一、设置安全组

1.入方向规则

# 80端口 所有IP访问
IPv4   0.0.0.0/0   TCP:80   HTTP

# 443端口 所有IP访问
IPv4   0.0.0.0/0   TCP:443   HTTPS

# 22端口 本机IP访问
IPv4   183.220.16.253/32   TCP:22   SSH

# ICMP 本机IP访问
IPv4   183.220.16.253/32   ICMP: 全部   Ping

2.出方向规则

IPv4   0.0.0.0/0   全部协议   全部端口
IPv6   ::/0   全部协议   全部端口

二、脚本检测

1.登录成功统计

last -a -F | awk '$NF ~ /^[0-9.]+$/ || $NF=="localhost" {print $NF, $1, "成功"}' | sort | uniq -c | sort -nr

2.登录成功列表

last -a -F | awk '
  BEGIN {
    split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec", m, " ");
    for(i=1;i<=12;i++) month[m[i]]=sprintf("%02d", i);
  }
  $NF ~ /^[0-9.]+$/ || $NF=="localhost" {
    day = sprintf("%02d", $5);
    printf "%s-%s-%s %s %s %s %s\n", $7, month[$4], day, $6, $NF, $1, "成功";
  }' | sort

3.登录失败统计

sudo lastb -a -F 2>/dev/null | awk '$NF ~ /^[0-9.]+$/ || $NF=="localhost" {print $NF, $1, "失败"}' | sort | uniq -c | sort -nr

4.登录失败列表

sudo lastb -a -F 2>/dev/null | awk '
  BEGIN {
    split("Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec", m, " ");
    for(i=1;i<=12;i++) month[m[i]]=sprintf("%02d", i);
  }
  $NF ~ /^[0-9.]+$/ || $NF=="localhost" {
    day = sprintf("%02d", $5);
    printf "%s-%s-%s %s %s %s %s\n", $7, month[$4], day, $6, $NF, $1, "失败";
  }' | sort

5.清除历史数据

sh -c ': > /var/log/wtmp; : > /var/log/btmp; : > /var/log/lastlog; : > /var/log/faillog'