Исходный код вики Proxy
Версия 5.1 от Anton Krivchenkov на 02.03.2026 11:03
Последние авторы
| author | version | line-number | content |
|---|---|---|---|
| 1 | # Отключение ICMP | ||
| 2 | |||
| 3 | nano disable_ping.sh | ||
| 4 | |||
| 5 | -- НЕ ввезде прокатывает )) Зависит от Хостера | ||
| 6 | |||
| 7 | #!/usr/bin/env bash | ||
| 8 | set -e | ||
| 9 | |||
| 10 | # Требуются root-права | ||
| 11 | |||
| 12 | # Запретить входящие ICMP echo-request (ping) IPv4 | ||
| 13 | iptables -A INPUT -p icmp --icmp-type echo-request -j DROP # [web:6][web:9] | ||
| 14 | |||
| 15 | # Если используешь IPv6, можно дополнительно глушануть и его: | ||
| 16 | ip6tables -A INPUT -p ipv6-icmp --icmpv6-type echo-request -j DROP # [web:9] | ||
| 17 | |||
| 18 | # Чтобы убедиться: | ||
| 19 | echo "Текущие правила ICMP:" | ||
| 20 | iptables -L INPUT -n | grep icmp || true | ||
| 21 | ip6tables -L INPUT -n | grep icmp || true | ||
| 22 | |||
| 23 | применяем | ||
| 24 | |||
| 25 | chmod +x disable_ping.sh && ./disable_ping.sh | ||
| 26 | |||
| 27 | # Утилиты | ||
| 28 | |||
| 29 | sudo apt update && sudo apt upgrade -y && \ | ||
| 30 | sudo apt install -y \ | ||
| 31 | gpg btop ncdu nload iperf3 mc htop net-tools curl wget tree \ | ||
| 32 | git vim tmux mtr traceroute dnsutils iproute2 \ | ||
| 33 | jq lsof rsync unzip zip \ | ||
| 34 | netcat-openbsd socat \ | ||
| 35 | bash-completion \ | ||
| 36 | unattended-upgrades ufw fail2ban && \ | ||
| 37 | sudo dpkg-reconfigure -plow unattended-upgrades && \ | ||
| 38 | sudo apt clean && sudo apt autoremove -y | ||
| 39 | |||
| 40 | Кратко, зачем что: | ||
| 41 | |||
| 42 | * git – конфиги, dotfiles, скрипты.xda-developers+1 | ||
| 43 | * vim – базовый редактор всегда под рукой.tecmint+1 | ||
| 44 | * tmux – мультиплексор, чтобы сессии не умирали по SSH.admin-companion+1 | ||
| 45 | * mtr, traceroute – диагностика сети, трассировка + статистика.linuxblog+1 | ||
| 46 | * dnsutils – dig, nslookup для проверки DNS.[linuxblog](https://linuxblog.io/linux-sysadmin-tools/) | ||
| 47 | * iproute2 – современный стек ip, ss и т.п. (обычно уже стоит, но можно дотащить).manpages.ubuntu+1 | ||
| 48 | * jq – парсинг JSON в CLI (API, kubectl, docker и т.д.).tecmint+1 | ||
| 49 | * lsof – кто держит порт/файл, очень выручает.dedirock+1 | ||
| 50 | * rsync – бэкапы, заливка на другие сервера.[linuxblog](https://linuxblog.io/linux-sysadmin-tools/) | ||
| 51 | * unzip/zip – работа с zip‑архивами.[linuxblog](https://linuxblog.io/linux-sysadmin-tools/) | ||
| 52 | * netcat-openbsd, socat – проверки портов, простые TCP/UDP туннели.dedirock+1 | ||
| 53 | * bash-completion – автодополнение в bash (если на нём что‑то будешь делать).[linuxblog](https://linuxblog.io/linux-sysadmin-tools/) | ||
| 54 | |||
| 55 | -- | ||
| 56 | |||
| 57 | базовая настройка: | ||
| 58 | |||
| 59 | # UFW | ||
| 60 | sudo ufw default deny incoming | ||
| 61 | sudo ufw default allow outgoing | ||
| 62 | sudo ufw allow OpenSSH | ||
| 63 | sudo ufw enable | ||
| 64 | |||
| 65 | |||
| 66 | `sudo apt install fail2ban -y | ||
| 67 | sudo bash -c 'cat > /etc/fail2ban/jail.local << "JAIL" | ||
| 68 | [DEFAULT] | ||
| 69 | bantime = 24h | ||
| 70 | findtime = 10m | ||
| 71 | maxretry = 3 | ||
| 72 | |||
| 73 | bantime.increment = true | ||
| 74 | bantime.factor = 2 | ||
| 75 | bantime.maxtime = 4w | ||
| 76 | |||
| 77 | banaction = iptables-multiport | ||
| 78 | banaction_allports = iptables-allports | ||
| 79 | |||
| 80 | ignoreip = 127.0.0.1/8 ::1 | ||
| 81 | |||
| 82 | [sshd] | ||
| 83 | enabled = true | ||
| 84 | logpath = %(sshd_log)s | ||
| 85 | backend = %(sshd_backend)s | ||
| 86 | maxretry = 3 | ||
| 87 | bantime = 48h | ||
| 88 | findtime = 15m | ||
| 89 | mode = aggressive | ||
| 90 | |||
| 91 | [sshd-ddos] | ||
| 92 | enabled = true | ||
| 93 | logpath = %(sshd_log)s | ||
