Detailed Aliyun CentOS Server security setup Steps tutorial

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Aliyun CentOS Server security setting steps are as follows

1, open the Cloud shield all services

2. Restricting external scan behavior through firewall policy

Please according to your server operating system, download the corresponding script to run, after running your firewall policy will ban the behavior of the external contract, to ensure that your host will not appear malicious contract, for you to do follow-up data backup operations to provide enough time.

Window2003 batch File download address: Http://oss.aliyuncs.com/aliyunecs/windows2003_drop_port.bat

Window2008 batch File download address: Http://oss.aliyuncs.com/aliyunecs/windows2008_drop_port.bat

Linux System scripts: http://oss.aliyuncs.com/aliyunecs/linux_drop_port.sh

The above files can be downloaded to the machine for direct execution.

The contents of the document are as follows:

&nbsp;&nbsp;&nbsp;#!/bin/bash&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;#########################################
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #Function:&nbsp;&nbsp;&nbsp;&nbsp;linux&nbsp;drop&nbsp;port&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #Usage:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bash&nbsp;linux_drop_port.sh&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #Author:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;customer&nbsp;service&nbsp; department&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #Company:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;alibaba&nbsp;cloud&nbsp; computing&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #Version:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2.0&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;#########################################&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;check_os_release () &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;while&nbsp;true&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;do&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; os_release=$ (grep&nbsp; "Red&nbsp;hat&nbsp;enterprise&nbsp;linux&nbsp;server&nbsp;release"/etc/issue&nbsp;2 &gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp; "Red&nbsp;Hat
&nbsp;enterprise&nbsp;linux&nbsp;server&nbsp;release "/etc/redhat-release&nbsp;2&gt;/dev/null" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp; "$os _release" &nbsp;]&nbsp;&amp;&amp;&nbsp;[&nbsp; "$os _release_2 "&nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "release&nbsp;5" &nbsp;&gt;/dev/ null2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=redhat5&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;elif&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "release&nbsp;6" &gt;/dev/null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;os_release=redhat6&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release= "" &nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;os_release=$ (grep&nbsp; "Aliyun&nbsp;linux&nbsp;release" &nbsp;/etc/issue2&gt;/dev/null) &nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp; "Aliyun&nbsp;linux&nbsp;release" &nbsp;/etc/aliyun-release2&gt;/dev/ NULL) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp; "$os _release" &nbsp;]&nbsp;&amp;&amp;
&nbsp;[&nbsp; "$os _release_2" &nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "release&nbsp; 5 "&nbsp;&gt;/dev/null2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=aliyun5&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elif&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "Release&nbsp;6" &gt;/dev /null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=aliyun6&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release = "" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;os_release=$ (grep&nbsp; "Centos&nbsp;release" &nbsp;/etc/issue&nbsp;2&gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp; "Centos&nbsp;release" &nbsp;/etc /*release2&gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp; "$os _release" &nbsp;]&nbsp;&amp;&amp;&nbsp;[&nbsp; "$os _release_2" &nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "release &nbsp;5 "&nbsp;&gt;/dev/null2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=centos5&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elif&nbsp;echo&nbsp; "$os _release" |grep&nbsp; "release &nbsp;6 "&gt;/dev/null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then
&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=centos6&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os _release= "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;" $os _ Release "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=$ (grep&nbsp;-i&nbsp; "Ubuntu" &nbsp;/etc/issue&nbsp;2&gt;/ Dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp;-i&nbsp; "Ubuntu" &nbsp; /etc/lsb-release2&gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp; "$os _ Release "&nbsp;]&nbsp;&amp;&amp;&nbsp;[&nbsp;" $os _release_2 "&nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;echo&nbsp; "$os _ Release "|grep&nbsp;" UbunTu&nbsp;10 "&nbsp;&gt;/dev/null2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; then&nbsp;&nbsp; &NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;OS_RELEASE=UBUNTU10 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elif&nbsp;echo&nbsp; "$os _release" |grep&nbsp; " ubuntu&nbsp;12.04 "&gt;/dev/null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=ubuntu1204 &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;elif&nbsp;echo&nbsp; "$os _release" |grep&nbsp; " ubuntu&nbsp;12.10 "&gt;/dev/null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;then&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=ubuntu1210&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;os_release= "" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=$ (grep&nbsp;-i&nbsp; "Debian" &nbsp;/etc/issue &nbsp;2&gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp;-i&nbsp; " Debian "&nbsp;/proc/version&nbsp;2&gt;/dev/null" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[ &nbsp; "$os _releaSe "&nbsp;]&nbsp;&amp;&amp;&nbsp;[&nbsp;" $os _release_2 "&nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;echo&nbsp; "$os _release" | grep&nbsp; "Linux&nbsp;6" &nbsp;&gt;/dev/null2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release= debian6&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release= "" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release=$ (grep&nbsp; "OpenSUSE" &nbsp;/etc/ Issue&nbsp;2&gt;/dev/null) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release_2=$ (grep&nbsp; " OpenSUSE "&nbsp;/etc/*release&nbsp;2&gt;/dev/null" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if &nbsp;[&nbsp; "$os _release" &nbsp;]&nbsp;&amp;&amp;&nbsp;[&nbsp; "$os _release_2" &nbsp;]&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if &nbsp;echo&nbsp; "$os _release" |grep "13.1" &nbsp;&gt;/dev/null&nbsp;2&gt;&amp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;os_release=opensuse131&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;os_release= "" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp; "$os _release" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;done&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;exit_script () &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[1;40;31minstall&nbsp;$1&nbsp;error,will&nbsp;exit.\n\033[0m" &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rm-f&nbsp; $LOCKfile &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; exit&nbsp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp;&nBsp;&nbsp;config_iptables () &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Iptables&nbsp;-i&nbsp;output&nbsp;1&nbsp;-p&nbsp;tcp&nbsp;-m&nbsp;multiport&nbsp;--dport21, 22,23,25,53,80,135,139,443,445&nbsp;-j&nbsp;drop&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;iptables&nbsp;-i &nbsp;OUTPUT&nbsp;2&nbsp;-p&nbsp;tcp&nbsp;-m&nbsp;multiport&nbsp;--dport&nbsp; 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186-j&nbsp;drop&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables&nbsp;-i&nbsp;output&nbsp;3&nbsp;-p&nbsp;udp&nbsp;-j&nbsp;drop&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;iptables&nbsp;-nvL&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &NBSP;&NBSP;&NBSP;&NBSP;UBUNTU_CONFIG_UFW () &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;ufwdeny&nbsp;out&nbsp;proto&nbsp;tcp&nbsp;to&nbsp;any&nbsp;port&nbsp; 21,22,23,25,53,80,135,139,443,445&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ufwdeny&nbsp;out&nbsp;proto&nbsp;tcp&nbsp;to&nbsp;any&nbsp;port&nbsp; 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ufwdeny &nbsp;out&nbsp;proto&nbsp;udp&nbsp;to&nbsp;any&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ufwstatus&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;# ################## #Start ###################&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #check &nbsp;lock&nbsp;file &nbsp;,one&nbsp;time&nbsp;only&nbsp;let&nbsp;thescript&nbsp;run&nbsp;one&nbsp;time&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;lockfile=/tmp/.$ (basename&nbsp;$0) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp;-f&nbsp; "$ Lockfile "&nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e &nbsp; "\033[1;40;31mthe&nbsp;script&nbsp;is&nbsp;already&nbsp;exist,please&nbsp;next&nbsp;timeto&nbsp;run &nbsp;this&nbsp;script.\n\033[0m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &NBSP;&NBSP;&NBSP;&NBSP;&NBSP;ECHO&NBSP;-E &nbsp; "\033[40;32mstep&nbsp;1.no&nbsp;lock&nbsp;file,begin&nbsp;to&nbsp;create&nbsp;lock&nbsp;fileand&nbsp; continue.\n\033[40;37m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;touch&nbsp; $LOCKfile &nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; #check &nbsp;user &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp;$ (id&nbsp;-u) &nbsp;!=&nbsp; "0" &nbsp;]&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[1;40;31merror:&nbsp; you&nbsp;must&nbsp;be&nbsp;root&nbsp;to&nbsp;run&nbsp;this&nbsp;script,please&nbsp;use&nbsp;root&nbsp;to&nbsp; execute&nbsp;this&nbsp;script.\n\033[0m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rm-f&nbsp; $LOCKfile &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;1&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[40;32mstep&nbsp;2.begen&nbsp;tocheck&nbsp; the&nbsp;os&nbsp;issue.\n\033[40;37m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;os_release=$ (check_os_release) &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;[&nbsp; "X$os_release" &nbsp;== "X" &nbsp;]&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;then&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[1;40;31mthe&nbsp;os&nbsp;does &nbsp;not&nbsp;identify,so&nbsp;this&nbsp;script&nbsp;isnot&nbsp;executede.\n\033[0m "&nbsp;&nbsp; &nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;rm-f&nbsp; $LOCKfile &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;0&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;else&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[40;32mthis&nbsp; os&nbsp;is&nbsp; $os _release.\n\033[40;37m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;fi&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;-e&nbsp; "\033[40;32mstep&nbsp;3.begen&nbsp;toconfig &nbsp;firewall.\n\033[40;37m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;case&nbsp;" $os _release "&nbsp;in&nbsp;&nbsp; &nbsp;&nbsp; &NBSP;&NBSP;REDHAT5|CENTOS5|REDHAT6|CENTOS6|ALIYUN5|ALIYUN6) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;service &nbsp;iptables&nbsp;start&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;config_iptables&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;;; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;debian6) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;config_iptables&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;ubuntu10|ubuntu1204|ubuntu1210) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;ufwenable&nbsp;&lt;&lt;EOF&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;y&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;eof &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ubuntu_config_ufw&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;opensuse131) &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;config_iptables &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;esac&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;echo&nbsp;-e&nbsp; "\033[40;32mconfig&nbsp;firewallsuccess,this&nbsp;script&nbsp;now&nbsp;exit!\n\033[40; 37m "&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;rm&nbsp;-f&nbsp; $LOCKfile

