从Linode后台wipe VPS，使用Debian 9 Stretch Rebuild、配置基础参数、配置Exim4、安装Fail2Ban、安装UFW、安装MariaDB(MySQL)、安装PHP-7.0、安装Apache2、安装phpmyadmin、配置通用HTTPS证书、配置Let’s Encrypt、开启BBR加速、安装ShadowsocksR、安装UnattendedUpgrades、安装apt-listchanges、安装apticron
配置基础参数
更新系统
|
1 |
apt update && apt upgrade |
修改hosts
|
1 |
nano /etc/hosts |
修改hostname
|
1 |
hostnamectl set-hostname yourhostname |
验证hostname
|
1 |
hostname |
设置时区
|
1 |
dpkg-reconfigure tzdata |
验证时区
|
1 |
date |
配置Exim4
安装exim4（Linode的Debian9中没有包括exim4组件）
|
1 |
apt install exim4 |
配置exim4
|
1 |
dpkg-reconfigure exim4-config |
|
1 2 3 4 5 6 7 8 9 |
邮件系统设置的常见类型：互联网站；直接通过 SMTP 发送或接收信件 系统邮件名称：(注意，一定要填一个能解析的域名，我就是在这吃了亏): xxx.com 要监听入站 SMTP 连接的 IP 地址：(留空) 其它可接收邮件的目的地址：localhost.localdomain:xxx.com 为下列域名进行邮件中转 (relay)：(留空) │ 为下列主机进行邮件中转 (relay)：(留空) 保持最小 DNS 查询量吗 (按需拔号，Dial-on-Demand)？<否> 本地信件的投递方式：/var/mail/ 中的 mbox 格式 将设置文件分拆成小文件吗？<否> |
测试邮件发送功能
|
1 |
echo “邮件正文” | mail -s 邮件主题 yourname@domain.com |
安装Fail2Ban
|
1 |
apt install fail2ban |
配置Fail2Ban
|
1 |
cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local |
|
1 |
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local |
|
1 |
nano /etc/fail2ban/jail.local |
配置邮件
|
1 2 3 |
destemail = The email address where you would like to receive the emails. sender = The email address from which Fail2ban will send emails. 最新的fail2ban取消了sendername的设置 |
查询Fail2ban状态
|
1 |
fail2ban-client status |
安装UFW
|
1 |
apt install ufw |
添加初始规则
|
1 |
ufw allow 22 |
启用UFW
|
1 |
ufw enable |
开启日志
|
1 |
ufw logging on |
查看UFW状态
|
1 |
ufw status |
使用外部工具检测防火墙状态
|
1 |
http://tool.chinaz.com/port/ |
安装MariaDB(MySQL)
|
1 |
apt install mariadb-client mariadb-server |
初始化root用户密码
|
1 |
mysql -u root -p |
安装PHP-7.0
|
1 |
apt install php7.0 |
安装Apache2
安装PHP-7.0的同时，apache2以及apache2-mod-php7.0都已经包括在其中，无需另外安装。
|
1 |
apt install apache2 apache2-mod-php7.0 |
开启防火墙80端口
|
1 |
ufw allow 80 |
测试网站外部访问
从浏览器访问VPS外部IP地址
修改/etc/apache2/sites-available/000-default.conf，更改默认网站访问权限。
|
1 2 3 4 5 6 7 8 |
<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/html ServerSignature Off <Directory /var/www/html > Options -Indexes </Directory> </VirtualHost> |
重启apache2服务
|
1 |
service apache2 reload |
安装PHP7附加组件
Apache2
|
1 |
apt-get install -y libapache2-mod-php7.0 php7.0-cli php7.0-common php7.0-mbstring php7.0-gd php7.0-intl php7.0-xml php7.0-mysql php7.0-mcrypt php7.0-zip php7.0-curl |
安装phpmyadmin
|
1 |
apt install phpmyadmin |
保持默认选项安装
在/etc/apache2/apache2.conf最后加入
|
1 |
Include /etc/phpmyadmin/apache.conf |
修改/etc/phpmyadmin/apache.conf开头部分访问地址，增加安全
|
1 |
Alias /yourphpmyadmin /usr/share/phpmyadmin |
修改默认登录模式为使用密码登录（解决#1698 – Access denied for user ‘root’@’localhost’）
|
1 2 3 4 5 6 7 8 |
$ sudo mysql -u root # I had to use "sudo" since is new installation mysql> USE mysql; mysql> UPDATE user SET plugin='mysql_native_password' WHERE User='root'; mysql> FLUSH PRIVILEGES; mysql> exit; $ service mysql restart |
重新设置密码（解决#1045 – Access denied for user ‘root’@’localhost’ (using password: YES)）
|
1 2 3 |
mysql -u root mysql> SET PASSWORD FOR 'root'@'localhost' = PASSWORD('newpass'); |
重启apache2
|
1 |
service apache2 reload |
测试phpmyadmin
通过浏览器访问domain/yourphpmyadmin进入管理界面，使用root加密码登录
配置通用HTTPS证书
|
1 |
mkdir /etc/apache2/ssl |
|
1 |
