CentOS7.9安装docker 在开始安装前，请确保满足以下要求：系统要求：CentOS 7 的 64 位版本，内核版本不低于 3.10。清理旧版本：如果你的系统之前安装过 Docker，建议先将其卸载，可以避免冲突。可以直接复制下面的命令，一次性清除干净sudo yum remove docker \ docker-client \ docker-client-latest \ docker-common \ docker-latest \ docker-latest-logrotate \ docker-logrotate \ docker-engine第二步：安装 Docker安装依赖工具这些是 Docker 正常运行所需的基础工具sudo yum install -y yum-utils device-mapper-persistent-data lvm2添加 Docker CE 软件源Docker 官方和国内镜像源都提供了对应的软件源。建议优先使用国内镜像源，下载速度会更快更稳定。使用阿里云镜像源（推荐）sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo执行安装源添加完成后，更新软件源缓存并安装 Dockersudo yum makecache fast sudo yum install -y docker-ce docker-ce-cli containerd.io启动 Docker 并设置开机自启安装完成后，启动 Docker 服务，并设置它在系统启动时自动运行sudo systemctl start docker sudo systemctl enable docker验证安装运行一个测试镜像来验证 Docker 是否正常工作sudo docker run hello-world为了提升国内环境拉取 Docker 镜像的速度，可以配置一个国内的镜像加速器。sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": [ "https://docker.m.daocloud.io", "https://dockerproxy.com", "https://docker.nju.edu.cn" ] } EOF重启 Docker 服务使配置生效sudo systemctl daemon-reload sudo systemctl restart docker删除停止的容器sudo docker container prune查看还在运行的容器sudo docker ps删除所有未使用的容器sudo docker system prune -a {dotted startColor="#ff6c6c" endColor="#1989fa"/}一些常用的 Docker 管理命令：查看运行中的容器：sudo docker ps查看所有容器（包括已停止）：sudo docker ps -a停止容器：sudo docker stop <容器名或ID>删除容器：sudo docker rm <容器名或ID>查看本地镜像：sudo docker images另外，如果之后想用非 root 用户执行 docker 命令（避免每次输入 sudo），可以把你常用的用户加入 docker 组（例如 root 用户不需要，但如果是其他普通用户）：sudo usermod -aG docker $USER # 重新登录后生效{dotted startColor="#ff6c6c" endColor="#1989fa"/}安装ollama拉取并运行Ollama容器：# 拉取并运行容器，将本地的11434端口映射出来 docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama检查容器状态docker ps验证 Ollama 服务是否正常# 查看容器日志 docker logs ollama

腾讯1.8B专用翻译模型安装过程 确保Docker容器在运行docker ps -a | grep ollama-server-cpu如果没找到，或者之前停了，就用下面这个命令新建并启动一个：docker run -d --name ollama-server-cpu -p 11434:11434 -v /home/docker/ollama:/root/.ollama --restart unless-stopped ollama/ollama从魔塔社区拉取镜像docker exec -it ollama-server-cpu ollama run modelscope.cn/Tencent-Hunyuan/HY-MT1.5-1.8B-GGUF检查镜像目录docker exec -it ollama-server-cpu ollama list运行结果参考[root@ah-ipv6 ~]# docker exec -it ollama-server-cpu ollama list NAME ID SIZE MODIFIED modelscope.cn/Tencent-Hunyuan/HY-MT1.5-1.8B-GGUF:latest b31d15fc8de8 1.1 GB 7 minutes ago [root@ah-ipv6 ~]# 卸载这个模型docker exec -it ollama-server-cpu ollama rm modelscope.cn/Tencent-Hunyuan/HY-MT1.5-1.8B-GGUF:latest检查是否卸载成功docker exec -it ollama-server-cpu ollama list{dotted startColor="#ff6c6c" endColor="#1989fa"/}调用模型docker exec -it ollama-server-cpu ollama run ali6parmak/hy-mt1.5:1.8bdocker exec -it ollama-server-cpu ollama run deepseek-r1:7b或者time curl -s http://localhost:11434/api/generate -d '{ "model": "ali6parmak/hy-mt1.5:1.8b", "prompt": "将以下文本翻译为英文：人工智能正在改变世界。", "stream": false }'安全测试命令docker exec -i ollama-server-cpu curl -s http://localhost:11434/api/generate -d '{ "model": "qwen3.5:4b", "prompt": "在这里放入你的问题", "stream": false, "options": { "num_ctx": 2048, "num_predict": 200 } }'参考结果

