VPS 选购与优化完全指南：从新手到专家的完整路线图 | 2026最新实践

1
# 方法1：systemd-detect-virt
2
systemd-detect-virt
3
# 输出：kvm / openvz / lxc / xen / vmware
4

5
# 方法2：查看 /proc/1/environ
6
cat /proc/1/environ | tr '\0' '\n' | grep -i virt
7

8
# 方法3：lscpu
9
lscpu | grep -i hypervisor
10

11
# 方法4：查看 /proc/user_beancounters（OpenVZ 特有）
12
cat /proc/user_beancounters  # 存在则为 OpenVZ

1
# 1. 更新系统
2
apt update && apt upgrade -y
3

4
# 2. 安装常用工具
5
apt install -y curl wget git vim htop unzip net-tools \
6
    build-essential software-properties-common \
7
    apt-transport-https ca-certificates gnupg lsb-release
8

9
# 3. 设置时区
10
timedatectl set-timezone Asia/Shanghai
11

12
# 4. 配置 hostname
13
hostnamectl set-hostname myserver
14

15
# 5. 配置 hosts
16
echo "127.0.1.1 myserver" >> /etc/hosts

1
# 创建新用户
2
adduser deploy
3

4
# 赋予 sudo 权限
5
usermod -aG sudo deploy
6

7
# 切换到新用户
8
su - deploy

1
# 本地生成密钥对（如果还没有）
2
ssh-keygen -t ed25519 -C "your_email@example.com"
3

4
# 上传公钥到服务器
5
ssh-copy-id deploy@your_server_ip
6

7
# 或手动添加
8
mkdir -p ~/.ssh
9
chmod 700 ~/.ssh
10
echo "你的公钥内容" >> ~/.ssh/authorized_keys
11
chmod 600 ~/.ssh/authorized_keys

1
# 编辑 SSH 配置
2
sudo vim /etc/ssh/sshd_config
3

4
# 关键配置
5
Port 22                          # 建议改为非标准端口
6
PermitRootLogin no               # 禁止 root 登录
7
PasswordAuthentication no        # 禁用密码登录
8
PubkeyAuthentication yes         # 启用密钥登录
9
MaxAuthTries 3                   # 最大认证次数
10
ClientAliveInterval 300          # 空闲超时
11
ClientAliveCountMax 2            # 超时次数
12

13
# 重启 SSH
14
sudo systemctl restart sshd

1
# 安装 UFW
2
sudo apt install -y ufw
3

4
# 默认策略
5
sudo ufw default deny incoming
6
sudo ufw default allow outgoing
7

8
# 放行 SSH
9
sudo ufw allow 22/tcp           # 或自定义端口
10
sudo ufw allow 22/tcp comment 'SSH'
11

12
# 放行 Web 服务
13
sudo ufw allow 80/tcp
14
sudo ufw allow 443/tcp
15

16
# 放行特定 IP
17
sudo ufw allow from 1.2.3.4 to any port 22
18

19
# 限制 SSH 连接频率
20
sudo ufw limit 22/tcp
21

22
# 启用防火墙
23
sudo ufw enable
24

25
# 查看状态
26
sudo ufw status verbose

1
# 安装
2
sudo apt install -y fail2ban
3

4
# 配置
5
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
6
sudo vim /etc/fail2ban/jail.local
7

8
# [DEFAULT]
9
# bantime = 3600        # 封禁 1 小时
10
# findtime = 600        # 10 分钟内
11
# maxretry = 3          # 3 次失败
12

13
# [sshd]
14
# enabled = true
15
# port = 22
16
# logpath = /var/log/auth.log
17

18
# 启动
19
sudo systemctl enable fail2ban
20
sudo systemctl start fail2ban
21

22
# 查看状态
23
sudo fail2ban-client status sshd

1
# 安装
2
sudo apt install -y unattended-upgrades
3

4
# 配置
5
sudo dpkg-reconfigure -plow unattended-upgrades
6

7
# 编辑配置
8
sudo vim /etc/apt/apt.conf.d/50unattended-upgrades
9

10
# 允许安全更新
11
Unattended-Upgrade::Allowed-Origins {
12
    "${distro_id}:${distro_codename}-security";
13
};
14

15
# 自动清理
16
Unattended-Upgrade::Remove-Unused-Dependencies "true";
17
Unattended-Upgrade::Automatic-Reboot "false";

1
# 检查内核版本（需要 4.9+）
2
uname -r
3

4
# 开启 BBR
5
echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
6
echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
7

8
# 应用配置
9
sysctl -p
10

11
# 验证
12
sysctl net.ipv4.tcp_congestion_control
13
# 输出：net.ipv4.tcp_congestion_control = bbr
14

15
lsmod | grep bbr
16
# 输出：tcp_bbr 20480 0

1
# 创建自定义配置文件
2
cat > /etc/sysctl.d/99-optimize.conf << 'EOF'
3
# === 网络优化 ===
4

5
# TCP 缓冲区
6
net.core.rmem_max = 67108864
7
net.core.wmem_max = 67108864
8
net.ipv4.tcp_rmem = 4096 87380 67108864
9
net.ipv4.tcp_wmem = 4096 65536 67108864
10

11
# 连接队列
12
net.core.somaxconn = 65535
13
net.core.netdev_max_backlog = 65535
14
net.ipv4.tcp_max_syn_backlog = 65535
15

16
# TIME_WAIT 优化
17
net.ipv4.tcp_max_tw_buckets = 1048576
18
net.ipv4.tcp_tw_reuse = 1
19
net.ipv4.tcp_fin_timeout = 15
20

