Debian 13 (Trixie) 完整自动化配置文档

文档说明

本文档汇总了 Debian 13 系统的完整配置流程，包含系统更新、网络加速、安全防护、开发环境和 Shell 美化等所有功能。 执行顺序: 从上到下依次执行各代码块

一、系统更新与基础优化

#!/bin/bash
# Debian 13 系统全面更新与基础配置
1.1 更新软件源并升级系统#
echo “【步骤1】更新系统软件包…”
sudo apt update && sudo apt upgrade -y
1.2 安装基础工具#
echo “【步骤2】安装基础工具…”
sudo apt install -y 

curl wget git vim htop net-tools lsof 

apt-transport-https ca-certificates 

gnupg lsb-release software-properties-common
1.3 清理旧版本软件包#
echo “【步骤3】清理系统…”
sudo apt autoremove -y
sudo apt autoclean
1.4 修复已知Bug（如主机名解析问题）#
echo “【步骤4】修复sudo主机名解析问题…”
CURRENT_HOSTNAME=(hostname)
if ! grep -q "CURRENT_HOSTNAME” /etc/hosts; then
echo “127.0.1.1 $CURRENT_HOSTNAME” | sudo tee -a /etc/hosts
echo ”✅ 已添加主机名映射”
else
echo ”✅ 主机名映射已存在”
fi
1.5 系统参数优化#
echo “【步骤5】系统性能优化…”
sudo sysctl -w vm.swappiness=10
sudo bash -c ‘cat > /etc/sysctl.d/99-system-optimize.conf << EOF
系统性能优化参数#
vm.swappiness = 10
fs.file-max = 1000000
fs.inotify.max_user_instances = 8192
EOF’
sudo sysctl -p /etc/sysctl.d/99-system-optimize.conf
1.6 更新GRUB（如需要）#
echo “【步骤6】更新GRUB引导…”
sudo update-grub
sudo update-initramfs -u
echo ”✅ 系统更新与优化完成！建议重启系统使部分更改生效”

二、网络加速配置（BBR3启用）

#!/bin/bash
# Debian 13 BBR3 网络加速配置
# 注意：Debian 13内核6.12+已内置BBR v3，无需升级内核
echo “【BBR3配置】启用TCP BBR v3拥塞控制算法…”
2.1 检查内核版本#
KERNEL_VERSION=(uname -r | cut -d. -f1-2)
echo "当前内核版本: KERNEL_VERSION”
if (( (echo "KERNEL_VERSION >= 6.3” | bc -l) )); then
echo ”✅ 内核版本支持BBR v3”
else
echo “⚠️  内核版本过低，建议升级至6.3+”
fi
2.2 创建BBR3配置文件#
sudo bash -c ‘cat > /etc/sysctl.d/10-bbr.conf << EOF
TCP BBR v3 网络加速配置#
net.core.default_qdisc = fq_pie
net.ipv4.tcp_congestion_control = bbr
额外优化参数#
net.ipv4.tcp_notsent_lowat = 16384
net.ipv4.tcp_ecn = 1
EOF’
2.3 应用配置#
sudo sysctl -p /etc/sysctl.d/10-bbr.conf
2.4 验证BBR3是否生效#
echo “【验证】检查BBR3状态…”
sleep 1
if sysctl net.ipv4.tcp_congestion_control | grep -q “bbr”; then
echo ”✅ BBR已启用”
else
echo ”❌ BBR启用失败”
fi
2.5 检查BBR版本#
echo “【验证】检查BBR模块版本…”
if modinfo tcp_bbr 2>/dev/null | grep -q “version:        3”; then
echo ”✅ BBR v3 已成功加载”
modinfo tcp_bbr | grep version
else
echo “⚠️  当前为BBR v1/v2，但功能已启用”
fi
2.6 TCP窗口优化（可选）#
echo “【优化】调整TCP窗口参数…”
sudo bash -c ‘cat >> /etc/sysctl.d/10-bbr.conf << EOF
TCP窗口优化#
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.tcp_wmem = 4096 65536 33554432
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
EOF’
sudo sysctl -p /etc/sysctl.d/10-bbr.conf
echo ”✅ BBR3网络加速配置完成！建议重启使所有参数生效”

