{"id":105247,"date":"2026-09-15T07:00:22","date_gmt":"2026-09-14T23:00:22","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/105247.html"},"modified":"2026-09-15T07:00:22","modified_gmt":"2026-09-14T23:00:22","slug":"linux-%e5%ae%89%e5%85%a8%e5%8a%a0%e5%9b%ba%e5%ae%8c%e6%95%b4%e7%af%87%ef%bc%9a%e4%bb%8e-ssh%e3%80%81%e9%98%b2%e7%81%ab%e5%a2%99%e5%88%b0selinux-apparmor-%e4%b8%8e%e5%ae%a1%e8%ae%a1","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/105247.html","title":{"rendered":"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1"},"content":{"rendered":"

\u300c\u5bc6\u94a5\u6cc4\u9732\u4ecd\u88ab\u626b\u7aef\u53e3\u7206\u7834\u300d\u300csudo NOPASSWD \u5168\u6743\u9650\u300d\u300c\u9632\u706b\u5899\u5f00\u4e86\u4f46 Docker \u7ed5\u8fc7\u300d\u2014\u2014\u52a0\u56fa\u5931\u8d25\u591a\u5728 \u9ed8\u8ba4\u914d\u7f6e\u672a\u6539\u3001\u89c4\u5219\u987a\u5e8f\u9519\u8bef\u3001MAC \u672a Enforcing\u3002\u672c\u6587\u6309 OpenSSH\u3001firewalld\/nftables\u3001auditd \u771f\u5b9e\u8def\u5f84\u5c55\u5f00\u3002<\/p>\n

\u6e90\u7801\u951a\u70b9<\/h3>\n\n\u8def\u5f84 \/ \u914d\u7f6e\u4f5c\u7528<\/tr>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\/etc\/ssh\/sshd_config<\/td>\nSSH \u670d\u52a1\u7aef<\/td>\n<\/tr>\n
\/etc\/ssh\/ssh_config<\/td>\nSSH \u5ba2\u6237\u7aef<\/td>\n<\/tr>\n
man sshd_config<\/td>\n\u6307\u4ee4\u8bf4\u660e<\/td>\n<\/tr>\n
\/etc\/sudoers<\/td>\nsudo \u4e3b\u914d\u7f6e<\/td>\n<\/tr>\n
\/etc\/sudoers.d\/<\/td>\n\u7247\u6bb5<\/td>\n<\/tr>\n
visudo<\/td>\n\u8bed\u6cd5\u6821\u9a8c<\/td>\n<\/tr>\n
\/etc\/firewalld\/<\/td>\nfirewalld zone<\/td>\n<\/tr>\n
man firewalld.richlanguage<\/td>\n\u5bcc\u89c4\u5219<\/td>\n<\/tr>\n
nft list ruleset<\/td>\nnftables<\/td>\n<\/tr>\n
\/etc\/nftables.conf<\/td>\nnft \u6301\u4e45\u5316<\/td>\n<\/tr>\n
\/etc\/fail2ban\/jail.local<\/td>\nfail2ban<\/td>\n<\/tr>\n
\/etc\/selinux\/config<\/td>\nSELinux \u6a21\u5f0f<\/td>\n<\/tr>\n
getenforce \/ semanage<\/td>\nSELinux<\/td>\n<\/tr>\n
\/etc\/apparmor.d\/<\/td>\nAppArmor profile<\/td>\n<\/tr>\n
aa-status<\/td>\nAppArmor<\/td>\n<\/tr>\n
\/etc\/audit\/auditd.conf<\/td>\nauditd<\/td>\n<\/tr>\n
\/etc\/audit\/rules.d\/<\/td>\n\u5ba1\u8ba1\u89c4\u5219<\/td>\n<\/tr>\n
ausearch \/ aureport<\/td>\n\u5ba1\u8ba1\u67e5\u8be2<\/td>\n<\/tr>\n
\/etc\/sysctl.d\/<\/td>\n\u5185\u6838\u5b89\u5168\u53c2\u6570<\/td>\n<\/tr>\n
\/var\/log\/auth.log \u6216 secure<\/td>\n\u8ba4\u8bc1\u65e5\u5fd7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