21
# TCP 快速打开
22
net.ipv4.tcp_fastopen = 3
23

24
# keepalive 优化
25
net.ipv4.tcp_keepalive_time = 600
26
net.ipv4.tcp_keepalive_intvl = 30
27
net.ipv4.tcp_keepalive_probes = 3
28

29
# 文件描述符
30
fs.file-max = 1048576
31
fs.inotify.max_user_watches = 1048576
32

33
# 内存
34
vm.swappiness = 10
35
vm.overcommit_memory = 1
36

37
# 端口范围
38
net.ipv4.ip_local_port_range = 10000 65535
39
EOF
40

41
# 应用
42
sysctl -p /etc/sysctl.d/99-optimize.conf

1
# 查看当前限制
2
ulimit -n
3
# 默认 1024
4

5
# 临时修改
6
ulimit -n 65535
7

8
# 永久修改
9
cat >> /etc/security/limits.conf << 'EOF'
10
* soft nofile 65535
11
* hard nofile 65535
12
root soft nofile 65535
13
root hard nofile 65535
14
EOF
15

16
# systemd 服务限制
17
mkdir -p /etc/systemd/system.conf.d
18
cat > /etc/systemd/system.conf.d/limits.conf << 'EOF'
19
[Manager]
20
DefaultLimitNOFILE=65535
21
EOF
22

23
# 重启生效
24
sudo systemctl daemon-reexec

1
# 查看当前 Swap
2
free -h
3
swapon --show
4

5
# 创建 Swap 文件（1GB）
6
sudo fallocate -l 1G /swapfile
7
sudo chmod 600 /swapfile
8
sudo mkswap /swapfile
9
sudo swapon /swapfile
10

11
# 永久生效
12
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
13

14
# 优化 swappiness
15
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf
16
sudo sysctl -p
17

18
# 验证
19
free -h

1
# 一键安装
2
bash <(curl -Ss https://get.netdata.cloud/kickstart.sh)
3

4
# 访问
5
# http://your_server_ip:19999
6

7
# 配置开机自启
8
sudo systemctl enable netdata
9
sudo systemctl start netdata

1
# 配置 logrotate
2
sudo vim /etc/logrotate.d/myapp
3

4
/var/log/myapp/*.log {
5
    daily
6
    rotate 7
7
    compress
8
    delaycompress
9
    missingok
10
    notifempty
11
    create 644 www-data www-data
12
}
13

14
# 手动测试
15
sudo logrotate -d /etc/logrotate.d/myapp

1
# 添加到 crontab
2
crontab -e
3

4
# 每天凌晨 3 点备份
5
0 3 * * * /path/to/backup.sh
6

7
# 每周日凌晨 4 点全量备份
8
0 4 * * 0 /path/to/full_backup.sh

1
# Vultr/DigitalOcean 快照 API
2
# 建议每周创建一次快照
3

4
# 文件系统快照（如果使用 LVM）
5
# 创建快照
6
lvcreate -L 10G -s -n root_snapshot /dev/vg0/root
7

8
# 恢复快照
9
lvconvert --merge /dev/vg0/root_snapshot

1
# 一键安装
2
curl -fsSL https://get.docker.com | bash
3

4
# 启动并设置开机自启
5
sudo systemctl enable docker
6
sudo systemctl start docker
7

8
# 验证
9
docker --version
10
docker run hello-world
11

12
# 安装 Docker Compose
13
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" \
14
    -o /usr/local/bin/docker-compose
15
sudo chmod +x /usr/local/bin/docker-compose
16

17
# 验证
18
docker-compose --version

1
# 配置日志大小限制
2
sudo mkdir -p /etc/docker
3
cat > /etc/docker/daemon.json << 'EOF'
4
{
5
    "log-driver": "json-file",
6
    "log-opts": {
7
        "max-size": "10m",
8
        "max-file": "3"
9
    },
10
    "storage-driver": "overlay2",
11
    "live-restore": true
12
}
13
EOF
14

15
# 重启 Docker
16
sudo systemctl restart docker

1
# 1. 启用防火墙限流
2
sudo ufw limit 22/tcp
3

4
# 2. 安装 DDoS Deflate
5
wget https://github.com/jgmdev/ddos-deflate/archive/master.tar.gz
6
tar -xzf master.tar.gz
7
cd ddos-deflate-master
8
./install.sh
9

10
# 3. 配置 Cloudflare CDN 隐藏真实 IP
11

12
# 4. 联系服务商开启 DDoS 防护

1
# 1. 综合测试脚本
2
wget -qO- bench.sh | bash
3

4
# 2. 网络测速
5
speedtest-cli
6

7
# 3. 磁盘 IO 测试
8
dd if=/dev/zero of=testfile bs=1M count=1024 oflag=direct
9
# 看写入速度
10

11
# 4. UnixBench
12
wget https://github.com/kdlucas/byte-unixbench/archive/refs/tags/v5.1.3.tar.gz
13
tar -xzf v5.1.3.tar.gz
14
cd byte-unixbench-5.1.3/UnixBench
15
make
16
./Run

1
# 1. 旧服务器打包
2
tar -czf /tmp/backup.tar.gz /var/www /etc/nginx /home
3

4
# 2. 传输到新服务器
5
scp /tmp/backup.tar.gz newuser@new_ip:/tmp/
6

7
# 3. 新服务器解压
8
cd /
9
tar -xzf /tmp/backup.tar.gz
10

11
# 4. 更新 DNS 解析到新 IP
12

13
# 5. 测试无误后关闭旧服务器