3, setting iptables, restricting access

/sbin/iptables -p input accept  /sbin/iptables  -F  /sbin/iptables -x  /sbin/iptables -z     /sbin/ iptables -a input -i lo -j accept   /sbin/iptables -A  input -p tcp --dport 22 -j accept  /sbin/iptables -A INPUT  -p tcp --dport 80 -j ACCEPT  /sbin/iptables -a input - p tcp --dport 8080 -j accept  /sbin/iptables -a input -p  icmp -m icmp --icmp-type 8 -j ACCEPT  /sbin/iptables -a  INPUT -m state --state ESTABLISHED -j ACCEPT  /sbin/iptables  -P INPUT DROP    service iptables save

The above script is executed once after each reload system, and its configuration is saved to/etc/sysconfig/iptables

This step refers to the Aliyun CentOS configuration iptables firewall http://www.111cn.net/sys/linux/85675.htm

Because it is used as a Web server, so external to open 80 ports, and also must be through SSH server management, 22 ports also to open up, of course, the SSH service is best to change the default port, on the public network will be a lot of people trying to crack the password, if you modify the port, remember to put the port to develop external, Otherwise, it's not even a tragedy. The following provides a detailed description of the configuration rules:

First step: Clear all Rules

When/sbin/iptables-f is executed when chain INPUT (Policy DROP), you disconnect from the server

All the rules before emptying all the policy drop should be input, prevent the tragedy, careful and careful

/sbin/iptables-p INPUT ACCEPT

Clear all Rules

/sbin/iptables-f

/sbin/iptables-x

Counter 0

/sbin/iptables-z

Step Two: Set the Rules

Allow packets from the LO interface, without this rule, you will not be able to access local services via 127.0.0.1, such as Ping 127.0.0.1

/sbin/iptables-a input-i lo-j ACCEPT

Open TCP protocol 22 port so that you can ssh, if you are in a fixed IP location, you can use-s to qualify the client's IP

/sbin/iptables-a input-p TCP--dport 22-j ACCEPT

Open TCP protocol 80-End confession Web Service

/sbin/iptables-a input-p TCP--dport 80-j ACCEPT

10.241.121.15 is another server intranet IP, because there is communication between all the TCP requests from 10.241.121.15

