1.1 \u4f01\u4e1a\u7ea7\u5e94\u7528\u573a\u666f\u53d7\u963b
\n\u5f53VPS\u4f5c\u4e3a\u4f01\u4e1a\u5185\u90e8\u7ba1\u7406\u7cfb\u7edf\uff08\u5982ERP\u3001OA\uff09\u3001\u6570\u636e\u5b58\u50a8\u4e2d\u5fc3\u6216\u79c1\u6709\u4e91\u5e73\u53f0\u65f6\uff0c\u5185\u7f51\u8bbf\u95ee\u4e2d\u65ad\u4f1a\u5bfc\u81f4\uff1a
\n– \u6bcf\u5c0f\u65f6\u635f\u5931\u7ea62000\u5143\u4e1a\u52a1\u6536\u5165\uff08\u6309\u884c\u4e1a\u5747\u503c\u6d4b\u7b97\uff09
\n– 72\u5c0f\u65f6\u4ee5\u4e0a\u672a\u6062\u590d\u5c06\u5f15\u53d1\u5ba2\u6237\u6295\u8bc9\u7387\u4e0a\u5347300%
\n– \u6570\u636e\u6cc4\u9732\u98ce\u9669\u589e\u52a085%\uff08\u56e0\u5185\u90e8\u7cfb\u7edf\u66b4\u9732\uff09<\/p>\n
1.2 \u5f00\u53d1\u6d4b\u8bd5\u73af\u5883\u762b\u75ea
\n\u524d\u7aef\/\u540e\u7aef\u5f00\u53d1\u56e2\u961f\u906d\u9047\uff1a
\n– \u8c03\u8bd5\u6548\u7387\u964d\u4f4e60%\uff08\u65e0\u6cd5\u5b9e\u65f6\u9a8c\u8bc1\u63a5\u53e3\uff09
\n– \u7248\u672c\u8fed\u4ee3\u5468\u671f\u5ef6\u957f25%
\n– \u534f\u540c\u5f00\u53d1\u6210\u672c\u589e\u52a040%<\/p>\n
\u4e8c\u3001\u6838\u5fc3\u95ee\u9898\u8bca\u65ad\u65b9\u6cd5\u8bba\uff08\u542b\u4e13\u4e1a\u5de5\u5177\u63a8\u8350\uff09
\n2.1 \u9632\u706b\u5899\u89c4\u5219\u5ba1\u8ba1
\n– Linux\u7cfb\u7edf\u68c0\u67e5\uff1a`grep -r ‘ deny ‘ \/etc\/hosts.deny`
\n– Windows\u7cfb\u7edf\u67e5\u770b\uff1a\u5b89\u5168\u4e2d\u5fc3\u2192Windows Defender\u9632\u706b\u5899\u2192\u9ad8\u7ea7\u8bbe\u7f6e
\n– \u5e38\u89c1\u8bef\u914d\u7f6e\uff1a22\/3306\/80\u7aef\u53e3\u672a\u653e\u884c\uff0cICMP\u54cd\u5e94\u88ab\u62e6\u622a<\/p>\n
2.2 \u7f51\u7edc\u5c42\u6df1\u5ea6\u68c0\u6d4b
\n2.2.1 \u8def\u7531\u8868\u5206\u6790\u5de5\u5177
\n– `netstat -nr`\uff08Windows\u547d\u4ee4\uff09
\n– `ip route show`\uff08Linux\u547d\u4ee4\uff09
\n– \u91cd\u70b9\u6392\u67e5\uff1a
\n – \u9ed8\u8ba4\u8def\u7531\u8df3\u8f6c\u5f02\u5e38\uff08\u5982\u6307\u5411\u9519\u8bef\u7f51\u5173\uff09
\n – VPN\u96a7\u9053\u672a\u751f\u6548\uff08\u8def\u7531\u6761\u76ee\u7f3a\u5931\uff09
\n – \u4ea4\u6362\u673aMAC\u5730\u5740\u8fc7\u6ee4\u89c4\u5219<\/p>\n
2.2.2 \u5ef6\u8fdf\u4e0e\u4e22\u5305\u6d4b\u8bd5
\n| \u5de5\u5177 | Linux | Windows | \u6807\u51c6\u9608\u503c |
\n|——|——-|———|———-|
\n| Ping | `ping -t 8.8.8.8` | cmd \u2192 ping 8.8.8.8 | <50ms |
\n| Traceroute | `traceroute 114.114.114.114` | CMD \u2192 tracepath 114.114.114.114 | \u226415\u8df3 |
\n| MTR | `mtr -n 8.8.8.8` | \u65e0\u76f4\u63a5\u5de5\u5177 |\u4e22\u5305\u7387<1% |<\/p>\n
2.3 \u670d\u52a1\u5668\u72b6\u6001\u6838\u67e5\u6e05\u5355
\n– CPU\/\u5185\u5b58\u4f7f\u7528\u7387\uff08\u6301\u7eed>80%\u89e6\u53d1\u6545\u969c\uff09
\n– \u78c1\u76d8I\/O\u76d1\u63a7\uff08SMART\u68c0\u6d4b\uff09
\n– \u7f51\u7edc\u63a5\u53e3\u72b6\u6001\uff08Speed\/Duplex\u6a21\u5f0f\uff09
\n– \u9632\u706b\u5899\u65e5\u5fd7\u5206\u6790\uff08\u91cd\u70b9\uff1a\u5f02\u5e38\u767b\u5f55\u5c1d\u8bd5\uff09<\/p>\n
\u4e09\u3001\u670d\u52a1\u5668\u914d\u7f6e\u4f18\u5316\u65b9\u6848\uff08\u542b\u914d\u7f6e\u793a\u4f8b\uff09
\n3.1 \u8d1f\u8f7d\u5747\u8861\u914d\u7f6e
\nNginx\u96c6\u7fa4\u90e8\u7f72\u793a\u4f8b\uff1a
\n“`nginx
\nhttp {
\n upstream app_server {
\n server 192.168.1.10:8080 weight=5;
\n server 192.168.1.11:8080 weight=3;
\n least_conn; \u6309\u8fde\u63a5\u6570\u667a\u80fd\u5206\u914d
\n }<\/p>\n
server {
\n location \/ {
\n proxy_pass http:\/\/app_server;
\n proxy_set_header X-Real-IP $remote_addr;
\n proxy_set_header Host $host;
\n }
\n }
\n}
\n“`<\/p>\n
3.2 \u9632\u706b\u5899\u4f18\u5316\u7b56\u7565
\niptables\u914d\u7f6e\u6a21\u677f\uff1a
\n“`bash
\n \u5141\u8bb8\u5185\u90e8\u7f51\u7edc\u8bbf\u95ee
\niptables -A INPUT -s 192.168.1.0\/24 -p tcp –dport 80 -j ACCEPT
\niptables -A INPUT -s 192.168.1.0\/24 -p tcp –dport 443 -j ACCEPT<\/p>\n
\u5173\u95edSSH\u66b4\u529b\u7834\u89e3
\niptables -A INPUT -p tcp –dport 22 -m connlimit –connlimit-above 5 -j DROP
\n“`<\/p>\n
3.3 DNS\u4f18\u5316
\n\u914d\u7f6e\u672c\u5730DNS\u7f13\u5b58\uff1a
\n– Linux\uff1a`echo “nameserver 8.8.8.8” >> \/etc\/resolvnf`
\n– Windows\uff1a\u8bbe\u7f6e”\u7f51\u7edc\u9002\u914d\u5668\u2192\u5c5e\u6027\u2192DNS\u2192\u9ad8\u7ea7\u2192\u4f7f\u7528DNS\u670d\u52a1\u5668”
\n– DNS\u8f6e\u6362\u8bbe\u7f6e\uff08TTL\u8c03\u6574\u4e3a60\u79d2\uff09<\/p>\n
\u56db\u3001\u8fdb\u9636\u89e3\u51b3\u65b9\u6848\uff08\u5de5\u7a0b\u5e08\u5fc5\u5907\uff09
\n4.1 CDN\u52a0\u901f\u914d\u7f6e
\nCloudflare Workers\u914d\u7f6e\u793a\u4f8b\uff1a
\n“`javascript
\n\/\/ workers.js
\nconst cloudflare = require(‘cloudflare’)();<\/p>\n
async function handler (event) {
\n const request = event.request;
\n const url = new URL(request.url);<\/p>\n
\/\/ \u6dfb\u52a0CORS\u5934
\n request.headers.set(‘Access-Control-Allow-Origin’, ‘*’);<\/p>\n
\/\/ \u52a0\u5bc6\u4f20\u8f93
\n request.headers.set(‘Content-Security-Policy’,
