debian stun 服务器搭建
安装服务
apt-get install coturn
设置开机启动
nano /etc/default/coturn
取消注释：
TURNSERVER_ENABLED=1
编辑配置文件
nano /etc/turnserver.conf
服务管理
systemctl stop coturn
systemctl start coturn
2024年3月
debian rsync ssh配置
安装rsync
apt-get install rsync
rsync使用教程
rsync有两种工作方式：SSH和daemon。
SSH方式是使用系统上的用户通过SSH进行同步操作。
daemon方式是rsync服务器会开一个873端口，等待客户端去连接，连接是进行验证，通过后进行同步。
一、SSH模式下进行同步操作
rsync -options SRC DEST
SRC代表源目录，DEST代表目标目录，当通过ssh链接时， 有时需要指定ssh端口， 请使用这个方式：rsync -options -e "ssh -p 10000" SRC DEST
下面举例说明一下常用到的场景：
1.1：本地拷贝目录，将/home/wwwroot/wzh/拷贝到/data/wwwroot/wzh/
rsync -avu /home/wwwroot/wzh/ /data/wwwroot/wzh/
1.2：将本地目录拷贝到远程服务器
rsync -avu --progress --delete /home/wwwroot/wzh/ root@1.2.3.4:/home/wwwroot/wzh/
如果改了SSH端口，需要加-e "ssh -p 你的SSH端口"，如果不想显示具体传输过程可以去掉P参数，如果需要压缩传输可以加z参数。
--delete 参数，这样当本地删除的文件，远程端也会删除，保持完整的一致。
1.3：将远程服务器目录拷贝到本地
rsync -avu --progress --delete root@1.2.3.4:/home/wwwroot/wzh/ /home/wwwroot/wzh/
二、daemon模式的配置
rsync daemon模式是以rsync服务器形式运行，首先我们需要创建rsync服务器的配置文件，配置文件：/etc/rsyncd.conf 默认此文件可能不存在，需要自己创建，配置信息如下：
port = 873
uid = root
gid = root
use chroot = no //使用chroot到文件系统中的目录中
max connections = 100 //最大并发连接数
motd file = /etc/rsyncd.motd //定义服务器信息的，自己写 rsyncd.motd 文件内容
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
log file = /var/log/rsyncd.log
timeout = 300
[wzh] //自定义模块
path = /home/wwwroot/wzh/ //用来指定要备份的目录
ignore errors //可以忽略一些IO错误
read only = no //设置no，客户端可以上传文件，yes是只读
write only = no //no为客户端可以下载，yes 不能下载
hosts allow = 192.168.2.0/24 //允许连接的IP，强烈建议加上你允许的IP，多个IP逗号隔开
list = yes //客户请求时，使用模块列表
auth users = wzh //连接用户名，是虚拟用户与linux系统用户无关，多个用户名逗号隔开
secrets file = /etc/rsyncd.secrets //验证密码文件，文件格式为：用户名:密码
/etc/rsyncd.secrets 文件权限必须是600，创建好该文件后可以执行： chmod 600 /etc/rsyncd.secrets
注意：默认rsync服务器并不是自动启动的！
Debian/Ubuntu上是带自启动脚本的，修改 /etc/default/rsync ，将里面的RSYNC_ENABLE=false 改成 RSYNC_ENABLE=true 保存就设成开机自启动了。
完成上面设置后，执行：/etc/init.d/rsync start 即可启动。
测试rsync服务器：rsync -avuP wzh@192.227.165.35::wzh /home/wwwroot/wzh/ 进行连接测试，注：@前的wzh为自定义模块里设置的用户名，::后面的wzh为你自定义模块的名称。
rsync使用小技巧：
1、可以用rsync快速删除大量文件：
建立一个空的文件夹： mkdir /root/blank
用rsync删除目标目录：rsync --delete-before -a -H -v --progress --stats /root/blank/ /home/wwwroot/cache/
这样我们要删除的 cache目录就会被清空了，删除的速 度会非常快。
2、如果开启了iptables防火墙，请将873端口加入防火墙允许规则。
iptables -I INPUT -p tcp --dport 873 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 873 -j ACCEPT
3、用户可以自己根据自己的需求选择SSH或daemon模式
配合crontab定时执行任务 自动完成同步、备份等工作。
rsync 常用参数的具体解释如下：
-v, --verbose 详细模式输出
-q, --quiet 精简输出模式
-c, --checksum 打开校验开关，强制对文件传输进行校验
-a, --archive 归档模式，表示以递归方式传输文件，并保持所有文件属性，等于-rlptgoD
-r, --recursive 对子目录以递归模式处理
-b, --backup 创建备份，也就是对于目的已经存在有同样的文件名时，将老的文件重新命名为~filename。可以使用--suffix选项来指定不同的备份文件前缀。
-suffix=SUFFIX 定义备份文件前缀
-u, --update 仅仅进行更新，也就是跳过所有已经存在于DST，并且文件时间晚于要备份的文件。(不覆盖更新的文件)
-l, --links 保留软链结
-p, --perms 保持文件权限
-o, --owner 保持文件属主信息
-g, --group 保持文件属组信息
-t, --times 保持文件时间信息
-e, --rsh=COMMAND 指定使用rsh、ssh方式进行数据同步
--delete 删除那些DST中SRC没有的文件
--delete-excluded 同样删除接收端那些被该选项指定排除的文件
--delete-after 传输结束以后再删除
--ignore-errors 及时出现IO错误也进行删除
--force 强制删除目录，即使不为空
--timeout=TIME IP超时时间，单位为秒
--progress 显示备份过程
-z, --compress 对备份的文件在传输时进行压缩处理
--exclude=PATTERN 指定排除不需要传输的文件模式
--include=PATTERN 指定不排除而需要传输的文件模式
--exclude-from=FILE 排除FILE中指定模式的文件
--include-from=FILE 不排除FILE指定模式匹配的文件
pve7 pve8 kvmqemu反虚拟化检测
PVE7 编译
1、修改更新源
nano /etc/apt/sources.list
