轻量服务器加固实践：五层防线与零新增组件

1
2
3
4
5
6

ss -tlnp                                           # 谁在监听
systemctl list-units --type=service --state=running
sshd -T | grep -E 'permitroot|password|maxauth'    # sshd 实际生效配置
nft list ruleset                                   # 防火墙现状
last -n 10 -F                                      # 谁登录过
apt list --upgradable                              # 有没有欠账的补丁

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        iif lo accept
        ct state established,related accept
        ct state invalid drop

        # DHCP / DHCPv6 client: lease replies must be able to come back
        udp dport 68 accept
        udp dport 546 accept

        # ICMP / ICMPv6: path-MTU discovery, neighbour discovery, diagnostics
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        # SSH
        tcp dport 22 accept

        # LLM API distribution service (Go)
        tcp dport 8338 accept
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

PermitRootLogin prohibit-password
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthenticationMethods publickey
PermitEmptyPasswords no
AllowUsers root
MaxAuthTries 3
MaxSessions 4
MaxStartups 3:50:10
LoginGraceTime 30
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
AllowStreamLocalForwarding no
PermitUserEnvironment no
LogLevel VERBOSE
ClientAliveInterval 300
ClientAliveCountMax 3

# --- algorithm restriction: ssh-audit Debian 13 Server hardening guide ---
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
RequiredRSASize 3072

# --- audit: log sftp file access (Mozilla OpenSSH guidelines) ---
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# /etc/fail2ban/jail.d/defaults-debian.conf
[DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]

[sshd]
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
enabled = true

# /etc/fail2ban/jail.d/99-tune.conf
[sshd]
bantime = 1h
findtime = 30m

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# /etc/sysctl.d/99-hardening.conf
kernel.kptr_restrict = 2
kernel.yama.ptrace_scope = 1
kernel.dmesg_restrict = 1
fs.suid_dumpable = 0
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_fifos = 2
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
kernel.kexec_load_disabled = 1
kernel.unprivileged_bpf_disabled = 2

1
2
3
4
5

# /etc/sysctl.d/98-network-perf.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_slow_start_after_idle = 0

1
2
3

// /etc/apt/apt.conf.d/52auto-reboot
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:30";

1
2
3
4
5
6
7
8
9

[Service]
DynamicUser=yes
NoNewPrivileges=true
ProtectSystem=strict
PrivateTmp=yes
CapabilityBoundingSet=
SystemCallFilter=@system-service
IPAddressAllow=10.0.0.0/8
MemoryMax=512M

1
2
3

grep -q '^AllowStreamLocalForwarding' /etc/ssh/sshd_config.d/99-hardening.conf \
  || echo 'AllowStreamLocalForwarding no' >> /etc/ssh/sshd_config.d/99-hardening.conf
sshd -t && systemctl reload ssh && echo OK