linux后门排查 #!/bin/bash # Linux 后门自动排查脚本（文件版） # 使用方法：chmod +x check.sh && sudo ./check.sh WHITELIST_IPS=( "127.0.0.1" "::1" "192.168." "10." "172.16." "172.17." "172.18." "172.19." "172.20." "172.21." "172.22." "172.23." "172.24." "172.25." "172.26." "172.27." "172.28." "172.29." "172.30." "172.31." "120.27.157.31" ) WHITELIST_PORTS=( "22" "80" "443" "3306" "5432" "6379" "27017" "8080" "8443" "8888" "29000" "29400" "29401" "29200" "29702" "34816" "888" "29301" "29712" ) SUSPECT_KEYWORDS=("curl" "wget" "nc " "bash -i" "perl -e" "python -c" "ruby -e" "php -r" "base64 -d" "/dev/tcp" "/dev/udp") MINER_KEYWORDS=("minerd" "xmrig" "cpuminer" "cryptonight" "stratum" "kdevtmpfsi" "kinsing") log_info() { echo -e "\033[32m[INFO]\033[0m $1"; } log_warn() { echo -e "\033[33m[WARN]\033[0m $1"; } log_error() { echo -e "\033[31m[ERROR]\033[0m $1"; } is_ip_whitelisted() { local ip=$1; for w in "${WHITELIST_IPS[@]}"; do [[ "$ip" == "$w"* ]] && return 0; done; return 1; } is_port_whitelisted() { local port=$1; for p in "${WHITELIST_PORTS[@]}"; do [[ "$port" == "$p" ]] && return 0; done; return 1; } echo "==================== Linux 后门自动排查报告 ====================" echo "时间: $(date) | 主机: $(hostname)" echo "" errors=(); warnings=() cpu_idle=$(top -bn1 | grep "%Cpu" | awk -F 'id' '{print $1}' | awk '{print $NF}') cpu_idle_int=${cpu_idle%.*} if [[ $cpu_idle_int -lt 70 ]]; then log_warn "CPU 空闲率仅 ${cpu_idle_int}%"; warnings+=("CPU过高"); else log_info "CPU 空闲率 ${cpu_idle_int}%"; fi miner_procs=$(ps aux | grep -E "$(IFS='|'; echo "${MINER_KEYWORDS[*]}")" | grep -v grep) if [[ -n "$miner_procs" ]]; then log_error "发现疑似挖矿进程"; errors+=("挖矿进程"); echo "$miner_procs"; else log_info "无挖矿进程"; fi suspect_procs=$(ps aux | grep -E "$(IFS='|'; echo "${SUSPECT_KEYWORDS[*]}")" | grep -v grep) if [[ -n "$suspect_procs" ]]; then log_warn "发现可疑命令行"; warnings+=("可疑进程命令"); echo "$suspect_procs"; else log_info "无可疑进程命令"; fi echo ""; echo "--- 外部连接 ---" external=$(lsof -i -P -n 2>/dev/null | grep -v "127.0.0.1\|::1" | grep ESTABLISHED) if [[ -z "$external" ]]; then log_info "无外部 ESTABLISHED 连接"; else suspicious_conn=0 while IFS= read -r line; do target=$(echo "$line" | awk '{print $NF}' | awk -F'->' '{print $2}') if [[ -n "$target" ]]; then ip=$(echo "$target" | cut -d: -f1) if ! is_ip_whitelisted "$ip"; then log_error "非白名单连接: $target" errors+=("外部连接 $target") suspicious_conn=1 else log_info "白名单连接: $target" fi fi done <<< "$external" if [[ $suspicious_conn -eq 0 ]]; then log_info "所有外部连接均在白名单内"; fi fi echo ""; echo "--- 监听端口 ---" listening_ports=$(netstat -antlp 2>/dev/null | grep LISTEN | grep -v "127.0.0.1\|::1" | awk '{print $4}' | sed 's/.*://' | sort -u) for port in $listening_ports; do if ! is_port_whitelisted "$port"; then log_warn "非常规监听端口: $port" warnings+=("监听端口$port") fi done if [[ -z "$listening_ports" ]]; then log_info "无监听端口（或全部过滤）"; fi echo ""; echo "--- 可疑进程路径 ---" suspicious_paths="" for pid in $(ps -e -o pid=); do if [[ -d /proc/$pid ]]; then exe=$(ls -l /proc/$pid/exe 2>/dev/null | awk '{print $NF}') if [[ "$exe" == "/tmp/"* || "$exe" == "/dev/shm/"* || "$exe" == *"/..."