Debian一键安全加强脚本

#!/bin/bash
# ============================================================
# Debian 12 服务器安全加固一键脚本
# 适用: Debian 11/12 + Nginx + PHP 博客服务器
# 功能: A.封堵数据库下载  B.fail2ban防暴力破解  C.ufw防火墙  D.安全补丁+自动更新
# 用法: 以 root 运行  bash harden.sh
# 特性: 幂等设计，重复执行无副作用；不会锁死 SSH（先放行 22 再开防火墙）
# ============================================================
set -u

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()   { echo -e "${GREEN}[OK]${NC} $1"; }
warn() { echo -e "${YELLOW}[..]${NC} $1"; }
fail() { echo -e "${RED}[失败]${NC} $1"; }

if [ "$(id -u)" -ne 0 ]; then
    fail "请用 root 运行: sudo bash $0"
    exit 1
fi

echo "=============================================="
echo " Debian 12 安全加固开始 $(date '+%F %T')"
echo "=============================================="

# ---------- A. 封堵数据库/敏感文件下载 ----------
echo ""
warn "A. 封堵数据库和敏感文件下载..."
CONF="/etc/nginx/sites-enabled/default"
# 兼容无 sites-enabled 的配置结构
if [ ! -f "$CONF" ]; then
    CONF=$(grep -rlE '^\s*server\s*\{' /etc/nginx/conf.d/ /etc/nginx/nginx.conf 2>/dev/null | head -1)
fi
if [ -n "${CONF:-}" ] && [ -f "$CONF" ]; then
    if grep -q 'block-sensitive' "$CONF"; then
        ok "A: 保护规则已存在，跳过"
    else
        # 备份放到 sites-enabled 之外，防止被 nginx 当配置加载
        cp -an "$CONF" "/etc/nginx/$(basename "$CONF").bak-hardening"
        sed -i '/server_name/a\    # block-sensitive: 保护数据库和敏感文件\n    location ^~ /data/ { deny all; return 404; }\n    location ~* \.(db|sqlite|sqlite3|sql|bak|log)$ { deny all; return 404; }' "$CONF"
        if nginx -t 2>/dev/null; then
            systemctl reload nginx
            ok "A: 数据库/敏感文件已禁止下载"
        else
            fail "A: nginx 配置异常，已回滚"
            cp -an "/etc/nginx/$(basename "$CONF").bak-hardening" "$CONF"
            systemctl reload nginx
        fi
    fi
else
    fail "A: 未找到 nginx 站点配置，请手动检查"
fi

# ---------- B. fail2ban 防暴力破解 ----------
echo ""
warn "B. 安装配置 fail2ban..."
if systemctl is-active --quiet fail2ban 2>/dev/null; then
    ok "B: fail2ban 已在运行，跳过安装"
else
    DEBIAN_FRONTEND=noninteractive apt-get install -y fail2ban > /dev/null 2>&1
    cat > /etc/fail2ban/jail.local <<'EOF'
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 10
ignoreip = 127.0.0.1/8

[sshd]
enabled  = true
port     = ssh
backend  = systemd
maxretry = 10
bantime  = 1h
EOF
    systemctl enable --now fail2ban > /dev/null 2>&1
    if systemctl is-active --quiet fail2ban; then
        ok "B: fail2ban 已启用（10次失败/10分钟 封1小时）"
    else
        fail "B: fail2ban 启动失败，请检查 /etc/fail2ban/jail.local"
    fi
fi

# ---------- C. ufw 防火墙 ----------
echo ""
warn "C. 配置 ufw 防火墙（只放行 22/80/443）..."
if ufw status 2>/dev/null | grep -q "Status: active"; then
    ok "C: 防火墙已启用，跳过"
else
    DEBIAN_FRONTEND=noninteractive apt-get install -y ufw > /dev/null 2>&1
    # 顺序关键：先放行 SSH 再启用，防止锁死自己
    ufw default deny incoming > /dev/null
    ufw default allow outgoing > /dev/null
    ufw allow 22/tcp  comment 'SSH'   > /dev/null
    ufw allow 80/tcp  comment 'HTTP'  > /dev/null
    ufw allow 443/tcp comment 'HTTPS' > /dev/null
    ufw --force enable > /dev/null
    if ufw status | grep -q "Status: active"; then
        ok "C: 防火墙已启用（放行 22/80/443，其余全拒）"
    else
        fail "C: 防火墙启用失败"
    fi
fi

# ---------- D. 安全补丁 + 自动更新 ----------
echo ""
warn "D. 安装安全补丁（包多时需几分钟）..."
apt-get update -qq > /dev/null 2>&1
DEBIAN_FRONTEND=noninteractive apt-get -y \
    -o Dpkg::Options::='--force-confdef' \
    -o Dpkg::Options::='--force-confold' \
    upgrade > /tmp/harden-upgrade.log 2>&1
if [ $? -eq 0 ]; then
    ok "D: 系统补丁已全部安装（日志: /tmp/harden-upgrade.log）"
else
    fail "D: 补丁安装有报错，请查看 /tmp/harden-upgrade.log"
fi

warn "D. 启用自动安全更新..."
DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades > /dev/null 2>&1
cat > /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF
systemctl enable --now unattended-upgrades > /dev/null 2>&1
if systemctl is-active --quiet unattended-upgrades; then
    ok "D: 自动安全更新已启用（每天自动装安全补丁）"
else
    fail "D: unattended-upgrades 启动失败"
fi

# ---------- 最终验证 ----------
echo ""
echo "=============================================="
echo " 加固完成，最终状态:"
echo "=============================================="
echo -n "  SSH/nginx/PHP/fail2ban/自动更新: "
systemctl is-active --quiet ssh      && printf "SSH✓ "     || printf "SSH✗ "
systemctl is-active --quiet nginx    && printf "Nginx✓ "   || printf "Nginx✗ "
systemctl is-active --quiet php*-fpm && printf "PHP✓ "    || printf "PHP✗ "
systemctl is-active --quiet fail2ban && printf "f2b✓ "    || printf "f2b✗ "
systemctl is-active --quiet unattended-upgrades && echo "自动更新✓" || echo "自动更新✗"
echo -n "  防火墙: "; ufw status | grep "Status: active" > /dev/null && echo "已启用✓" || echo "未启用✗"

SITE_URL="http://127.0.0.1"
echo -n "  网站首页: "
curl -s -o /dev/null -w "HTTP %{http_code}" "$SITE_URL/" 2>/dev/null; echo ""
echo -n "  数据库文件(应404): "
curl -s -o /dev/null -w "HTTP %{http_code}" "$SITE_URL/data/blog.db" 2>/dev/null; echo ""
echo -n "  待更新补丁: "
N=$(apt list --upgradable 2>/dev/null | grep -c upgradable)
echo "${N:-0} 个"
if [ -f /var/run/reboot-required ]; then
    warn "  内核已更新，建议找个方便的时间重启: reboot"
fi
echo "=============================================="
echo " 提示: fail2ban 封禁状态查看: fail2ban-client status sshd"
echo "       防火墙规则查看:       ufw status verbose"
echo "=============================================="