服务器初始化安全脚本

服务器初始化安全脚本

#!/bin/bash
# 服务器初始化安全配置

# 创建非 root 用户
adduser deploy
usermod -aG sudo deploy

# SSH 加固
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

# 防火墙
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

# 安装 Fail2Ban
apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

# 自动更新
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades