Kuderedza server kuremerwa

Muchinyorwa chino, isu tichaongorora kuti sei yakawedzera server kuremerwa kunoitika uye kukurukura nzira dzakasiyana dzekukwirisa yakakwirira-mutoro maitiro. Kunyanya kutariswa kuchapihwa kodhi optimization muApache/Nginx uye MySQL, isu tichataura nezve caching sechishandiso chekubatsira, uye zvakare kufunga dzingangove kutyisidzira kwekunze, sekurwiswa kweDDOS, uye nzira dzekudzidzivirira.

Sei Server Load Inoitika

Usati waenderera kune server optimization, zvinodikanwa kuita ongororo yakakwana yemutoro wazvino pane zviwanikwa. Izvi zvinosanganisira kuyera CPU mutoro, kushandiswa kweRAM, chiitiko chetiweki, uye mamwe akakosha paramita. Kunzwisisa masimba uye mitoro yepamusoro inobvumira kuona mabhodhoro uye optimize zviwanikwa zvekugovera, nekudaro kuwedzera kugadzikana uye kuita kweiyo server zvivakwa.

Kuti titange tagadzirisa dambudziko rehuwandu hwesevha, tinokurudzira kuti tiongorore server yese . Kana izvi zvisina kukwana, ongororo yakadzama yezviwanikwa inodiwa. Sechishandiso chekubatsira, kuongorora magwaro eLinux server kunogona kubatsira, sezvo apa ndipo panowanikwa dambudziko muzviitiko zvakawanda.

Kugadzirisa Apache/Nginx Server

Yakawedzera Server Mutoro Nekuda kweIndexing

Kuwedzera mutoro nekuda kwe indexing pane sevha inogona kuitika, semuenzaniso, kana injini dzekutsvaga dzichitsvaga nhamba huru yemapeji panzvimbo yako. Izvi zvinogona kutungamira mukuwedzera kushandiswa kwemaseva zviwanikwa uye, nekudaro, kunonotsa kuita kwesaiti. Kuziva chikonzero kuri nyore; unofanira kuvhura faira riri pa:

/var/www/httpd-logs/sitename.access.log

Kana yaiswa indexed neinjini dzekutsvaga, mushandisi achaona zvinyorwa zveanotevera hunhu:

11.22.33.44 - - [Date and Time] "GET /your-page-path HTTP/1.1" 200 1234 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Semhinduro yekutanga yekuderedza mutoro, unogona kushandisa meta tags "noindex" uye "nofollow" pamapeji asingade kuiswa index. Mhinduro yechipiri ifaira re.htaccess , apo zvinyorwa zvinoenderana neinjini dzekutsvaga dzinofanira kuwedzerwa, semuenzaniso, kuti dzisaonekwe neYandex neGoogle:

SetEnvIfNoCase User-Agent "^Yandex" search_bot
SetEnvIfNoCase User-Agent "^Googlebot" search_bot
Order Allow,Deny
Allow from all
Deny from env=search_bot

Saizvozvowo, kugadziridzwa kunofanirwa kuitwa kune dzimwe injini dzekutsvaga. Zvinofanira kucherechedzwa kuti kugona kwe.htaccess hakungogumiri pakuvharira indexing chete. Tinokurudzira kuti uzive zvakawanda nezvezvinhu zvayo zvikuru muchinyorwa ichi.

Kushandisa Caching Settings

Kusagadzirisa caching zvisirizvo paserver kunogonawo kukonzera mutoro wakawanda. Kuti parameter iyi ishande zvakanaka, shanduko dzinoenderana dzinofanira kuitwa mumafaira ekugadzirisa kana .htaccess . Kana iri Apache, sarudzo yekupedzisira ndiyo inonyanya kufarirwa, yeNginx - yekutanga.

