Изменения документа Proxy

Сводка

• Свойства страницы (1 изменено, 0 добавлено, 0 удалено)

Подробности

Свойства страницы

Содержимое

...	...	@@ -1,5 +1,9 @@
	1	+# Отключение ICMP
	2	+
1	1	nano disable_ping.sh
2	2
	5	+-- НЕ ввезде прокатывает )) Зависит от Хостера
	6	+
3	3	#!/usr/bin/env bash
4	4	set -e
5	5
...	...	@@ -20,7 +20,7 @@
20	20
21	21	chmod +x disable_ping.sh && ./disable_ping.sh
22	22
23		-Утилиты
	27	+# Утилиты
24	24
25	25	sudo apt update && sudo apt upgrade -y && \
26	26	sudo apt install -y \
...	...	@@ -50,7 +50,7 @@
50	50
51	51	--
52	52
53		- базовая настройка:
	57	+базовая настройка:
54	54
55	55	# UFW
56	56	sudo ufw default deny incoming
...	...	@@ -57,12 +57,88 @@
57	57	sudo ufw default allow outgoing
58	58	sudo ufw allow OpenSSH
59	59	sudo ufw enable
	64	+
	65	+### fail2ban
	66	+
	67	+ sudo apt install fail2ban -y
	68	+ sudo bash -c 'cat > /etc/fail2ban/jail.local << "JAIL"
	69	+ [DEFAULT]
	70	+ bantime = 24h
	71	+ findtime = 10m
	72	+ maxretry = 3
60	60
61		- # fail2ban (ssh-джейл по умолчанию)
62		- sudo systemctl enable --now fail2ban
	74	+ bantime.increment = true
	75	+ bantime.factor = 2
	76	+ bantime.maxtime = 4w
	77	+
	78	+ banaction = iptables-multiport
	79	+ banaction_allports = iptables-allports
	80	+
	81	+ ignoreip = 127.0.0.1/8 ::1
	82	+
	83	+ [sshd]
	84	+ enabled = true
	85	+ logpath = %(sshd_log)s
	86	+ backend = %(sshd_backend)s
	87	+ maxretry = 3
	88	+ bantime = 48h
	89	+ findtime = 15m
	90	+ mode = aggressive
	91	+
	92	+ [sshd-ddos]
	93	+ enabled = true
	94	+ logpath = %(sshd_log)s
	95	+ backend = %(sshd_backend)s
	96	+ maxretry = 5
	97	+ bantime = 24h
	98	+ findtime = 30s
	99	+
	100	+ [recidive]
	101	+ enabled = true
	102	+ logpath = /var/log/fail2ban.log
	103	+ maxretry = 3
	104	+ bantime = 4w
	105	+ findtime = 7d
	106	+ banaction = iptables-allports
	107	+ JAIL
	108	+ apt-get update
	109	+ apt-get install -y fail2ban
	110	+ systemctl enable --now fail2ban
	111	+ systemctl restart fail2ban
	112	+ echo "fail2ban настроен и запущен"
	113	+ '
	114	+ systemctl enable fail2ban
	115	+ systemctl restart fail2ban
63	63
64		-Докер
	117	+# ZSH
65	65
	119	+ sudo apt update && sudo apt install -y zsh git fonts-powerline curl && \
	120	+ sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended && \
	121	+ sed -i 's/^ZSH_THEME=.*/ZSH_THEME="agnoster"/' ~/.zshrc && \
	122	+ grep -q "^ZSH_DISABLE_COMPFIX=" ~/.zshrc && sed -i 's/^ZSH_DISABLE_COMPFIX=.*/ZSH_DISABLE_COMPFIX="true"/' ~/.zshrc || echo 'ZSH_DISABLE_COMPFIX="true"' >> ~/.zshrc && \
	123	+ sed -i 's/^plugins=(.*/plugins=(git sudo zsh-autosuggestions zsh-syntax-highlighting)/' ~/.zshrc && \
	124	+ git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions && \
	125	+ git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting && \
	126	+ printf "\nalias ll='ls -la'\nalias gs='git status'\nalias d='docker ps --format \"table {{.Names}}\t{{.Status}}\t{{.Ports}}\"'\nalias dcu='docker compose up -d'\nalias dcd='docker compose down'\nalias dl='docker logs'\nalias n='nano'\nalias lzd='lazydocker'\nalias dr='dry'\nalias dcuf='docker compose up -d --force-recreate'\nalias dv='docker ps -a --format \"table {{.Names}}\t{{.Mounts}}\"'\nalias dvc='docker ps -a --format \"{{.Mounts}}\" | tr \",\" \"\n\" | grep -v \"^$\" | sort | uniq'\nalias dvo='comm -23 <(docker volume ls -q | sort) <(docker ps -a --format \"{{.Mounts}}\" | tr \",\" \"\n\" | grep -v \"^$\" | sort | uniq)'\nalias dsp='docker system prune -a --volumes'\nalias ds='docker stats --no-stream'\nalias dcdub='docker compose down && docker compose up --build'\nalias cr_gitlab_repo='/prod/create_repo_and_push.sh'\n" >> ~/.zshrc && \
	127	+ chsh -s "$(which zsh)"
	128	+
	129	+дальше
	130	+
	131	+ exec zsh
	132	+
	133	+что делает:
	134	+
	135	+* ставит zsh, git и powerline‑шрифты
	136	+* ставит Oh My Zsh
	137	+* включает нужную тему и плагины
	138	+* добавляет твои алиасы
	139	+* включает ZSH_DISABLE_COMPFIX="true"
	140	+* делает zsh оболочкой по умолчанию
	141	+
	142	+--
	143	+
	144	+# Докер
	145	+
66	66	sudo curl -fsSL https://get.docker.com | sh &&
67	67	LATEST=$(curl -sL https://api.github.com/repos/docker/compose/releases/latest | grep '"tag_name":' | cut -d'"' -f4)
68	68	DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
...	...	@@ -71,16 +71,14 @@
71	71	chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose
72	72	docker compose version
73	73
74		-Управление докером
	154	+## Управление докером
75	75
76		-ctop
	156	+### ctop
77	77
78	78	sudo wget https://github.com/bcicen/ctop/releases/download/v0.7.7/ctop-0.7.7-linux-amd64 -O /usr/local/bin/ctop
79	79	sudo chmod +x /usr/local/bin/ctop
80	80
81		-lzd
	161	+### lzd
82	82
83	83	DIR=/usr/local/bin \
84		- bash -c 'curl -fsSL https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bash && echo "alias lzd='\''lazydocker'\''" >> "$HOME/.zshrc"'
85		-
86		-
	164	+ curl -fsSL https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | sudo DIR=/usr/local/bin bash && echo "alias lzd='lazydocker'" >> "$HOME/.zshrc"