Ubuntu 24.04 服务器安全加固指南：15分钟完成基线配置（2026实战版）

lsb_release -a
# 确认输出包含 Ubuntu 24.04 LTS

uname -r
# 确认内核版本 6.8+

# 创建新用户（替换 yourname）
adduser yourname

# 赋予 sudo 权限
usermod -aG sudo yourname

# 切换到新用户测试
su - yourname
sudo whoami
# 输出 root 说明 sudo 权限正常

apt update && apt upgrade -y
apt autoremove -y

# 本地执行
ssh-keygen -t ed25519 -C "your_email@example.com"
# ed25519 比 RSA 更短更快更安全

# 本地执行
ssh-copy-id -i ~/.ssh/id_ed25519.pub yourname@服务器IP

ssh yourname@服务器IP
# 如果不需要输密码就能登录，说明密钥配置成功

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo nano /etc/ssh/sshd_config

# 禁用 root 登录
PermitRootLogin no

# 禁用密码登录
PasswordAuthentication no

# 禁用空密码
PermitEmptyPasswords no

# 限制最大认证尝试次数
MaxAuthTries 3

# 登录超时时间（秒）
LoginGraceTime 30

# 空闲超时自动断开（秒）
ClientAliveInterval 300
ClientAliveCountMax 2

# 禁用 X11 转发（如不需要）
X11Forwarding no

# 只允许指定用户登录
AllowUsers yourname

# 检查并修改 override 文件
sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
# 确保里面没有 PasswordAuthentication yes

sudo systemctl restart ssh

sudo nano /etc/ssh/sshd_config
# 修改
Port 22222  # 换成一个高位端口（1024-65535）

sudo ufw allow 22222/tcp

sudo systemctl restart ssh

ssh -p 22222 yourname@服务器IP

# 设置默认策略：拒绝所有入站，允许所有出站
sudo ufw default deny incoming
sudo ufw default allow outgoing

# 放行 SSH（如果你改了端口，用新端口）
sudo ufw allow 22222/tcp comment 'SSH'

# 放行 HTTP/HTTPS（如果是 Web 服务器）
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# 启用防火墙
sudo ufw enable

# 查看状态
sudo ufw status verbose

# 限制 SSH：每个 IP 每 30 秒最多 6 次连接
sudo ufw limit 22222/tcp

# 限制其他敏感端口
sudo ufw limit 443/tcp

# 只允许指定 IP 访问 SSH
sudo ufw allow from 你的IP to any port 22222 proto tcp

# 删除之前的开放规则
sudo ufw delete allow 22222/tcp

sudo apt install fail2ban -y

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
# 封禁时间（秒），1小时
bantime = 3600
# 检测时间窗口（秒），10分钟
findtime = 600
# 最大失败次数
maxretry = 3
# 封禁动作
banaction = ufw

# 忽略本地 IP
ignoreip = 127.0.0.1/8 ::1 192.168.0.0/16 10.0.0.0/8

[sshd]
enabled = true
port = 22222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400  # SSH 封禁 24 小时

sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

# 查看所有 jail 状态
sudo fail2ban-client status

# 查看 SSH 详细状态
sudo fail2ban-client status sshd

# 手动解封某个 IP
sudo fail2ban-client set sshd unbanip 1.2.3.4

# 手动封禁某个 IP
sudo fail2ban-client set sshd banip 1.2.3.4

[DEFAULT]
bantime.increment = true
bantime.factor = 2
bantime.maxtime = 604800  # 最长封禁 7 天

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure -plow unattended-upgrades
# 选择 Yes

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";
};

// 自动重启（如果更新需要）
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

// 自动清理旧内核
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";

# 模拟运行（不会真的更新）
sudo unattended-upgrade --dry-run -v

# 手动触发一次
sudo unattended-upgrade -v

sudo apparmor_status

# 生成 profile 模板
sudo aa-genprof /usr/local/bin/your-service

# 查看所有 profile
sudo aa-status

# 设置 profile 为投诉模式（只记录不阻止，用于测试）
sudo aa-complain /usr/local/bin/your-service

# 设置为强制模式（阻止违规操作）
sudo aa-enforce /usr/local/bin/your-service

# 查看 AppArmor 日志
sudo dmesg | grep apparmor
sudo journalctl -k | grep apparmor

sudo apt install aide -y

# 初始化数据库（需要几分钟）
sudo aideinit

# 安装数据库
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# 手动检查
sudo aide --check

# 每天凌晨 3 点检查文件完整性
echo "0 3 * * * root /usr/bin/aide --check | mail -s 'AIDE Report' yourname@localhost" | sudo tee /etc/cron.d/aide

sudo apt install auditd -y

# 审计 SSH 配置文件修改
sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_config_change

# 审计 sudo 使用
sudo auditctl -w /var/log/sudo.log -p wa -k sudo_usage

# 审计用户创建/删除
sudo auditctl -w /etc/passwd -p wa -k user_modify
sudo auditctl -w /etc/group -p wa -k group_modify
sudo auditctl -w /etc/shadow -p wa -k shadow_modify

