Yaraynta culeyska server-ka

Maqaalkan, waxaan ku dhex geli doonaa sababta kororka culeyska server-ka uu u dhaco oo aan ka wada hadalno siyaabo kala duwan oo lagu wanaajiyo hababka culeyska sare leh. Fiiro gaar ah ayaa la siin doonaa hagaajinta koodhka ee Apache/Nginx iyo MySQL, waxaan ka hadli doonaa kaydinta sidii qalab caawiye ah, sidoo kale waxaan tixgelin doonaa khataraha dibadeed ee suurtogalka ah, sida weerarrada DDOS, iyo siyaabaha looga hortago.

Waa maxay sababta Load Server u dhaco

Kahor intaadan u gudbin hagaajinta server-ka, waxaa lagama maarmaan ah in la sameeyo falanqayn qotodheer oo ku saabsan culeyska hadda jira ee kheyraadka. Tan waxaa ka mid ah cabbiraadda culeyska CPU, isticmaalka RAM, dhaqdhaqaaqa shabakadda, iyo cabbirrada kale ee muhiimka ah. Fahamka dhaq-dhaqaaqa iyo culeysyada ugu sarreeya waxay u oggolaaneysaa in la aqoonsado caqabadaha iyo hagaajinta qoondaynta kheyraadka, sidaas darteed kordhinta xasilloonida iyo waxqabadka kaabayaasha server-ka.

Si loo xalliyo dhibaatooyinka bilowga ah ee culayska server-ka oo sarreeya, waxaan kugula talineynaa inaad sameyso baaritaan guud oo server ah . Haddii tani aysan ku filnayn, falanqayn faahfaahsan oo ku saabsan kheyraadka ayaa lagama maarmaan ah. Qalab kaaliye ahaan, sahaminta diiwaanka server-ka Linux ayaa waxtar yeelan karta, maadaama halkan ay tahay meesha laga helo isha dhibaatada inta badan kiisaska.

Hagaajinta Apache/Nginx Server

Kordhinta Culayska Server-ka Sababtoo ah Tilmaan-ururinta

Kordhinta culeyska sababtoo ah tusmaynta server-ka ayaa dhici karta, tusaale ahaan, marka makiinadaha raadinta ay sawiraan tiro badan oo bogag ah oo ku yaal goobtaada. Tani waxay u horseedi kartaa korodhka isticmaalka ilaha server-ka iyo, sidaas awgeed,, hoos u dhigista waxqabadka goobta. Aqoonsiga sababta waa mid fudud; waxaad u baahan tahay inaad furto faylka ku yaal:

/var/www/httpd-logs/sitename.access.log

Marka lagu tilmaansado makiinadaha raadinta, isticmaaluhu wuxuu arki doonaa galitaanka dabeecadda soo socota:

11.22.33.44 - - [Date and Time] "GET /your-page-path HTTP/1.1" 200 1234 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Xalka ugu horreeya ee lagu dhimayo culayska, waxaad isticmaali kartaa dejinta calaamadaha meta ee "noindex" iyo "nofollow" ee bogagga aan u baahnayn in la tusmeeyo. Xalka labaad waa faylka .htaccess , halkaas oo loo baahan yahay in lagu daro qoraallo u dhigma matoorada raadinta gaarka ah, tusaale ahaan, si looga qariyo Yandex iyo Google:

SetEnvIfNoCase User-Agent "^Yandex" search_bot
SetEnvIfNoCase User-Agent "^Googlebot" search_bot
Order Allow,Deny
Allow from all
Deny from env=search_bot

Sidoo kale, wax ka beddelka ayaa loo baahan yahay in lagu sameeyo matoorada kale ee raadinta. Waa in la ogaadaa in awoodaha .htaccess aysan ku koobnayn oo keliya xannibaadda tusmada. Waxaan kugula talineynaa inaad si fiican u barato astaamaha ugu muhiimsan ee maqaalka.

Isticmaalka Settings Caching

Dejinta kaydinta khaldan ee server-ka ayaa sidoo kale keeni karta culays badan. Si loo hagaajiyo halbeeggan, waxaa loo baahan yahay in la sameeyo isbeddellada u dhigma faylasha habaynta ama .htaccess . Xaaladda Apache, ikhtiyaarka dambe ayaa la doorbidaa, Nginx - kii hore.

