{"action":"created","issue":{"url":"https://api.github.com/repos/v2ray/v2ray-core/issues/1011","repository_url":"https://api.github.com/repos/v2ray/v2ray-core","labels_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/1011/labels{/name}","comments_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/1011/comments","events_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/1011/events","html_url":"https://github.com/v2ray/v2ray-core/issues/1011","id":310667927,"number":1011,"title":"关于一键安装脚本安全优化的一点小小建议","user":{"login":"mm2231031","id":29967151,"avatar_url":"https://avatars0.githubusercontent.com/u/29967151?v=4","gravatar_id":"","url":"https://api.github.com/users/mm2231031","html_url":"https://github.com/mm2231031","followers_url":"https://api.github.com/users/mm2231031/followers","following_url":"https://api.github.com/users/mm2231031/following{/other_user}","gists_url":"https://api.github.com/users/mm2231031/gists{/gist_id}","starred_url":"https://api.github.com/users/mm2231031/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mm2231031/subscriptions","organizations_url":"https://api.github.com/users/mm2231031/orgs","repos_url":"https://api.github.com/users/mm2231031/repos","events_url":"https://api.github.com/users/mm2231031/events{/privacy}","received_events_url":"https://api.github.com/users/mm2231031/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-03T02:04:51Z","updated_at":"2018-04-06T04:40:23Z","closed_at":null,"author_association":"NONE","body":"我发现现在官方的一键安装脚本生成的systemd的启动文件，指定的是root用户运行的，毕竟v2ray是对外服务的，我担心会有人通过开放的端口可能存在的漏洞获得root权限，所以我做了个小小的设置，让v2ray以普通用户身份运行，减少攻击获取root权限的几率\r\n1、创建用于运行v2ray的用户，且不允许执行解释器\r\nuseradd v2ray -s /usr/sbin/nologin\r\n\r\n2、修改v2ray.service文件，加入User和Group两项\r\nvim /etc/systemd/system/v2ray.service\r\n\r\n\r\n[Unit]\r\nDescription=V2Ray Service\r\nAfter=network.target\r\nWants=network.target\r\n\r\n[Service]\r\nUser=v2ray\r\nGroup=v2ray\r\nType=simple\r\nPIDFile=/var/run/v2ray.pid\r\nExecStart=/usr/bin/v2ray/v2ray -config /etc/v2ray/config.json\r\nRestart=on-failure\r\n\r\n[Install]\r\nWantedBy=multi-user.target\r\n\r\n执行systemctl daemon-reload\r\n\r\n3、为日志目录赋权\r\nchown -R v2ray:v2ray /var/log/v2ray\r\n\r\n4、重启服务\r\nsystemctl restart v2ray\r\n\r\n5、查看运行状态\r\nps -ef |grep v2ray\r\nv2ray     3382     1  0 21:49 ?        00:00:00 /usr/bin/v2ray/v2ray -config /etc/v2ray/config.json\r\nroot      3484  2073  0 22:04 pts/0    00:00:00 grep v2ray\r\n这样就可以看到v2ray是以普通用户运行的了"},"comment":{"url":"https://api.github.com/repos/v2ray/v2ray-core/issues/comments/379146111","html_url":"https://github.com/v2ray/v2ray-core/issues/1011#issuecomment-379146111","issue_url":"https://api.github.com/repos/v2ray/v2ray-core/issues/1011","id":379146111,"user":{"login":"WangShanpeng","id":7185584,"avatar_url":"https://avatars0.githubusercontent.com/u/7185584?v=4","gravatar_id":"","url":"https://api.github.com/users/WangShanpeng","html_url":"https://github.com/WangShanpeng","followers_url":"https://api.github.com/users/WangShanpeng/followers","following_url":"https://api.github.com/users/WangShanpeng/following{/other_user}","gists_url":"https://api.github.com/users/WangShanpeng/gists{/gist_id}","starred_url":"https://api.github.com/users/WangShanpeng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WangShanpeng/subscriptions","organizations_url":"https://api.github.com/users/WangShanpeng/orgs","repos_url":"https://api.github.com/users/WangShanpeng/repos","events_url":"https://api.github.com/users/WangShanpeng/events{/privacy}","received_events_url":"https://api.github.com/users/WangShanpeng/received_events","type":"User","site_admin":false},"created_at":"2018-04-06T04:40:23Z","updated_at":"2018-04-06T04:40:23Z","author_association":"NONE","body":"一键脚本能否加入自动更新功能呢？作为服务器端，可以每周更新V2Ray-core内核"}}
{"actor":{"display_login":"WangShanpeng"}}