# This file is generated from information provided by the datasource. Changes # to it will not persist across an instance reboot. To disable cloud-init's # network configuration capabilities, write a file # /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following: # network: {config: disabled} network: ethernets: ens33: dhcp4: true version: 2 renderer: NetworkManager
# /etc/fstab: static file system information. # # Use'blkid' to print the universally unique identifier for a # device; this may be used withUUID= as a more robust way to name devices # that works even if disks are added and removed. Seefstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> # / was on /dev/sda2 during curtin installation /dev/disk/by-uuid/ff80e2ef / ext4 defaults 0 1 # /boot/efi was on /dev/sda1 during curtin installation /dev/disk/by-uuid/5AAF-235C /boot/efi vfat defaults 0 1 # /swap.img none swap sw 0 0 UUID=f26c008c /srv/volume_1 auto nofail 0 0 UUID=2a4f759b /srv/volume_2 auto nofail 0 0
ubtest@ubuntutest:~$ sudo adduser test Adding user `test' ... Adding new user `test' (1002) with group `users' ... Creating home directory `/mnt/volume_1/data/home/test' ... Copying files from `/etc/skel' ... New password: //新用户密码 Retype new password: //再次确认新用户密码 passwd: password updated successfully Changing the user information for test Enter the new value, or press ENTER for the default Full Name []: test //新用户全名，建议填写 Room Number []: //房间号码 Work Phone []: //工作电话 Home Phone []: //家庭电话 Other []: //其他 Is the information correct? [Y/n] y //这些信息是否正确？
Please select the mail server configuration type that best meets your needs.
Systemswith dynamic IP addresses, including dialup systems, should generally be configured to send outgoing mail to another machine, called a 'smarthost'for delivery because many receiving systems on the Internet block incoming mail from dynamic IP addresses as spam protection.
A system with a dynamic IP address can receive its own mail, or local delivery can be disabled entirely (except mail for root and postmaster).
1. internet site; mail is sent and received directly usingSMTP 2. mail sent by smarthost; received via SMTP or fetchmail 3. mail sent by smarthost; no local mail 4. local delivery only; not on a network 5. no configuration at this time General type of mail configuration:
# # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). Thedefault is to use the # traditional Unix authentication mechanisms. # # Asof pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage ofthis, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block) auth required pam_faillock.so preauth audit silent deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth [success=1default=ignore] pam_unix.so nullok # here's the fallback if no module succeeds # BEGIN ANSIBLE MANAGED BLOCK auth [default=die] pam_faillock.so authfail audit deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth sufficient pam_faillock.so authsucc audit deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_cap.so # end of pam-auth-update config
# # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. Thedefault is to # only deny service to users whose accounts are expired in /etc/shadow. # # Asof pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage ofthis, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. #
# here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config account required pam_faillock.so
#%PAM-1.0 auth required pam_sepermit.so auth substack common-auth auth optional pam_ssh_add.so # Set up user limits from /etc/security/limits.conf. session required pam_limits.so
保存后退出即刻生效。
5.7限制用户SU
限制能su到root的用户。操作步骤
使用命令：
1
sudo vim /etc/pam.d/su
修改配置文件，在配置文件中添加行。例如，只允许sudo组用户su到root，则添加
1
auth required pam_wheel.so group=sudo
添加后如下所示：
1 2 3 4 5 6
