进去了
ssh 用户@服务器IP

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak-$(date +%Y%m%d)

sudo nano /etc/ssh/sshd_config

ls /etc/ssh/sshd_config.d/

sudo sshd -t

sudo systemctl reload ssh        # Debian 系
sudo systemctl reload sshd       # RPM 系

# 用密钥登录 —— 应该成功
ssh 用户@服务器IP

# 试着用密码登录 —— 应该被拒绝
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no 用户@服务器IP
# 应该看到 Permission denied (publickey)

sudo apt install fail2ban       # Debian 系
sudo dnf install fail2ban       # RPM 系

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
banaction = iptables-multiport

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s

# 看你系统有什么防火墙
which iptables nft firewall-cmd

# 纯 iptables 系统
banaction = iptables-multiport

# 用 nftables 的新系统
banaction = nftables-multiport

# 确实在用 firewalld（并且服务在跑）
banaction = firewallcmd-rich-rules

sudo systemctl enable --now fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd

# 1. 看 iptables 里有没有 f2b 链
sudo iptables -L -n | grep f2b

# 手动封一个测试 IP
sudo fail2ban-client set sshd banip 203.0.113.99

# 立刻检查 iptables
sudo iptables -L -n | grep 203.0.113.99

sudo fail2ban-client set sshd unbanip 203.0.113.99

sudo apt install ufw

# ⚠️ 先放行 SSH，再启用！（否则锁死）
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw enable
sudo ufw status verbose

sudo systemctl enable --now firewalld

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

sudo firewall-cmd --list-all

# Debian 系
sudo apt update
sudo apt list --upgradable
sudo apt upgrade

# 只装安全更新（unattended-upgrades）
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Debian 系
ls /var/run/reboot-required 2>/dev/null && echo "需要重启"

# RPM 系
sudo needs-restarting -r

sudo ss -ltnp

systemctl list-unit-files --state=enabled

crontab -l
sudo crontab -l
sudo ls -la /etc/cron.*/

# UID 0 的账号（应该只有 root）
awk -F: '$3==0 {print $1}' /etc/passwd

# 有 shell 的账号（能登录的）
awk -F: '$7 !~ /nologin|false/ {print $1, $7}' /etc/passwd

# 最近登录
last -20
lastb -20

#!/bin/bash
echo "=== 1. SSH 配置 ==="
sudo sshd -T 2>/dev/null | grep -E "^(passwordauthentication|permitrootlogin|pubkeyauthentication)"

echo "=== 2. 监听端口 ==="
sudo ss -ltnp | grep -v "127.0.0.1" | grep -v "::1"

echo "=== 3. 防火墙 ==="
sudo ufw status 2>/dev/null | head -8 || sudo firewall-cmd --list-all 2>/dev/null | head -12

echo "=== 4. fail2ban ==="
sudo fail2ban-client status 2>/dev/null || echo "未安装"

echo "=== 5. 失败登录统计 ==="
sudo grep -c "Failed password" /var/log/auth.log 2>/dev/null || echo "无记录"

echo "=== 6. UID 0 账号 ==="
awk -F: '$3==0 {print $1}' /etc/passwd

echo "=== 7. 重启需求 ==="
[ -f /var/run/reboot-required ] && echo "需要重启" || echo "不需要"

sudo grep -c "Failed password" /var/log/auth.log 2>/dev/null
sudo lastb | wc -l

ssh-copy-id 你的用户@服务器
ssh 你的用户@服务器     # 应该不问密码

sudo sshd -T | grep -E "^(passwordauthentication|permitrootlogin)"

sudo fail2ban-client set sshd banip 203.0.113.99
sudo iptables -L -n | grep 203.0.113.99
sudo fail2ban-client set sshd unbanip 203.0.113.99

sudo ss -ltnp | grep "0.0.0.0"

sudo cp /etc/ssh/sshd_config.bak-* /etc/ssh/sshd_config
sudo systemctl reload ssh

# ① 本地私钥权限
ls -l ~/.ssh/id_ed25519        # 必须 600

# ② 服务器上公钥
cat ~/.ssh/authorized_keys     # 有没有你的公钥
ls -ld ~/.ssh                  # 必须 700
ls -l ~/.ssh/authorized_keys   # 必须 600

# ③ 详细调试
ssh -v 用户@服务器 2>&1 | grep -i "offering\|denied\|authentications"

sudo fail2ban-client set sshd banip 203.0.113.99
sudo iptables -L -n | grep 203.0.113.99

sudo ufw allow 22/tcp
sudo ufw reload

sudo ss -ltnp | grep :端口号