さくらVPS初期設定 俺々編

Linux Centos さくらVPS
  • ちょっと我流が交じるけど大体皆同じ？
  • 不要なcron設定を止める
// 素早く検索するためのコマンド whatis, locate は
// 夜中にゴリゴリI/O動いてDBを作ってるので止める。
# mv /etc/cron.daily/makewhatis.cron /root
# mv /etc/cron.daily/mlocate.cron /root
# mv /etc/cron.weekly/makewhatis.cron /root/makewhatis.cron.weekly

// 悪名高いprelinkを止める。バイナリを壊したりすることがあるので。
# mv /etc/cron.daily/prelink /root
  • ユーザー作成
# useradd -G wheel -g users ymko

# diff -Naur /etc/sudoers{.o,}
--- /etc/sudoers.o      2011-08-12 04:17:05.000000000 +0900
+++ /etc/sudoers        2011-08-12 04:17:30.000000000 +0900
@@ -84,6 +84,7 @@

 ## Same thing without a password
 # %wheel       ALL=(ALL)       NOPASSWD: ALL
+%wheel ALL=(ALL)       NOPASSWD: ALL

 ## Allows members of the users group to mount and unmount the
 ## cdrom as root

# su - ymko
$ mkdir -m 700 .ssh
$ cat >> .ssh/authorized_keys
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
$ chmod 600 !$

# diff -Naur /etc/ssh/sshd_config{.o,}
--- /etc/ssh/sshd_config.o      2010-09-13 00:58:45.000000000 +0900
+++ /etc/ssh/sshd_config        2011-08-12 03:52:26.000000000 +0900
@@ -11,6 +11,7 @@
 # default value.
 
 #Port 22
+Port xxxx
 #Protocol 2,1
 Protocol 2
 #AddressFamily any
@@ -37,6 +38,7 @@
 
 #LoginGraceTime 2m
 #PermitRootLogin yes
+PermitRootLogin no
 #StrictModes yes
 #MaxAuthTries 6
@@ -56,6 +58,7 @@
 
 # To disable tunneled clear text passwords, change to no here!
 #PasswordAuthentication yes
+PasswordAuthentication no
 #PermitEmptyPasswords no
 PasswordAuthentication yes

# cat /etc/sysconfig/i18n
LANG="ja_JP.UTF-8"

\*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport xxxx -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

http://akabeko.sakura.ne.jp/blog/2010/09/%e3%81%95%e3%81%8f%e3%82%89%e3%81%aevps-%e3%82%92%e4%bd%bf%e3%81%84%e3%81%af%e3%81%98%e3%82%81%e3%82%8b-3/

      • port 631もいらない。