# 查看审计日志
sudo ausearch -k ssh_config_change
sudo ausearch -k user_modify

sudo nano /etc/audit/rules.d/audit.rules
# 把上面的 auditctl 命令去掉 sudo 和 auditctl，只保留参数部分
# 例如：-w /etc/ssh/sshd_config -p wa -k ssh_config_change

sudo systemctl restart auditd

# 查看最近登录成功记录
last -20

# 查看最近登录失败记录
sudo lastb -20

# 查看当前登录用户
who

# 查看可疑的 SUID 文件
sudo find / -perm -4000 -type f 2>/dev/null

# 查看最近修改的文件（24小时内）
sudo find /etc /usr/local/bin /opt -mtime -1 -type f 2>/dev/null

# 查看异常网络连接
sudo ss -tunlp
sudo netstat -anp | grep ESTABLISHED

# 查看所有运行的服务
sudo systemctl list-unit-files --type=service --state=enabled

# 禁用不需要的服务（举例）
sudo systemctl disable --now snapd  # 如果不用 snap
sudo systemctl disable --now apport  # 关闭错误报告
sudo systemctl disable --now modemmanager  # 服务器不需要调制解调器

sudo nano /etc/sysctl.d/99-security.conf

# 禁用 IP 转发（如果不是路由器）
net.ipv4.ip_forward = 0

# 防 SYN Flood
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# 禁用 ICMP 重定向
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# 禁用源路由
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 禁用 ping（可选，防探测）
# net.ipv4.icmp_echo_ignore_all = 1

# 忽略 ICMP 广播
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 反向路径过滤
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# 记录可疑数据包
net.ipv4.conf.all.log_martians = 1

sudo sysctl -p /etc/sysctl.d/99-security.conf

# Ubuntu 24.04 默认用 systemd-timesyncd
sudo timedatectl set-ntp true
timedatectl status

sudo apt install rkhunter chkrootkit -y

# 更新数据库
sudo rkhunter --update
sudo rkhunter --propupd

# 扫描
sudo rkhunter --check
sudo chkrootkit

# 每周扫描一次
echo "0 4 * * 0 root /usr/bin/rkhunter --check --sk --report-warnings-only | mail -s 'Rkhunter Report' yourname@localhost" | sudo tee /etc/cron.d/rkhunter

#!/bin/bash
# Ubuntu 24.04 安全加固脚本
# 使用方法：sudo bash harden.sh

set -e

# 颜色输出
GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m'

echo_step() {
    echo -e "${GREEN}[✓]${NC} $1"
}

echo_error() {
    echo -e "${RED}[✗]${NC} $1"
}

# 检查 root 权限
if [ "$EUID" -ne 0 ]; then
    echo_error "请用 sudo 运行此脚本"
    exit 1
fi

# 1. 系统更新
echo "=== 1. 系统更新 ==="
apt update && apt upgrade -y
apt autoremove -y
echo_step "系统已更新"

# 2. 安装安全工具
echo "=== 2. 安装安全工具 ==="
apt install -y fail2ban ufw unattended-upgrades auditd rkhunter
echo_step "安全工具已安装"

# 3. 配置 UFW 防火墙
echo "=== 3. 配置防火墙 ==="
ufw default deny incoming
ufw default allow outgoing
ufw limit 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
yes | ufw enable
echo_step "防火墙已启用"

# 4. 配置 Fail2ban
echo "=== 4. 配置 Fail2ban ==="
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
banaction = ufw
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400
EOF
systemctl enable fail2ban
systemctl restart fail2ban
echo_step "Fail2ban 已配置"

# 5. 内核参数加固
echo "=== 5. 内核参数加固 ==="
cat > /etc/sysctl.d/99-security.conf << 'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.log_martians = 1
EOF
sysctl -p /etc/sysctl.d/99-security.conf
echo_step "内核参数已加固"

# 6. 配置自动安全更新
echo "=== 6. 配置自动更新 ==="
cat > /etc/apt/apt.conf.d/20auto-upgrades << 'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
EOF
echo_step "自动更新已配置"

# 7. 审计规则
echo "=== 7. 配置审计规则 ==="
cat > /etc/audit/rules.d/hardening.rules << 'EOF'
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /etc/passwd -p wa -k user_modify
-w /etc/group -p wa -k group_modify
-w /etc/shadow -p wa -k shadow_modify
-w /etc/sudoers -p wa -k sudoers_modify
EOF
systemctl restart auditd
echo_step "审计规则已配置"

# 8. 时间同步
echo "=== 8. 配置时间同步 ==="
timedatectl set-ntp true
echo_step "时间同步已启用"

echo ""
echo "========================================"
echo "  安全加固完成！"
echo "========================================"
echo ""
echo "接下来请手动完成："
echo "1. 配置 SSH 密钥登录"
echo "2. 禁用密码登录（修改 /etc/ssh/sshd_config）"
echo "3. 修改 SSH 默认端口"
echo "4. 创建非 root 管理用户"
echo "5. 初始化 AIDE 数据库：sudo aideinit"
echo ""