web-. , . . . - ... .
Ubuntu 18.04. .
F4 Install minimal system. lxc python3?
.
.
apt-get update
apt-get upgrade
apt-get autoremove
/etc/default/grub :
GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"
docker, . GRUB:
update-grub
:
https://askubuntu.com/questions/417215/how-does-kernel-support-swap-limit
, :
shutdown -r now
. , .
- , :
apt-get install nano mc htop iftop
nano -
mc - " "
htop - (, , )
iftop -
mc. , . , Ctrl + O . mc - Ctrl + O. - F4. - F3. - F2. - ESCAPE. !
. SSH. , mc. .
SSH - , 22 . , ,
. :
" 20- 80 (web) 15 1 ip .
(, nginx, )":
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 15 --hitcount 20 -j DROP
" SSH, 4- 1 ":
iptables -A INPUT -p tcp --dport 354 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 354 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
" 354 ssh . 1 . ."
Simple Service Discovery Protocol (SSDP) . ( 22):
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 1900 -j DROP
-A INPUT -i eth0 -p udp -m udp --dport 1900 -j DROP
-A FORWARD -i eth0 -p tcp --dport 22 -j ACCEPT
-A FORWARD -i eth0 -j DROP
-A FORWARD -i eth0 -p tcp -m tcp --dport 1900 -j DROP
-A FORWARD -i eth0 -p udp -m udp --dport 1900 -j DROP
-A OUTPUT -s 234.165.140.130/32 -p tcp -m tcp --sport 1900 -j DROP
-A OUTPUT -s 234.165.140.130/32 -p udp -m udp --sport 1900 -j DROP
234.165.140.130 - IP .
:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 22 -j ACCEPT
-A INPUT -i eth0 -m conntrack -j ACCEPT --ctstate RELATED,ESTABLISHED
-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth0 -j DROP
-A OUTPUT -s 234.165.140.130/32 -p tcp -m tcp --sport 1900 -j DROP
-A OUTPUT -s 234.165.140.130/32 -p udp -m udp --sport 1900 -j DROP
-A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth0 -j DROP
, :
apt-get install ifupdown
/etc/network/if-up.d/00-iptables
nano -w /etc/network/if-up.d/00-iptables
:
#!/bin/sh
iptables-restore < /etc/firewall.conf
:
chmod +x /etc/network/if-up.d/00-iptables
:
iptables-save | sudo tee /etc/firewall.conf
, ."
iptables
fail2ban.
:
apt-get install ntpdate
crontab -e
crontab:
* */4 * * * ntpdate 2.de.pool.ntp.org
, . .
" . Prelink Preload. Prelink - , Preload - , , , .
Prelink:
apt-get -y install prelink
/etc/default/prelink:
nano /etc/default/prelink
PRELINKING=unknown PRELINKING=yes
:
/etc/cron.daily/prelink
Preload:
apt-get -y install preload"
.
/tmp . . :
echo "tmpfs /tmp tmpfs size=8G,rw,nosuid,nodev 0 0" | tee -a /etc/fstab
reboot
UPD: , /tmp . . , /dev/shm - , /dev.
. " ", . , . , . /etc/security/limits.conf:
# Disable all limits for root
root - core 0
root - nofile 1048576
root - memlock unlimited
root - fsize unlimited
root - data unlimited
root - rss unlimited
root - stack unlimited
root - cpu unlimited
root - nproc unlimited
root - as unlimited
root - locks unlimited
root - sigpending unlimited
root - msgqueue unlimited
# Disable all limits for other users
* - core 0
* - nofile 1048576
* - memlock unlimited
* - fsize unlimited
* - data unlimited
* - rss unlimited
* - stack unlimited
* - cpu unlimited
* - nproc unlimited
* - as unlimited
* - locks unlimited
* - sigpending unlimited
* - msgqueue unlimited
, core , core-dump' - php. .
/etc/sysctl.conf. . .
C :
https://gist.github.com/kgriffs/4027835
VDS:
https://habrahabr.ru/post/186362/
( .):
https://www.prolinux.org/post/nastroyki-nagruzhennogo-servera/
:
https://tobert.github.io/post/2014-06-24-linux-defaults.html
sysctl.conf :
http://adminunix.ru/nastrojka-sysctl/
https://nikitushkin.wordpress.com/2011/02/12/%D0%B...D0%BF%D1%80%D0%B0%D0%B2%D0%BB/
.
vm.vfs_cache_pressure = 1000
!
. :
sync
echo 3 > /proc/sys/vm/drop_caches
:
" , , , . 60 , - 150.
/etc/sysctl.conf
vm.laptop_mode = 5 //
vm.dirty_writeback_centisecs = 6000 . .. 100 = 1 "
:
.
. /etc/sysctl.conf. . , . /etc/sysctl.conf :
#
# : https://www.prolinux.org/post/nastroyki-nagruzhennogo-servera/
#
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
net.ipv4.tcp_syncookies = 0
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
vm.swappiness = 0
net.ipv4.tcp_fack = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_mem = 8388608 12582912 16777216