Server- ka Apache , waxaad u baahan tahay inaad furto faylka .htacess oo aad geliso koodhka soo socda:

<FilesMatch ".(flv|gif|jpg|jpeg|png|ico|swf|js|css|pdf|doc|docx)$">
Header set Cache-Control "max-age=2592000"
</FilesMatch>

Kadib, awood u yeelo module- ka Dhacaya adoo adeegsanaya amarka:

sudo a2enmod expires

Ka dib markaa, dib u bilaw serverka shabakada:

sudo service apache2 restart

Oo dhaqaaji moduleka adiga oo tilmaamaya:

ExpiresActive On

Server- ka Nginx , waxaa ku filan in lagu daro koodhka soo socda faylka qaabeynta:

location ~* .(jpg|jpeg|gif|png|ico|css|swf|flv|doc|docx)$ {
root /var/www/yoursite.com;
}

Oo samee dib u dejinta adeegga:

sudo service nginx restart

Ogsoonow in dejimahan, tilmaamaha Ogolaanshaha iyo Diidmada waa la dhaafi doonaa.

Isticmaalka Cadaadiska Xogta

Awoodsiinta cadaadiska xogta iyadoo la adeegsanayo Gzip ee server-yada shabakadda Apache iyo Nginx waxay kaa caawineysaa yareynta tirada xogta la isugu gudbiyo server-ka iyo macmiilka, taasoo hagaajineysa waxqabadka waxayna yareyneysaa waqtiga rarista bogga shabakadda.

Si aad Gzip uga hawlgeliso Apache , waxaad u baahan tahay inaad dhaqaajiso moduleka mod_deflate :

sudo a2enmod deflate

Kadibna, dib u bilaw serverka shabakada:

sudo service apache2 restart

Ugu dambeyntiina, ku dar xannibaadda soo socota faylka qaabeynta ama .htaccess:

<IfModule mod_deflate.c>
# Configure compression for specified file types
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/x-javascript application/json

# If the browser matches the specified pattern, apply compression only to text/html files
BrowserMatch ^Mozilla/4 gzip-only-text/html

# If the browser matches the specified version patterns of Mozilla 4.0.6, 4.0.7, 4.0.8, disable compression
BrowserMatch ^Mozilla/4\.0[678] no-gzip

# If the browser is MSIE (Internet Explorer), disable compression for all files except text/html
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

# If the request contains the specified pattern (extensions of image files), disable compression
SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip
</IfModule>

Qaabayntan waxay awood u siinaysaa isku-buufinta noocyada faylalka qaarkood oo waxay ka joojinaysaa sawirrada.

Xaaladda Nginx , habayntu waxay ka dhacdaa barta http ee faylka habaynta. Koodhka soo socda ayaa loo baahan yahay in lagu daro:

gzip on;
gzip_disable "msie6";

# Adds the Vary header, indicating that the response may change depending on the Accept-Encoding header value
gzip_vary on;

# Enables compression for any proxy servers
gzip_proxied any;

# Sets the compression level. A value of 6 provides a good balance between compression efficiency and resource use
gzip_comp_level 6;

# Sets the size of the buffer for compressed data (16 buffers of 8 kilobytes each)
gzip_buffers 16 8k;

# Specifies that data compression should be used only for HTTP version 1.1 and higher
gzip_http_version 1.1;

# Sets the file types that can be compressed
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

Sida Apache oo kale , halkan waxaa lagu dejiyaa xuduudaha cadaadiska ee noocyada faylasha qaarkood. Ka dib marka la sameeyo isbeddello mid ka mid ah server-yada shabakadda, dib u cusboonaysiin adeeg ayaa loo baahan yahay:

sudo service apache2 restart

Or

sudo service nginx restart

Weerarkii DDOS ee Server-ka

Culayska sare ee server-ka wuxuu ku dhici karaa natiijada weerarka DDoS. Aqoonsiga joogitaanka weerarka DDoS waxa lagu samayn karaa la socodka korodhka degdega ah ee taraafikada, codsiyada aan caadiga ahayn, iyo hoos u dhaca waxqabadka server-ka. Dib u eegista diiwaannada codsiyada soo noqnoqda ee hal ciwaanka IP-ga ah ama sawirka dekedda waxay sidoo kale muujin kartaa weerar DDoS suurtagal ah. Waxaa jira tallaabooyin badan oo ilaalin ah, laakiin waxaan ka hadli doonaa oo kaliya aasaaska.

Adeegsiga CDN (Shabakadda Bixinta Mawduuca) . CDN waxay u adeegi kartaa sidii dhexdhexaadiye u dhexeeya server-kaaga shabakada iyo isticmaalayaasha, iyadoo qaybinaysa taraafikada iyo kaydinta macluumaadka si loo yareeyo saameynta weerarka DDoS. CDN-yadu waxay sidoo kale yeelan karaan habab ilaalin DDoS ah oo ku dhex jira, oo ay ku jiraan qaybinta culayska iyo shaandhaynta taraafikada.

