阿里云server安全设定

1、打开所有的服务云盾

 

2、通过防火墙策略限制对外扫描行为

请您依据您的server操作系统，下载相应的脚本执行，执行后您的防火墙策略会封禁对外发包的行为，确保您的主机不会再出现恶意发包的情况，为您进行兴许数据备份操作提供足够的时间。

Window2003的批处理文件下载地址：http://oss.aliyuncs.com/aliyunecs/windows2003_drop_port.bat

Window2008的批处理文件下载地址：http://oss.aliyuncs.com/aliyunecs/windows2008_drop_port.bat

Linux系统脚本：http://oss.aliyuncs.com/aliyunecs/linux_drop_port.sh

上述文件下载到机器内部直接运行就可以。

文件内容例如以下：

#!/bin/bash
#########################################
#Function:    linux drop port
#Usage:       bash linux_drop_port.sh
#Author:      Customer Service Department
#Company:     Alibaba Cloud Computing
#Version:     2.0
#########################################
 
check_os_release()
{
 while true
  do
   os_release=$(grep "Red Hat Enterprise Linux Server release"/etc/issue 2>/dev/null)
   os_release_2=$(grep "Red Hat Enterprise Linux Server release"/etc/redhat-release 2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
     if echo "$os_release"|grep "release 5" >/dev/null2>&1
     then
       os_release=redhat5
       echo "$os_release"
     elif echo "$os_release"|grep "release 6">/dev/null 2>&1
     then
       os_release=redhat6
       echo "$os_release"
     else
       os_release=""
       echo "$os_release"
     fi
     break
   fi
   os_release=$(grep "Aliyun Linux release" /etc/issue2>/dev/null)
   os_release_2=$(grep "Aliyun Linux release" /etc/aliyun-release2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
     if echo "$os_release"|grep "release 5" >/dev/null2>&1
     then
       os_release=aliyun5
       echo "$os_release"
     elif echo "$os_release"|grep "release 6">/dev/null 2>&1
     then
       os_release=aliyun6
       echo "$os_release"
     else
       os_release=""
       echo "$os_release"
     fi
     break
   fi
   os_release=$(grep "CentOS release" /etc/issue 2>/dev/null)
   os_release_2=$(grep "CentOS release" /etc/*release2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
     if echo "$os_release"|grep "release 5" >/dev/null2>&1
     then
       os_release=centos5
        echo "$os_release"
     elif echo "$os_release"|grep "release 6">/dev/null 2>&1
     then
       os_release=centos6
       echo "$os_release"
     else
       os_release=""
       echo "$os_release"
     fi
     break
   fi
   os_release=$(grep -i "ubuntu" /etc/issue 2>/dev/null)
   os_release_2=$(grep -i "ubuntu" /etc/lsb-release2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
     if echo "$os_release"|grep "Ubuntu 10" >/dev/null2>&1
     then
        os_release=ubuntu10
       echo "$os_release"
     elif echo "$os_release"|grep "Ubuntu 12.04">/dev/null 2>&1
     then
       os_release=ubuntu1204
       echo "$os_release"
     elif echo "$os_release"|grep "Ubuntu 12.10">/dev/null 2>&1
      then
       os_release=ubuntu1210
       echo "$os_release"
     else
       os_release=""
       echo "$os_release"
     fi
     break
   fi
   os_release=$(grep -i "debian" /etc/issue 2>/dev/null)
   os_release_2=$(grep -i "debian" /proc/version 2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
     if echo "$os_release"|grep "Linux 6" >/dev/null2>&1
     then
       os_release=debian6
       echo "$os_release"
     else
        os_release=""
       echo "$os_release"
     fi
     break
   fi
   os_release=$(grep "openSUSE" /etc/issue 2>/dev/null)
   os_release_2=$(grep "openSUSE" /etc/*release 2>/dev/null)
   if [ "$os_release" ] && [ "$os_release_2" ]
   then
      if echo "$os_release"|grep"13.1" >/dev/null 2>&1
     then
       os_release=opensuse131
       echo "$os_release"
     else
       os_release=""
       echo "$os_release"
     fi
     break
   fi
   break
   done
}
 
exit_script()
{
 echo -e "33[1;40;31mInstall $1 error,will exit.
33[0m"
  rm-f $LOCKfile
 exit 1
}
 
config_iptables()
{
 iptables -I OUTPUT 1 -p tcp -m multiport --dport21,22,23,25,53,80,135,139,443,445 -j DROP
 iptables -I OUTPUT 2 -p tcp -m multiport --dport 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186-j DROP
 iptables -I OUTPUT 3 -p udp -j DROP
 iptables -nvL
}
 
ubuntu_config_ufw()
{
  ufwdeny out proto tcp to any port 21,22,23,25,53,80,135,139,443,445
  ufwdeny out proto tcp to any port 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186
  ufwdeny out proto udp to any
  ufwstatus
}
 
####################Start###################
#check lock file ,one time only let thescript run one time
LOCKfile=/tmp/.$(basename $0)
if [ -f "$LOCKfile" ]
then
 echo -e "33[1;40;31mThe script is already exist,please next timeto run this script.
33[0m"
 exit
else
 echo -e "33[40;32mStep 1.No lock file,begin to create lock fileand continue.
33[40;37m"
 touch $LOCKfile
fi
 
