【初始】
apt install -y cron rsync openssl xinetd haveged iptables lsb-release ca-certificates apt-transport-https
grep -q 'net.core.default_qdisc' /etc/sysctl.conf || echo 'net.core.default_qdisc=fq' >> /etc/sysctl.conf && grep -q 'net.ipv4.tcp_congestion_control' /etc/sysctl.conf || echo 'net.ipv4.tcp_congestion_control=bbr' >> /etc/sysctl.conf && sysctl -p && lsmod | grep bbr
sed -i 's/^#*PermitRootLogin.*$/PermitRootLogin yes/gi' /etc/ssh/sshd_config && sed -i 's/^#*Port.*$/Port 3828/gi' /etc/ssh/sshd_config
iptables -A INPUT -p tcp --dport 3828 -j ACCEPT && iptables-save > /etc/iptables.up.rules && iptables -L -n
firewall-cmd --zone=public --add-port=3828/tcp --permanent && firewall-cmd --reload
ufw allow 3828 && ufw reload
service sshd restart
【NGINX】
apt remove apache* && apt install -y nginx && service nginx start
sed -i 's/^\s*access_log.*$/access_log off;/gi' /etc/nginx/nginx.conf && sed -i 's/^\s*error_log\(.*\.log\).*;/error_log \1 emerg;/gi' /etc/nginx/nginx.conf && grep -q 'client_max_body_size' /etc/nginx/nginx.conf || sed -i '/http {/a\client_max_body_size 100M;' /etc/nginx/nginx.conf && cat /etc/nginx/nginx.conf && service nginx restart
mkdir -p /www && openssl req -nodes -new -x509 -subj '/CN=/O=/C=' -newkey ec:<(openssl ecparam -name prime256v1) -keyout /www/_ssl.key -out /www/_ssl.crt && echo -e 'server {\nlisten 80 default_server;\nserver_name _;\nreturn 444;\nlisten 443 ssl default_server;\nssl_certificate /www/_ssl.crt;\nssl_certificate_key /www/_ssl.key;\n}' > /etc/nginx/sites-enabled/default && chown www-data:www-data /www/_ssl.crt && chown www-data:www-data /www/_ssl.key && chmod 700 /www/_ssl.crt && chmod 700 /www/_ssl.key && service nginx restart
【NGINX-WEB】
read -p '■ Domain: ' weburl && webdir=${weburl//./_} && mkdir -p /www/$webdir && chown www-data:www-data /www/$webdir && chmod 770 /www/$webdir && echo -e "server {\nlisten 80;\nserver_name $weburl www.$weburl;\nindex index.php index.html index.htm;\nroot /www/$webdir;\n#if (\$host != '$weburl') {\n#rewrite ^(.*)\$ https://$weburl\$1 permanent;\n#}\nif (\$scheme != 'https') {\nrewrite ^(.*)\$ https://\$host\$1 permanent;\n}\nlocation ~* \.php\$ {\ninclude fastcgi_params;\nfastcgi_pass unix:/var/php.sock;\nfastcgi_param SCRIPT_FILENAME \$request_filename;\nfastcgi_param PHP_VALUE "open_basedir=\$document_root:/tmp/:/proc/";\n}\nlocation / {\ntry_files \$uri \$uri/ /index.php?\$args;\n}\n}" > /etc/nginx/sites-enabled/$webdir.conf && cat /etc/nginx/sites-enabled/$webdir.conf && service nginx restart
【SSL】
apt install -y snapd && snap install core && snap install --classic certbot && ln -sf /snap/bin/certbot /usr/bin/certbot
snap refresh core && apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.certbot.* && certbot --nginx --no-redirect --register-unsafely-without-email
【PHP】 # disable_functions = shell_exec,passthru,system,exec,eval,
apt install -y php-fpm php-xml php-opcache php-mbstring php-curl php-zip php-gd php-mysql php-sqlite3
sed -i 's/^memory_limit.*$/memory_limit = 512M/gi; s/^post_max_size.*$/post_max_size = 100M/gi; s/^upload_max_filesize.*$/upload_max_filesize = 100M/gi; s/^mysqlnd.collect_statistics.*$/mysqlnd.collect_statistics = Off/gi; s/^;opcache.enable.*$/opcache.enable = 1/gi; s/^;opcache.revalidate_freq.*$/opcache.revalidate_freq = 60/gi;' `find /etc/php -path '*/php.ini'` && sed -i 's/^listen.*\.sock$/listen = \/var\/php\.sock/gi; s/^pid.*\.pid$/pid = \/var\/php\.pid/gi;' `find /etc/php -path '*.conf'` && service php*-fpm restart --all
【SQL】
apt install -y mariadb-server && service mariadb start && mysql_secure_installation
mkdir -p /www/_ && webpwd=`tr -cd '[:alnum:]' </dev/urandom | head -c 16` && mysqladmin -u root -p password "$webpwd" && echo -e "[client]\nuser=root\npassword=$webpwd\n[mysqldump]\nuser=root\npassword=$webpwd" > /www/_mysql && chown mysql:mysql /www/_mysql && chmod 700 /www/_mysql
【SQL-WEB】
read -p '■ Domain: ' weburl && read -p '■ Minute: ' webmin && webdir=${weburl//./_} && webpwd=`tr -cd '[:alnum:]' </dev/urandom | head -c 16` && mysql --defaults-file=/www/_mysql -e "CREATE USER IF NOT EXISTS '$webdir'@'localhost' IDENTIFIED BY '$webpwd'; CREATE DATABASE IF NOT EXISTS $webdir CHARACTER SET utf8mb4 COLLATE utf8mb4_bin; GRANT ALL ON $webdir.* TO '$webdir'@'localhost';" && newcron="$webmin 1 * * * mysqldump --defaults-file=/www/_mysql $webdir | gzip> /www/$webdir.sql.gz" && cat <(fgrep -i -v "$newcron" <(crontab -l)) <(echo "$newcron") | crontab - && crontab -l && echo "$webdir $webpwd"
你可能高估别人了