Pane server yeApache , unofanirwa kuvhura faira re .htacess woisa kodhi inotevera:

<FilesMatch ".(flv|gif|jpg|jpeg|png|ico|swf|js|css|pdf|doc|docx)$">
Header set Cache-Control "max-age=2592000"
</FilesMatch>

Wobva wagonesa Expires module uchishandisa murairo:

sudo a2enmod expires

Mushure meizvozvo, tangazve sevha yewebhu:

sudo service apache2 restart

Uye shandisa module nekutsanangura:

ExpiresActive On

Pane sevha yeNginx , zvakakwana kuwedzera kodhi inotevera kufaira rekugadzirisa:

location ~* .(jpg|jpeg|gif|png|ico|css|swf|flv|doc|docx)$ {
root /var/www/yoursite.com;
}

Uye ita sevhisi reload:

sudo service nginx restart

Ziva kuti nemarongero aya, mirairo yeAllow neDeny ichadziviswa.

Kushandisa Data Compression

Kugonesa kudzvanywa kwedata uchishandisa Gzip pamaseva ewebhu eApache neNginx kunobatsira kuderedza huwandu hwedata rinotumirwa pakati peseva nemutengi, izvo zvinovandudza mashandiro uye zvinoderedza nguva yekurodha mapeji ewebhu.

Kuti ugonese Gzip paApache , unofanirwa kuvhura module ye mod_deflate :

sudo a2enmod deflate

Zvadaro, tangazve web server:

sudo service apache2 restart

Uye pakupedzisira, wedzera chivharo chinotevera kune faira rekugadzirisa kana .htaccess:

<IfModule mod_deflate.c>
# Configure compression for specified file types
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/x-javascript application/json

# If the browser matches the specified pattern, apply compression only to text/html files
BrowserMatch ^Mozilla/4 gzip-only-text/html

# If the browser matches the specified version patterns of Mozilla 4.0.6, 4.0.7, 4.0.8, disable compression
BrowserMatch ^Mozilla/4\.0[678] no-gzip

# If the browser is MSIE (Internet Explorer), disable compression for all files except text/html
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

# If the request contains the specified pattern (extensions of image files), disable compression
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip
</IfModule>

Iyi gadziriso inogonesa kudzvanya kwemamwe marudzi emafaira uye inodzima kune mifananidzo.

Kana iri Nginx , configuration inoitika mu http block ye configuration file. Kodhi inotevera inofanira kuwedzerwa:

gzip on;
gzip_disable "msie6";

# Adds the Vary header, indicating that the response may change depending on the Accept-Encoding header value
gzip_vary on;

# Enables compression for any proxy servers
gzip_proxied any;

# Sets the compression level. A value of 6 provides a good balance between compression efficiency and resource use
gzip_comp_level 6;

# Sets the size of the buffer for compressed data (16 buffers of 8 kilobytes each)
gzip_buffers 16 8k;

# Specifies that data compression should be used only for HTTP version 1.1 and higher
gzip_http_version 1.1;

# Sets the file types that can be compressed
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

Kufanana neApache , pano ma "compression parameters" emamwe marudzi emafaira anoiswa. Mushure mekuchinja chero ma "web servers", "service reload" inodiwa:

sudo service apache2 restart

Or

sudo service nginx restart

DDOS Kurwisa paSevha

Yakakwira sevha mutoro inogona kuitika semhedzisiro yekurwiswa kweDDoS. Kuziva kuvepo kwekurwiswa kweDDoS kunogona kuitwa kuburikidza nekutarisa kuwedzera kamwe kamwe mutraffic, zvikumbiro zvisina kujairika, uye server performance inodonha. Kudzokorora matanda ezvikumbiro zvakadzokororwa kubva kune imwe kero yeIP kana chiteshi chekuongorora kunogonawo kuratidza inogona kuitika DDoS kurwisa. Kune akawanda matanho ekudzivirira, asi isu tichangokurukura zvekutanga.

Kushandisa CDN (Content Delivery Network) . CDN inogona kushanda semurevereri pakati pewebhu server yako nevashandisi, ichigovera traffic uye kuchengetedza zviri mukati kuti ideredze kukanganiswa kweDDoS. CDN dzinogonawo kuva nenzira dzekudzivirira DDoS dzakavakirwa mukati, kusanganisira kugoverwa kwemutoro uye kusefa traffic.

Kugadzirisa mafirewall uye masisitimu ekuona kupinda kwedata (IDS/IPS) . Mafirewall anogona kugadzirwa kuti asefe traffic zvichibva pane zvakasiyana-siyana, zvakaita se IP addresses nema ports. IDS/IPS inogona kuona maitiro asina kujairika etraffic uye kudzivirira connections dzinofungidzirwa. Zvishandiso izvi zvinogona kushanda mukutevera nekudzivirira traffic inogona kunge ine njodzi.