三、SSH安全防护配置

#!/bin/bash
# Debian 13 SSH安全加固与防护软件安装
echo “【SSH安全】配置Fail2ban和基础SSH加固…”
3.1 修改SSH默认端口（推荐）#
echo “【步骤1】修改SSH端口…”
read -p “请输入新的SSH端口 (默认2222): ” NEW_SSH_PORT
NEW_SSH_PORT={NEW_SSH_PORT:-2222}
sudo sed -i "s/#Port 22/Port NEW_SSH_PORT/” /etc/ssh/sshd_config
sudo sed -i “s/Port 22/Port NEW_SSH_PORT/" /etc/ssh/sshd_config
echo "✅ SSH端口已修改为: NEW_SSH_PORT”
3.2 禁止root登录SSH#
sudo sed -i ‘s/#PermitRootLogin yes/PermitRootLogin no/’ /etc/ssh/sshd_config
sudo sed -i ‘s/PermitRootLogin yes/PermitRootLogin no/’ /etc/ssh/sshd_config
echo ”✅ 已禁止root登录”
3.3 安装Fail2ban#
echo “【步骤2】安装Fail2ban…”
sudo apt install -y fail2ban
3.4 配置Fail2ban#
sudo bash -c ‘cat > /etc/fail2ban/jail.local << EOF
[sshd]
enabled = true
port = ‘$NEW_SSH_PORT’
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
findtime = 600
ignoreip = 127.0.0.1/8 ::1
EOF’
3.5 启动Fail2ban服务#
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban
echo ”✅ Fail2ban已启动并配置完成”
3.6 配置UFW防火墙#
echo “【步骤3】配置防火墙…”
sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow $NEW_SSH_PORT/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw —force enable
sudo ufw status verbose
echo ”✅ 防火墙配置完成”
3.7 提示重启SSH服务#
echo “⚠️  需要重启SSH服务以应用端口更改”
read -p “是否立即重启SSH服务? (y/n): ” RESTART_SSH
if [[ RESTART_SSH == &quot;y&quot; ]]; then
  sudo systemctl restart sshd
  echo &quot;✅ SSH服务已重启，请使用新端口 NEW_SSH_PORT 重新连接”
else
echo “⚠️  请稍后手动重启SSH服务: sudo systemctl restart sshd”
fi
echo ”✅ SSH安全防护配置完成！”

四、系统安全与防病毒

#!/bin/bash
# Debian 13 系统安全加固与ClamAV安装
echo “【系统安全】安装ClamAV防病毒软件…”
4.1 安装ClamAV#
sudo apt install -y clamav clamav-daemon clamav-freshclam
4.2 更新病毒库#
sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam
4.3 启用ClamAV服务#
sudo systemctl enable clamav-daemon
sudo systemctl start clamav-daemon
echo ”✅ ClamAV防病毒系统已安装”
4.4 设置每周定时扫描#
sudo bash -c ‘cat > /etc/cron.weekly/clamav-scan << EOF
#!/bin/bash
LOGFILE=“/var/log/clamav/weekly-scan-$(date +%Y%m%d).log”
clamscan -r -i /home —log=$LOGFILE
EOF’
sudo chmod +x /etc/cron.weekly/clamav-scan
echo ”✅ 已配置每周自动扫描”
4.5 安全审计工具（可选）#
echo “【可选】安装安全审计工具…”
sudo apt install -y lynis chkrootkit rkhunter
echo ”✅ 安全审计工具已安装”
4.6 系统日志监控#
sudo apt install -y logwatch
sudo bash -c ‘cat > /etc/logwatch/conf/logwatch.conf << EOF
MailTo = root
Detail = Med
Range = yesterday
EOF’
echo ”✅ 日志监控已配置”

五、Node.js开发环境安装

#!/bin/bash
# Debian 13 Node.js 开发环境配置
echo “【开发环境】安装Node.js和npm…”
5.1 安装Node.js 20.x LTS（推荐）#
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs
5.2 验证安装#
node —version
npm —version
5.3 更新npm到最新版#
sudo npm install -g npm@latest
5.4 配置npm全局安装路径（避免权限问题）#
mkdir -p /.npm-global
npm config set prefix ‘/.npm-global’
echo ‘export PATH=~/.npm-global/bin:PATH' >> ~/.bashrc
echo 'export PATH=~/.npm-global/bin:PATH’ >> ~/.zshrc
5.5 安装常用全局工具#
npm install -g 

pm2 

yarn 

pnpm 

@vue/cli 

create-react-app
echo ”✅ Node.js开发环境配置完成”