sshd -T<\/span> |<\/span> grep<\/span> -Ei<\/span> 'permitroot|password|pubkey'<\/span>;<\/span> sudo<\/span> -l;<\/span> firewall-cmd –list-all 2<\/span>><\/span>\/dev\/null ||<\/span> nft list ruleset |<\/span> head<\/span><\/p>\n

\u8c03\u7528\u94fe<\/h3>\n

SSH \u8ba4\u8bc1<\/h4>\n

\u6e32\u67d3\u9519\u8bef: Mermaid \u6e32\u67d3\u5931\u8d25: Parse error on line 4:
\n…d Accept S –> V{\u8ba4\u8bc1} V –>|Pubke
\n———————-^
\nExpecting 'SQE', 'DOUBLECIRCLEEND', 'PE', '-)', 'STADIUMEND', 'SUBROUTINEEND', 'PIPE', 'CYLINDEREND', 'DIAMOND_STOP', 'TAGEND', 'TRAPEND', 'INVTRAPEND', 'UNICODE_TEXT', 'TEXT', 'TAGSTART', got 'DIAMOND_START'<\/p>\n

\u9632\u706b\u5899 zone<\/h4>\n

#mermaid-svg-S4h5ITerxiym8u1E{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-S4h5ITerxiym8u1E .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-S4h5ITerxiym8u1E .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-S4h5ITerxiym8u1E .error-icon{fill:#552222;}#mermaid-svg-S4h5ITerxiym8u1E .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-S4h5ITerxiym8u1E .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-S4h5ITerxiym8u1E .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-S4h5ITerxiym8u1E .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-S4h5ITerxiym8u1E .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-S4h5ITerxiym8u1E .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-S4h5ITerxiym8u1E .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-S4h5ITerxiym8u1E .marker{fill:#333333;stroke:#333333;}#mermaid-svg-S4h5ITerxiym8u1E .marker.cross{stroke:#333333;}#mermaid-svg-S4h5ITerxiym8u1E svg{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-S4h5ITerxiym8u1E p{margin:0;}#mermaid-svg-S4h5ITerxiym8u1E .label{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-S4h5ITerxiym8u1E .cluster-label text{fill:#333;}#mermaid-svg-S4h5ITerxiym8u1E .cluster-label span{color:#333;}#mermaid-svg-S4h5ITerxiym8u1E .cluster-label span p{background-color:transparent;}#mermaid-svg-S4h5ITerxiym8u1E .label text,#mermaid-svg-S4h5ITerxiym8u1E span{fill:#333;color:#333;}#mermaid-svg-S4h5ITerxiym8u1E .node rect,#mermaid-svg-S4h5ITerxiym8u1E .node circle,#mermaid-svg-S4h5ITerxiym8u1E .node ellipse,#mermaid-svg-S4h5ITerxiym8u1E .node polygon,#mermaid-svg-S4h5ITerxiym8u1E .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-S4h5ITerxiym8u1E .rough-node .label text,#mermaid-svg-S4h5ITerxiym8u1E .node .label text,#mermaid-svg-S4h5ITerxiym8u1E .image-shape .label,#mermaid-svg-S4h5ITerxiym8u1E .icon-shape .label{text-anchor:middle;}#mermaid-svg-S4h5ITerxiym8u1E .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-S4h5ITerxiym8u1E .rough-node .label,#mermaid-svg-S4h5ITerxiym8u1E .node .label,#mermaid-svg-S4h5ITerxiym8u1E .image-shape .label,#mermaid-svg-S4h5ITerxiym8u1E .icon-shape .label{text-align:center;}#mermaid-svg-S4h5ITerxiym8u1E .node.clickable{cursor:pointer;}#mermaid-svg-S4h5ITerxiym8u1E .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-S4h5ITerxiym8u1E .arrowheadPath{fill:#333333;}#mermaid-svg-S4h5ITerxiym8u1E .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-S4h5ITerxiym8u1E .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-S4h5ITerxiym8u1E .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-S4h5ITerxiym8u1E .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-S4h5ITerxiym8u1E .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-S4h5ITerxiym8u1E .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-S4h5ITerxiym8u1E .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-S4h5ITerxiym8u1E .cluster text{fill:#333;}#mermaid-svg-S4h5ITerxiym8u1E .cluster span{color:#333;}#mermaid-svg-S4h5ITerxiym8u1E div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-S4h5ITerxiym8u1E .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-S4h5ITerxiym8u1E rect.text{fill:none;stroke-width:0;}#mermaid-svg-S4h5ITerxiym8u1E .icon-shape,#mermaid-svg-S4h5ITerxiym8u1E .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-S4h5ITerxiym8u1E .icon-shape p,#mermaid-svg-S4h5ITerxiym8u1E .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-S4h5ITerxiym8u1E .icon-shape rect,#mermaid-svg-S4h5ITerxiym8u1E .image-shape rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-S4h5ITerxiym8u1E .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-S4h5ITerxiym8u1E .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-S4h5ITerxiym8u1E :root{–mermaid-font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;}<\/span><\/span><\/span><\/span><\/span><\/p>\n

