vault backup: 2026-02-04 13:41:36
This commit is contained in:
windyboy
@@ -0,0 +1,163 @@
|
||||
|
||||
|
||||
# elastic search
|
||||
index stats:
|
||||
GET /<index_name>/_stats/store
|
||||
|
||||
cluster stats:
|
||||
GET /_cluster/stats?human&pretty
|
||||
|
||||
get index:
|
||||
GET /_cat/indices?v&s=store.size:desc
|
||||
|
||||
|
||||
---
|
||||
|
||||
### **仅通过 SSH 服务端设置超时（方案一）**
|
||||
|
||||
#### **步骤说明**：
|
||||
1. **修改 SSH 服务端配置文件**：
|
||||
```bash
|
||||
sudo vim /etc/ssh/sshd_config
|
||||
```
|
||||
|
||||
2. **添加或修改以下参数**：
|
||||
```ini
|
||||
# 客户端空闲超时设置（单位：秒）
|
||||
ClientAliveInterval 300 # 每 300 秒（5分钟）检查一次客户端是否存活
|
||||
ClientAliveCountMax 0 # 如果客户端无响应，立即断开连接（总超时时间 = 300秒=5分钟）
|
||||
```
|
||||
**或**
|
||||
```ini
|
||||
ClientAliveInterval 600 # 每 600 秒（10分钟）检查一次
|
||||
ClientAliveCountMax 3 # 允许3次无响应（总超时时间 = 600x3=1800秒=30分钟）
|
||||
```
|
||||
|
||||
3. **重启 SSH 服务**：
|
||||
```bash
|
||||
# 大多数现代系统（Ubuntu/CentOS/RHEL等）：
|
||||
sudo systemctl restart sshd
|
||||
|
||||
# 旧版系统（如Debian 7）：
|
||||
sudo service ssh restart
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **参数解释**：
|
||||
- `ClientAliveInterval`：
|
||||
服务器每隔 N 秒向客户端发送一次保活信号，若客户端无响应，触发超时计数。
|
||||
**示例**：`300` 表示每5分钟检查一次。
|
||||
|
||||
- `ClientAliveCountMax`：
|
||||
允许客户端连续无响应的次数，超过后断开连接。
|
||||
**示例**：
|
||||
- 若设为 `0`，客户端一次无响应立即断开（总超时时间 = `ClientAliveInterval` 值）。
|
||||
- 若设为 `3`，总超时时间 = `ClientAliveInterval × 3`。
|
||||
|
||||
---
|
||||
|
||||
### **验证配置**：
|
||||
1. **检查配置文件**：
|
||||
```bash
|
||||
grep ClientAlive /etc/ssh/sshd_config
|
||||
```
|
||||
输出应包含你设置的参数值。
|
||||
|
||||
2. **测试超时**：
|
||||
登录 SSH 后保持会话空闲，观察是否在预期时间内自动断开。
|
||||
|
||||
---
|
||||
|
||||
### **注意事项**：
|
||||
1. **优先级**：服务端配置对所有通过 SSH 登录的用户生效，覆盖客户端设置。
|
||||
2. **安全建议**：
|
||||
- 生产环境建议设置 `ClientAliveInterval=300` + `ClientAliveCountMax=0`（严格超时5分钟）。
|
||||
- 避免设置过长的超时（如几小时），以防会话被恶意利用。
|
||||
3. **备份配置**：
|
||||
修改前建议备份原文件：
|
||||
```bash
|
||||
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **总结**
|
||||
通过服务端配置 `ClientAliveInterval` 和 `ClientAliveCountMax`，即可强制所有 SSH 会话在空闲超时后自动断开，无需用户端额外操作。
|
||||
|
||||
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
以下是设置Linux用户密码策略的**极简步骤**：
|
||||
|
||||
---
|
||||
|
||||
### **1. 设置密码有效期**
|
||||
- **新用户**：修改全局配置
|
||||
```bash
|
||||
sudo vim /etc/login.defs
|
||||
```
|
||||
修改以下值：
|
||||
```ini
|
||||
PASS_MAX_DAYS 90 # 密码90天后过期
|
||||
PASS_MIN_DAYS 7 # 修改密码后至少7天才能再改
|
||||
PASS_WARN_AGE 14 # 过期前14天提醒
|
||||
```
|
||||
|
||||
- **现有用户**：使用 `chage` 命令
|
||||
```bash
|
||||
sudo chage -M 90 -m 7 -W 14 用户名
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **2. 设置密码复杂度**
|
||||
- 编辑PAM配置文件（Ubuntu为例）：
|
||||
```bash
|
||||
sudo vim /etc/pam.d/common-password
|
||||
```
|
||||
- 修改以下行：
|
||||
```ini
|
||||
password requisite pam_pwquality.so minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1
|
||||
```
|
||||
参数说明：
|
||||
- `minlen=12`：密码至少12位
|
||||
- `ucredit=-1`：需1个大写字母
|
||||
- `lcredit=-1`：需1个小写字母
|
||||
- `dcredit=-1`：需1个数字
|
||||
- `ocredit=-1`：需1个特殊符号
|
||||
|
||||
---
|
||||
|
||||
### **3. 禁止重复使用旧密码**
|
||||
在PAM配置文件中添加：
|
||||
```ini
|
||||
password required pam_unix.so remember=5 # 禁止使用最近5次用过的密码
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **4. 强制用户立即修改密码**
|
||||
```bash
|
||||
sudo chage -d 0 用户名 # 用户下次登录时必须改密码
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **5. 验证配置**
|
||||
```bash
|
||||
sudo chage -l 用户名 # 查看用户的密码策略
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### **总结**
|
||||
1. 修改 `/etc/login.defs` 设置全局策略
|
||||
2. 用 `chage` 调整现有用户
|
||||
3. 通过PAM配置密码复杂度和历史
|
||||
4. 强制关键用户立即更新密码
|
||||
|
||||
完成后，用户密码会定期过期并满足复杂度要求。
|
||||
@@ -0,0 +1,5 @@
|
||||
|
||||
|
||||
program note:
|
||||
springboot version: 1.5.17.RELEASE
|
||||
|
||||
@@ -0,0 +1,210 @@
|
||||
# Office Test Environment
|
||||
|
||||
> [!info] Key Takeaways
|
||||
> - **Environment**: Chengdu Airport office test environment with 3-server Docker Swarm cluster
|
||||
> - **Architecture**: Microservices architecture using Spring Cloud Gateway, Eureka service registry, and Kafka messaging
|
||||
> - **Servers**: hz015 (swarm leader), hz016 (swarm worker), hz018 (database server)
|
||||
> - **Core Services**: adminapi (management), gatewayapi (API gateway), msgexchangeapi (message processing), kafkawsproxyapi (WebSocket proxy)
|
||||
> - **Infrastructure**: MySQL + Oracle dual databases, Redis cluster, Elasticsearch, Kafka, monitoring via Grafana/Prometheus
|
||||
> - **Repository**: [app-stack on local Gitea](https://gitea.int.it2000.com.cn/cdia/app-stack)
|
||||
|
||||
## Server Infrastructure
|
||||
|
||||
| server name | ip address | components |
|
||||
| ----------------------- | -------------- | ------------------- |
|
||||
| hz015.int.it2000.com.cn | 10.100.100.181 | docker swarm leader |
|
||||
| hz016.int.it2000.com.cn | 10.100.100.182 | docker swarm worker |
|
||||
| hz018.int.it2000.com.cn | 10.100.100.184 | database |
|
||||
|
||||
|
||||
## Component
|
||||
- 基础设施
|
||||
- 数据库
|
||||
- oracle
|
||||
- mysql
|
||||
- redis
|
||||
- elastic search
|
||||
- 消息服务
|
||||
- apache zookeeper
|
||||
- apache kafka
|
||||
- 应用程序注册
|
||||
- eureka
|
||||
- 网关
|
||||
- spring cloud
|