#check user
if [ $(id -u) != "0" ]
then
 echo -e "33[1;40;31mError: You must be root to run this script,please use root to execute this script.
33[0m"
  rm-f $LOCKfile
 exit 1
fi
 
echo -e "33[40;32mStep 2.Begen tocheck the OS issue.
33[40;37m"
os_release=$(check_os_release)
if [ "X$os_release" =="X" ]
then
 echo -e "33[1;40;31mThe OS does not identify,So this script isnot executede.
33[0m"
  rm-f $LOCKfile
 exit 0
else
 echo -e "33[40;32mThis OS is $os_release.
33[40;37m"
fi
 
echo -e "33[40;32mStep 3.Begen toconfig firewall.
33[40;37m"
case "$os_release" in
redhat5|centos5|redhat6|centos6|aliyun5|aliyun6)
 service iptables start
 config_iptables
  ;;
debian6)
 config_iptables
  ;;
ubuntu10|ubuntu1204|ubuntu1210)
  ufwenable <<EOF
y
EOF
 ubuntu_config_ufw
  ;;
opensuse131)
 config_iptables
  ;;
esac
 
echo -e "33[40;32mConfig firewallsuccess,this script now exit!
33[40;37m"
rm -f $LOCKfile

3、设置iptables，限制訪问

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z

/sbin/iptables -A INPUT -i lo -j ACCEPT 
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -P INPUT DROP
 service iptables save

以上脚本，在每次重装完系统后运行一次就可以，其配置会保存至/etc/sysconfig/iptables

此步骤參考http://www.netingcn.com/aliyun-iptables.html

因为作为webserver来使用，所以对外要开放 80 port，另外肯定要通过ssh进行server管理，22 port也要对外开放。当然最好是把ssh服务的默认port改掉，在公网上会有非常多人试图破解password的。假设改动port。记得要把该port对外开发，否则连不上就悲剧了。

以下提供配置规则的具体说明：

第一步：清空全部规则

当Chain INPUT (policy DROP)时运行/sbin/iptables -F后，你将和server断开连接
全部在清空全部规则前把policy DROP该为INPUT，防止悲剧发生，小心小心再小心
/sbin/iptables -P INPUT ACCEPT
清空全部规则
/sbin/iptables -F
/sbin/iptables -X
计数器置0
/sbin/iptables -Z

第二步：设置规则

同意来自于lo接口的数据包，假设没有此规则，你将不能通过127.0.0.1訪问本地服务，比如ping 127.0.0.1
/sbin/iptables -A INPUT -i lo -j ACCEPT 

开放TCP协议22端口，以便能ssh，假设你是在有固定ip的场所。能够使用 -s 来限定client的ip
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT

开放TCP协议80端口供web服务
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

10.241.121.15是另外一台server的内网ip，因为之间有通信，接受全部来自10.241.121.15的TCP请求
/sbin/iptables -A INPUT -p tcp -s 10.241.121.15 -j ACCEPT

接受ping
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

这条规则參看：http://www.netingcn.com/iptables-localhost-not-access-internet.html
/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

屏蔽上述规则以为的全部请求，必不可少。否则防火墙没有不论什么过滤的功能
/sbin/iptables -P INPUT DROP

能够使用 iptables -L -n 查看规则是否生效

至此防火墙就算配置好，可是这是暂时的，当重新启动iptables或重新启动机器，上述配置就会被清空。要想永久生效，还须要例如以下操作：

/etc/init.d/iptables save   
或
service iptables save

运行上述命令能够在文件 /etc/sysconfig/iptables 中看到配置

下面提供一个干净的配置脚本：

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z

/sbin/iptables -A INPUT -i lo -j ACCEPT 
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 10.241.121.15 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -P INPUT DROP 

最后运行 。先确保ssh连接没有问题，防止规则错误。导致无法连上server。由于没有save。重新启动server规则都失效，否则就仅仅有去机房才干改动规则了。也能够參考：ubuntu iptables 配置脚本来写一个脚本。

4、经常使用网络监控命令

（1） netstat -tunl：查看全部正在监听的port

[root@AY1407041017110375bbZ ~]# netstat -tunl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
udp        0      0 ip:123           0.0.0.0:*                               
udp        0      0 ip:123           0.0.0.0:*                               
udp        0      0 127.0.0.1:123               0.0.0.0:*                               
udp        0      0 0.0.0.0:123                 0.0.0.0:*  

当中123port用于NTP服务。

（2）netstat  -tunp：查看全部已连接的网络连接状态，并显示其PID及程序名称。

[root@AY1407041017110375bbZ ~]# netstat -tunp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0     96 ip:22            221.176.33.126:52699        ESTABLISHED 926/sshd            
tcp        0      0 ip:34385         42.156.166.25:80            ESTABLISHED 1003/aegis_cli  

依据上述结果，能够依据须要kill掉对应进程。

如:

kill -9 1003

（3）netstat -tunlp

（4）netstat经常使用选项说明：

-t: tcp   

-u : udp
-l, --listening
       Show only listening sockets.  (These are omitted by default.)
-p, --program
       Show the PID and name of the program to which each socket belongs.
--numeric , -n
Show numerical addresses instead of trying to determine symbolic host, port or user names.

5、改动ssh的监听port

（1）改动 /etc/ssh/sshd_config 

原有的port 22

改为port 44

（2）重新启动服务

/etc/init.d/sshd restart
（3）查看情况

 netstat -tunl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:44               0.0.0.0:*                   LISTEN      
udp        0      0 ip:123           0.0.0.0:*                               
udp        0      0 ip:123           0.0.0.0:*                               
udp        0      0 127.0.0.1:123               0.0.0.0:*                               
udp        0      0 0.0.0.0:123                 0.0.0.0:*   

版权声明：本文博客原创文章，博客，未经同意，不得转载。