\u5305<\/p>\n

<\/span><\/p>\n

nftables\/iptables<\/p>\n

<\/span><\/p>\n

firewalld zone<\/p>\n

<\/span><\/p>\n

service\/port\/rich rule<\/p>\n

<\/span><\/p>\n

ACCEPT\/DROP<\/p>\n

<\/span><\/p>\n

Docker DNAT<\/p>\n

<\/span><\/p>\n

auditd \u4e8b\u4ef6<\/h4>\n

auditdkernel auditsyscallauditdkernel auditsyscall#mermaid-svg-56VZtVifGJU1OfV1{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-56VZtVifGJU1OfV1 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-56VZtVifGJU1OfV1 .error-icon{fill:#552222;}#mermaid-svg-56VZtVifGJU1OfV1 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-56VZtVifGJU1OfV1 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-56VZtVifGJU1OfV1 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-56VZtVifGJU1OfV1 .marker.cross{stroke:#333333;}#mermaid-svg-56VZtVifGJU1OfV1 svg{font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-56VZtVifGJU1OfV1 p{margin:0;}#mermaid-svg-56VZtVifGJU1OfV1 .actor{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-56VZtVifGJU1OfV1 text.actor>tspan{fill:black;stroke:none;}#mermaid-svg-56VZtVifGJU1OfV1 .actor-line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-56VZtVifGJU1OfV1 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#mermaid-svg-56VZtVifGJU1OfV1 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#mermaid-svg-56VZtVifGJU1OfV1 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#mermaid-svg-56VZtVifGJU1OfV1 #arrowhead path{fill:#333;stroke:#333;}#mermaid-svg-56VZtVifGJU1OfV1 .sequenceNumber{fill:white;}#mermaid-svg-56VZtVifGJU1OfV1 #sequencenumber{fill:#333;}#mermaid-svg-56VZtVifGJU1OfV1 #crosshead path{fill:#333;stroke:#333;}#mermaid-svg-56VZtVifGJU1OfV1 .messageText{fill:#333;stroke:none;}#mermaid-svg-56VZtVifGJU1OfV1 .labelBox{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-56VZtVifGJU1OfV1 .labelText,#mermaid-svg-56VZtVifGJU1OfV1 .labelText>tspan{fill:black;stroke:none;}#mermaid-svg-56VZtVifGJU1OfV1 .loopText,#mermaid-svg-56VZtVifGJU1OfV1 .loopText>tspan{fill:black;stroke:none;}#mermaid-svg-56VZtVifGJU1OfV1 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);}#mermaid-svg-56VZtVifGJU1OfV1 .note{stroke:#aaaa33;fill:#fff5ad;}#mermaid-svg-56VZtVifGJU1OfV1 .noteText,#mermaid-svg-56VZtVifGJU1OfV1 .noteText>tspan{fill:black;stroke:none;}#mermaid-svg-56VZtVifGJU1OfV1 .activation0{fill:#f4f4f4;stroke:#666;}#mermaid-svg-56VZtVifGJU1OfV1 .activation1{fill:#f4f4f4;stroke:#666;}#mermaid-svg-56VZtVifGJU1OfV1 .activation2{fill:#f4f4f4;stroke:#666;}#mermaid-svg-56VZtVifGJU1OfV1 .actorPopupMenu{position:absolute;}#mermaid-svg-56VZtVifGJU1OfV1 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 \/ 0.4));}#mermaid-svg-56VZtVifGJU1OfV1 .actor-man line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;}#mermaid-svg-56VZtVifGJU1OfV1 .actor-man circle,#mermaid-svg-56VZtVifGJU1OfV1 line{stroke:hsl(259.6261682243, 59.7765363128%, 87.9019607843%);fill:#ECECFF;stroke-width:2px;}#mermaid-svg-56VZtVifGJU1OfV1 :root{–mermaid-font-family:\\”trebuchet ms\\”,verdana,arial,sans-serif;}\u5339\u914d rules.dnetlink\/var\/log\/audit\/audit.log<\/p>\n

\u91cd\u70b9\u77e5\u8bc6<\/h3>\n

\u6700\u5c0f\u6743\u9650\u539f\u5219<\/h4>\n

\u8d26\u6237：\u7981\u7528\u65e0\u7528\u8d26\u53f7；\u670d\u52a1\u7528\u4e13\u7528\u7cfb\u7edf\u7528\u6237；\u7981\u6b62\u5171\u4eab\u79c1\u94a5\u3002<\/p>\n

\u6587\u4ef6：\/etc\/shadow 600；SSH \u79c1\u94a5 600；\u76ee\u5f55 750\u3002\u5b9a\u671f\u5ba1\u8ba1 SUID\/SGID\u3002<\/p>\n

awk<\/span> -F: '($3==0){print}'<\/span> \/etc\/passwd
\nfind<\/span> \/ -perm<\/span> -4000<\/span> -type<\/span> f 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\nfind<\/span> \/home -name<\/span> id_rsa -exec<\/span> ls<\/span> -l<\/span> {<\/span>}<\/span> \\\\<\/span>;<\/span><\/p>\n

SSH \u52a0\u56fa<\/h4>\n

\u63a8\u8350：PermitRootLogin no\u3001PasswordAuthentication no\u3001PubkeyAuthentication yes\u3002<\/p>\n

\u9650\u5236\u7528\u6237：AllowUsers deploy \u6216 AllowGroups sshusers；MaxAuthTries 3\u3002<\/p>\n

# \/etc\/ssh\/sshd_config<\/span>
\nPermitRootLogin no
\nPasswordAuthentication no
\nPubkeyAuthentication yes<\/span>
\nMaxAuthTries 3<\/span>
\nAllowUsers deploy
\nsshd -t<\/span> &&<\/span> systemctl reload sshd
\nsshd -T<\/span> |<\/span> grep<\/span> -i<\/span> permitroot<\/p>\n

sudo \u914d\u7f6e<\/h4>\n

\u7528 visudo \u7f16\u8f91；NOPASSWD \u4ec5\u5fc5\u8981\u65f6\u4e14 \u547d\u4ee4\u767d\u540d\u5355，\u7981\u6b62 ALL\u3002<\/p>\n

Defaults logfile=\/var\/log\/sudo.log \u7559\u75d5；requiretty \u81ea\u52a8\u5316\u73af\u5883\u5e38\u9700\u5173\u95ed\u3002<\/p>\n