||||
- 监控服务
|
||||
- 日志集中
|
||||
- logstash
|
||||
- grafana
|
||||
- promethues
|
||||
- 管理工具
|
||||
- portainer
|
||||
- kafka
|
||||
- 应用程序
|
||||
- adminapi - 管理接口
|
||||
- kafkawsproxyapi - kafka消息websocket代理
|
||||
- msgexchangeapi - 消息处理
|
||||
- servicecenter - eureka消息注册
|
||||
- sysapi
|
||||
|
||||
## Deployment
|
||||
|
||||
### App Stack
|
||||
[local git](https://gitea.int.it2000.com.cn/cdia/app-stack)
|
||||
|
||||
- adminapi （管理程序）
|
||||
2 个数据库配置，一个mysql, 一个oracle
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
jpa:
|
||||
show-sql: true
|
||||
datasource:
|
||||
primary:
|
||||
username: root
|
||||
password: admingzzn
|
||||
url: >-
|
||||
jdbc:mysql://hz018.int.it2000.com.cn:3306/cdairport?useSSL=false&useUnicode=true&characterEncoding=utf-8&allowMultiQueries=true&autoReconnect=true
|
||||
max-active: 30
|
||||
test-on-borrow: true
|
||||
validation-query: SELECT 1
|
||||
initialSize: 5
|
||||
min-idle: 1
|
||||
max-wait: 60000
|
||||
time-between-eviction-runs-millis: 60000
|
||||
min-evictable-idle-time-millis: 300000
|
||||
test-while-idle: true
|
||||
test-on-return: true
|
||||
pool-prepared-statements: false
|
||||
max-pool-prepared-statement-per-connection-size: 20
|
||||
secondary:
|
||||
username: omms
|
||||
password: omms
|
||||
url: 'jdbc:oracle:thin:@hz018.int.it2000.com.cn:1521/orcl'
|
||||
driver: oracle.jdbc.driver.OracleDriver
|
||||
max-active: 30
|
||||
test-on-borrow: true
|
||||
validation-query: SELECT 1 FROM dual
|
||||
initial-size: 10
|
||||
min-idle: 1
|
||||
max-wait: 60000
|
||||
time-between-eviction-runs-millis: 60000
|
||||
min-evictable-idle-time-millis: 300000
|
||||
test-while-idle: true
|
||||
test-on-return: true
|
||||
pool-prepared-statements: false
|
||||
max-pool-prepared-statement-per-connection-size: 20
|
||||
eureka:
|
||||
client:
|
||||
service-url:
|
||||
defaultZone: 'http://hz015.int.it2000.com.cn:94/eureka/'
|
||||
instance:
|
||||
prefer-ip-address: false
|
||||
hostName: adminapi
|
||||
sysApi:
|
||||
host: hz015.int.it2000.com.cn
|
||||
port: 80
|
||||
schema: http
|
||||
baseUrl: '${sysApi.schema}://SYSAPI'
|
||||
getOpLogSwitchByLevleAndNameUrl: '${sysApi.baseUrl}/oplog/getOpLogSwitch/{level}/{name}'
|
||||
logstash:
|
||||
host: 'hz015.int.it2000.com.cn:5000'
|
||||
elasticsearch:
|
||||
ip: hz016.int.it2000.com.cn
|
||||
port: 9300
|
||||
pool: 5
|
||||
cluster:
|
||||
name: docker-cluster
|
||||
nodes: 'hz016.int.it2000.com.cn:9300'
|
||||
maxSize: 10000
|
||||
|
||||
```
|
||||
|
||||
gatewayapi （api gateway）
|
||||
|
||||
```yaml
|
||||
spring:
|
||||
application:
|
||||