deb https://mirrors.ustc.edu.cn/debian/ bullseye main contrib non-free
deb https://mirrors.ustc.edu.cn/debian/ bullseye-updates main contrib non-free
deb https://mirrors.ustc.edu.cn/debian/ bullseye-backports main contrib non-free
deb https://mirrors.ustc.edu.cn/debian-security bullseye-security main contrib
pve源
deb https://mirrors.ustc.edu.cn/proxmox/debian bullseye pve-no-subscription
ceph源
deb https://mirrors.ustc.edu.cn/proxmox/debian/ceph-pacific bullseye main
开发源，必须
deb https://mirrors.ustc.edu.cn/proxmox/debian/devel bullseye main
2、更新软件
apt-get update && apt-get install -y
3、编译前需要安装的软件包
apt-get install -y devscripts build-essential librust-openssl-sys-dev git git-email pkg-config debhelper pve-doc-generator \
cmake bison dwarves flex libdw-dev libelf-dev libiberty-dev lz4 zstd librados-dev \
libtest-mockmodule-perl check libcmap-dev libcorosync-common-dev libcpg-dev libfuse-dev \
libglib2.0-dev libpve-access-control libpve-apiclient-perl libquorum-dev librrd-dev librrds-perl \
libsqlite3-dev libtest-mockmodule-perl libuuid-perl rrdcached sqlite3 rsync \
libauthen-pam-perl libnet-ldap-perl libpve-cluster-perl pve-cluster \
libjs-marked pve-eslint esbuild quilt bash-completion dh-apparmor docbook2x libapparmor-dev libcap-dev \
libgnutls28-dev libseccomp-dev meson libarchive-dev libanyevent-perl dh-python python3-all python3-setuptools python3-docutils \
liblocale-po-perl help2man libpam0g-dev libpve-storage-perl lxc-pve \
libjpeg62-turbo-dev libpng-dev unifont libspice-protocol-dev libspice-server-dev libcap-ng-dev \
libio-multiplex-perl libjson-c-dev libpve-guest-common-perl libpve-storage-perl pve-edk2-firmware pve-firewall pve-ha-manager \
libposix-strptime-perl librados2-perl pve-qemu-kvm zfsutils-linux \
libacl1-dev libaio-dev libattr1-dev libcap-ng-dev libepoxy-dev libfdt-dev libgbm-dev libglusterfs-dev libiscsi-dev libjemalloc-dev libjpeg-dev \
libnuma-dev libpixman-1-dev libproxmox-backup-qemu0-dev librbd-dev \
libsdl1.2-dev liburing-dev libusb-1.0-0-dev libusbredirparser-dev \
libvirglrenderer-dev libzstd-dev python3-sphinx python3-sphinx-rtd-theme texi2html xfslibs-dev \
abigail-tools libpam0g-dev python3-cffi python3-all-dev
4、自动安装依赖
yes | mk-build-deps --install
5、自动安装依赖之后，卸载deps包
yes | mk-build-deps --install --remove
6、下载pve-qemu源码
apt-get install git
apt update
git clone git://git.proxmox.com/git/pve-qemu.git
cd pve-qemu
//后面6c5563e30bea889ffc38a03d6ac86866c50e6484这个是8.0.2-6具体的commit，其他版本查询地址https://git.proxmox.com/?p=pve-qemu.git;a=summary
git reset --hard 6c5563e30bea889ffc38a03d6ac86866c50e6484
//安装依赖
mk-build-deps --install
//开始编译
make
//查看当前安装的版本
dpkg -l|grep kvm
//安装
dpkg -i pve-qemu-kvm_8.0.2-6_amd64.deb
//编辑虚拟机配置文件里面再加这一串代码
nano /etc/pve/qemu-server/虚拟机ID.conf
args: -cpu host,hypervisor=off,vmware-cpuid-freq=false,enforce=false,host-phys-bits=true, -smbios type=0,version=UX305UA.201 -smbios type=1,manufacturer=ASUS,product=UX305UA,version=2021.1 -smbios type=2,manufacturer=Intel,version=2021.5,product='Intel i5-12400' -smbios type=3,manufacturer=XBZJ -smbios type=17,manufacturer=KINGSTON,loc_pfx=DDR4,speed=3200,serial=114514,part=FF63 -smbios type=4,manufacturer=Intel,max-speed=3200,current-speed=3200
//如果编译出错qemu目录下单独执行更新内部的子模块
git submodule update --init --recursive
mk-build-deps --install
apt install XXX包
aptitude install XXX包
make clean