# \/etc\/sudoers.d\/deploy<\/span>
\ndeploy ALL<\/span>=<\/span>(<\/span>ALL)<\/span> NOPASSWD: \/bin\/systemctl reload nginx
\nsudo<\/span> -l<\/span> -U<\/span> deploy
\ngrep<\/span> sudo<\/span> \/var\/log\/auth.log |<\/span> tail<\/span><\/p>\n

firewalld \u4e0e nftables<\/h4>\n

firewalld：–permanent \u5199\u5165 XML，–reload \u751f\u6548\u3002\u9ed8\u8ba4 zone \u7ed1\u5b9a\u63a5\u53e3\u3002<\/p>\n

Docker \u53ef\u80fd\u63d2\u5165 DOCKER \u94fe\u7ed5\u8fc7 firewalld \u76f4\u89c9；\u9700 firewall-cmd –permanent –zone=trusted –change-interface=docker0 \u7b49\u7b56\u7565\u3002<\/p>\n

firewall-cmd –get-active-zones
\nfirewall-cmd –list-all –zone<\/span>=<\/span>public
\nfirewall-cmd –permanent<\/span> –remove-service=<\/span>cockpit
\nfirewall-cmd –reload<\/span>
\nnft list ruleset<\/p>\n

fail2ban<\/h4>\n

\u8bfb auth \u65e5\u5fd7\u5339\u914d\u5931\u8d25\u6b21\u6570，\u8c03\u7528 firewall ban IP\u3002<\/p>\n

jail.local \u8986\u76d6\u9ed8\u8ba4；filter \u5728 \/etc\/fail2ban\/filter.d\/\u3002<\/p>\n

# \/etc\/fail2ban\/jail.local<\/span>
\n[<\/span>sshd]<\/span>
\nenabled<\/span>=<\/span>true
\nmaxretry<\/span>=<\/span>5<\/span>
\nbantime<\/span>=<\/span>3600<\/span>
\nfail2ban-client status sshd<\/p>\n

SELinux<\/h4>\n

\u6a21\u5f0f Enforcing\/Permissive\/Disabled\u3002\u5bb9\u5668\/\u81ea\u5b9a\u4e49\u7aef\u53e3\u9700 semanage port；\u6587\u4ef6\u4e0a\u4e0b\u6587 semanage fcontext + restorecon\u3002<\/p>\n

AVC \u62d2\u7edd：ausearch -m avc -ts recent；audit2allow \u751f\u6210\u7b56\u7565（\u9700\u4eba\u5de5\u5ba1）\u3002<\/p>\n

getenforce
\nsemanage port -l<\/span> |<\/span> grep<\/span> http
\nsemanage fcontext -a<\/span> -t<\/span> httpd_sys_content_t '\/web(\/.*)?'<\/span>
\nrestorecon -Rv<\/span> \/web
\nausearch -m<\/span> avc -ts<\/span> recent<\/p>\n

AppArmor<\/h4>\n

Ubuntu \u5e38\u89c1\u3002profile \u5728 \/etc\/apparmor.d\/；complain \u6a21\u5f0f\u53ea\u8bb0\u4e0d\u62e6\u3002<\/p>\n

aa-status
\napparmor_parser -r<\/span> \/etc\/apparmor.d\/usr.sbin.nginx
\njournalctl |<\/span> grep<\/span> -i<\/span> apparmor |<\/span> tail<\/span><\/p>\n

auditd \u5ba1\u8ba1<\/h4>\n

\u89c4\u5219 \/etc\/audit\/rules.d\/；augenrules –load \u52a0\u8f7d\u3002\u8ddf\u8e2a\u6587\u4ef6 -w path -p wa -k key\u3002<\/p>\n