六、Shell环境自动化配置（Zsh）

#!/bin/bash
# Debian 13 Zsh + Powerlevel10k 完美配置
echo “【Shell配置】卸载Powerline并安装Zsh…”
6.1 卸载Powerline（如果存在）#
sudo apt remove -y powerline fonts-powerline
sudo rm -rf /usr/share/powerline
sed -i ‘/powerline/d’ ~/.bashrc
sed -i ‘/POWERLINE/d’ ~/.bashrc
fc-cache -f -v
echo ”✅ Powerline已卸载”
6.2 安装Zsh和基础工具#
sudo apt install -y zsh git wget curl fonts-firacode
6.3 安装Oh My Zsh（无交互模式）#
sh -c ”$(wget -O- https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)” "" —unattended
6.4 安装Powerlevel10k主题#
git clone —depth=1 https://github.com/romkatv/powerlevel10k.git {ZSH_CUSTOM:-HOME/.oh-my-zsh/custom}/themes/powerlevel10k
6.5 安装Nerd Font字体#
mkdir -p ~/.local/share/fonts
wget -O ~/.local/share/fonts/FiraCodeNerdFont-Regular.ttf 

https://github.com/ryanoasis/nerd-fonts/raw/master/patched-fonts/FiraCode/Regular/FiraCodeNerdFont-Regular.ttf
fc-cache -fv
6.6 安装Oh My Zsh插件#
git clone —depth=1 https://github.com/zsh-users/zsh-autosuggestions {ZSH_CUSTOM:-HOME/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
git clone —depth=1 https://github.com/zsh-users/zsh-syntax-highlighting.git {ZSH_CUSTOM:-HOME/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
sudo apt install -y autojump command-not-found
6.7 生成完整.zshrc配置#
cat > ~/.zshrc << ‘EOF’
Enable Powerlevel10k instant prompt#
if [[ -r “{XDG_CACHE_HOME:-HOME/.cache}/p10k-instant-prompt-{(%):-%n}.zsh&quot; ]]; then
  source &quot;{XDG_CACHE_HOME:-HOME/.cache}/p10k-instant-prompt-{(%):-%n}.zsh”
fi
Path to Oh My Zsh#
export ZSH=“$HOME/.oh-my-zsh”
Theme configuration#
ZSH_THEME=“powerlevel10k/powerlevel10k”
Plugin configuration#
plugins=(
git
docker
docker-compose
kubectl
zsh-autosuggestions
zsh-syntax-highlighting
autojump
command-not-found
colored-man-pages
extract
history-substring-search
)
source $ZSH/oh-my-zsh.sh
History configuration#
export HISTSIZE=100000
export HISTFILESIZE=100000
export HISTCONTROL=ignoredups
export HISTTIMEFORMAT=“%F %T ”
setopt SHARE_HISTORY
Completion configuration#
autoload -U compinit && compinit
zstyle ‘:completion:’ menu select
zstyle ‘:completion:’ list-colors ”${(@s.:.)LS_COLORS}”
Aliases#
alias ll=‘ls -alhF —color=auto’
alias la=‘ls -A’
alias l=‘ls -CF’
alias grep=‘grep —color=auto’
alias df=‘df -h’
alias du=‘du -sh’
alias ..=‘cd ..’
alias …=‘cd ../..’
alias zshconfig=‘nano ~/.zshrc’
alias reloadzsh=‘source ~/.zshrc’
kubectl & Docker completion#
[[ commands[kubectl] ]] &amp;&amp; source &lt;(kubectl completion zsh)
[[ commands[docker] ]] && source <(docker completion zsh)
autojump#
-s /usr/share/autojump/autojump.sh && source /usr/share/autojump/autojump.sh
Powerlevel10k configuration#
! -f ~/.p10k.zsh || source ~/.p10k.zsh
EOF
6.8 设置Zsh为默认Shell#
chsh -s $(which zsh)
echo ”✅ Zsh基础配置完成！”
6.9 提示用户手动配置Powerlevel10k#
echo “⚠️  接下来需要手动启动Zsh完成Powerlevel10k配置”
echo “请执行: zsh”
echo “然后按照Powerlevel10k配置向导的提示进行选择”
echo “推荐选择: Rainbow主题, Unicode字符集, 24小时制时间”

