-
-
Save lenonhere/2f97029981acdcb966d7 to your computer and use it in GitHub Desktop.
Revisions
-
fqrouter revised this gist
Jun 23, 2014 . 1 changed file with 1 addition and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -35,7 +35,7 @@ Version: 2.5 dummy 0 0 9223372036854775807 9223372036854775807 0 dummy 0 0 9223372036854775807 9223372036854775807 0 numiptent 30 30 9223372036854775807 9223372036854775807 0 其中 numtcpsock 表示 tcp 连接数。像上面这样的情况，就不适合用于公共代理，因为vps商限制了并发的tcp连接数。 shell# ulimit -n 1024 这个命令检查默认的一个进程可以打开的文件数。1024这个默认值是不够的。推荐设置为8000 -
Jun 23, 2014 . 1 changed file with 1 addition and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -65,7 +65,7 @@ shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp -j REJEC shell# apt-get update && apt-get install -y nginx 安装nginx server { listen 127.0.0.1:3128; server_name localhost; resolver 8.8.8.8; location / { -
Jun 21, 2014 . 1 changed file with 2 additions and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -1,6 +1,7 @@ good, 你已经有了一个自己的shadowsocks代理了，现在想要把这个代理公布出去给所有人分享。 但是没有两个小时，代理就没法使用了，为什么？因为你需要额外注意以下事项（以下步骤需要比较高的linux技能） 本文只关注于确保shadowsocks服务还“活着”，如果你希望让其跑得更快，请参考 https://github.com/clowwindy/shadowsocks/wiki/Optimizing-Shadowsocks 1、 shadowsocks的timeout设置 超时时间越长，连接被保持得也就越长，导致并发的tcp的连接数也就越多。对于公共代理，这个值应该调整得小一些。推荐60秒。 -
Jun 21, 2014 . 1 changed file with 1 addition and 0 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -1,5 +1,6 @@ good, 你已经有了一个自己的shadowsocks代理了，现在想要把这个代理公布出去给所有人分享。 但是没有两个小时，代理就没法使用了，为什么？因为你需要额外注意以下事项（以下步骤需要比较高的linux技能） 本文只关注于确保shadowsocks服务还“活着”，如果你希望让其跑得更快，请参考 https://github.com/clowwindy/shadowsocks/wiki/Optimizing-Shadowsocks 1、 shadowsocks的timeout设置 超时时间越长，连接被保持得也就越长，导致并发的tcp的连接数也就越多。对于公共代理，这个值应该调整得小一些。推荐60秒。 -
Jun 21, 2014 . 1 changed file with 7 additions and 2 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -42,7 +42,9 @@ shell# ss-server -s 0.0.0.0 -p 1080 -k xxxx -m rc4 上面启动ss-server的命令只是示意性的，请替换成你自己的启动命令。ulimit的设置是一次性的，每次启动ss-server之前都要设置一下。 3、 防止vps被用于暴力破解ssh密码等非法行为 只要shadowsocks被公开出去，肯定会有人拿代理用于暴力破解ssh的密码。 推荐你把shadowsocks限制为只允许访问443和80两个端口。如果你不添加这样的限制， 很多vps商都会因为ssh连接开得太多而暂停对你的服务。 shell# adduser http-ss shell# su http-ss -c "ss-server -s 0.0.0.0 -p 1080 -k xxxx -m rc4" 让ss-server以特定的用户启动 @@ -54,7 +56,10 @@ shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp -j REJEC 对于http-ss用户，限制其不能访问80,443之外的端口 4、 防止DMCA Compliant 虽然你已经把shadowsocks限制为只能访问80/443端口，但是对于美国的vps，仍然有额外的一点需要注意。 因为美国的vps需要遵从美国的DMCA版权法律，如果该vps被用于bt下载，而且正好遇上了电影公司设置的蜜罐的话， 你的vps的ip就会被记录下来。然后DMCA Compliant律师函会被送往你的vps商那，然后就会被停止服务。 为了避免shadowsocks帐号被用于bt下载，你不得不对80端口的流量再进一步进行限制 shell# apt-get update && apt-get install -y nginx 安装nginx server { -
Jun 21, 2014 . 1 changed file with 2 additions and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -1,4 +1,5 @@ good, 你已经有了一个自己的shadowsocks代理了，现在想要把这个代理公布出去给所有人分享。 但是没有两个小时，代理就没法使用了，为什么？因为你需要额外注意以下事项（以下步骤需要比较高的linux技能） 1、 shadowsocks的timeout设置 超时时间越长，连接被保持得也就越长，导致并发的tcp的连接数也就越多。对于公共代理，这个值应该调整得小一些。推荐60秒。 -