-w<\/span> \/etc\/passwd -p<\/span> wa -k<\/span> passwd_changes
\n-a<\/span> always,exit -F<\/span> arch<\/span>=<\/span>b64 -S<\/span> execve -k<\/span> exec<\/span>
\naugenrules –load<\/span>
\nausearch -k<\/span> passwd_changes
\naureport -x<\/span> –summary<\/span><\/p>\n

\u5185\u6838 sysctl \u5b89\u5168<\/h4>\n

\u9632 spoof\u3001icmp redirect\u3001syn flood \u7b49；ASLR randomize_va_space=2\u3002<\/p>\n

# \/etc\/sysctl.d\/99-hardening.conf<\/span>
\nnet.ipv4.conf.all.rp_filter<\/span>=<\/span>1<\/span>
\nnet.ipv4.conf.all.accept_redirects<\/span>=<\/span>0<\/span>
\nkernel.randomize_va_space<\/span>=<\/span>2<\/span>
\nkernel.kptr_restrict<\/span>=<\/span>2<\/span>
\nfs.protected_symlinks<\/span>=<\/span>1<\/span>
\nsysctl<\/span> –system<\/span><\/p>\n

\u66f4\u65b0\u4e0e\u6f0f\u6d1e\u54cd\u5e94<\/h4>\n

\u8ba2\u9605 CVE；unattended-upgrades \u6216\u955c\u50cf\u4ed3；\u5185\u6838\/glibc\/OpenSSL \u4f18\u5148\u3002<\/p>\n

apt<\/span> list –upgradable<\/span> 2<\/span>><\/span>\/dev\/null ||<\/span> yum check-update
\nneeds-restarting -r<\/span> 2<\/span>><\/span>\/dev\/null
\nreboot<\/span> # \u5185\u6838\u66f4\u65b0\u540e<\/span><\/p>\n

\u5e38\u89c1\u8bef\u914d<\/h4>\n

PermitRootLogin yes\u3001chmod 777\u3001sudo NOPASSWD:ALL\u3001firewalld \u505c\u3001SELinux Disabled\u3001auditd \u672a\u542f\u2014\u2014\u4e94\u6761\u6700\u5e38\u89c1\u751f\u4ea7\u4e8b\u6545\u6e90\u3002<\/p>\n\n\u9879\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n
\u8bef\u914d<\/td>\n\u540e\u679c<\/td>\n<\/tr>\n
root SSH<\/td>\n\u7206\u7834\u9762<\/td>\n<\/tr>\n
777 \u76ee\u5f55<\/td>\n\u4efb\u610f\u5199<\/td>\n<\/tr>\n
NOPASSWD ALL<\/td>\n\u7b49\u4ef7 root<\/td>\n<\/tr>\n
firewalld \u505c<\/td>\n\u5168\u7aef\u53e3\u66b4\u9732<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u52a0\u56fa\u5b9e\u8df5\u6df1\u5316<\/h4>\n

\u5b9e\u8df5 1：SSH \u5bc6\u94a5\u6743\u9650<\/h5>\n

\u8fc7\u5bbd sshd \u62d2\u7edd<\/p>\n

chmod<\/span> 700<\/span> ~\/.ssh;<\/span> chmod<\/span> 600<\/span> ~\/.ssh\/authorized_keys<\/p>\n

\u5b9e\u8df5 2：ssh-audit<\/h5>\n

\u7b97\u6cd5\u5f3a\u5ea6\u5ba1\u8ba1<\/p>\n

ssh-audit localhost 2<\/span>><\/span>\/dev\/null ||<\/span> true<\/span><\/p>\n

\u5b9e\u8df5 3：PAM faillock<\/h5>\n

\u8d26\u6237\u9501\u5b9a<\/p>\n

faillock –user<\/span> badguy 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5b9e\u8df5 4：sftp chroot<\/h5>\n

