刚开通的 VPS 默认配置并不安全，公网一上线就被全网扫描。到手先按这份清单过一遍。
开机必做清单
- 改 root 密码 / 配密钥：默认密码要立刻改（
passwd），更推荐直接配 SSH 密钥登录。 - 系统更新：
apt update && apt upgrade -y（Debian/Ubuntu）或yum update -y（CentOS）。 - 开防火墙：只放行用得到的 端口（SSH、80、443），其余拒绝。见 安全加固。
- 改 SSH 端口（可选）：换掉默认 22，能大幅减少扫描噪音。
- 设时区 / hostname：
timedatectl set-timezone Asia/Shanghai。 - 小内存机加 swap：512M/1G 内存的机建个 1–2G swap 防 OOM。
- 关 root 密码登录：密钥配好、确认能登上后再关，别把自己锁门外。
提醒
改 SSH 端口 / 关密码登录前，务必先确认新方式能连上，再关旧的——很多人就是这一步把自己锁在外面。
配好后建议给新机做一遍 体检测试。
还没挑好机器？去 库存监控 按线路 / 地区筛选在售机型。
A freshly provisioned VPS has an insecure default configuration — the moment it’s online it will be scanned by automated bots across the internet. Run through this checklist as soon as you get access.
Essential First-Boot Checklist
- Change the root password / set up SSH keys: Change the default password immediately (
passwd). Better yet, set up SSH key-based login instead. - System updates:
apt update && apt upgrade -y(Debian/Ubuntu) oryum update -y(CentOS). - Enable a firewall: Only allow ports you actually need (SSH, 80, 443); block everything else. See security hardening.
- Change the SSH port (optional): Moving away from the default port 22 significantly reduces scan noise.
- Set timezone / hostname:
timedatectl set-timezone Asia/Shanghai. - Add swap for low-memory VPS: For machines with 512MB or 1GB of RAM, add 1–2GB of swap to prevent OOM crashes.
- Disable root password login: Only do this after confirming you can log in via SSH key — don’t lock yourself out.
Important Warning
Before changing the SSH port or disabling password login, always verify the new method works first, then disable the old one — many people lock themselves out at this exact step.
Once configured, it’s a good idea to run a health-check benchmark on the new machine.
Haven’t picked a VPS yet? Go to the stock monitor to browse available plans by route or region.
发表回复