* || "$exe" == " (deleted)" ]]; then cmd=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ') suspicious_paths+="PID:$pid EXE:$exe CMD:$cmd\n" fi fi done if [[ -n "$suspicious_paths" ]]; then log_error "发现可疑进程路径"; errors+=("可疑路径"); echo -e "$suspicious_paths"; else log_info "所有进程路径正常"; fi echo ""; echo "--- 计划任务 ---" cron_suspect="" for user in $(cut -f1 -d: /etc/passwd); do cron_suspect+=$(crontab -u $user -l 2>/dev/null) done cron_suspect+=$(cat /etc/crontab 2>/dev/null) cron_suspect+=$(cat /etc/cron.d/* 2>/dev/null | grep -v "^#") if echo "$cron_suspect" | grep -qE "$(IFS='|'; echo "${SUSPECT_KEYWORDS[*]}")"; then log_error "计划任务中存在可疑命令"; errors+=("cron可疑"); echo "$cron_suspect" | grep -E "$(IFS='|'; echo "${SUSPECT_KEYWORDS[*]}")" else log_info "计划任务无异常" fi echo ""; echo "--- SSH authorized_keys ---" if [[ -s /root/.ssh/authorized_keys ]]; then log_warn "SSH authorized_keys 非空，请人工确认"; warnings+=("authorized_keys非空"); cat /root/.ssh/authorized_keys; else log_info "无 SSH authorized_keys 后门"; fi echo ""; echo "--- LD_PRELOAD ---" if [[ -s /etc/ld.so.preload ]]; then log_error "ld.so.preload 存在"; errors+=("ld.so.preload"); cat /etc/ld.so.preload; else log_info "ld.so.preload 正常"; fi echo ""; echo "--- 登录记录 ---" last_output=$(last -20 | grep -v "still logged in") known_ips=$(echo "$last_output" | awk '{print $3}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | sort -u) for ip in $known_ips; do if ! is_ip_whitelisted "$ip"; then log_error "非白名单IP登录: $ip" errors+=("登录IP $ip") fi done if [[ ${#errors[@]} -eq 0 ]]; then log_info "所有登录IP均在白名单内"; fi echo ""; echo "--- SSH 暴力破解迹象 ---" if [[ -f /var/log/secure ]]; then fail_count=$(grep "Failed password" /var/log/secure 2>/dev/null | wc -l) elif [[ -f /var/log/auth.log ]]; then fail_count=$(grep "Failed password" /var/log/auth.log 2>/dev/null | wc -l) else fail_count=0 fi if [[ $fail_count -gt 100 ]]; then log_warn "SSH失败尝试次数较多 ($fail_count)"; warnings+=("暴力破解迹象"); else log_info "SSH失败尝试较少 ($fail_count)"; fi echo ""; echo "==================== 综合结论 ====================" if [[ ${#errors[@]} -gt 0 ]]; then echo -e "\033[31m❌ 检测到明确恶意迹象！请立即处理。\033[0m" printf " - %s\n" "${errors[@]}" echo "建议：封禁IP、杀进程、删文件、改密码，必要时重装系统。" elif [[ ${#warnings[@]} -gt 0 ]]; then echo -e "\033[33m⚠️ 发现可疑迹象，建议人工复核。\033[0m" printf " - %s\n" "${warnings[@]}" else echo -e "\033[32m✅ 未发现明显后门迹象。系统基本安全。\033[0m" fi直接在root目录下新建文件check.sh，贴入上面内容回到根目录运行 ./check.sh显示结果参考[root@ah-ipv6 ~]# ./check.sh ==================== Linux 后门自动排查报告 ==================== 时间: 2026年 05月 21日 星期四 15:02:39 CST | 主机: ah-ipv6 [INFO] CPU 空闲率 96% [INFO] 无挖矿进程 [INFO] 无可疑进程命令 --- 外部连接 --- [INFO] 所有外部连接均在白名单内 --- 监听端口 --- --- 可疑进程路径 --- [INFO] 所有进程路径正常 --- 计划任务 --- [INFO] 计划任务无异常 --- SSH authorized_keys --- [INFO] 无 SSH authorized_keys 后门 --- LD_PRELOAD --- [INFO] ld.so.preload 正常 --- 登录记录 --- [INFO] 所有登录IP均在白名单内 --- SSH 暴力破解迹象 --- [INFO] SSH失败尝试较少 (0) ==================== 综合结论 ==================== ✅ 未发现明显后门迹象。系统基本安全。 [root@ah-ipv6 ~]#