Habaynta dab-damisyada iyo nidaamyada ogaanshaha faragelinta (IDS/IPS) . Dab-damisyada waxaa loo habeyn karaa inay sifeeyaan taraafikada iyadoo lagu saleynayo shuruudo kala duwan, sida cinwaanada IP-ga iyo dekedaha. IDS/IPS waxay ogaan karaan dhaqanka taraafikada ee aan caadiga ahayn waxayna xannibi karaan xiriirrada laga shakiyo. Qalabkani wuxuu wax ku ool u noqon karaa la socodka iyo xannibaadda taraafikada khatarta ah.

Habaynta Apache iyo Nginx server-yada si loo yareeyo saamaynta weerarrada DDoS.

Xal ahaan Apache, waxaan awood u siineynaa module-ka mod_evasive . Si aad tan u sameyso, faallo ka bixi ama ku dar xariiqda soo socota faylka qaabeynta httpd.conf ama apache2.conf :

LoadModule evasive20_module modules/mod_evasive.so

Isla faylka, waxaad u baahan tahay inaad ku darto xannibaadda dejinta:

<IfModule mod_evasive20.c>
# Hash table size for storing request information
DOSHashTableSize 3097

# Number of requests to one page before activating protection
DOSPageCount 2
DOSPageInterval 1

# Number of requests to all pages before activating protection
DOSSiteCount 50
DOSSiteInterval 1

# Blocking period in seconds for IP addresses
DOSBlockingPeriod 10
</IfModule>

Sidoo kale, waxaan dhaqaajineynaa moduleka mod_ratelimit :

LoadModule ratelimit_module modules/mod_ratelimit.so

Oo ku dar qaabaynta:

<IfModule mod_ratelimit.c>
# Setting the output filter for rate limiting (Rate Limit)
SetOutputFilter RATE_LIMIT

# Beginning of the settings block for the location "/login"
<Location "/login">

# Setting the environment variable rate-limit with a value of 1
SetEnv rate-limit 1

# Ending of the settings block for the location "/login"
</Location>
</IfModule>

Qaabeynta Nginx waxay la mid tahay Apache . Faylka habaynta nginx.conf , tilmaamaha soo socda ayaa loo baahan yahay in la isticmaalo:

http {
...
# Defining a zone for connection limits
limit_conn_zone $binary_remote_addr zone=addr:10m;

# Defining a zone for request limits
limit_req_zone $binary_remote_addr zone=req_zone:10m rate=1r/s;

server {
        ...
        # Configuring connection limits
        limit_conn addr 10;

        # Configuring request limits
        limit_req zone=req_zone burst=5;

        ...
    }
}

Kadib marka ay isbedel ku sameeyaan mid kasta oo ka mid ah adeegyada, waxay u baahan yihiin in dib loo raro:

sudo systemctl restart apache2

Ama:

sudo systemctl restart nginx

Tusaalooyinkani waxay bixiyaan kaliya qaabeynta aasaasiga ah, kaas oo si dheeraad ah loo waafajin karo iyadoo ku xiran shuruudaha gaarka ah iyo nooca weerarrada.

Hagaajinta Su'aalaha MySQL

Hagaajinta weydiimaha xogta MySQL ee server-ka shabakadda waxaa lagu gaari karaa siyaabo kala duwan, mid ka mid ahna waa habaynta saxda ah ee faylka habaynta. Caadiyan, faylkan waxaa loogu yeeraa my.cnf ama my.ini wuxuuna ku yaal galka /etc/ ama /etc/mysql/ . Waa inaad furtaa oo aad sameysaa isbeddelada soo socda:

[mysqld]
# Location of the file for recording slow queries. Be sure to replace it with your path
log-slow-queries = /var/log/mariadb/slow_queries.log

# Threshold time for considering slow queries (in seconds)
long_query_time = 5

# Enabling recording of queries that do not use indexes
log-queries-not-using-indexes = 1

# Disabling query caching
query_cache_size = 0
query_cache_type = 0
query_cache_limit = 1M

# Size of temporary tables
tmp_table_size = 16M
max_heap_table_size = 16M

# Size of the thread cache
thread_cache_size = 16

# Disabling name resolving
skip-name-resolve = 1

# Size of the InnoDB buffer pool. Set to 50-70% of available RAM
innodb_buffer_pool_size = 800M

# Size of the InnoDB log file
innodb_log_file_size = 200M

Aynu sidoo kale tixgelinno talooyinka dheeraadka ah ee fududayn kara isdhexgalka xogta serverka:

1. Isticmaal Faahfaahin amar ka hor su'aalaha SQL si loo falanqeeyo fulinteeda. Tani waxay kuu ogolaaneysaa inaad hesho qorshe fulinta su'aasha oo aad go'aamiso tusmooyinka la isticmaalo, miisaska la sawiray, iwm.
2. Tusayaashu waxay dedejiyaan raadinta xogta, sidaas darteed tusmooyinka sida habboon loo qaabeeyey ayaa si weyn u wanaajin kara waxqabadka weydiinta. U fiirso tiirarka sida badan loo isticmaalo HALKEE or JOIN xaaladaha.
3. Ka fogow adeegsiga DOELECT *. Keliya tiirarka sida dhabta ah lagama maarmaanka u ah weydiintaada, halkii aad ka dooran lahayd dhammaan tiirarka shaxda.
4. Ka fogow isticmaalka hawlaha gudaha HALKEE shuruudaha. Isticmaalka hawlaha (sida HOOSAN, UPPER, BIDIX, XAQA) HALKEE shuruudaha waxay ka dhigi karaan tusmooyinka wax aan faa'iido lahayn. Isku day inaad ka fogaato isticmaalkooda tooska ah xaaladaha.
5. Isticmaal INNER JOIN halka ay suurtagal tahay, maadaama ay inta badan ka waxtar badan tahay. Sidoo kale, hubi in tiirarka u dhigma ee ku biirista ay leeyihiin tusmooyin.
6. Isticmaal Yaree si loo xaddido tirada safafka la soo celiyay haddii aad u baahan tahay inaad hesho tiro cayiman oo natiijooyin ah.
7. Tixgeli kaydinta natiijooyinka weydiinta, gaar ahaan haddii ay naadir isbeddelaan, si loo dhimo culayska server-ka.

Adeegaha Boostada waxa uu ku abuuraa Server-ka culays sare

Qaybtan, waxaan ku sahamin doonnaa sida loo ogaado in server-ka boostada uu la kulmayo culays badan iyo tallaabooyinka la qaadi karo si loo hagaajiyo hawlgalkiisa, oo ay ku jiraan hubinta safka farriinta iyo habaynta xuduudaha server-ka. Ku bilow hubinta safka farriinta. Adeegga mailq ayaa kaa caawin kara tan, si aad u hawlgeliso, geli amarka u dhigma ee terminal-ka:

mailq

Tani waxay muujin doontaa liiska fariimaha safka ku jira, haddii ay jiraan. Fariin kasta waxaa lagu soo bandhigi doonaa aqoonsigeeda gaarka ah iyo macluumaadka ku saabsan heerka dirida. Natiijo la mid ah ayaa lagu heli karaa dib u eegista diiwaanka macmiilka boostada.

Xaaladaha intooda badan, culeyska sare wuxuu dhacaa haddii ay dhacdo is-afgaranwaa server-ka marka ay bilowdo diritaanka spam. Si kastaba ha noqotee, haddii ka dib markaad hubiso maamulaha uu ku kalsoon yahay in server-ka aan laga soo weerarin dibadda iyo isticmaalayaashu aysan dayacin spam, waa waqtigii loo gudbi lahaa hagaajinta serverka boostada. Waa kuwan tillaabooyinka ku caawin doona:

1. Hubi in diiwaanka DNS ee boggaaga si sax ah loo habeeyey, oo ay ku jiraan SPF, DKIM, Iyo DMRC diiwaanada si loo hagaajiyo gudbinta waraaqaha loogana ilaaliyo spam. Qaabeynta saxda ah ee xuduudaha waxaa laga heli karaa maqaalka ku saabsan ogaanshaha server-ka boostada.
2. Hubi goobaha shabakada, oo ay ku jiraan qaabeynta firewall-ka iyo qawaaniinta dariiqa, si aad uga fogaato xannibaadaha oo aad u dedejiso diritaannada.
3. Habbee xuduudaha safka fariinta si waafaqsan culayska serverka. Tan waxa ku jiri kara in la dejiyo cabbirka safka ugu badan iyo waqtiyada.
4. Ka fiirso xalalka aan kaga hadalnay maqaalkan hore. Marmarba kor u qaad xogta kaydinta boostada si aad u wanaajiso waxqabadka, adeegso hababka kaydinta si aad u dedejiso raadinta iyo habaynta xogta, sida waydiimaha DNS.
5. Haddii serfarka boostada uu wali si joogto ah ula kulmo culays sare, ka fiirso xulashooyinka cabirida, sida isticmaalka koox ka mid ah adeegayaasha boostada ama xalalka daruuraha.

Ugu Dambeyn

Kordhinta culeyska server-ka ayaa si toos ah u saameeya xawaaraha rarka website-ka, ugu dambeyntii saameyn ku yeelata khibradaha isticmaalaha iyo sumcadda matoorada raadinta. Haddaba, si wax ku ool ah oo loo maareeyo culayskani waxa ay door muhiim ah ka ciyaartaa hubinta shaqaynta joogtada ah ee agabka iyo kordhinta marin u helida booqdayaasha.