\u9694\u79bb\u4e0a\u4f20<\/p>\n

# Match Group sftp \/ ChrootDirectory \/srv\/sftp<\/span><\/p>\n

\u5b9e\u8df5 5：hosts.allow<\/h5>\n

TCP Wrappers<\/p>\n

grep<\/span> sshd \/etc\/hosts.allow 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5b9e\u8df5 6：AIDE<\/h5>\n

\u5b8c\u6574\u6027<\/p>\n

aide –check<\/span> 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5b9e\u8df5 7：lynis<\/h5>\n

\u57fa\u7ebf\u626b\u63cf<\/p>\n

lynis audit system 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -5<\/span><\/p>\n

\u5b9e\u8df5 8：TLS \u63a2\u6d4b<\/h5>\n

cipher \u7248\u672c<\/p>\n

openssl s_client -connect<\/span> host:443 -brief<\/span> <<\/span>\/dev\/null<\/p>\n

\u5b9e\u8df5 9：iptables legacy<\/h5>\n

\u4e0e nft \u5e76\u5b58<\/p>\n

iptables -L<\/span> -n<\/span> -v<\/span> |<\/span> head<\/span><\/p>\n

\u5b9e\u8df5 10：podman rootless<\/h5>\n

\u65e0 root \u8fb9\u754c<\/p>\n

podman<\/span> unshare cat<\/span> \/proc\/self\/cgroup |<\/span> head<\/span><\/p>\n

\u5b9e\u8df5 11：SSH ForceCommand<\/h5>\n

\u9650\u5236 shell<\/p>\n

# ForceCommand \/usr\/bin\/ls<\/span><\/p>\n

\u5b9e\u8df5 12：SSH Match User<\/h5>\n

\u6309\u7528\u6237\u7b56\u7565<\/p>\n

# Match User alice \/ AllowTcpForwarding no<\/span><\/p>\n

\u5b9e\u8df5 13：firewalld rich<\/h5>\n

\u6e90 IP \u767d\u540d\u5355<\/p>\n

firewall-cmd –add-rich-rule=<\/span>'rule family=ipv4 source address=10.0.0.0\/8 accept'<\/span><\/p>\n

