Skill: xiaowenzhou/vps-maintenance (version 1.0.0)

--- name: vps-maintenance description: | VPS 服务器维护与优化配置。用于：(1) 新 VPS 入手后的初始化配置，(2) 服务器安全加固， (3) 系统性能优化，(4) 日常维护任务。包含 SSH 加固、防火墙配置、性能调优、时间同步等完整流程。 --- # VPS 维护配置 ## 快速开始 ### 1. 换源加速 ```bash # 备份原始源 cp /etc/apt/sources.list /etc/apt/sources.list.backup # 获取系统版本代号 CODENAME=$(lsb_release -cs) # 国内源（推荐国内用户） cat > /etc/apt/sources.list <<EOF deb http://mirrors.aliyun.com/debian/ ${CODENAME} main contrib non-free non-free-firmware deb http://mirrors.aliyun.com/debian-security ${CODENAME}-security main contrib non-free non-free-firmware deb http://mirrors.aliyun.com/debian/ ${CODENAME}-updates main contrib non-free non-free-firmware EOF # 国外用户用官方源 # deb https://deb.debian.org/debian/ ${CODENAME} main ... apt update ``` ### 2. 账户安全 ```bash # 创建普通用户（禁止直接用 root） useradd -m -s /bin/bash username echo "username:StrongPassword123!" | chpasswd usermod -aG sudo username # 配置 SSH 密钥 mkdir -p ~/.ssh chmod 700 ~/.ssh echo "你的公钥" > ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys ``` ### 3. SSH 加固 ```bash # 备份配置 cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup # 修改默认端口（防扫描） sed -i 's/^#*Port .*/Port 54321/' /etc/ssh/sshd_config # 加固配置 cat >> /etc/ssh/sshd_config <<EOF PasswordAuthentication no PermitRootLogin prohibit-password PubkeyAuthentication yes LoginGraceTime 30 MaxAuthTries 3 EOF systemctl restart ssh ``` ### 4. 防火墙 (nftables) ```bash # 安装 nftables（替代 ufw） apt-get install -y nftables # 配置规则（只开放 SSH） cat > /etc/nftables.conf <<EOF #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input priority 0; policy drop; iif lo accept; ct state established,related accept; tcp dport 54321 accept; } chain forward { type filter hook forward priority 0; policy drop; } chain output { type filter hook output priority 0; policy accept; } } EOF systemctl enable --now nftables ``` ### 5. 性能优化 ```bash # BBR + 网络参数 cat > /etc/sysctl.d/99-custom.conf <<EOF net.ipv4.tcp_congestion_control = bbr net.core.default_qdisc = fq net.core.rmem_max = 33554432 net.core.wmem_max = 33554432 net.core.somaxconn = 4096 net.ipv4.tcp_max_syn_backlog = 4096 net.ipv4.tcp_fastopen = 3 vm.swappiness = 3 kernel.panic = 1 EOF sysctl --system # Swap 配置（内存 < 4GB 时） fallocate -l 2G /swapfile chmod 600 /swapfile mkswap /swapfile swapon /swapfile echo "/swapfile none swap sw 0 0" >> /etc/fstab ``` ### 6. 时间同步 ```bash # 时区 timedatectl set-timezone Asia/Shanghai # NTP（国内用阿里云/清华） cat > /etc/systemd/timesyncd.conf <<EOF [Time] NTP=ntp.aliyun.com ntp.ntsc.ac.cn time1.cloud.tencent.com FallbackNTP=ntp1.aliyun.com ntp2.aliyun.com EOF systemctl enable --now systemd-timesyncd timedatectl set-ntp yes ``` ### 7. 安全加固 ```bash # Fail2Ban 防暴力破解 apt-get install -y fail2ban cat > /etc/fail2ban/jail.d/sshd.local <<EOF [sshd] enabled = true port = 54321 filter = sshd maxretry = 5 findtime = 10m bantime = 30m EOF systemctl enable --now fail2ban # 自动安全更新 apt-get install -y unattended-upgrades dpkg-reconfigure -plow unattended-upgrades # 可选：禁用 ICMP ping echo "net.ipv4.icmp_echo_ignore_all = 1" > /etc/sysctl.d/99-disable-ping.conf sysctl -w net.ipv4.icmp_echo_ignore_all=1 ``` ### 8. 系统清理 ```bash # 1. 清理 apt 缓存 apt-get clean apt-get autoclean apt-get autoremove -y # 2. 清理旧内核（Debian/Ubuntu） dpkg -l 'linux-*' 2>/dev/null | grep '^ii' | grep -v "$(uname -r | sed 's/-.*//')" | awk '{print $2}' | xargs apt-get -y purge 2>/dev/null # 3. 清理日志（保留最近 7 天） journalctl --vacuum-time=7d find /var/log -type f -name "*.log" -mtime +7 -delete 2>/dev/null find /var/log -type f -name "*.gz" -mtime +30 -delete 2>/dev/null find /var/log -type f -name "*.old" -delete 2>/dev/null # 4. 清理临时文件 rm -rf /tmp/* 2>/dev/null rm -rf /var/tmp/* 2>/dev/null # 5. 清理用户缓存 rm -rf ~/.cache/* 2>/dev/null ``` --- ## 日常维护命令 | 任务 | 命令 | |------|------| | 查看负载/内存 | `uptime && free -h` | | 查看磁盘 | `df -h` | | 查看登录日志 | `last` / `journalctl -u ssh` | | 查看被封 IP | `fail2ban-client status sshd` | | 解封 IP | `fail2ban-client set sshd unbanip <IP>` | | 查看防火墙规则 | `nft list ruleset` | | 重启服务 | `systemctl restart ssh` | | 检查开放端口 | `ss -tulnp` | ### 定期清理脚本 ```bash #!/bin/bash # vps-cleanup.sh - 定期清理脚本 echo "=== VPS 清理开始 ===" # apt 清理 apt-get clean apt-get autoremove -y # 清理日志 journalctl --vacuum-time=7d find /var/log -type f -name "*.log" -mtime +7 -delete 2>/dev/null # 清理临时文件 rm -rf /tmp/* 2>/dev/null rm -rf /var/tmp/* 2>/dev/null echo "=== 清理完成 ===" df -h ``` --- ## 安全检查清单 - [ ] SSH 端口已改为非 22 - [ ] 禁用密码登录，使用密钥 - [ ] 禁用 root 直接登录 - [ ] 防火墙默认 DROP，只开必要端口 - [ ] Fail2Ban 已启用 - [ ] BBR 已启用 - [ ] 时区正确（NTP 同步） - [ ] 自动安全更新已配置 - [ ] Swap 已配置（低内存 VPS）


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)