pve7 pve8 kvmqemu反虚拟化检测补丁
//编辑新建一个sed文件
nano sedPatch-pve-qemu-kvm7-8-anti-dection.sh
!/bin/bash
适用于给pve-qemu-kvm7 和pve-qemu-kvm8里面的qemu打补丁使用，最高从7.0支持到8.1(再高没有测试)，直接放本脚本在qemu目录下，在make包之前在qemu目录运行一次本脚本就是，运行后你可以继续使用git工具生成qemu具体版本的patch文件
参考开源项目 https://github.com/zhaodice/proxmox-ve-anti-detection 编写，处理重复劳作
echo "开始sed工作"
sed -i 's/QEMU v" QEMU_VERSION/ASUS v" QEMU_VERSION/g' block/vhdx.c
sed -i 's/QEMU VVFAT", 10/ASUS VVFAT", 10/g' block/vvfat.c
sed -i 's/QEMU Microsoft Mouse/ASUS Microsoft Mouse/g' chardev/msmouse.c
sed -i 's/QEMU Wacom Pen Tablet/ASUS Wacom Pen Tablet/g' chardev/wctablet.c
sed -i 's/QEMU vhost-user-gpu/ASUS vhost-user-gpu/g' contrib/vhost-user-gpu/vhost-user-gpu.c
sed -i 's/desc->oem_id/ACPI_BUILD_APPNAME6/g' hw/acpi/aml-build.c
sed -i 's/desc->oem_table_id/ACPI_BUILD_APPNAME8/g' hw/acpi/aml-build.c
sed -i 's/array, ACPI_BUILD_APPNAME8/array, "PTL "/g' hw/acpi/aml-build.c
grep "do this once" hw/acpi/vmgenid.c >/dev/null
if [ $? -eq 0 ]; then
echo "hw/acpi/vmgenid.c 文件只能处理一次！以前已经处理，本次不执行！"
else
sed -i 's/ Aml \*ssdt/ \/\/FUCK YOU~~~\n return;\/\/do this once\n Aml \*ssdt/g' hw/acpi/vmgenid.c
echo "hw/acpi/vmgenid.c 文件处理完成（第一次处理，只处理一次）"
fi
sed -i 's/QEMU N800/ASUS N800/g' hw/arm/nseries.c
sed -i 's/QEMU LCD panel/ASUS LCD panel/g' hw/arm/nseries.c
sed -i 's/strcpy((void *) w, "QEMU ")/strcpy((void *) w, "ASUS ")/g' hw/arm/nseries.c
sed -i 's/"1.1.10-qemu" : "1.1.6-qemu"/"1.1.10-asus" : "1.1.6-asus"/g' hw/arm/nseries.c
sed -i "s/QEMU 'SBSA Reference' ARM Virtual Machine/ASUS 'SBSA Reference' ARM Real Machine/g" hw/arm/sbsa-ref.c
sed -i 's/QEMU Sun Mouse/ASUS Sun Mouse/g' hw/char/escc.c
sed -i 's/info->vendor = "RHT"/info->vendor = "DEL"/g' hw/display/edid-generate.c
sed -i 's/QEMU Monitor/DEL Monitor/g' hw/display/edid-generate.c
sed -i 's/uint16_t model_nr = 0x1234;/uint16_t model_nr = 0xA05F;/g' hw/display/edid-generate.c
grep "do this once" hw/i386/acpi-build.c >/dev/null
if [ $? -eq 0 ]; then
echo "hw/i386/acpi-build.c 文件只能处理一次！以前已经处理，本次不执行！"
else
sed -i '/static void build_dbg_aml(Aml \*table)/,/ /s/{/{\n return;\/\/do this once/g' hw/i386/acpi-build.c
sed -i '/create fw_cfg node/,/}/s/}/}*\//g' hw/i386/acpi-build.c
sed -i '/create fw_cfg node/,/}/s/{/\/*{/g' hw/i386/acpi-build.c
echo "hw/i386/acpi-build.c 文件处理完成（第一次处理，只处理一次）"
fi
sed -i 's/"QEMU", "Standard PC (i440FX + PIIX, 1996)",/"ASUS", "M4A88TD-M",/g' hw/i386/pc_piix.c
sed -i 's/"QEMU", "Standard PC (Q35 + ICH9, 2009)",/"ASUS", "M4A88TD-M",/g' hw/i386/pc_q35.c
sed -i 's/mc->name, pcmc->smbios_legacy_mode,/"ASUS-PC", pcmc->smbios_legacy_mode,/g' hw/i386/pc_q35.c
sed -i 's/pcmc->smbios_uuid_encoded,/0x00,/g' hw/i386/pc_q35.c
sed -i 's/"QEMU/"ASUS/g' hw/ide/atapi.c
sed -i 's/"QEMU/"ASUS /g' hw/ide/core.c
sed -i 's/QM%05d/ASUS%05d/g' hw/ide/core.c
sed -i 's/"QEMU/"ASUS/g' hw/input/adb-kbd.c
sed -i 's/"QEMU/"ASUS/g' hw/input/adb-mouse.c
sed -i 's/"QEMU/"ASUS/g' hw/input/ads7846.c
sed -i 's/"QEMU/"ASUS/g' hw/input/hid.c
sed -i 's/"QEMU/"ASUS/g' hw/input/ps2.c
sed -i 's/"QEMU/"ASUS/g' hw/input/tsc2005.c
sed -i 's/"QEMU/"ASUS/g' hw/input/tsc210x.c
sed -i 's/"QEMU Virtio/"ASUS/g' hw/input/virtio-input-hid.c
sed -i 's/QEMU M68K Virtual Machine/ASUS M68K Real Machine/g' hw/m68k/virt.c
sed -i 's/"QEMU/"ASUS/g' hw/misc/pvpanic-isa.c
sed -i 's/"QEMU/"ASUS/g' hw/nvme/ctrl.c
sed -i 's/0x51454d5520434647ULL/0x4155535520434647ULL/g' hw/nvram/fw_cfg.c
