一、系统更新与基础安装

#更新系统
apt update && apt upgrade -y

#安装 shadowsocks-libev 和必要工具
apt install -y shadowsocks-libev netcat-openbsd socat bc

#安装网络优化工具
apt install -y ethtool

二、配置 ss-manager（Unix Socket 方式）

2.1 创建配置文件

#创建配置目录
mkdir -p /etc/shadowsocks-libev

#创建 manager 配置文件
cat > /etc/shadowsocks-libev/manager.json << 'EOF'
{
    "server": ["0.0.0.0", "::0"],
    "manager_address": "/var/run/shadowsocks-manager.sock",
    "method": "chacha20-ietf-poly1305",
    "timeout": 300,
    "fast_open": true,
    "reuse_port": true,
    "no_delay": true,
    "mode": "tcp_and_udp"
}
EOF

2.2 创建服务脚本和 systemd 服务

# 创建启动脚本
cat > /usr/local/bin/ss-manager-with-users << 'EOF'
#!/bin/bash

# 启动 ss-manager
/usr/bin/ss-manager -c /etc/shadowsocks-libev/manager.json --executable /usr/bin/ss-server &

# 等待 manager 启动
sleep 2

# 恢复用户配置
if [ -f /etc/shadowsocks-libev/users.conf ]; then
    while IFS=: read -r port password; do
        [[ "$port" =~ ^#.*$ ]] && continue
        [[ -z "$port" ]] && continue
        echo "add: {\"server_port\": $port, \"password\": \"$password\"}" | nc -Uu -w 2 /var/run/shadowsocks-manager.sock
    done < /etc/shadowsocks-libev/users.conf
fi

# 等待进程结束
wait
EOF

chmod +x /usr/local/bin/ss-manager-with-users

# 创建服务文件
cat > /etc/systemd/system/ss-manager.service << 'EOF'
[Unit]
Description=Shadowsocks-libev Manager with Auto Restore
After=network.target

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/local/bin/ss-manager-with-users
Restart=on-failure
RestartSec=5
LimitNOFILE=65535
Environment="SS_LOG_LEVEL=error"  #调整日志级别来减少输出

[Install]
WantedBy=multi-user.target
EOF

2.3 启动服务

#重新加载 systemd
systemctl daemon-reload

#启动 manager 服务
systemctl start ss-manager

#设置开机自启
systemctl enable ss-manager

#检查服务状态
systemctl status ss-manager

#验证 socket 文件是否创建成功
ls -la /var/run/shadowsocks-manager.sock

三、创建管理脚本

#安装管理脚本（自动保存到 users.conf）

cat > /usr/local/bin/ssm << 'EOF'
#!/bin/bash

SOCKET="/var/run/shadowsocks-manager.sock"
CONFIG_FILE="/etc/shadowsocks-libev/users.conf"

# 字节转人类可读格式（不依赖 bc）
human_readable() {
    local bytes=$1
    if [ $bytes -ge 1073741824 ]; then
        # GB - 使用 awk 计算，不依赖 bc
        echo "$(awk "BEGIN {printf \"%.2f\", $bytes/1073741824}")G"
    elif [ $bytes -ge 1048576 ]; then
        # MB
        echo "$(awk "BEGIN {printf \"%.2f\", $bytes/1048576}")M"
    elif [ $bytes -ge 1024 ]; then
        # KB
        echo "$(awk "BEGIN {printf \"%.2f\", $bytes/1024}")K"
    else
        echo "${bytes}B"
    fi
}

# 确保配置目录存在
mkdir -p /etc/shadowsocks-libev
touch $CONFIG_FILE

case "$1" in
    add)
        if [ -z "$2" ] || [ -z "$3" ]; then
            echo "Usage: ssm add <port> <password>"
            exit 1
        fi
        echo "add: {\"server_port\": $2, \"password\": \"$3\"}" | nc -Uu -w 2 $SOCKET
        if grep -q "^$2:" $CONFIG_FILE 2>/dev/null; then
            sed -i "s/^$2:.*/$2:$3/" $CONFIG_FILE
        else
            echo "$2:$3" >> $CONFIG_FILE
        fi
        echo "✓ User $2 added"
        ;;
    remove)
        if [ -z "$2" ]; then
            echo "Usage: ssm remove <port>"
            exit 1
        fi
        echo "remove: {\"server_port\": $2}" | nc -Uu -w 2 $SOCKET
        sed -i "/^$2:/d" $CONFIG_FILE
        echo "✓ User $2 removed"
        ;;
    list)
        echo "=== Active Users & Traffic ==="
        RESPONSE=$(echo "ping" | nc -Uu -w 2 $SOCKET 2>/dev/null)
        
        if [ -z "$RESPONSE" ]; then
            echo "  No response from manager"
            echo "  Make sure ss-manager is running"
            exit 1
        fi
        