| 94 | backend = %(sshd_backend)s | ||
| 95 | maxretry = 5 | ||
| 96 | bantime = 24h | ||
| 97 | findtime = 30s | ||
| 98 | |||
| 99 | [recidive] | ||
| 100 | enabled = true | ||
| 101 | logpath = /var/log/fail2ban.log | ||
| 102 | maxretry = 3 | ||
| 103 | bantime = 4w | ||
| 104 | findtime = 7d | ||
| 105 | banaction = iptables-allports | ||
| 106 | JAIL | ||
| 107 | apt-get update | ||
| 108 | apt-get install -y fail2ban | ||
| 109 | systemctl enable --now fail2ban | ||
| 110 | systemctl restart fail2ban | ||
| 111 | echo "fail2ban настроен и запущен" | ||
| 112 | ' | ||
| 113 | systemctl enable fail2ban | ||
| 114 | systemctl restart fail2ban` | ||
| 115 | |||
| 116 | # ZSH | ||
| 117 | |||
| 118 | sudo apt update && sudo apt install -y zsh git fonts-powerline curl && \ | ||
| 119 | sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended && \ | ||
| 120 | sed -i 's/^ZSH_THEME=.*/ZSH_THEME="agnoster"/' ~/.zshrc && \ | ||
| 121 | grep -q "^ZSH_DISABLE_COMPFIX=" ~/.zshrc && sed -i 's/^ZSH_DISABLE_COMPFIX=.*/ZSH_DISABLE_COMPFIX="true"/' ~/.zshrc || echo 'ZSH_DISABLE_COMPFIX="true"' >> ~/.zshrc && \ | ||
| 122 | sed -i 's/^plugins=(.*/plugins=(git sudo zsh-autosuggestions zsh-syntax-highlighting)/' ~/.zshrc && \ | ||
| 123 | git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions && \ | ||
| 124 | git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting && \ | ||
| 125 | printf "\nalias ll='ls -la'\nalias gs='git status'\nalias d='docker ps --format \"table {{.Names}}\t{{.Status}}\t{{.Ports}}\"'\nalias dcu='docker compose up -d'\nalias dcd='docker compose down'\nalias dl='docker logs'\nalias n='nano'\nalias lzd='lazydocker'\nalias dr='dry'\nalias dcuf='docker compose up -d --force-recreate'\nalias dv='docker ps -a --format \"table {{.Names}}\t{{.Mounts}}\"'\nalias dvc='docker ps -a --format \"{{.Mounts}}\" | tr \",\" \"\n\" | grep -v \"^$\" | sort | uniq'\nalias dvo='comm -23 <(docker volume ls -q | sort) <(docker ps -a --format \"{{.Mounts}}\" | tr \",\" \"\n\" | grep -v \"^$\" | sort | uniq)'\nalias dsp='docker system prune -a --volumes'\nalias ds='docker stats --no-stream'\nalias dcdub='docker compose down && docker compose up --build'\nalias cr_gitlab_repo='/prod/create_repo_and_push.sh'\n" >> ~/.zshrc && \ | ||
| 126 | chsh -s "$(which zsh)" | ||
| 127 | |||
| 128 | дальше | ||
| 129 | |||
| 130 | exec zsh | ||
| 131 | |||
| 132 | что делает: | ||
| 133 | |||
| 134 | * ставит zsh, git и powerline‑шрифты | ||
| 135 | * ставит Oh My Zsh | ||
| 136 | * включает нужную тему и плагины | ||
| 137 | * добавляет твои алиасы | ||
| 138 | * включает ZSH_DISABLE_COMPFIX="true" | ||
| 139 | * делает zsh оболочкой по умолчанию | ||
| 140 | |||
| 141 | -- | ||
| 142 | |||
| 143 | # Докер | ||
| 144 | |||
| 145 | sudo curl -fsSL https://get.docker.com | sh && | ||
| 146 | LATEST=$(curl -sL https://api.github.com/repos/docker/compose/releases/latest | grep '"tag_name":' | cut -d'"' -f4) | ||
| 147 | DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker} | ||
| 148 | mkdir -p $DOCKER_CONFIG/cli-plugins | ||
| 149 | curl -sSL https://github.com/docker/compose/releases/download/$LATEST/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose | ||
| 150 | chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose | ||
| 151 | docker compose version | ||
| 152 | |||
| 153 | ## Управление докером | ||
| 154 | |||
| 155 | ### ctop | ||
| 156 | |||
| 157 | sudo wget https://github.com/bcicen/ctop/releases/download/v0.7.7/ctop-0.7.7-linux-amd64 -O /usr/local/bin/ctop | ||
| 158 | sudo chmod +x /usr/local/bin/ctop | ||
| 159 | |||
| 160 | ### lzd | ||
| 161 | |||
| 162 | DIR=/usr/local/bin \ | ||
| 163 | bash -c 'curl -fsSL https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bash && echo "alias lzd='\''lazydocker'\''" >> "$HOME/.zshrc"' |