From 2696a28765c3f7aa9783f751d8a958faa8b7245b Mon Sep 17 00:00:00 2001 From: 247LIKE <54342887+247like@users.noreply.github.com> Date: Mon, 15 Dec 2025 17:57:24 +0800 Subject: [PATCH] Update README_EN.md --- README_EN.md | 69 ++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 51 insertions(+), 18 deletions(-) diff --git a/README_EN.md b/README_EN.md index a6b4621..0919bfe 100644 --- a/README_EN.md +++ b/README_EN.md @@ -21,16 +21,16 @@ It safely handles **SSH key deployment**, **port changing**, **user creation**, ### ✨ Key Features -* **Universal Compatibility**: Works flawlessly on **Debian 10/11/12**, **Ubuntu**, **CentOS 7/8/9**, **Alma/Rocky**, and **Alpine Linux**. +* **Universal Compatibility**: Works flawlessly on **Debian**, **Ubuntu**, **CentOS/RHEL**, **Alma/Rocky**, and **Alpine Linux**. * **POSIX Compliant**: Written in pure `/bin/sh`. No `bash` dependency. Runs perfectly on `dash` (Debian) and `ash` (Alpine/Busybox). -* **Safety Architecture**: +* **Security Architecture (Fortress Pro)**: * **Managed Config Block**: Inserts configuration at the **top** of `sshd_config` to strictly override vendor defaults (bypasses the Debian 12 `Include` trap). - * **Atomic Verification**: Validates config with `sshd -t` before restarting. Automatically rolls back on failure to prevent downtime. - * **Anti-Lockout**: If SSH keys fail to deploy, it **will not** disable password login, ensuring you don't lose access. - * **Firewall Awareness**: Automatically detects and configures `ufw` or `firewalld` if port is changed. + * **Auto-Rollback**: If SSHD validation fails, port is not listening, or connection test fails during execution, the script **automatically reverts** all system changes. + * **Service Protection (Anti-Kill)**: Adds a systemd `override.conf` to prevent OOM kills and ensures SSHD restarts automatically on failure. + * **Deadlock Prevention**: Intelligently detects authentication states to prevent "Password Disabled + No Key" lockouts. * **Automation Friendly**: - * Supports **Headless Mode**, allowing zero-interaction unattended installation via command line arguments. - * **Random High Port**: Automatically generates a random port between 20000-60000 and checks for availability. + * Supports **Headless Mode** allowing zero-interaction unattended installation. + * **Audit & Reporting**: Automatically generates detailed operation audit logs and system health reports. ### 🚀 Quick Start @@ -79,9 +79,10 @@ The script supports rich command-line arguments to control its behavior: | **Control** | `--lang=en` | Force English UI | | | `--yes` | **Auto Confirm**: Skip the final "Proceed?" prompt | | | `--strict` | **Strict Mode**: Exit immediately on error (see below) | +| | `--delay-restart` | **Delay Restart**: Apply config but do not restart SSHD immediately | | **User/Port** | `--user=root` | Specify login user (root or username) | | | `--port=22` | Keep default port 22 | -| | `--port=random` | Generate random high port (20000-60000) | +| | `--port=random` | Generate random high port (49152-65535) | | | `--port=2222` | Specify a specific port number | | **Keys** | `--key-gh=username` | Fetch public key from GitHub | | | `--key-url=url` | Download public key from URL | @@ -98,18 +99,50 @@ The script supports rich command-line arguments to control its behavior: | **Philosophy** | **"Don't Lockout"** (Best Effort) | **"Compliance First"** (Zero Tolerance) | | **Key Failure** | If key download fails, script **keeps Password Auth enabled** and warns you.
👉 *Result: Server reachable but less secure.* | Script **exits immediately**. No changes applied.
👉 *Result: Deployment aborted, state unchanged.* | | **Port Failure** | If random port fails, it falls back to **Port 22**. | Script **exits immediately**. | -| **Use Case** | Manual setup, unstable networks. | CI/CD pipelines, high-security requirements. | -### 🛠️ Execution Details +### 📂 Logs & Audit -1. **Dependency Check**: Auto-detects package manager (`apt`, `yum`, `apk`) and installs dependencies (`curl`, `sudo`, `openssh-server`). -2. **User Setup**: Creates the specified user (if not root) and grants password-less `sudo` privileges. -3. **Key Deployment**: Deploys SSH public keys, fixes `.ssh` permissions, and supports deduplication. -4. **SSH Hardening**: - * Backs up `sshd_config`. - * Cleans up old script blocks. - * Inserts a new configuration block at the **top** of the file (Disable password, Change port, etc.) to ensure highest priority. -5. **Finalization**: Validates config syntax, restarts SSH service, and applies BBR/Updates if selected. +After execution, the following files are generated for troubleshooting and auditing: + +* **Run Log**: `/var/log/server-init.log` (Detailed debug information) +* **Audit Log**: `/var/log/server-init-audit.log` (Records key actions, timestamps, and operators) +* **Health Report**: `/var/log/server-init-health.log` (Snapshot of the final system configuration state) + +### 🆘 Disaster Recovery & Restore + +The script features a dual-layer safety mechanism: **Runtime Auto-Rollback** and **Persistent Backup Restore**. + +If you cannot connect to your server via SSH after the script finishes (after seeing "DONE"), log in via your Cloud Provider's **VNC / Console** and use one of the following methods. + +#### Method A: One-Click Restore Script (Recommended) + +The script automatically creates a backup and generates a restore script before applying changes. + +1. Find the latest backup directory: + ```bash + ls -ld /var/backups/ssh-config/* + ``` +2. Enter the directory and run the restore script: + ```bash + # Enter the latest timestamp directory (e.g., 20250520_120000) + cd /var/backups/ssh-config// + + # Run the restore script + sh restore.sh + ``` + *This will automatically overwrite `sshd_config` and attempt to restart the SSH service.* + +#### Method B: Manual Restore + +If the restore script is unavailable, manually copy the files: + +```bash +# 1. Overwrite configuration +cp /var/backups/ssh-config//sshd_config /etc/ssh/sshd_config + +# 2. Restart Service +systemctl restart sshd || service sshd restart +``` ---