/sbin/iptables-a input-p tcp-s 10.241.121.15-j ACCEPT

Accept Ping

/sbin/iptables-a input-p icmp-m ICMP--icmp-type 8-j ACCEPT

This rule is as follows: http://www.netingcn.com/iptables-localhost-not-access-internet.html

/sbin/iptables-a input-m State--state established-j ACCEPT

Mask the above rules for all requests, indispensable, otherwise firewall does not have any filtering function

/sbin/iptables-p INPUT DROP

You can use Iptables-l-N to see if a rule takes effect

At this point the firewall is configured, but this is temporary, when restarting the iptables or restarting the machine, the above configuration will be emptied, to be permanently effective, you need to do the following:

/etc/init.d/iptables Save

Or

Service Iptables Save

Execute the above command to see the configuration in file/etc/sysconfig/iptables

The following provides a clean configuration script:

/sbin/iptables-p INPUT ACCEPT

/sbin/iptables-f

/sbin/iptables-x

/sbin/iptables-z

/sbin/iptables-a input-i lo-j ACCEPT

/sbin/iptables-a input-p TCP--dport 22-j ACCEPT

/sbin/iptables-a input-p TCP--dport 80-j ACCEPT

/sbin/iptables-a input-p tcp-s 10.241.121.15-j ACCEPT

/sbin/iptables-a input-p icmp-m ICMP--icmp-type 8-j ACCEPT

/sbin/iptables-a input-m State--state established-j ACCEPT

/sbin/iptables-p INPUT DROP

Finally, to ensure that the SSH connection is not a problem, to prevent the rule error, resulting in the server can not be connected, because there is no save, restart the server rules are invalid, otherwise only to the room to modify the rules. Also can refer to: Ubuntu iptables configuration script to write.

4, the commonly used network monitoring command

(1) NETSTAT-TUNL: View all ports that are listening

[Root@ay1407041017110375bbz ~]# NETSTAT-TUNL

Active Internet connections (only servers)

Proto recv-q send-q Local address Foreign

TCP 0 0 0.0.0.0:22 0.0.0.0:* LISTEN

UDP 0 0 ip:123 0.0.0.0:*

UDP 0 0 ip:123 0.0.0.0:*

UDP 0 0 127.0.0.1:123 0.0.0.0:*

UDP 0 0 0.0.0.0:123 0.0.0.0:*

Where 123 ports are used for NTP services.

(2) NETSTAT-TUNP: View all connected network connection status, and display its PID and program name.

[Root@ay1407041017110375bbz ~]# NETSTAT-TUNP

Active Internet connections (w/o servers)

Proto recv-q Send-q Local address Foreign address State Pid/program Name

TCP 0 ip:22 221.176.33.126:52699 established 926/sshd

TCP 0 0 ip:34385 42.156.166.25:80 established 1003/AEGIS_CLI

According to the above results, you can kill the corresponding process as needed.

Such as:

Kill-9 1003

(3) NETSTAT-TUNLP

(4) Netstat common option Description:

-t:tcp

-u:udp

-L,--listening

Show only listening sockets. (These are omitted by default.)

-P,--program

Show the PID and name of the "program to which" each socket belongs.

--numeric,-N

Show numerical addresses instead of trying to determine symbolic host, port or user names.

5, modify the SSH listening port

(1) Modify/etc/ssh/sshd_config

The original port 22

Change to Port 44

(2) Restart service

/etc/init.d/sshd restart

(3) View the situation

Netstat-tunl

Active Internet connections (only servers)

Proto recv-q send-q Local address Foreign

TCP 0 0 0.0.0.0:44 0.0.0.0:* LISTEN

UDP 0 0 ip:123 0.0.0.0:*

UDP 0 0 ip:123 0.0.0.0:*

UDP 0 0 127.0.0.1:123 0.0.0.0:*

UDP 0 0 0.0.0.0:123 0.0.0.0:*

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More

Detailed Aliyun CentOS Server security setup Steps tutorial

Contact Us

What's Trending

Top 10 Tags

Top 10 Keywords

A Free Trial That Lets You Build Big!

Sales Support

After-Sales Support

Detailed Aliyun CentOS Server security setup Steps tutorial

Contact Us

What's Trending

Top 10 Tags

Top 10 Keywords

Trending Topic

A Free Trial That Lets You Build Big!

Sales Support

After-Sales Support