\n “default-src ‘self’; script-src ‘self’ https:\/\/cdn.example”);<\/p>\n
return new Response(JSON.stringify({ status: ‘success’ }), {
\n headers: { ‘Content-Type’: ‘application\/json’ }
\n });
\n}<\/p>\n
cloudflare workers run –name “vps-cdn” –token $CLOUDFLARE_TOKEN –workersdk version=-01-01 handler
\n“`<\/p>\n
4.2 \u865a\u62df\u5c40\u57df\u7f51\uff08VLAN\uff09\u914d\u7f6e
\nCisco\u4ea4\u6362\u673a\u914d\u7f6e\u793a\u4f8b\uff1a
\n“`bash
\nvlan 10
\nname Internal_Network
\nvlan 20
\nname Public_Network<\/p>\n
interface GigabitEthernet0\/1
\n switchport mode access
\n switchport access vlan 10<\/p>\n
interface GigabitEthernet0\/24
\n switchport trunk encapsulation dot1q
\n switchport mode trunk
\n switchport trunk allowed vlan 10,20
\n“`<\/p>\n
\u4e94\u3001\u9884\u9632\u6027\u7ef4\u62a4\u4f53\u7cfb\u6784\u5efa
\n5.1 \u76d1\u63a7\u544a\u8b66\u65b9\u6848
\n\u63a8\u8350\u4f7f\u7528Zabbix\u76d1\u63a7\u6a21\u677f\uff1a
\n– \u670d\u52a1\u5668\u5065\u5eb7\u6307\u6807\uff08CPU\/\u5185\u5b58\/Disk\uff09
\n– \u7f51\u7edc\u6027\u80fd\uff08\u63a5\u53e3\u6d41\u91cf\u3001\u4e22\u5305\u7387\uff09
\n– \u5e94\u7528\u6027\u80fd\uff08HTTP\u54cd\u5e94\u65f6\u95f4\u3001\u9519\u8bef\u7387\uff09
\n– \u81ea\u52a8\u63a8\u9001\u544a\u8b66\u81f3\u4f01\u4e1a\u5fae\u4fe1\/\u9489\u9489<\/p>\n
5.2 \u5907\u4efd\u6062\u590d\u673a\u5236
\n\u589e\u91cf\u5907\u4efd\u7b56\u7565\uff1a
\n“`bash
\n Linux\u6bcf\u65e5\u589e\u91cf\u5907\u4efd\u811a\u672c
\ntar -czf \/backups\/vps-$”.tar.gz –exclude={.git,*~} –newer-hour=24 \/var\/
\n“`<\/p>\n
5.3 \u5b89\u5168\u52a0\u56fa\u6d41\u7a0b
\n\u5b63\u5ea6\u5b89\u5168\u5ba1\u8ba1\u8981\u70b9\uff1a
\n– \u6f0f\u6d1e\u626b\u63cf\uff08Nessus\/OpenVAS\uff09
\n– \u66b4\u529b\u7834\u89e3\u9632\u62a4\uff08Fail2Ban\uff09
\n– \u96f6\u4fe1\u4efb\u7f51\u7edc\u67b6\u6784
\n– \u786c\u4ef6\u7ea7\u5b89\u5168\uff08TPM\u6a21\u5757\uff09<\/p>\n
\u516d\u3001\u5178\u578b\u6848\u4f8b\u5206\u6790\u4e0e\u6570\u636e\u652f\u6491
\n6.1 \u67d0\u7535\u5546VPS\u5b95\u673a\u4e8b\u4ef6\u590d\u76d8
\n– \u6545\u969c\u65f6\u95f4\uff1a.08.15 14:30-16:45
\n– \u635f\u5931\u6570\u636e\uff1a\u7ea6320\u4e07\u6761\u7528\u6237\u884c\u4e3a\u65e5\u5fd7
\n– \u6839\u672c\u539f\u56e0\uff1a\u672a\u53ca\u65f6\u66f4\u65b0OpenSSL\u5bfc\u81f4\u8bc1\u4e66\u8fc7\u671f
\n– \u6062\u590d\u8017\u65f6\uff1a\u901a\u8fc7\u5feb\u7167\u56de\u6eda\u8282\u77012.3\u5c0f\u65f6<\/p>\n