sed -i 's/"QEMU/"ASUS/g' hw/pci-host/gpex.c
sed -i 's/"QEMU/"ASUS/g' hw/ppc/e500plat.c
sed -i 's/qemu-e500/asus-e500/g' hw/ppc/e500plat.c
sed -i 's/s16s8s16s16s16/s11s4s51s41s91/g' hw/scsi/mptconfig.c
sed -i 's/QEMU MPT Fusion/ASUS MPT Fusion/g' hw/scsi/mptconfig.c
sed -i 's/"QEMU"/"ASUS"/g' hw/scsi/mptconfig.c
sed -i 's/0000111122223333/1145141919810000/g' hw/scsi/mptconfig.c
sed -i 's/"QEMU/"ASUS/g' hw/scsi/scsi-bus.c
sed -i 's/"QEMU/"ASUS/g' hw/scsi/scsi-disk.c
sed -i 's/"QEMU/"ASUS/g' hw/scsi/spapr_vscsi.c
sed -i 's/extension_bytes[1] = 0x14/extension_bytes[1] = 0x08/g' hw/smbios/smbios.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-audio.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-hid.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-hub.c
sed -i 's/314159/114514/g' hw/usb/dev-hub.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-mtp.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-network.c
sed -i 's/"RNDIS\/QEMU/"RNDIS\/ASUS/g' hw/usb/dev-network.c
sed -i 's/400102030405/400114514405/g' hw/usb/dev-network.c
sed -i 's/s->vendorid = 0x1234/s->vendorid = 0x8086/g' hw/usb/dev-network.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-serial.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-smartcard-reader.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-storage.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-uas.c
sed -i 's/27842/33121/g' hw/usb/dev-uas.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/dev-wacom.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/u2f-emulated.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/u2f-passthru.c
sed -i 's/"QEMU/"ASUS/g' hw/usb/u2f.c
sed -i 's/"BOCHS/"INTEL/g' include/hw/acpi/aml-build.h
sed -i 's/"BXPC/"PC8086/g' include/hw/acpi/aml-build.h
sed -i 's/"QEMU0002/"ASUS0002/g' include/standard-headers/linux/qemu_fw_cfg.h
sed -i 's/0x51454d5520434647ULL/0x4155535520434647ULL/g' include/standard-headers/linux/qemu_fw_cfg.h
sed -i 's/"QEMU/"ASUS/g' migration/migration.c
sed -i 's/"QEMU/"ASUS/g' migration/rdma.c
sed -i 's/0x51454d5520434647ULL/0x4155535520434647ULL/g' pc-bios/optionrom/optionrom.h
sed -i 's/"QEMU/"ASUS/g' pc-bios/s390-ccw/virtio-scsi.h
sed -i 's/"QEMU/"ASUS/g' roms/seabios/src/fw/ssdt-misc.dsl
sed -i 's/"QEMU/"ASUS/g' roms/seabios-hppa/src/fw/ssdt-misc.dsl
sed -i 's/KVMKVMKVM\\0\\0\\0/GenuineIntel/g' target/i386/kvm/kvm.c
sed -i 's/QEMUQEMUQEMUQEMU/ASUSASUSASUSASUS/g' target/s390x/tcg/misc_helper.c
sed -i 's/"QEMU/"ASUS/g' target/s390x/tcg/misc_helper.c
sed -i 's/"KVM/"ATX/g' target/s390x/tcg/misc_helper.c
#额外文件处理
sed -i 's/0x1af4/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1100/0x8086/g' include/hw/pci/pci.h
#只替换一次
#sed -i 's/0x1000/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1001/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1002/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1003/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1004/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1005/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1009/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1012/0x8086/g' include/hw/pci/pci.h
sed -i 's/0x1b36/0x8086/g' include/hw/pci/pci.h
#替换后直通显卡启动选择UEFI无显示-解决方法q35-SeaBIOS启动
sed -i 's/0x1af4/0x8086/g' hw/audio/hda-codec.c
echo "结束sed工作"
