购买阿里云服务器后的基本安全配置
1.创建实例前,先创建ssh密钥对,只允许密钥对进行远程登录。具体见:https://help.aliyun.com/document_detail/51792.html?spm=5176.2020520101.193.1.CChOuj
2.配置自动快照策略,每日一备份,不过貌似现在这个功能开始收费了。具体:
3.安装安骑士进行服务器安全保护。具体:
4.配置主机访问控制,限制和允许ip访问特定端口。具体:
5.配置安全组,限制和允许ip访问特定端口,默认如下,表示无限制:
具体:
6.配置主机防火墙。具体:
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
#ssh default 222.209.0.0/21=222.209.0.0~222.209.8.0
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
#http default
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# https default
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
# ftp default
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# ftp passive
-A INPUT -p tcp -m state --state NEW -m tcp --dport 30000:40000 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# tomcat default jenkins
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
# my tomcat
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -j ACCEPT
# my tomcat wiki
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8070 -j ACCEPT
# my tomcat debug
-A INPUT -p tcp -m state --state NEW -m tcp --dport 9999 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# svn default
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3690 -j ACCEPT
# redis cluster
-A INPUT -p tcp -m state --state NEW -m tcp --dport 7001:7006 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# redis cluster total line
-A INPUT -p tcp -m state --state NEW -m tcp --dport 17001:17006 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# mysql default
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -s 183.222.9.18,222.209.0.0/21,本服务器公网ip -j ACCEPT
# my udp
-A INPUT -p udp -m state --state NEW -m udp --dport 8888 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
注:183.222.9.18,222.209.0.0/21表示只允许ip大概222.209.0.0到222.209.8.0和183.222.9.18访问。21的子网掩码为:255.255.248.0,内有2048个主机。故从222.209.0.0往上加,满256进一,一直加完2048,截止的ip就是222.209.8.0
原文地址:https://blog.csdn.net/localhost01/article/details/78170615
本文由主机测评网发布,不代表主机测评网立场,转载联系作者并注明出处:https://zhuji.jb51.net/yunfuwuqi/408.html