Archived
88 lines
2.7 KiB
Markdown
88 lines
2.7 KiB
Markdown
## 0.必要条件
|
||
|
||
在 PVE 系统调整之前，请确保必要的软件包已经安装完成。
|
||
|
||
```bash
|
||
## 同步镜像仓库
|
||
apt update
|
||
|
||
## 安装系统软件
|
||
apt install htop lm-sensors neofetch fail2ban vim tmux unattended-upgrades apt-listchanges powermgmt-base
|
||
|
||
## 安装网络工具
|
||
apt install iperf iperf3 iftop net-tools ethtool
|
||
|
||
## 安装CPU调度调整工具
|
||
apt install cpufrequtils
|
||
```
|
||
|
||
本篇教程后续命令，均在 SSH 终端下完成。
|
||
|
||
|
||
## 1.Fail2ban 配置
|
||
|
||
安装好 `fail2ban` 后，检查其服务状态：
|
||
|
||
```bash
|
||
## 检查 Fail2ban 系统服务状态
|
||
systemctl status fail2ban.service
|
||
```
|
||
|
||
在 `Loaded` 行，检查是否存在 `enable` ：
|
||
|
||
```bash
|
||
## 参考输出
|
||
|
||
● fail2ban.service - Fail2Ban Service
|
||
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
|
||
Active: active (running) since Sat 2022-07-16 05:03:53 CST; 4 days ago
|
||
Docs: man:fail2ban(1)
|
||
Process: 777 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)
|
||
Main PID: 792 (fail2ban-server)
|
||
Tasks: 5 (limit: 18904)
|
||
Memory: 13.3M
|
||
CPU: 4min 53.764s
|
||
CGroup: /system.slice/fail2ban.service
|
||
└─792 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
|
||
|
||
Jul 16 05:03:53 hyper systemd[1]: Starting Fail2Ban Service...
|
||
Jul 16 05:03:53 hyper systemd[1]: Started Fail2Ban Service.
|
||
Jul 16 05:03:53 hyper fail2ban-server[792]: Server ready
|
||
```
|
||
|
||
其中第1个 `enable` 表示当前服务开机自动启动，第2个 `enable` 表示该软件的默认启用状态。
|
||
|
||
如果并非为双 `enable` 状态，需要用一下命名进行调整：
|
||
|
||
```bash
|
||
## 开机自启 fail2ban 服务
|
||
systemctl enable fail2ban.service
|
||
|
||
## 参考输出
|
||
Synchronizing state of fail2ban.service with SysV service script with /lib/systemd/systemd-sysv-install.
|
||
Executing: /lib/systemd/systemd-sysv-install enable fail2ban
|
||
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /lib/systemd/system/fail2ban.service.
|
||
```
|
||
|
||
执行完成后，再次通过前面的命令检查服务自启状态。
|
||
|
||
后续如果想查看 Fail2ban 有关 sshd 的执行状态，可使用如下命令：
|
||
|
||
```bash
|
||
## 检查 sshd 的执行情况
|
||
fail2ban-client status sshd
|
||
|
||
## 参考输出
|
||
Status for the jail: sshd
|
||
|- Filter
|
||
| |- Currently failed: 0
|
||
| |- Total failed: 0
|
||
| `- File list: /var/log/auth.log
|
||
`- Actions
|
||
|- Currently banned: 0
|
||
|- Total banned: 0
|
||
`- Banned IP list:
|
||
```
|
||
|
||
如果均为0，表示 PVE 系统没有 SSH 错误密码的尝试记录。
|