//补丁加执行权限
chmod +x sedPatch-pve-qemu-kvm7-8-anti-dection.sh
//运行一次这个sed补丁
bash sedPatch-pve-qemu-kvm7-8-anti-dection.sh
//第二种补丁方法
//编辑新建一个patch文件
nano 001-anti-detection.patch
//修改编译执行
nano debian/rules
//添加以下代码
# [Inject]Surprised Detector's Mother Fucker !!!
patch -p1 < 001-anti-detection.patch
guest-agent is only required for guest systems
...
//PVE配置文件
args: -cpu host,+kvm_pv_unhalt,+kvm_pv_eoi,hv_spinlocks=0x1fff,hv_vapic,hv_time,hv_reset,hv_vpindex,hv_runtime,hv_relaxed,kvm=off,hv_vendor_id=intel,vmware-cpuid-freq=false,enforce=false,host-phys-bits=true,hypervisor=off -smbios type=0,version=UX305UA.201 -smbios type=1,manufacturer=ASUS,product=UX305UA,version=2021.1 -smbios type=2,manufacturer=Intel,version=2021.5,product='Intel i9-12900K' -smbios type=3,manufacturer=XBZJ -smbios type=17,manufacturer=KINGSTON,loc_pfx=DDR5,speed=4800,serial=114514,part=FF63 -smbios type=4,manufacturer=Intel,max-speed=4800,current-speed=4800
audio0: device=ich9-intel-hda,driver=none
balloon: 0
bios: ovmf
boot: order=sata0
cores: 12
cpu: host,flags=+pcid
efidisk0: local-lvm:vm-100-disk-0,efitype=4m,pre-enrolled-keys=1,size=4M
hostpci0: 0000:01:00,pcie=1,x-vga=1
machine: pc-q35-7.1
memory: 32768
meta: creation-qemu=7.1.0,ctime=1679627202
name: Windows11
net0: rtl8139=CA:09:F3:97:56:0B,bridge=vmbr0,firewall=1
numa: 1
ostype: win11
sata0: HugeSSD:100/vm-100-disk-1.qcow2,discard=on,size=64G,ssd=1
sata1: HugeHDD:100/vm-100-disk-0.qcow2,backup=0,size=128G
smbios1: uuid=24c326dd-3cec-48fc-bb9f-87aa3984e2c9,manufacturer=QVNVUw==,product=VVgzMDVVQQ==,version=MjAyMS4x,serial=MTI0NjY3,sku=MTM0NDY4,family=Ng==,base64=1
sockets: 1
tpmstate0: local-lvm:vm-100-disk-1,size=4M,version=v2.0
usb0: host=4e53:5406
usb1: host=040b:2000
vga: none
vmgenid: 020229e3-2cdb-4a91-8e77-1d04cf1f060f
args: -cpu host,+kvm_pv_unhalt,+kvm_pv_eoi,hv_spinlocks=0x1fff,hv_vapic,hv_time,hv_reset,hv_vpindex,hv_runtime,hv_relaxed,kvm=off,hv_vendor_id=intel,vmware-cpuid-freq=false,enforce=false,host-phys-bits=true,hypervisor=off -smbios type=0,version=UX305UA.201 -smbios type=1,manufacturer=ASUS,product=UX305UA,version=2021.1 -smbios type=2,manufacturer=Intel,version=2021.5,product='Intel i9-12900K' -smbios type=3,manufacturer=XBZJ -smbios type=17,manufacturer=KINGSTON,loc_pfx=DDR5,speed=4800,serial=114514,part=FF63 -smbios type=4,manufacturer=Intel,max-speed=4800,current-speed=4800
audio0: device=ich9-intel-hda,driver=none
balloon: 0
bios: ovmf
boot: order=sata0
cores: 12
cpu: host,flags=+pcid
efidisk0: local-lvm:vm-100-disk-0,efitype=4m,pre-enrolled-keys=1,size=4M
hostpci0: 0000:01:00,pcie=1,x-vga=1
machine: pc-q35-7.1
memory: 32768
meta: creation-qemu=7.1.0,ctime=1679627202
name: Windows11
net0: rtl8139=CA:09:F3:97:56:0B,bridge=vmbr0,firewall=1
numa: 1
ostype: win11
sata0: HugeSSD:100/vm-100-disk-1.qcow2,discard=on,size=64G,ssd=1
sata1: HugeHDD:100/vm-100-disk-0.qcow2,backup=0,size=128G
smbios1: uuid=24c326dd-3cec-48fc-bb9f-87aa3984e2c9,manufacturer=QVNVUw==,product=VVgzMDVVQQ==,version=MjAyMS4x,serial=MTI0NjY3,sku=MTM0NDY4,family=Ng==,base64=1
sockets: 1
tpmstate0: local-lvm:vm-100-disk-1,size=4M,version=v2.0
usb0: host=4e53:5406
usb1: host=040b:2000
vga: none
vmgenid: 020229e3-2cdb-4a91-8e77-1d04cf1f060f
