ubuntu 下部署 node 服務器環境 - 安全篇

防火牆

一、更新 Ubuntu sudo apt-get update && sudo apt-get upgrade
二、清空原有規則 sudo iptables -F
三、配置防火牆 sudo vi /etc/iptables.up.rules 假設 ssh 訪問端口爲 39999， 數據庫訪問端口爲 19999，且開放 3000、3001 端口

*filter

# allow all connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow out traffic
-A OUTPUT -j ACCEPT

# allow https http
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT

# allow ssh port login
-A INPUT -p tcp -m state --state NEW --dport 39999 -j ACCEPT

# ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# mongodb connect   
-A INPUT -s 127.0.0.1 -p tcp --destination-port 19999 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 127.0.0.1 -p tcp --source-port 19999 -m state --state ESTABLISHED -j ACCEPT

-A INPUT -s 127.0.0.1 -p tcp --destination-port 3000 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 127.0.0.1 -p tcp --source-port 3000 -m state --state ESTABLISHED -j ACCEPT

-A INPUT -s 127.0.0.1 -p tcp --destination-port 3001 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 127.0.0.1 -p tcp --source-port 3001 -m state --state ESTABLISHED -j ACCEPT

# log denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied:" --log-level 7

# drop incoming sensitive connections
-A INPUT -p tcp --dport 80 -8i eth0 -m state --state NEW -m recent --set
-A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 150 -j DROP

# reject all other inbound
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

四、重載配置 sudo iptables-restore < /etc/iptables.up.rules （每次修改均需重載）
五、查看防火牆啓動狀態 sudo ufw status
六、激活 Firewalls sudo ufw enable
七、設置防火牆開機自啓動 sudo vi /etc/network/if-up.d/iptables

#!/bin/sh
iptables-restore /etc/iptables.up.rules

八、受權 sudo chmod +x /etc/network/if-up.d/iptables

Fail2Ban

一、安裝 sudo apt-get install fail2ban
二、配置 sudo vi /etc/fail2ban/jail.conf

bantime = 3600
destemail = your email  
action = %(action_mw)s
...

三、查看運行狀態 sudo service fail2Ban statu
四、運行 or 中止 sudo service fail2Ban start ，sudo service fail2Ban stop