debian 128MB内存VPS 配置

冗长的前奏

花了15刀淘了一个128MB内存的VPS，算是人生中第一次海淘。

鉴于内存太小系统装 Debian 6 64-bit

琢磨着装个lnmp、wordpress。

呵呵，发现使用 lowendscript 精简系统、lnmp、wordpress全搞定。

参照 128MB小内存VPS安装LNMP

php

配置php-cgi 子线程数目

# vim /etc/default/php-cgi 
PHP_FCGI_CHILDREN = 3


# cat /etc/init.d/php-cgi ##这里面可以看到php各种配置的加载

# vim /etc/php5//etc/php5/cgi/php.ini

  ####将expose_php = On改为expose_php = Off   关闭版本号

# service php-cgi force-reload ##重新加载

mysql

设置编码

# mysql
mysql> show variables like '%character%';
+--------------------------+----------------------------+
| Variable_name            | Value                      |
+--------------------------+----------------------------+
| character_set_client     | latin1                     |
| character_set_connection | latin1                     |
| character_set_database   | latin1                     |
| character_set_filesystem | binary                     |
| character_set_results    | latin1                     |
| character_set_server     | latin1                     |
| character_set_system     | utf8                       |
| character_sets_dir       | /usr/share/mysql/charsets/ |
+--------------------------+----------------------------+
8 rows in set (0.00 sec)

vim  /etc/mysql/my.cnf
在[client]下增加default-character-set=utf8
在[mysqld]下增加
default-character-set=utf8
init_connect='set names utf8' #设定连接mysql数据库时使用utf8编码，以让mysql数据库为utf8运行

iptables

不同于centos使用iptables配置文件来配置

# vim  /etc/firewall.sh
#!bin/bash
iptables -F
iptables -N FIREWALL
iptables -F FIREWALL
iptables -A INPUT -j FIREWALL
iptables -A FORWARD -j FIREWALL
iptables -A FIREWALL -p tcp -m tcp –dport 110 –syn -j ACCEPT
iptables -A FIREWALL -p tcp -m tcp –dport 80 –syn -j ACCEPT
iptables -A FIREWALL -p tcp -m tcp –dport 22 –syn -j ACCEPT
iptables -A FIREWALL -i lo -j ACCEPT
iptables -A FIREWALL -p udp -m udp –sport 53 -j ACCEPT
iptables -A FIREWALL -p tcp -m tcp –syn -j REJECT
iptables -A FIREWALL -p udp -m udp -j REJECT 

# chmod +x /etc/firewall.sh    
# echo sh /etc/firewall.sh >> /etc/init.d/rc.local #把firewall.sh加到启动中

nginx

关闭nginx版本号

# vim /etc/nginx/nginx.conf

http中添加
server_tokens off; ##关闭nginx版本号

deny非绑定域名

# vim /etc/nginx/sites-available/default
server {
    listen            80 default;
    server_name      _;
    return            500;
}

配置缓存过期

# vim /etc/nginx/sites-enable/mydomain.com

server {

    server_name mydomain.com www.mydomain.com;
    root /var/www/mydomain.com;
    include /etc/nginx/fastcgi_php;
    location / {
        index index.php;
        if (!-e $request_filename) {
            rewrite ^(.*)$  /index.php last;
        }
    }


    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
        #过期时间为30天，
        #图片文件不怎么更新，过期可以设大一点，
        #如果频繁更新，则可以设置得小一点。
        expires 30d;
    }


    location ~ .*\.(js|css)$ {
        expires 10d;  }
}

# service nginx reload

syslog

参照 Linux / Unix Command: syslog.conf

# vim /etc/syslog.conf
*.*;authpriv.none;user.none;mail.none;cron.none -/var/log/messages ##默认定向到/var/log/messages
cron.*                  -/var/log/cron
mail.*                  -/var/log/mail
user.*                  -/var/log/user     ##其他用户
authpriv.*              -/var/log/auth.log ##认证日志定向（dropbear的日志等）

fail2ban

# apt-get install fail2ban
# vim /etc/fail2ban.conf

查看并修改

logtarget = /var/log/fail2ban.log

防止ssh暴力破解

fail2ban 模板里面没有dropbear日志，参照其他模板，琢磨自己写一个规则
# cp /etc/fail2ban/filter.d/sshd.conf /etc/fail2ban/filter.d/dropbear.conf
# vim /etc/fail2ban/filter.d/dropbear.conf
添加
failregex = ^%(__prefix_line)sbad password attempt for .* from <HOST>:(?:\d*)$ ##dropbear日志

nginx防止扫目录

假设出现大量404即为扫目录 ban掉

# vim /etc/fail2ban/filter.d/nginx.conf
[Definition]
failregex = <HOST> -.*- .*HTTP/1.* 404 .*$
ignoreregex =

最后配置jail.conf

# vim /etc/fail2ban/jail.conf
添加
[dropbear]
enabled = true
port    = ssh
filter    = dropbear
logpath  = /var/log/auth.log
maxretry = 3    #错误次数
bantime = 86400 #ban掉的时间


[nginx-get-dos]
enabled = true
port = http,https
filter = nginx
logpath = /var/log/nginx/access.log
maxretry = 20
findtime = 60
bantime = 86400
#ignoreip = 192.168.1.2


# service fail2ban force-reload ##重新加载