        # 提取 JSON 部分
        if [[ $RESPONSE =~ stat:\ (.+) ]]; then
            JSON_DATA="${BASH_REMATCH[1]}"
            
            # 检查是否为空
            if [ "$JSON_DATA" = "{}" ]; then
                echo "  No users configured"
            else
                # 解析 JSON 中的键值对
                echo $JSON_DATA | grep -oE '"[0-9]+":[0-9]+' | while read -r item; do
                    port=$(echo $item | cut -d: -f1 | tr -d '"')
                    bytes=$(echo $item | cut -d: -f2)
                    human=$(human_readable $bytes)
                    # 格式化输出，右对齐
                    printf "  Port %-6s %12s (%'d bytes)\n" "$port" "$human" "$bytes"
                done
            fi
        else
            echo "  Unexpected response: $RESPONSE"
        fi
        ;;
    list-raw)
        echo "ping" | nc -Uu -w 2 $SOCKET
        ;;
    show-config)
        echo "=== Saved Config ($CONFIG_FILE) ==="
        if [ -s $CONFIG_FILE ]; then
            cat $CONFIG_FILE
        else
            echo "(empty)"
        fi
        ;;
    *)
        echo "Shadowsocks Manager Tool"
        echo ""
        echo "Usage:"
        echo "  ssm add <port> <password>       - Add user"
        echo "  ssm remove <port>               - Remove user"
        echo "  ssm list                        - List users with human-readable traffic"
        echo "  ssm list-raw                    - List users with raw bytes"
        echo "  ssm show-config                 - Show saved config"
        echo ""
        echo "Examples:"
        echo "  ssm add 65531 Tian@2026_"
        echo "  ssm list"
        echo "  ssm remove 65531"
        ;;
esac
EOF

chmod +x /usr/local/bin/ssm

echo "✓ Enhanced ssm installed with auto-save feature"

四、添加用户

4.1 添加单个用户

添加第一个用户（端口 8388）
ssm add 8388 "YourPassword1"

添加第二个用户（端口 8389）
ssm add 8389 "YourPassword2"

添加你需要的用户（端口 xxxx）
ssm add xxxx "xxxxxxxxx"

4.2 批量添加用户

# 创建批量添加脚本
cat > /tmp/batch_add.sh << 'EOF'
#!/bin/bash
# 格式：端口:密码
users=(
    "8388:password123"
    "8389:password456"
    "8390:password789"
)

for user in "${users[@]}"; do
    port=$(echo $user | cut -d: -f1)
    pass=$(echo $user | cut -d: -f2)
    echo "Adding user: $port"
    ssm add $port "$pass"
    sleep 1
done
EOF

chmod +x /tmp/batch_add.sh
/tmp/batch_add.sh

4.3 查看所有用户

#查看所有用户和流量统计
ssm list

五、网络优化

5.1 内核参数优化

cat > /etc/sysctl.d/99-shadowsocks.conf << 'EOF'
# TCP BBR 拥塞控制（提升速度）
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# TCP Fast Open（减少延迟）
net.ipv4.tcp_fastopen = 3

# 端口复用
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0

# 增加连接队列（应对高并发）
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 65536
net.core.netdev_max_backlog = 50000

# 文件描述符限制
fs.file-max = 655350

# 内存优化（提升吞吐量）
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 4096 87380 134217728
net.ipv4.tcp_wmem = 4096 65536 134217728

# 减少延迟
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.tcp_slow_start_after_idle = 0

# UDP 优化
net.core.rmem_default = 87380
net.core.wmem_default = 65536
EOF

# 应用配置
sysctl -p /etc/sysctl.d/99-shadowsocks.conf

5.2 验证 BBR 是否启用

# 检查当前拥塞控制算法
sysctl net.ipv4.tcp_congestion_control

# 检查 BBR 模块是否加载
lsmod | grep bbr

5.3 系统限制优化

# 增加文件描述符限制
cat >> /etc/security/limits.conf << 'EOF'
* soft nofile 65535
* hard nofile 65535
root soft nofile 65535
root hard nofile 65535
EOF

# 增加系统全局限制
cat >> /etc/systemd/system.conf << 'EOF'
DefaultLimitNOFILE=65535
DefaultLimitNPROC=65535
EOF

cat >> /etc/systemd/user.conf << 'EOF'
DefaultLimitNOFILE=65535
DefaultLimitNPROC=65535
EOF

六、防火墙配置

# 安装 UFW
apt install -y ufw

# 启用防火墙
ufw enable

# 开放 Shadowsocks 端口范围（根据需要修改）
ufw allow 8388:8400/tcp
ufw allow 8388:8400/udp

# 或者开放特定端口
ufw allow xxxxx/tcp
ufw allow xxxxx/udp

# 查看状态
ufw status verbose

七、验证服务

7.1 检查服务状态

# 查看 manager 状态
systemctl status ss-manager

# 查看所有运行的 ss-server 进程
ps aux | grep ss-server

# 查看监听端口
ss -tlnp | grep -E '838[0-9]|65535'
netstat -tulnp | grep ss-server

7.2 测试连接

# 本地测试（如果有 ss-local）
ss-local -s 127.0.0.1 -p 8388 -k "YourPassword1" -m chacha20-ietf-poly1305 -v

# 查看实时日志
journalctl -u ss-manager -f

八、日常管理命令

8.1 用户管理

# 添加用户
ssm add 8388 "newpassword"

# 查看所有用户
ssm list

# 删除用户
ssm remove 8388

# 查看流量统计
ssm stats

8.2 服务管理

# 重启 manager
systemctl restart ss-manager

# 查看日志
journalctl -u ss-manager -n 50 --no-pager

# 实时查看日志
journalctl -u ss-manager -f

# 停止服务
systemctl stop ss-manager

# 启动服务
systemctl start ss-manager

8.3查看是否有暴力破解尝试

# 查看该IP的连接记录
grep "147.185.132.250" /var/log/syslog | grep -i "auth"

# 查看失败次数
journalctl -u ss-manager | grep "authentication error" | wc -l