args: -cpu host,+kvm_pv_unhalt,+kvm_pv_eoi,hv_spinlocks=0x1fff,hv_vapic,hv_time,hv_reset,hv_vpindex,hv_runtime,hv_relaxed,kvm=off,hv_vendor_id=intel,vmware-cpuid-freq=false,enforce=false,host-phys-bits=true,hypervisor=off -smbios type=0,version=UX305UA.201 -smbios type=1,manufacturer=ASUS,product=UX305UA,version=2021.1 -smbios type=2,manufacturer=Intel,version=2021.5,product='Intel i9-12900K' -smbios type=3,manufacturer=XBZJ -smbios type=17,manufacturer=KINGSTON,loc_pfx=DDR5,speed=4800,serial=114514,part=FF63 -smbios type=4,manufacturer=Intel,max-speed=4800,current-speed=4800
audio0: device=ich9-intel-hda,driver=none
balloon: 0
bios: ovmf
boot: order=sata0
cores: 12
cpu: host,flags=+pcid
efidisk0: local-lvm:vm-100-disk-0,efitype=4m,pre-enrolled-keys=1,size=4M
hostpci0: 0000:01:00,pcie=1,x-vga=1
machine: pc-q35-7.1
memory: 32768
meta: creation-qemu=7.1.0,ctime=1679627202
name: Windows11
net0: rtl8139=CA:09:F3:97:56:0B,bridge=vmbr0,firewall=1
numa: 1
ostype: win11
sata0: HugeSSD:100/vm-100-disk-1.qcow2,discard=on,size=64G,ssd=1
sata1: HugeHDD:100/vm-100-disk-0.qcow2,backup=0,size=128G
smbios1: uuid=24c326dd-3cec-48fc-bb9f-87aa3984e2c9,manufacturer=QVNVUw==,product=VVgzMDVVQQ==,version=MjAyMS4x,serial=MTI0NjY3,sku=MTM0NDY4,family=Ng==,base64=1
sockets: 1
tpmstate0: local-lvm:vm-100-disk-1,size=4M,version=v2.0
usb0: host=4e53:5406
usb1: host=040b:2000
vga: none
vmgenid: 020229e3-2cdb-4a91-8e77-1d04cf1f060f
args: -cpu host,+kvm_pv_unhalt,+kvm_pv_eoi,hv_spinlocks=0x1fff,hv_vapic,hv_time,hv_reset,hv_vpindex,hv_runtime,hv_relaxed,kvm=off,hv_vendor_id=intel,vmware-cpuid-freq=false,enforce=false,host-phys-bits=true,hypervisor=off -smbios type=0,version=UX305UA.201 -smbios type=1,manufacturer=ASUS,product=UX305UA,version=2021.1 -smbios type=2,manufacturer=Intel,version=2021.5,product='Intel i9-12900K' -smbios type=3,manufacturer=XBZJ -smbios type=17,manufacturer=KINGSTON,loc_pfx=DDR5,speed=4800,serial=114514,part=FF63 -smbios type=4,manufacturer=Intel,max-speed=4800,current-speed=4800
audio0: device=ich9-intel-hda,driver=none
balloon: 0
bios: ovmf
boot: order=sata0
cores: 12
cpu: host,flags=+pcid
efidisk0: local-lvm:vm-100-disk-0,efitype=4m,pre-enrolled-keys=1,size=4M
hostpci0: 0000:01:00,pcie=1,x-vga=1
machine: pc-q35-7.1
memory: 32768
meta: creation-qemu=7.1.0,ctime=1679627202
name: Windows11
net0: rtl8139=CA:09:F3:97:56:0B,bridge=vmbr0,firewall=1
numa: 1
ostype: win11
sata0: HugeSSD:100/vm-100-disk-1.qcow2,discard=on,size=64G,ssd=1
sata1: HugeHDD:100/vm-100-disk-0.qcow2,backup=0,size=128G
smbios1: uuid=24c326dd-3cec-48fc-bb9f-87aa3984e2c9,manufacturer=QVNVUw==,product=VVgzMDVVQQ==,version=MjAyMS4x,serial=MTI0NjY3,sku=MTM0NDY4,family=Ng==,base64=1
sockets: 1
tpmstate0: local-lvm:vm-100-disk-1,size=4M,version=v2.0
usb0: host=4e53:5406
usb1: host=040b:2000
vga: none
vmgenid: 020229e3-2cdb-4a91-8e77-1d04cf1f060fdebian 更新系统&卸载多余内核
更新系统
apt update -y
apt full-upgrade -y清理未使用的依赖包
apt autoremove -y
apt autoclean查看当前系统所有内核：
dpkg -l|grep linux-image | awk '{print $2}'卸载/删除多余内核：
apt-get purge 内核名称 -y更新 grub 系统引导文件
update-grubOpenWrt 编译说明 2025-08
编译丰富插件时，建议修改下面两项默认大小，留足插件空间。（ x86/64 ）
Target Images ---> (16) Kernel partition size (in MB) #建议修改 (128)
Target Images ---> (160) Root filesystem partition size (in MB) #建议修改 (1024)取消samba