七、系统验证与测试

#!/bash/bash
# Debian 13 配置完整性验证脚本
echo “【系统验证】检查所有配置是否生效…”
7.1 系统版本验证#
echo ”=== 系统版本 ===”
cat /etc/os-release
uname -r
7.2 BBR3验证#
echo -e “\n=== BBR3状态 ===”
sysctl net.ipv4.tcp_congestion_control
sysctl net.core.default_qdisc
lsmod | grep bbr
7.3 SSH安全验证#
echo -e “\n=== SSH安全 ===”
sudo fail2ban-client status sshd
sudo ufw status verbose
sudo grep “Port” /etc/ssh/sshd_config | grep -v ”^#”
7.4 防病毒验证#
echo -e “\n=== ClamAV状态 ===”
sudo systemctl is-active clamav-daemon
sudo systemctl is-enabled clamav-daemon
clamscan —version
7.5 Node.js验证#
echo -e “\n=== Node.js环境 ===”
node —version
npm —version
echo “npm全局路径: $(npm config get prefix)”
7.6 Zsh验证#
echo -e “\n=== Zsh环境 ===”
zsh —version
echo “当前Shell: $SHELL”
if [ -f ~/.oh-my-zsh/oh-my-zsh.sh ]; then
echo ”✅ Oh My Zsh已安装”
else
echo ”❌ Oh My Zsh未安装”
fi
echo -e “\n=== 验证脚本执行完成 ===”
echo “如果所有检查项都显示正常，说明配置成功！”
echo “建议执行 ‘sudo reboot’ 重启系统使所有更改完全生效”

八、一键执行所有配置（主脚本）

#!/bin/bash
# Debian 13 完整自动化配置主脚本
# 执行时间：约15-30分钟（取决于网络速度）
set -e  # 遇到错误立即退出
echo ”==========================================”
echo “Debian 13 完整自动化配置脚本”
echo “执行时间: $(date)”
echo ”==========================================”
步骤1: 系统更新与优化#
echo “【阶段1/7】系统更新与优化…”
/bin/bash <(curl -s https://your-domain.com/config/01-system-update.sh)
步骤2: BBR3网络加速#
echo “【阶段2/7】配置BBR3网络加速…”
/bin/bash <(curl -s https://your-domain.com/config/02-bbr3.sh)
步骤3: SSH安全防护#
echo “【阶段3/7】配置SSH安全防护…”
/bin/bash <(curl -s https://your-domain.com/config/03-ssh-security.sh)
步骤4: 防病毒系统#
echo “【阶段4/7】安装防病毒软件…”
/bin/bash <(curl -s https://your-domain.com/config/04-antivirus.sh)
步骤5: Node.js环境#
echo “【阶段5/7】安装Node.js开发环境…”
/bin/bash <(curl -s https://your-domain.com/config/05-nodejs.sh)
步骤6: Zsh配置#
echo “【阶段6/7】配置Zsh Shell环境…”
/bin/bash <(curl -s https://your-domain.com/config/06-zsh.sh)
步骤7: 系统验证#
echo “【阶段7/7】验证所有配置…”
/bin/bash <(curl -s https://your-domain.com/config/07-validation.sh)
echo ”==========================================”
echo ”✅ 所有配置已完成！”
echo “请执行 ‘sudo reboot’ 重启系统”
echo “重启后执行 ‘zsh’ 完成Powerlevel10k配置”
echo ”==========================================”

附录：常用维护命令

# 系统更新
sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y
BBR3状态检查#
sysctl net.ipv4.tcp_congestion_control
sysctl net.core.default_qdisc
Fail2ban管理#
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip <IP>
ClamAV手动扫描#
sudo clamscan -r -i /home
Node.js版本切换（如使用nvm）#
nvm install —lts && nvm use —lts#
Zsh重新配置#
p10k configure
查看系统日志#
sudo journalctl -xe
cat /var/log/fail2ban.log

文档版本: 1.0
适用系统: Debian 13 (Trixie)
最后更新: 2025年11月
注意事项: 生产环境建议在测试服务器验证后再执行