卸载ollama模型命令 [root@ah-ipv6 ~]# docker exec -it ollama ollama list NAME ID SIZE MODIFIED deepseek-r1:7b 755ced02ce7b 4.7 GB 21 minutes ago [root@ah-ipv6 ~]# docker exec -it ollama ollama rm deepseek-r1:7b deleted 'deepseek-r1:7b' [root@ah-ipv6 ~]# docker exec -it ollama ollama list NAME ID SIZE MODIFIED [root@ah-ipv6 ~]# docker exec -it ollama sh -c "rm -rf /root/.ollama/models/blobs/* 2>/dev/null || true" [root@ah-ipv6 ~]# docker exec -it ollama ollama run deepseek-r1:1.5b

centos7.9安装ds蒸馏模型记录 安装 Ollamacurl -fsSL https://ollama.com/install.sh | sh报错[root@ah-ipv6 ~]# curl -fsSL https://ollama.com/install.sh | sh >>> Installing ollama to /usr/local ERROR: This version requires zstd for extraction. Please install zstd and try again: - Debian/Ubuntu: sudo apt-get install zstd - RHEL/CentOS/Fedora: sudo dnf install zstd - Arch: sudo pacman -S zstd [root@ah-ipv6 ~]#安装报错是因为 Ollama 的安装脚本需要 zstd 这个压缩工具来解压文件。这个错误信息已经直接给出了解决方案：先安装 zstd 再重试即可。安装 zstdsudo dnf install -y zstd还是报错[root@ah-ipv6 ~]# sudo dnf install -y zstd sudo: dnf：找不到命令 [root@ah-ipv6 ~]#报错 sudo: dnf：找不到命令 说明系统中没有 dnf 这个包管理器。这是因为 CentOS 7 及更早的 RHEL 系统默认使用 yum 作为包管理器，并未预装 dnf。此系统应该也属于这种情况。CentOS 7 的 yum 官方源已停用，以及某些第三方源（如 EPEL）因压缩格式不兼容也会报错。使用正确的包管理器安装 zstd[root@ah-ipv6 ~]# # 清理yum缓存并生成新缓存 [root@ah-ipv6 ~]# sudo yum clean all 已加载插件：fastestmirror, product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. 正在清理软件源： base cloudflared-stable docker-ce-stable epel extras updates Cleaning up list of fastest mirrors [root@ah-ipv6 ~]# sudo yum makecache 已加载插件：fastestmirror, product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. Determining fastest mirrors epel/x86_64/metalink | 4.2 kB 00:00:00 * base: mirrors.aliyun.com * epel: d2lzkl7pfhq30w.cloudfront.net * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com base | 3.6 kB 00:00:00 cloudflared-stable | 1.5 kB 00:00:00 docker-ce-stable | 3.5 kB 00:00:00 epel | 4.3 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 (1/22): base/7/x86_64/group_gz | 153 kB 00:00:00 (2/22): base/7/x86_64/primary_db | 6.1 MB 00:00:03 (3/22): base/7/x86_64/filelists_db | 7.2 MB 00:00:03 (4/22): docker-ce-stable/x86_64/updateinfo | 55 B 00:00:00 (5/22): docker-ce-stable/x86_64/filelists_db | 66 kB 00:00:00 (6/22): docker-ce-stable/x86_64/primary_db | 152 kB 00:00:00 (7/22): docker-ce-stable/x86_64/other_db | 145 kB 00:00:00 (8/22): base/7/x86_64/other_db | 2.6 MB 00:00:01 (9/22): epel/x86_64/group | 399 kB 00:00:00 (10/22): cloudflared-stable/filelists | 377 B 00:00:02 (11/22): cloudflared-stable/other | 423 B 00:00:02 (12/22): epel/x86_64/filelists_db | 15 MB 00:00:01 (13/22): epel/x86_64/updateinfo | 1.0 MB 00:00:00 (14/22): epel/x86_64/prestodelta | 592 B 00:00:00 (15/22): epel/x86_64/primary_db | 8.7 MB 00:00:00 (16/22): extras/7/x86_64/filelists_db | 305 kB 00:00:00 (17/22): extras/7/x86_64/other_db | 154 kB 00:00:00 (18/22): extras/7/x86_64/primary_db | 253 kB 00:00:00 (19/22): epel/x86_64/other_db | 4.1 MB 00:00:00 (20/22): updates/7/x86_64/filelists_db | 15 MB 00:00:08 (21/22): updates/7/x86_64/other_db | 1.6 MB 00:00:00 (22/22): updates/7/x86_64/primary_db | 27 MB 00:00:15 One of the configured repositories failed (未知), and yum doesn't have enough cached data to continue. At this point the only safe thing yum can do is fail. There are a few ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working upstream. This is most often useful if you are using a newer distribution release than is supported by the repository (and the packages for the previous distribution release still work). 