6.2 \u9632\u706b\u5899\u8bef\u914d\u7f6e\u5f71\u54cd\u8bc4\u4f30
\n\u67d0\u91d1\u878d\u7cfb\u7edf\u56e0\u9632\u706b\u5899\u7b56\u7565\u9519\u8bef\u5bfc\u81f4\uff1a
\n– \u6bcf\u65e5\u989d\u5916\u8fd0\u7ef4\u6210\u672c\u589e\u52a01500\u5143
\n– \u5408\u89c4\u5ba1\u8ba1\u901a\u8fc7\u7387\u4e0b\u964d40%
\n– \u5ba2\u6237\u4fe1\u4efb\u5ea6\u964d\u4f4e28\u4e2a\u767e\u5206\u70b9<\/p>\n
\u516d\u3001\u884c\u4e1a\u6700\u4f73\u5b9e\u8df5\u4e0e\u8d8b\u52bf\u6d1e\u5bdf
\n7.1 VPS\u5b89\u5168\u65b0\u89c4
\n– GDPR\u5408\u89c4\u8981\u6c42\uff1a\u6570\u636e\u5fc5\u987b\u5b58\u50a8\u5728\u5883\u5185\u670d\u52a1\u5668
\n– \u7b49\u4fdd2.0\u4e09\u7ea7\u8ba4\u8bc1\uff1a\u5f3a\u5236\u5b9e\u65bd\u53cc\u56e0\u7d20\u8ba4\u8bc1
\n– \u7eff\u8272\u6570\u636e\u4e2d\u5fc3\u6807\u51c6\uff1aPUE\u503c\u22641.35<\/p>\n
7.2 \u667a\u80fd\u8fd0\u7ef4\u53d1\u5c55\u8d8b\u52bf
\n– AIOps\u81ea\u52a8\u6839\u56e0\u5206\u6790\uff08\u51c6\u786e\u7387\u226592%\uff09
\n– \u8d85\u878d\u5408\u67b6\u6784\u90e8\u7f72\uff08\u8d44\u6e90\u5229\u7528\u7387\u63d0\u534760%\uff09
\n– \u670d\u52a1\u7f51\u683c\u6cbb\u7406\uff08\u5fae\u670d\u52a1\u6545\u969c\u9694\u79bb\u738798.7%\uff09<\/p>\n","protected":false},"excerpt":{"rendered":"
1.1 \u4f01\u4e1a\u7ea7\u5e94\u7528\u573a\u666f\u53d7\u963b \u5f53VPS\u4f5c\u4e3a\u4f01\u4e1a\u5185\u90e8\u7ba1\u7406\u7cfb\u7edf\uff08\u5982ERP\u3001OA\uff09\u3001\u6570\u636e\u5b58\u50a8\u4e2d\u5fc3\u6216\u79c1\u6709\u4e91\u5e73\u53f0\u65f6\uff0c\u5185\u7f51\u8bbf\u95ee\u4e2d\u65ad\u4f1a\u5bfc\u81f4\uff1a – \u6bcf\u5c0f\u65f6\u635f\u5931\u7ea6200 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[2557,304,2555,2556,1192],"class_list":["post-910","post","type-post","status-publish","format-standard","hentry","category-23","tag-cloudflare","tag-request","tag-switchport","tag-vlan","tag-windows"],"_links":{"self":[{"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/posts\/910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/comments?post=910"}],"version-history":[{"count":0,"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/posts\/910\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/media?parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/categories?post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.topklus.com\/seo\/wp-json\/wp\/v2\/tags?post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}