# # ThePAM configuration file for the Shadow`su' service # auth required pam_wheel.so group=sudo # This allows root to su without passwords (normal operation) auth sufficient pam_rootok.so
# 在 history 命令中启用时间戳 exportHISTTIMEFORMAT="%F %T " # 记录所有用户的登录和操作日志 history USER=`whoami` USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'` if [ "$USER_IP" = "" ]; then USER_IP=`hostname` fi if [ ! -d /var/log/history ]; then mkdir /var/log/history chmod 777 /var/log/history fi if [ ! -d /var/log/history/${LOGNAME} ]; then mkdir /var/log/history/${LOGNAME} chmod 300 /var/log/history/${LOGNAME} fi exportHISTSIZE=4096 DT=`date +"%Y%m%d_%H:%M:%S"` exportHISTFILE="/var/log/history/${LOGNAME}/${USER}@${USER_IP}_$DT" chmod 600 /var/log/history/${LOGNAME}/*history* 2>/dev/null
# bypass ban/unban for restored tickets norestored = 1
# Option: actionstart # Notes.: command executed on demand at the first ban (or at the start ofFail2Banif actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "你好！\n 监视到【<name>】服务已成功启动。\n 敬请注意！\n Fail2Ban"|mail -s "[Fail2Ban] <name>: 在 <fq-hostname> 服务器上启动" <dest>
# Option: actionstop # Notes.: command executed at the stop ofjail (or at the end ofFail2Ban) # Values: CMD # actionstop = printf %%b "你好！\n 监视到【<name>】服务已被停止。\n 敬请注意！\n Fail2Ban"|mail -s "[Fail2Ban] <name>: 在 <fq-hostname> 服务器上停止" <dest>
# Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # actioncheck =
# Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed withFail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionban = printf %%b "警告!!!\n 攻击者IP：<ip>\n 被攻击机器名：`uname -n` \n 被攻击机器IP：`/bin/curl ifconfig.co` \n 攻击服务：<name> \n 攻击次数：<failures> 次 \n 攻击方法：暴力破解，尝试弱口令.\n 该IP：<ip>已经被Fail2Ban加入防火墙黑名单,屏蔽时间<bantime>秒.\n\n 以下是攻击者 <ip>信息 :\n `/bin/curl https://ip.appworlds.cn?ip=<ip>`\n\n Fail2Ban邮件提醒\n\n "|/bin/mailx -s "<fq-hostname>服务器:<name>服务疑似遭到<ip>暴力攻击。" <dest>
# Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed withFail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionunban =
cat <<EOF > /etc/apt/sources.list # 默认注释了源码镜像以提高 apt update 速度，如有需要可自行取消注释 deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm main contrib non-free non-free-firmware # deb-src https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm main contrib non-free non-free-firmware
deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-updates main contrib non-free non-free-firmware # deb-src https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-updates main contrib non-free non-free-firmware
deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-backports main contrib non-free non-free-firmware # deb-src https://mirrors.tuna.tsinghua.edu.cn/debian/ bookworm-backports main contrib non-free non-free-firmware
# 以下安全更新软件源包含了官方源与镜像站配置，如有需要可自行修改注释切换 deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware # deb-src https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware EOF
The programs included with the DebianGNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
# This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # source /etc/network/interfaces.d/* # The loopback network interface # auto lo # iface lo inet loopback # The primary network interface # allow-hotplug enp1s0 # iface enp1s0 inet dhcp
默认的节能配置文件。它在性能和功耗之间具有折衷。在可能的情况下尽可能使用自动扩展和自动调整。唯一缺陷是增加延迟。在当前的 TuneD 版本中，它启用了 CPU、磁盘、音频和视频插件，并激活了 conservative CPU 调控器。如果支持，radeon_powersave 选项使用 dpm-balanced 值，否则被设置为 auto。它将 energy_performance_preference 属性改为 normal 能源设置。它还将 scaling_governor 策略属性改为 conservative 或 powersave CPU 调控器。
5、powersave
用于最大节能性能的配置集。它可以对性能进行调整，从而最大程度降低实际功耗。在当前的 TuneD 发行版本中，它为 SATA 主机适配器启用 USB 自动挂起、WiFi 节能和 Aggresive Link Power Management (ALPM) 节能。它还为使用低折率的系统调度多核功耗，并激活 ondemand 监管器。它启用了 AC97 音频节能，或根据您的系统，HDA-Intel 节能时间为 10 秒。如果您的系统包含启用了 KMS 支持的 Radeon 图形卡，配置集会将其配置为自动节能。在 ASUS Eee PC 上，启用了动态超级混合引擎。它将 energy_performance_preference 属性改为 powersave 或 power energy 设置。它还会将 scaling_governor 策略属性更改为 ondemand 或 powersave CPU 调控器。
Please select the mail server configuration type that best meets your needs.
Systemswith dynamic IP addresses, including dialup systems, should generally be configured to send outgoing mail to another machine, called a 'smarthost'for delivery because many receiving systems on the Internet block incoming mail from dynamic IP addresses as spam protection.