3. Run the command with the repository temporarily disabled yum --disablerepo=<repoid> ... 4. Disable the repository permanently, so yum won't use it by default. Yum will then just ignore the repository until you permanently enable it again or use --enablerepo for temporary usage: yum-config-manager --disable <repoid> or subscription-manager repos --disable=<repoid> 5. Configure the failing repository to be skipped, if it is unavailable. Note that yum will try to contact the repo. when it runs most commands, so will have to try and fail each time (and thus. yum will be be much slower). If it is a very temporary problem though, this is often a nice compromise: yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true Parsing primary.xml error: Start tag expected, '<' not found [root@ah-ipv6 ~]#看起来问题出在 cloudflared-stable 或 docker-ce-stable 这两个第三方仓库的元数据损坏了，导致 yum makecache 整体失败。我们可以暂时禁用它们，只从 CentOS 官方源和 EPEL 源安装 zstd。# 1. 禁用有问题的仓库，然后安装 zstd sudo yum --disablerepo=cloudflared-stable --disablerepo=docker-ce-stable install -y zstd运行结果[root@ah-ipv6 ~]# sudo yum --disablerepo=cloudflared-stable --disablerepo=docker-ce-stable install -y zstd 已加载插件：fastestmirror, product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. Loading mirror speeds from cached hostfile epel/x86_64/metalink | 4.2 kB 00:00:00 * base: mirrors.aliyun.com * epel: d2lzkl7pfhq30w.cloudfront.net * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com base | 3.6 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 正在解决依赖关系 --> 正在检查事务 ---> 软件包 zstd.x86_64.0.1.5.5-1.el7 将被 安装 --> 解决依赖关系完成 依赖关系解决 ================================================================================================================================================================================================= Package 架构 版本 源 大小 ================================================================================================================================================================================================= 正在安装: zstd x86_64 1.5.5-1.el7 epel 449 k 事务概要 ================================================================================================================================================================================================= 安装 1 件包 总下载量：449 k 安装大小：1.7 M Downloading packages: zstd-1.5.5-1.el7.x86_64.rpm | 449 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction 正在安装 : zstd-1.5.5-1.el7.x86_64 1/1 验证中 : zstd-1.5.5-1.el7.x86_64 1/1 已安装: zstd.x86_64 0:1.5.5-1.el7 完毕！ [root@ah-ipv6 ~]#zstd 已经成功安装。现在继续安装 Ollama：curl -fsSL https://ollama.com/install.sh | sh安装完成后，验证一下：ollama --version正常输出版本号（例如 ollama version is 0.5.1），就可以拉取并运行模型了。ollama run deepseek-r1:7bOllama 会自动下载模型并启动对话。出现 >>> Send a message (/? for help) 提示时，就说明成功了。