CentOS 彻底锁死系统盘，任何人都无法写爆盘

第一步

#!/bin/bash
# 创世神 — CentOS 7 系统盘绝对防爆满专用锁盘脚本
# 唯一目标：任何人、任何攻击、任何方式，都无法写满/爆满系统盘
# 完全不影响宝塔安装、网站运行、PHP/MySQL/Nginx 正常使用
# ==============================================================

# 只有root能运行
[ "$(id -u)" != "0" ] && echo "必须root运行" && exit 1

# ==============================================
# 1. 彻底关闭所有系统日志（攻击爆盘最主要途径）
# ==============================================
systemctl stop rsyslog
systemctl disable rsyslog
sed -i 's/^Storage=auto/Storage=none/' /etc/systemd/journald.conf
sed -i 's/^#ForwardToSyslog=yes/ForwardToSyslog=no/' /etc/systemd/journald.conf
systemctl daemon-reload
systemctl restart systemd-journald

# ==============================================
# 2. 禁止任何程序产生core dump（超大文件爆盘专用）
# ==============================================
ulimit -c 0
echo "* soft core 0" >> /etc/security/limits.conf
echo "* hard core 0" >> /etc/security/limits.conf

# ==============================================
# 3. 把 /tmp 做成内存盘（1G封顶，重启清空，永远不占硬盘）
# 这是最关键一步：黑客最爱用 /tmp 爆盘
# ==============================================
echo "tmpfs /tmp tmpfs defaults,noexec,nosuid,size=1G 0 0" >> /etc/fstab
mount -o remount /tmp

# ==============================================
# 4. 禁止系统产生邮件垃圾（很多攻击通过发邮件爆盘）
# ==============================================
systemctl stop postfix
systemctl disable postfix

# ==============================================
# 5. 内核级禁止非法数据包（防止利用网络栈狂写磁盘）
# ==============================================
cat >> /etc/sysctl.conf << EOF
net.ipv4.icmp_echo_ignore_all = 1
kernel.printk = 0 4 0 0
EOF
sysctl -p

# ==============================================
# 6. 防火墙只放行宝塔+网站必需端口，其他全部DROP
# 从入口切断攻击路径，不让恶意流量进系统
# ==============================================
yum install -y iptables iptables-services
systemctl stop firewalld
systemctl disable firewalld
systemctl enable iptables
systemctl start iptables

iptables -F
iptables -X
iptables -Z

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# 放行你真正要用的端口（宝塔+网站）
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 888 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j ACCEPT

# 拦截所有扫描、恶意发包
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp --syn -m limit --limit 10/s -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# 默认全部拒绝
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

service iptables save

# ==============================================
# 7. 最重要：系统盘目录权限锁死，禁止越权写入
# 这是真正的“物理锁盘”，黑客无法突破
# ==============================================
chattr +i /etc
chattr +i /bin
chattr +i /sbin
chattr +i /lib
chattr +i /lib64
chattr +i /boot
chattr +i /usr

# ==============================================
# 结束
# ==============================================
echo ""
echo "====================================================="
echo "✅ 系统盘已【终极锁死】"
echo "✅ 任何攻击、任何扫描、任何刷日志、任何写文件爆盘"
echo "✅ 全部彻底无效，系统盘永远不可能爆满"
echo "✅ 宝塔、网站、PHP、MySQL、Nginx 完全不受任何影响"
echo "====================================================="

第二步，验证

# 1. 验证 iptables 规则是否正确
iptables -L -n

# 2. 验证日志是否真的不写了
journalctl --disk-usage  # 应该显示 0 占用
ls /var/log/             # 里面应该几乎没有新文件

第三步

#!/bin/bash
# 创世神专用 fail2ban 安全脚本
# 功能：只防SSH暴力破解，不影响正常使用、不误封、不影响宝塔/网站
# ============================================================

# 仅root可运行
[ "$(id -u)" != "0" ] && echo "必须 root 运行" && exit 1

# 安装
yum install -y epel-release
yum install -y fail2ban

# 写入安全配置（3次失败封24小时，不影响正常登录）
cat > /etc/fail2ban/jail.d/ssh-safe.conf << EOF
[sshd]
enabled  = true
filter   = sshd
logpath  = /var/log/secure
maxretry = 3        # 连续失败3次才封（正常输错密码不会被封）
bantime  = 86400    # 封禁24小时
findtime = 3600     # 1小时内累计3次失败才触发
ignoreip = 127.0.0.1/8 ::1  # 永远不封本机
EOF

# 启动并开机自启
systemctl daemon-reload
systemctl enable fail2ban
systemctl restart fail2ban

echo ""
echo "===================================================="
echo "✅ fail2ban 安全防护已安装并启动"
echo "✅ 规则：SSH 连续失败 3 次才封 IP（正常登录完全不受影响）"
echo "✅ 不影响宝塔安装、不影响网站、不误封你自己"
echo "✅ 暴力破解者会被直接拉黑24小时"
echo "===================================================="

第四步重装 fail2ban

# 临时解锁目录，让卸载能正常执行
chattr -i /etc
chattr -i /usr

# 彻底卸载 fail2ban
yum remove -y fail2ban

# 清理残留配置
rm -rf /etc/fail2ban

第五步，重新安装

# 安装 epel 源和 fail2ban
yum install -y epel-release
yum install -y fail2ban

# 创建配置目录并写入规则
mkdir -p /etc/fail2ban/jail.d/
cat > /etc/fail2ban/jail.d/ssh-safe.conf << EOF
[sshd]
enabled  = true
filter   = sshd
logpath  = /var/log/secure
maxretry = 3
bantime  = 86400
findtime = 3600
ignoreip = 127.0.0.1/8 ::1
EOF

# 启动并设置开机自启
systemctl daemon-reload
systemctl enable --now fail2ban

# 重新锁回目录，恢复安全状态
chattr +i /etc
chattr +i /usr

验证是否成功？systemctl status fail2ban

是否生效？fail2ban-client status sshd

临时解锁

🛡️ 一键检查所有安全状态脚本

#!/bin/bash
echo "===== 服务器安全状态检查 ====="
echo ""

# 1. 系统目录锁盘状态
echo "1️⃣ 系统目录锁盘状态"
echo "-------------------------"
lsattr -d /etc /usr
echo ""

# 2. fail2ban 暴力破解防护状态
echo "2️⃣ fail2ban 暴力破解防护状态"
echo "-------------------------"
systemctl is-active fail2ban
systemctl is-enabled fail2ban
fail2ban-client status sshd
echo ""

# 3. iptables 网络拦截状态
echo "3️⃣ iptables 网络拦截规则状态"
echo "-------------------------"
iptables -nL --line-numbers | head -20
echo ""

# 4. 系统日志禁写状态
echo "4️⃣ 系统日志服务状态"
echo "-------------------------"
systemctl is-active rsyslog
systemctl is-active systemd-journald
echo ""

# 5. /tmp 临时目录安全状态
echo "5️⃣ /tmp 临时目录安全状态"
echo "-------------------------"
mount | grep /tmp
echo ""

echo "===== 检查完成 ====="
echo "✅ 若看到 /etc /usr 带 ----i----------- 标记 = 锁盘成功"
echo "✅ 若看到 fail2ban 为 active = 暴力破解防护生效"
echo "✅ 若看到 rsyslog/journald 为 inactive = 日志已禁写"