Extra packages ---> autosamba （取消选定）支持 iPv6：
Extra packages ---> ipv6helper（选定）勾选的插件
LuCI ---> Applications ---> luci-app-adguardhome
LuCI ---> Applications ---> luci-app-ddns
LuCI ---> Applications ---> luci-app-diskman #磁盘管理工具
LuCI ---> Applications ---> luci-app-filetransfer #文件传输（可web安装ipk包）
LuCI ---> Applications ---> luci-app-firewall #默认勾选 防火墙
LuCI ---> Applications ---> luci-app-frpc #内网穿透Frp客户端
LuCI ---> Applications ---> luci-app-mwan3 #多线分流
LuCI ---> Applications ---> luci-app-nlbwmon #网络带宽监视器
LuCI ---> Applications ---> luci-app-opkg #默认勾选
LuCI ---> Applications ---> luci-app-qos #upnp需要
LuCI ---> Applications ---> luci-app-passwall #Include Hysteria(另外勾选)
LuCI ---> Applications ---> luci-app-socat #端口转发
LuCI ---> Applications ---> luci-app-ttyd #网页终端命令行
LuCI ---> Applications ---> luci-app-turboacc #Turbo ACC 网络加速(支持 Fast Path 或者 硬件 NAT)
LuCI ---> Applications ---> luci-app-turboacc ---> Enable BBR CCA #BBR拥塞控制算法提升TCP网络性能
LuCI ---> Applications ---> luci-app-upnp #通用即插即用UPnP（端口自动转发）
LuCI ---> Applications ---> luci-app-webadmin #Web管理页面设置
LuCI ---> Protocols ---> luci-proto-wireguard #wireguard设置默认主题为luci-theme-argon
sed -i 's/luci-theme-bootstrap/luci-theme-argon/g' feeds/luci/collections/luci-light/Makefile
sed -i 's/luci-theme-bootstrap/luci-theme-argon/g' feeds/luci/collections/luci-nginx/Makefile
sed -i 's/luci-theme-bootstrap/luci-theme-argon/g' feeds/luci/collections/luci-ssl-nginx/Makefile首次编译
export FORCE_UNSAFE_CONFIGURE=1 &&
./scripts/feeds update -a &&
./scripts/feeds install -a &&
make menuconfig &&
make download -j8 &&
make V=s -j$(nproc)二次编译
apt update -y &&
apt full-upgrade -y &&
cd /root/lede &&
export FORCE_UNSAFE_CONFIGURE=1 &&
git config pull.rebase false &&
git pull &&
./scripts/feeds update -a &&
./scripts/feeds install -a &&
make defconfig &&
make download -j8 &&
make V=s -j$(nproc)passwall
rm -rf feeds/luci/applications/luci-app-passwall
rm -rf package/feeds/luci/luci-app-passwall
rm -rf package/passwall-packages
git clone https://github.com/xiaorouji/openwrt-passwall-packages.git package/passwall-packages
rm -rf package/passwall
git clone https://github.com/xiaorouji/openwrt-passwall.git package/passwall拉取上游提交：
git -C package/passwall-packages pull
git -C package/passwall pullhelloworld
rm -rf package/helloworld
git clone https://github.com/fw876/helloworld.git package/helloworld拉取上游提交：
git -C package/helloworld pulltailscale
rm -rf feeds/luci/applications/luci-app-tailscale
rm -rf package/feeds/luci/luci-app-tailscale
rm -rf package/luci-app-tailscale
sed -i '/\/etc\/init\.d\/tailscale/d;/\/etc\/config\/tailscale/d;' feeds/packages/net/tailscale/Makefile
git clone https://github.com/asvow/luci-app-tailscale package/luci-app-tailscale
sed -i 's/--authkey=/--auth-key=/g' package/luci-app-tailscale/root/etc/init.d/tailscale拉取上游提交：
git -C package/luci-app-tailscale pulllucky
rm -rf package/feeds/luci/luci-app-lucky
rm -rf feeds/luci/applications/luci-app-lucky
rm -rf package/lucky
git clone https://github.com/gdy666/luci-app-lucky.git package/lucky拉取上游提交：
git -C package/lucky pull修改webadmin插件监听https端口
修改webadmin.po文件
cat > feeds/luci/applications/luci-app-webadmin/po/zh_Hans/webadmin.po << EOF
msgid ""
msgstr ""
"Language: zh_Hans\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=1; plural=0;\n"