net.ipv4.udp_mem = 8388608 12582912 16777216
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384
net.core.wmem_max = 8388608
net.core.rmem_max = 8388608
net.ipv4.tcp_rmem = 8192 87380 8388608
net.ipv4.tcp_wmem = 8192 87380 8388608
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_window_scaling = 1
net.core.somaxconn = 300000
net.core.netdev_max_backlog = 8192
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_keepalive_time = 180
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_max_tw_buckets = 1000000
net.ipv4.ip_local_port_range = 1024 65535
net.nf_conntrack_max = 1000000
#
# , , , .
# 60 , - 150.
#
vm.laptop_mode = 5 #
vm.dirty_writeback_centisecs = 6000 # : 100 . = 1
#
# Lines, as recommended by the LXD project
#
fs.inotify.max_queued_events = 1048576
fs.inotify.max_user_instances = 1048576
fs.inotify.max_user_watches = 1048576
#
# : https://blog.poiuty.com/dopolnitelnye-nastrojki-sysctl-conf.html
#
vm.vfs_cache_pressure = 10000
#
# Redis
#
vm.overcommit_memory = 1
#
# kernel panic
#
kernel.core_pattern = /var/crash/core.%t.%p
kernel.panic = 20
kernel.unknown_nmi_panic = 1
:
sysctl --system
rc.local Ubuntu 18.04 :
https://askubuntu.com/questions/886620/how-can-i-execute-command-on-startup-rc-local-alternative-on-ubuntu-16-10
Percona Redis rc.local:
echo never > /sys/kernel/mm/transparent_hugepage/enabled
nginx:
apt-get install nginx
nginx. .
. /etc/nginx/nginx.conf
.
php 7:
apt-get install php-fpm php-common php-cli
, .
PHP, . php 5.6
.
php-fpm
.
.
php7 :
apt-get install php-geoip php-curl php-gd php-intl php-mysql php-tidy php-opcache php-json php-mcrypt php-bz2 php-readline php-xsl php-memcache php-bcmath php-mbstring php-xml php-zip php-memcached
5.6, :
apt-get install php-geoip php5.6-curl php5.6-gd php5.6-intl php5.6-mysql php5.6-tidy php5.6-opcache php5.6-json php5.6-mcrypt php5.6-bz2 php5.6-readline php5.6-xsl php-memcache php5.6-bcmath php5.6-mbstring php5.6-xml php5.6-zip php-memcached
! PHP . php.ini , . , , . :
https://www.cyberciti.biz/tips/php-security-best-practices-tutorial.html "", - .
geoip:
apt-get install php-geoip geoip-database-contrib
. php.ini browscap:
[browscap]
; http://php.net/browscap
browscap = /etc/php/7.0/modules-available/php_browscap.ini
- php_browscap.ini.
.
memached:
apt-get install memcached
/etc/memcached.conf. . .
. mysql . Percona. , .
UPD: Percona 8.0 : https://www.percona.com/doc/percona-server/8.0/installation/apt_repo.html
( Percona )
Percona:
cd /tmp
wget https://repo.percona.com/apt/percona-release_0.1-4.$(lsb_release -sc)_all.deb
dpkg -i percona-release_0.1-4.$(lsb_release -sc)_all.deb
apt-get update
apt-get install percona-server-server-5.7
mysql -u root -e "CREATE FUNCTION fnv_64 RETURNS INTEGER SONAME 'libfnv_udf.so'"
mysql -u root -p -e "CREATE FUNCTION fnv_64 RETURNS INTEGER SONAME 'libfnv_udf.so'"
mysql -u root -p -e "CREATE FUNCTION murmur_hash RETURNS INTEGER SONAME 'libmurmur_udf.so'"
Percona
.
:
mysql / percona :
http://rimzy.net/category/mysql-5-7/
http://stackoverflow.com/questions/10905226/mysql-...ormance-tuning-recommendations
http://stackoverflow.com/questions/30901041/can-no...l-max-connections-in-ubuntu-15
/etc/mysql/percona-server.conf.d/mysqld.cnf :
#
# The Percona Server 5.7 configuration file.
#
# One can use all long options that the program supports.
# Run program with --help to get a list of available options and with
# --print-defaults to see which it would actually understand and use.
#
# For explanations see
#
http://dev.mysql.com/doc/mysql/en/server-system-variables.html
[mysqld]
user = mysql
pid-file = /var/run/mysqld/mysqld.pid
socket = /var/run/mysqld/mysqld.sock
port = 3306
basedir = /usr
datadir = /var/lib/mysql
tmpdir = /tmp
lc-messages-dir = /usr/share/mysql
explicit_defaults_for_timestamp
local-infile = 0
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
bind-address = 127.0.0.1
# Recommended in standard MySQL setup
#sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_ALL_TABLES
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links = 1
# GENERAL #
default-storage-engine = InnoDB
# MyISAM #
key-buffer-size = 96M
#myisam-recover = FORCE,BACKUP
# SAFETY #
max-allowed-packet = 16M
max-connect-errors = 1000000
sysdate-is-now = 1
innodb = FORCE
# CACHES AND LIMITS #
tmp-table-size = 32M
max-heap-table-size = 32M
query-cache-type = 0
query-cache-size = 0
max-connections = 500
thread-cache-size = 50
open-files-limit = 65535
table-definition-cache = 1024
table-open-cache = 2048
# INNODB #
innodb-flush-method = O_DSYNC
innodb-log-files-in-group = 2
innodb-log-file-size = 512M
innodb-flush-log-at-trx-commit = 2
innodb-file-per-table = 1
innodb-buffer-pool-size = 32G
# LOGGING #
log-error = /var/log/mysql/error.log
log-queries-not-using-indexes = 0
slow-query-log = 0
#slow-query-log-file = /var/log/mysql/slow.log
Percona, .
!
. :
cp /lib/systemd/system/mysql.service /etc/systemd/system/
Add the following lines to the bottom of the file /etc/systemd/system/mysql.service:
LimitNOFILE=infinity
LimitMEMLOCK=infinity
Now reload the Systemd configuration with:
systemctl daemon-reload
.
. . ,
..