name: gatewayapi
|
||||
redis:
|
||||
cluster:
|
||||
nodes:
|
||||
- 'hz018.int.it2000.com.cn:7000'
|
||||
- 'hz018.int.it2000.com.cn:7001'
|
||||
- 'hz018.int.it2000.com.cn:7002'
|
||||
- 'hz018.int.it2000.com.cn:7003'
|
||||
- 'hz018.int.it2000.com.cn:7004'
|
||||
- 'hz018.int.it2000.com.cn:7005'
|
||||
pool:
|
||||
max-idle: 10
|
||||
min-idle: 0
|
||||
max-active: 200
|
||||
max-wait: -1
|
||||
timeout: 1000
|
||||
cloud:
|
||||
gateway:
|
||||
default-filters:
|
||||
- PermissionCheckFilter
|
||||
routes:
|
||||
- id: host_adminapi
|
||||
uri: 'lb://ADMINAPI'
|
||||
predicates:
|
||||
- Path=/adminapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_sysapi
|
||||
uri: 'lb://SYSAPI'
|
||||
predicates:
|
||||
- Path=/sysapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_msgexchangeapi
|
||||
uri: 'lb://MSGEXCHANGEAPI'
|
||||
predicates:
|
||||
- Path=/msgexchangeapi/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_kafkawsproxyapi
|
||||
uri: 'lb://KAFKAWSPROXYAPI'
|
||||
predicates:
|
||||
- Path=/v2/broker
|
||||
- id: host_adminweb
|
||||
uri: 'http://10.100.100.181:96'
|
||||
predicates:
|
||||
- Path=/adminweb/**
|
||||
filters:
|
||||
- StripPrefix=1
|
||||
- id: host_redirect
|
||||
uri: 'http://10.100.100.181/adminweb/'
|
||||
predicates:
|
||||
- Path=/
|
||||
filters:
|
||||
- 'RedirectTo=302, http://10.100.100.181/adminweb/'
|
||||
gateway:
|
||||
loginUrl: '/adminweb/#/login'
|
||||
sysApi:
|
||||
schema: http
|
||||
baseUrl: '${sysApi.schema}://SYSAPI'
|
||||
getUserByLoginName: '${sysApi.baseUrl}/setting/user/detail/{loginName}'
|
||||
publicurlsServiceUrl: '${sysApi.baseUrl}/setting/permission/publicurls'
|
||||
privateurlsServiceUrl: '${sysApi.baseUrl}/setting/permission/privateurls/{uid}'
|
||||
getOpLogSwitchByLevleAndNameUrl: '${sysApi.baseUrl}/oplog/getOpLogSwitch/{level}/{name}'
|
||||
eureka:
|
||||
client:
|
||||
service-url:
|
||||
defaultZone: 'http://hz015.int.it2000.com.cn:94/eureka/'
|
||||
instance:
|
||||
prefer-ip-address: false
|
||||
hostName: gatewayapi
|
||||
logstash:
|
||||
host: 'hz015.int.it2000.com.cn:5000'
|
||||
elasticsearch:
|
||||
ip: hz016.int.it2000.com.cn
|
||||
port: 9300
|
||||
pool: 5
|
||||
password: changeme
|
||||
username: elastic
|
||||
cluster:
|
||||
name: docker-cluster
|
||||
nodes: 'hz016.int.it2000.com.cn:9300'
|
||||
|
||||
```
|
||||
@@ -0,0 +1,10 @@
|
||||
|
||||
|
||||
## 基础设施
|
||||
* 日志服务
|
||||
* 使用graylog 代替elk
|
||||
hz011.int.it2000.com.cn
|
||||
130.120.3.128
|
||||
http://hz011.int.it2000.com.cn:9000
|
||||
admin/admingzzn
|
||||
|
||||
Reference in New Issue
Block a user