msgid "Web Admin"
msgstr "Web 管理"
msgid "Web Admin Settings"
msgstr "Web 管理页面设置"
msgid "Web Admin Settings Page"
msgstr "设置更改Web管理页面端口，绑定地址，是否允许从互联网访问等"
msgid "HTTP listeners (address:port)"
msgstr "HTTP 监听 (IP地址:端口)"
msgid "HTTPS listeners (address:port)"
msgstr "HTTPS 监听 (IP地址:端口)"
msgid "Bind to specific interface:port (by specifying interface address"
msgstr "绑定到指定的IP地址:端口"
msgid "Redirect all HTTP to HTTPS"
msgstr "重定向HTTP到HTTPS"
msgid "Redirect all HTTP to HTTPS when SSl cert was installed"
msgstr "当安装了SSL证书后，重定向HTTP到HTTPS管理页面"
msgid "Auto activate"
msgstr "自动激活局域网客户端"
msgid "configfile"
msgstr "配置文件"
msgid "Ignore private IPs on public interface"
msgstr "只允许内网访问"
msgid "Prevent access from private (RFC1918) IPs on an interface if it has an public IP address"
msgstr "拒绝从互联网访问Web管理页面"
EOF修改webadmin.lua文件
cat > feeds/luci/applications/luci-app-webadmin/luasrc/model/cbi/webadmin.lua << EOF
-- Copyright 2015 Daniel Dickinson <openwrt@daniel.thecshore.com>
-- Licensed to the public under the Apache License 2.0.
local fs = require("nixio.fs")
local m = Map("uhttpd", translate("Web Admin Settings"),
translate("Web Admin Settings Page"))
local ucs = m:section(TypedSection, "uhttpd")
ucs.addremove = false
ucs.anonymous = true
lhttp = ucs:option(DynamicList, "listen_http", translate("HTTP listeners (address:port)"), translate("Bind to specific interface:port (by specifying interface address"))
lhttp.datatype = "list(ipaddrport(1))"
lhttps = ucs:option(DynamicList, "listen_https", translate("HTTPS listeners (address:port)"), translate("Bind to specific interface:port (by specifying interface address"))
lhttps.datatype = "list(ipaddrport(1))"
function lhttp.validate(self, value, section)
local have_https_listener = false
local have_http_listener = false
if lhttp and lhttp:formvalue(section) and (#(lhttp:formvalue(section)) > 0) then
for k, v in pairs(lhttp:formvalue(section)) do
if v and (v ~= "") then
have_http_listener = true
break
end
end
end
if lhttps and lhttps:formvalue(section) and (#(lhttps:formvalue(section)) > 0) then
for k, v in pairs(lhttps:formvalue(section)) do
if v and (v ~= "") then
have_https_listener = true
break
end
end
end
if not (have_http_listener or have_https_listener) then
return nil, "must listen on at list one address:port"
end
return DynamicList.validate(self, value, section)
end
o = ucs:option(Flag, "redirect_https", translate("Redirect all HTTP to HTTPS"))
o.default = o.enabled
o.rmempty = false
o.description = translate("Redirect all HTTP to HTTPS when SSl cert was installed")
o = ucs:option(Flag, "rfc1918_filter", translate("Ignore private IPs on public interface"), translate("Prevent access from private (RFC1918) IPs on an interface if it has an public IP address"))
o.default = o.enabled
o.rmempty = false
return m
EOFGIT合并失败处理 希望保留本地的修改，pull之后，修改依然存在
git stash
git pull
git stash popGIT合并失败处理 不保留本地的修改，直接覆盖
git reset --hard
git pull修改内核版本
/root/lede/target/linux/x86/Makefile原版修改Tailscale认证密钥不生效问题，修复方法uthkey修改为authKey（区分大小写），--authkey参数修改为--auth-key
sed -i 's/--authkey=/--auth-key=/g' package/feeds/luci/luci-app-tailscale/root/etc/init.d/tailscale
sed -i 's/authkey/authKey/g' package/feeds/luci/luci-app-tailscale/root/etc/init.d/tailscale