82 lines
2.3 KiB
Bash
82 lines
2.3 KiB
Bash
|
#!/bin/bash
|
|||
|
|
|
|||
|
|
# 检查是否以 root 权限运行
|
|||
|
|
if [ "$EUID" -ne 0 ]; then
|
|||
|
|
echo "[Init]请以 root 权限运行此脚本。"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 随机生成SSH端口（20000到29999之间）
|
|||
|
|
SSH_PORT=$((RANDOM % 10000 + 20000))
|
|||
|
|
|
|||
|
|
# APT更新
|
|||
|
|
echo "[Init]正在更新 APT..."
|
|||
|
|
apt update && apt upgrade -y
|
|||
|
|
|
|||
|
|
# Fail2ban 安装和配置
|
|||
|
|
echo "[Init]正在安装和配置 Fail2ban..."
|
|||
|
|
apt install -y fail2ban rsyslog
|
|||
|
|
systemctl enable fail2ban
|
|||
|
|
systemctl start fail2ban
|
|||
|
|
|
|||
|
|
# 创建一个简单的 Fail2ban 配置
|
|||
|
|
cat <<EOF >/etc/fail2ban/jail.local
|
|||
|
|
#DEFAULT-START
|
|||
|
|
[DEFAULT]
|
|||
|
|
bantime = 600
|
|||
|
|
findtime = 300
|
|||
|
|
maxretry = 5
|
|||
|
|
banaction = iptables-allports
|
|||
|
|
action = %(action_mwl)s
|
|||
|
|
#DEFAULT-END
|
|||
|
|
|
|||
|
|
[sshd]
|
|||
|
|
ignoreip = 127.0.0.1/8
|
|||
|
|
enabled = true
|
|||
|
|
filter = sshd
|
|||
|
|
port = $SSH_PORT
|
|||
|
|
maxretry = 5
|
|||
|
|
findtime = 300
|
|||
|
|
bantime = 600
|
|||
|
|
banaction = iptables-allports
|
|||
|
|
action = %(action_mwl)s
|
|||
|
|
logpath = /var/log/auth.log
|
|||
|
|
EOF
|
|||
|
|
|
|||
|
|
systemctl restart fail2ban
|
|||
|
|
echo "[Init]Fail2ban 安装并配置完成！"
|
|||
|
|
|
|||
|
|
# 配置 SSH 密钥登录和关闭密码登录
|
|||
|
|
echo "[Init]正在配置 SSH 密钥登录..."
|
|||
|
|
SSH_DIR="/root/.ssh"
|
|||
|
|
AUTHORIZED_KEYS="$SSH_DIR/authorized_keys"
|
|||
|
|
|
|||
|
|
# 确保 .ssh 目录存在
|
|||
|
|
mkdir -p $SSH_DIR
|
|||
|
|
chmod 700 $SSH_DIR
|
|||
|
|
|
|||
|
|
# 导入公钥
|
|||
|
|
cat <<EOF >$AUTHORIZED_KEYS
|
|||
|
|
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA4GtBuo9dezirPzwsmnyul3EwRWZFDweu1mCD7YCwt1QLFzjw3YYRpCTCDAoZOaKrV+G5W3awdidCCIWppi8QWjTG6SHvI0wo2Qszz6h5yr7znaRZlaBTKiCQsw7hhiFEVH69TclCFDNdkvbTn3cDAx8zBYYwiVnVBAqclnIlAWI9HQr8fCO5E2rJYQ4zaJZoiiJjNWk46bRtjvN1RyJ1Z1lX5zmYA6V5Wh9v54nSuI5zVlzzuox9sNJbyI3aLeBk37Z1Fc0GxkRwMlfuVHx6CZ/itHs8rVSv7oGVe+3yTu1SW2m+uVQtTXvh0+eFfajfVPpU69Jo0tOF2nlGlXkDBQ==
|
|||
|
|
EOF
|
|||
|
|
chmod 600 $AUTHORIZED_KEYS
|
|||
|
|
echo "[Init]公钥已导入！"
|
|||
|
|
|
|||
|
|
# 配置 SSHD
|
|||
|
|
echo "[Init]正在配置 SSH 服务..."
|
|||
|
|
sed -i.bak -e "s/^#*Port .*/Port $SSH_PORT/" \
|
|||
|
|
-e "s/^#*PasswordAuthentication .*/PasswordAuthentication no/" \
|
|||
|
|
-e "s/^#*PubkeyAuthentication .*/PubkeyAuthentication yes/" \
|
|||
|
|
-e "s/^#*PermitRootLogin .*/PermitRootLogin prohibit-password/" \
|
|||
|
|
/etc/ssh/sshd_config
|
|||
|
|
|
|||
|
|
systemctl restart sshd
|
|||
|
|
echo "[Init]SSH 配置完成！"
|
|||
|
|
|
|||
|
|
# 显示新的 SSH 端口
|
|||
|
|
echo "[Init]所有步骤完成！请使用以下信息连接到您的服务器："
|
|||
|
|
echo "[Init]-----------------------------------------"
|
|||
|
|
echo "[Init]SSH 端口：$SSH_PORT"
|
|||
|
|
echo "[Init]密钥认证已启用，密码登录已禁用。"
|
|||
|
|
echo "[Init]-----------------------------------------"
|