Jun 21, 2014 . 1 changed file with 40 additions and 2 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -1,4 +1,4 @@ good, 你已经有了一个自己的shadowsocks代理了，现在想要把这个代理公布出去给所有人分享。但是没有两个小时，代理就没法使用了，为什么？因为你需要额外注意以下事项（以下步骤需要比较高的linux技能） 1、 shadowsocks的timeout设置 超时时间越长，连接被保持得也就越长，导致并发的tcp的连接数也就越多。对于公共代理，这个值应该调整得小一些。推荐60秒。 @@ -38,4 +38,42 @@ shell# ulimit -n 这个命令检查默认的一个进程可以打开的文件数。1024这个默认值是不够的。推荐设置为8000 shell# ulimit -n 8000 shell# ss-server -s 0.0.0.0 -p 1080 -k xxxx -m rc4 上面启动ss-server的命令只是示意性的，请替换成你自己的启动命令。ulimit的设置是一次性的，每次启动ss-server之前都要设置一下。 3、 防止vps被用于暴力破解ssh密码等非法行为 只要shadowsocks被公开出去，肯定会有人拿代理用于暴力破解ssh的密码。推荐你把shadowsocks限制为只允许访问443和80两个端口。如果你不添加这样的限制，很多vps商都会因为ssh连接开得太多而暂停对你的服务。 shell# adduser http-ss shell# su http-ss -c "ss-server -s 0.0.0.0 -p 1080 -k xxxx -m rc4" 让ss-server以特定的用户启动 shell# iptables -t filter -A OUTPUT -d 127.0.0.1 -j ACCEPT shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp --sport 1080 -j ACCEPT shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp --dport 80 -j ACCEPT shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp --dport 443 -j ACCEPT shell# iptables -t filter -m owner --uid-owner http-ss -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset 对于http-ss用户，限制其不能访问80,443之外的端口 4、 防止DMCA Compliant 虽然你已经把shadowsocks限制为只能访问80/443端口，但是对于美国的vps，仍然有额外的一点需要注意。因为美国的vps需要遵从美国的DMCA版权法律，如果该vps被用于bt下载，而且正好遇上了电影公司设置的蜜罐的话，你的vps的ip就会被记录下来。然后DMCA Compliant律师函会被送往你的vps商那，然后就会被停止服务。为了避免shadowsocks帐号被用于bt下载，你不得不对80端口的流量再进一步进行限制 shell# apt-get update && apt-get install -y nginx 安装nginx server { listen 3128; server_name localhost; resolver 8.8.8.8; location / { set $upstream_host $host; if ($request_uri ~ "^/announce.*") { return 403; } if ($request_uri ~ "^.*torrent.*") { return 403; } proxy_set_header Host $upstream_host; proxy_pass http://$upstream_host; proxy_buffers 8 32k; proxy_buffering off; } } 然后配置nginx的server shell# iptables -t nat -m owner --uid-owner http-ss -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port 3128 把所有的80端口流量转到nginx来处理 -
Jun 21, 2014 .There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -0,0 +1,41 @@ good, 你已经有了一个自己的shadowsocks代理了，现在想要把这个代理公布出去给所有人分享。但是没有两个小时，代理就没法使用了，为什么？因为你需要额外注意以下事项 1、 shadowsocks的timeout设置 超时时间越长，连接被保持得也就越长，导致并发的tcp的连接数也就越多。对于公共代理，这个值应该调整得小一些。推荐60秒。 2、 检查操作系统的各种限制 对于openvz的vps，特别需要检查一下 shell# cat /proc/user_beancounters Version: 2.5 uid resource held maxheld barrier limit failcnt 1005: kmemsize 6499239 34332672 50331648 50331648 0 lockedpages 0 0 12288 12288 0 privvmpages 20185 89959 9223372036854775807 9223372036854775807 0 shmpages 654 670 9223372036854775807 9223372036854775807 0 dummy 0 0 9223372036854775807 9223372036854775807 0 numproc 26 102 9223372036854775807 9223372036854775807 0 physpages 12181 24887 0 24576 536 vmguarpages 0 0 9223372036854775807 9223372036854775807 0 oomguarpages 7054 30538 9223372036854775807 9223372036854775807 473 numtcpsock 52 1500 1500 2000 21583239 numflock 1 5 9223372036854775807 9223372036854775807 0 numpty 1 16 9223372036854775807 9223372036854775807 0 numsiginfo 0 63 9223372036854775807 9223372036854775807 0 tcpsndbuf 7497680 29165536 104857600 209715200 0 tcprcvbuf 18891984 88633288 104857600 209715200 0 othersockbuf 39304 386848 9223372036854775807 9223372036854775807 0 dgramrcvbuf 0 166480 9223372036854775807 9223372036854775807 0 numothersock 27 37 1500 2000 0 dcachesize 2293779 25165824 25165824 25165824 0 numfile 362 1910 9223372036854775807 9223372036854775807 0 dummy 0 0 9223372036854775807 9223372036854775807 0 dummy 0 0 9223372036854775807 9223372036854775807 0 dummy 0 0 9223372036854775807 9223372036854775807 0 numiptent 30 30 9223372036854775807 9223372036854775807 0 像上面这样的情况，就不适合用于公共代理，因为vps商限制了并发的tcp连接数。 shell# ulimit -n 1024 这个命令检查默认的一个进程可以打开的文件数。1024这个默认值是不够的。推荐设置为8000 shell# ulimit -n 8000 shell# ss-server -s 0.0.0.0 -p 1080 -k xxxx -m rc4 上面启动ss-server的命令只是示意性的，请替换成你自己的启动命令。ulimit的设置是一次性的，每次启动ss-server之前都要设置一下。