A system with a dynamic IP address can receive its own mail, or local delivery can be disabled entirely (except mail for root and postmaster).
1. internet site; mail is sent and received directly usingSMTP 2. mail sent by smarthost; received via SMTP or fetchmail 3. mail sent by smarthost; no local mail 4. local delivery only; not on a network 5. no configuration at this time General type of mail configuration:
# # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). Thedefault is to use the # traditional Unix authentication mechanisms. # # Asof pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage ofthis, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details.
# here are the per-package modules (the "Primary" block) auth required pam_faillock.so preauth audit silent deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth [success=1default=ignore] pam_unix.so nullok # here's the fallback if no module succeeds # BEGIN ANSIBLE MANAGED BLOCK auth [default=die] pam_faillock.so authfail audit deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth sufficient pam_faillock.so authsucc audit deny=3 fail_interval=900 unlock_time=900 even_deny_root root_unlock_time=900 auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_cap.so # end of pam-auth-update config
# # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. Thedefault is to # only deny service to users whose accounts are expired in /etc/shadow. # # Asof pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage ofthis, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. #
# here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config account required pam_faillock.so
# # ThePAM configuration file for the Shadow`su' service # auth required pam_wheel.so group=sudo # This allows root to su without passwords (normal operation) auth sufficient pam_rootok.so
# 在 history 命令中启用时间戳 exportHISTTIMEFORMAT="%F %T " # 记录所有用户的登录和操作日志 history USER=`whoami` USER_IP=`who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g'` if [ "$USER_IP" = "" ]; then USER_IP=`hostname` fi if [ ! -d /var/log/history ]; then mkdir /var/log/history chmod 777 /var/log/history fi if [ ! -d /var/log/history/${LOGNAME} ]; then mkdir /var/log/history/${LOGNAME} chmod 300 /var/log/history/${LOGNAME} fi exportHISTSIZE=4096 DT=`date +"%Y%m%d_%H:%M:%S"` exportHISTFILE="/var/log/history/${LOGNAME}/${USER}@${USER_IP}_$DT" chmod 600 /var/log/history/${LOGNAME}/*history* 2>/dev/null
# bypass ban/unban for restored tickets norestored = 1
# Option: actionstart # Notes.: command executed on demand at the first ban (or at the start ofFail2Banif actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "你好！\n 监视到【<name>】服务已成功启动。\n 敬请注意！\n Fail2Ban"|mail -s "[Fail2Ban] <name>: 在 <fq-hostname> 服务器上启动" <dest>
# Option: actionstop # Notes.: command executed at the stop ofjail (or at the end ofFail2Ban) # Values: CMD # actionstop = printf %%b "你好！\n 监视到【<name>】服务已被停止。\n 敬请注意！\n Fail2Ban"|mail -s "[Fail2Ban] <name>: 在 <fq-hostname> 服务器上停止" <dest>
# Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # actioncheck =
# Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed withFail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionban = printf %%b "警告!!!\n 攻击者IP：<ip>\n 被攻击机器名：`uname -n` \n 被攻击机器IP：`/bin/curl ifconfig.co` \n 攻击服务：<name> \n 攻击次数：<failures> 次 \n 攻击方法：暴力破解，尝试弱口令.\n 该IP：<ip>已经被Fail2Ban加入防火墙黑名单,屏蔽时间<bantime>秒.\n\n 以下是攻击者 <ip>信息 :\n `/bin/curl https://ip.appworlds.cn?ip=<ip>`\n\n Fail2Ban邮件提醒\n\n "|/bin/mailx -s "<fq-hostname>服务器:<name>服务疑似遭到<ip>暴力攻击。" <dest>
# Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed withFail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionunban =
Cockpit 一个基于 Web 的服务器图形界面，在 Web 浏览器中查看您的服务器并使用鼠标执行系统任务。启动容器、管理存储、配置网络和检查日志都很容易。基本上，您可以将 Cockpit 视为图形“桌面界面”。 Cockpit是直接使用系统账户进行登陆使用，出于安全考虑，Cockpit默认禁用root账户登陆，建议使用您安装系统时创建的第一个用户登陆。