Kugadzirisa Apache uye Nginx webhu maseva kudzikamisa kukanganisa kweDDoS kurwiswa.

Semhinduro yeApache, tinogonesa module ye mod_evasive . Kuti uite izvi, bvisa comment kana kuwedzera mutsetse unotevera mufaira re httpd.conf kana apache2.conf :

LoadModule evasive20_module modules/mod_evasive.so

Mune iyo faira imwe chete, iwe unofanirwa kuwedzera marongero block:

<IfModule mod_evasive20.c>
# Hash table size for storing request information
DOSHashTableSize 3097

# Number of requests to one page before activating protection
DOSPageCount 2
DOSPageInterval 1

# Number of requests to all pages before activating protection
DOSSiteCount 50
DOSSiteInterval 1

# Blocking period in seconds for IP addresses
DOSBlockingPeriod 10
</IfModule>

Saizvozvowo, tinoshandisa mod_ratelimit module:

LoadModule ratelimit_module modules/mod_ratelimit.so

Uye wedzera gadziriso:

<IfModule mod_ratelimit.c>
# Setting the output filter for rate limiting (Rate Limit)
SetOutputFilter RATE_LIMIT

# Beginning of the settings block for the location "/login"
<Location "/login">

# Setting the environment variable rate-limit with a value of 1
SetEnv rate-limit 1

# Ending of the settings block for the location "/login"
</Location>
</IfModule>

Magadzirirwo eNginx akafanana neApache . Mufaira rekugadzirisa re nginx.conf , mirairo inotevera inofanira kushandiswa:

http {
...
# Defining a zone for connection limits
limit_conn_zone $binary_remote_addr zone=addr:10m;

# Defining a zone for request limits
limit_req_zone $binary_remote_addr zone=req_zone:10m rate=1r/s;

server {
        ...
        # Configuring connection limits
        limit_conn addr 10;

        # Configuring request limits
        limit_req zone=req_zone burst=5;

        ...
    }
}

Mushure mekuita shanduko kune yega yega masevhisi, anofanirwa kurodhazve:

sudo systemctl restart apache2

Or:

sudo systemctl restart nginx

Iyi mienzaniso inopa chete gadziriro yekutanga, iyo inogona kugadziridzwa zvakare zvichienderana nezvinodiwa chaizvo uye chimiro chekurwiswa.

Kugadzirisa MySQL Mibvunzo

Kugadzirisa mibvunzo yedatabase yeMySQL pawebhu server kunogona kuitwa nenzira dzakasiyana-siyana, uye imwe yadzo ndeyekugadziriswa kwakakodzera kwefaira rekugadzirisa. Kazhinji, faira iri rinonzi my.cnf kana my.ini uye rinowanikwa mudhairekitori re /etc/ kana /etc/mysql/ . Unofanira kurivhura woita shanduko dzinotevera:

[mysqld]
# Location of the file for recording slow queries. Be sure to replace it with your path
log-slow-queries = /var/log/mariadb/slow_queries.log

# Threshold time for considering slow queries (in seconds)
long_query_time = 5

# Enabling recording of queries that do not use indexes
log-queries-not-using-indexes = 1

# Disabling query caching
query_cache_size = 0
query_cache_type = 0
query_cache_limit = 1M

# Size of temporary tables
tmp_table_size = 16M
max_heap_table_size = 16M

# Size of the thread cache
thread_cache_size = 16

# Disabling name resolving
skip-name-resolve = 1

# Size of the InnoDB buffer pool. Set to 50-70% of available RAM
innodb_buffer_pool_size = 800M

# Size of the InnoDB log file
innodb_log_file_size = 200M

Ngatitariseiwo mamwe mazano anogona kufambisa kudyidzana neserver database:

1. Shandisa DZIDZA raira pamberi pemubvunzo weSQL kuti uongorore kuita kwayo. Izvi zvinokutendera kuti uwane chirongwa chekuuraya chemubvunzo uye uone kuti ndeapi ma index anoshandiswa, ndeapi matafura anoongororwa, nezvimwe.
2. Ma indexes anomhanyisa kutsvaga kwedata, saka ma index akagadzirwa zvakanaka anogona kuvandudza zvakanyanya kuita kwemubvunzo. Chenjerera kune makoramu anowanzo shandiswa mukati WHERE or ONA mamiriro.
3. Ngwarira kushandisa Sarudza *. Nyora chete makoramu ayo anonyatso diwa pamubvunzo wako, pane kusarudza makoramu ese mutafura.
4. Dzivisa kushandisa mabasa mukati WHERE mamiriro. Kushandisa mabasa (akadai se CHIDUKU, PAMUSORO, RUBOSHWE, RUDYIin WHERE mamiriro anogona kuita indexes kusashanda. Edza kudzivisa kushandiswa kwavo zvakananga mumamiriro ezvinhu.
5. shandisa INNER JOIN pazvinogoneka, sezvo kazhinji kazhinji inoshanda. Zvakare, ita shuwa kuti makoramu anoenderana ekubatanidza ane indexes.
6. shandisa ZVIMWE kudzikamisa huwandu hwemitsara yakadzoserwa kana iwe uchida kuwana imwe nhamba yemhedzisiro.
7. Funga caching mhinduro yemubvunzo, kunyanya kana isingawanzo chinja, kuderedza server kuremerwa.

Iyo Email Server Inogadzira Yakakwira Mutoro paSevha

Muchikamu chino, tichaongorora kuti tingaziva sei kuti mail server iri kutambura nekuremerwa kwakanyanya uye matanho api anogona kutorwa kuti ishande zvakanaka, kusanganisira kutarisa meseji uye kugadzirisa ma parameter eseva. Tanga nekutarisa meseji. Mailq utility inogona kubatsira neizvi, kuti iite kuti ishande, isa murairo unoenderana muterminal:

mailq

Izvi zvicharatidza rondedzero yemameseji mumutsara, kana iripo. Imwe neimwe meseji icharatidzwa ine yakasarudzika identifier uye ruzivo nezve mamiriro ekutumira. Mhedzisiro yakafanana inogona kuwanikwa nekuongorora magwaro evatengi vetsamba.

Muzviitiko zvakawanda, mutoro wakakwirira unoitika muchiitiko che server compromise painotanga kutumira spam. Nekudaro, kana mushure mekutarisa maneja ane chivimbo chekuti sevha haina kurwiswa kubva kunze uye vashandisi havasi kuregeredza spam, inguva yekuenderera mberi nekugadzirisa iyo mail server. Heano matanho anobatsira:

1. Ita shuwa kuti yako domain DNS marekodhi akagadziriswa nemazvo, kusanganisira SPF, DKIM, uye DMARC zvinyorwa zvekuvandudza mail kutumira uye kudzivirira kubva kune spam. Iko kurongeka kwakaringana kweparamita kunogona kuwanikwa muchinyorwa pa mail server diagnostics.
2. Tarisa marongero etiweki, anosanganisira firewall kumisikidzwa uye routing mitemo, kudzivirira mabhuroko uye nekumhanyisa kutumira tsamba.
3. Rongedza mitsara yemutsara wemeseji zvinoenderana nekuremerwa kweseva. Izvi zvinogona kusanganisira kuseta hukuru hwemutsetse uye nguva dzekupedza nguva.
4. Funga nezvemhinduro dzatakurukura munyaya ino yapfuura. Nguva nenguva gadzirisa iyo mail server dhatabhesi kuti uvandudze mashandiro, shandisa caching nzira kukurumidza kutsvaga nekugadzirisa data, senge DNS mibvunzo.
5. Kana iyo mail server ichiri kugara ichisangana neyakakura, funga nezve kuyera sarudzo, sekushandisa boka remasevha etsamba kana gore mhinduro.

mhedziso

Kuwedzera server kuremerwa kunobata zvakananga kurodha webhusaiti kumhanya, pakupedzisira kukanganisa mushandisi ruzivo uye mukurumbira mumajini ekutsvaga. Nokudaro, kunyatsogadzirisa mutoro uyu kunotora basa rinokosha pakuita kuti basa rirambe riripo rekushandisa uye kuwedzera kuwanikwa kwayo kune vashanyi.