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt |
|
1 2 3 4 5 6 7 |
Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:New York Locality Name (eg, city) []:NYC Organization Name (eg, company) [Internet Widgits Pty Ltd]:MINIRPLUS Organizational Unit Name (eg, section) []:MINIRPLUS Common Name (e.g. server FQDN or YOUR name) []:*.minirplus.com Email Address []:webmaster@minirplus.com |
|
1 |
nano /etc/apache2/sites-available/000-default.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/vps ServerSignature Off <Directory /var/www/vps > Options -Indexes </Directory> </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> ServerAdmin webmaster@localhost DocumentRoot /var/www/vps ServerSignature Off <Directory /var/www/vps > Options -Indexes </Directory> SSLEngine on SSLCertificateFile /etc/apache2/ssl/apache.crt SSLCertificateKeyFile /etc/apache2/ssl/apache.key </VirtualHost> </IfModule> |
|
1 |
service apache2 restart |
验证
通过浏览器访问https://yourdomain.com，显示红色https标签警告
配置Let’s Encrypt
在debian 9 stretch中python-certbot-apache已经不用再添加backports源了。（官方文档）
|
1 |
apt install python-certbot-apache |
开启SSL模组
|
1 |
a2enmod ssl |
开启防火墙443端口
|
1 |
ufw allow 443 |
禁用站点
|
1 |
a2dissite dev.us.minirplus.com |
获取证书
|
1 |
certbot --apache |
1.选择需要生成证书的apache2的站点conf文件。2.选择secure模式
验证站点conf文件，如果certbot自动修改conf文件失败，则需要手动修改站点conf文件，添加SSL配置。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
<VirtualHost *:80> DocumentRoot /var/www/dev.us.minirplus.com ServerName dev.us.minirplus.com ServerSignature Off <Directory /var/www/dev.us.minirplus.com > Options -Indexes </Directory> Redirect permanent / https://dev.us.minirplus.com/ </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> DocumentRoot /var/www/dev.us.minirplus.com ServerName dev.us.minirplus.com ServerSignature Off <Directory /var/www/dev.us.minirplus.com > Options -Indexes </Directory> SSLEngine on SSLCertificateFile /etc/letsencrypt/live/dev.us.minirplus.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/dev.us.minirplus.com/privkey.pem </VirtualHost> </IfModule> |
重启apache2
|
1 |
systemctl restart apache2 |
验证
通过浏览器访问https://www.ssllabs.com/ssltest/analyze.html?d=dev.us.minirplus.com
开启BBR加速
查看系统内核版本是否大于4.9
|
1 |
uname -r |
修改
|
1 |
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf |
保存
|
1 |
sysctl -p |
验证
|
1 |
sysctl net.ipv4.tcp_congestion_control |
输出net.ipv4.tcp_congestion_control = bbr修改成功
安装ShadowsocksR
|
1 |
apt install git |
|
1 |
git clone -b manyuser https://github.com/shadowsocksr/shadowsocksr.git |
运行初始化
|
1 2 |
cd ~/shadowsocksr bash initcfg.sh |
修改配置文件
|
1 |
nano /root/shadowsocksr/user-config.json |
运行
|
1 2 |
cd ~/shadowsocksr/shadowsocks python server.py -d start/stop/restart |
安装unattended-upgrades
安装无人值守自动更新
|
1 |
apt install unattended-upgrades |
修改/etc/apt/apt.conf.d/50unattended-upgrades
|
1 |
Unattended-Upgrade::Mail "yourname@email.com"; |
检查/etc/apt/apt.conf.d/20auto-upgrades
|
1 2 |
APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; |
安装apt-listchanges
安装changelog
|
1 |
apt install apt-listchanges |
修改/etc/apt/listchanges.conf
|
1 |
email_address=yourmail@email.com |
安装apticron
安装更新列表通知
|
1 |
apt install apticron |
修改/etc/apt/listchanges.conf
|
1 |
EMAIL="root@example.com" |
There are no comments yet