\u5b9e\u8df5 14：nft drop all<\/h5>\n

\u9ed8\u8ba4\u62d2\u7edd<\/p>\n

nft add<\/span> rule inet filter input drop<\/p>\n

\u5b9e\u8df5 15：fail2ban unban<\/h5>\n

\u89e3\u5c01<\/p>\n

fail2ban-client set<\/span> sshd unbanip 1.2<\/span>.3.4<\/p>\n

\u5b9e\u8df5 16：audit execve<\/h5>\n

\u8c01 exec \u4e86\u4ec0\u4e48<\/p>\n

ausearch -m<\/span> EXECVE -ts<\/span> today<\/p>\n

\u5b9e\u8df5 17：audit login<\/h5>\n

\u767b\u5f55\u4e8b\u4ef6<\/p>\n

ausearch -m<\/span> USER_LOGIN -ts<\/span> today<\/p>\n

\u5b9e\u8df5 18：chattr +i<\/h5>\n

\u9632\u7be1\u6539\u6807\u5fd7<\/p>\n

lsattr \/etc\/passwd<\/p>\n

\u5b9e\u8df5 19：passwd -l<\/h5>\n

\u9501\u5b9a\u8d26\u6237<\/p>\n

passwd<\/span> -l<\/span> olduser<\/p>\n

\u5b9e\u8df5 20：userdel<\/h5>\n

\u5220\u6237\u53ca\u5bb6\u76ee\u5f55<\/p>\n

userdel<\/span> -r<\/span> serviceacct<\/p>\n

\u5b9e\u8df5 21：groupmod<\/h5>\n

sudo \u7ec4\u6210\u5458<\/p>\n

getent group sudo<\/span><\/p>\n

\u5b9e\u8df5 22：umask<\/h5>\n

\u9ed8\u8ba4\u521b\u5efa\u6743\u9650<\/p>\n

umask<\/span> 027<\/p>\n

\u5b9e\u8df5 23：pam_tally2<\/h5>\n

PAM \u6a21\u5757<\/p>\n

# \u65e7\u7cfb\u7edf\u5931\u8d25\u8ba1\u6570<\/span><\/p>\n

\u5b9e\u8df5 24：sshd AllowAgentForwarding<\/h5>\n

\u4ee3\u7406\u8f6c\u53d1<\/p>\n

sshd -T<\/span> |<\/span> grep<\/span> allowagentforwarding<\/p>\n

\u5b9e\u8df5 25：sshd X11Forwarding<\/h5>\n

X11 \u8f6c\u53d1<\/p>\n

sshd -T<\/span> |<\/span> grep<\/span> x11forwarding<\/p>\n

\u5b9e\u8df5 26：setroubleshoot<\/h5>\n

SELinux \u5efa\u8bae<\/p>\n

sealert -a<\/span> \/var\/log\/audit\/audit.log 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5b9e\u8df5 27：sepolicy generate<\/h5>\n

\u751f\u6210 SELinux \u6a21\u5757\u8349\u7a3f<\/p>\n

sepolicy generate –init<\/span> nginx<\/p>\n

\u5b9e\u8df5 28：apparmor complain<\/h5>\n

\u8c03\u8bd5 profile<\/p>\n

aa-complain \/usr\/sbin\/nginx<\/p>\n

\u5b9e\u8df5 29：apparmor enforce<\/h5>\n

\u5f3a\u5236\u6a21\u5f0f<\/p>\n

aa-enforce \/usr\/sbin\/nginx<\/p>\n

\u5b9e\u8df5 30：auditd space<\/h5>\n

\u65e5\u5fd7\u8f6e\u8f6c<\/p>\n

grep<\/span> max_log_file \/etc\/audit\/auditd.conf<\/p>\n

CIS \u5206\u9879\u68c0\u67e5<\/h3>\n

CIS 5.2 SSH \u670d\u52a1\u7aef<\/h4>\n

\u72ec\u7acb\u9879：\u7981\u6b62\u7a7a\u53e3\u4ee4\u3001\u9650\u5236 root\u3001\u5f3a MAC\u3002<\/p>\n

sshd -T<\/span> |<\/span> awk<\/span> '\/permitrootlogin|permitemptypasswords|maxauthtries|logingracetime\/ {print}'<\/span>
\nawk<\/span> '\/^PermitRootLogin|^PasswordAuthentication|^MaxAuthTries|^LoginGraceTime\/ {print NR":"$0}'<\/span> \/etc\/ssh\/sshd_config
\nstat<\/span> -c<\/span> '%a %U %G'<\/span> \/etc\/ssh\/sshd_config
\nfind<\/span> \/etc\/ssh -name<\/span> 'ssh_host_*_key'<\/span> -exec<\/span> stat<\/span> -c<\/span> '%a %n'<\/span> {<\/span>}<\/span> \\\\<\/span>;<\/span><\/p>\n

\u671f\u671b：PermitRootLogin no；host key 600 root:root\u3002<\/p>\n

CIS 5.3 sudo \u7b56\u7565<\/h4>\n

visudo -c<\/span>
\ngrep<\/span> -rE<\/span> 'NOPASSWD|ALL=\\\\(ALL\\\\)|!authenticate'<\/span> \/etc\/sudoers \/etc\/sudoers.d\/ 2<\/span>><\/span>\/dev\/null
\nawk<\/span> -F: '$3==0 {print}'<\/span> \/etc\/passwd
\ngetent group sudo<\/span> wheel
\nlastlog |<\/span> awk<\/span> '$3!="**Never logged in**" {print}'<\/span> |<\/span> head<\/span><\/p>\n

CIS 3.5 \u9632\u706b\u5899\u4e0e nftables<\/h4>\n

systemctl is-enabled firewalld nftables 2<\/span>><\/span>\/dev\/null
\nfirewall-cmd –get-default-zone 2<\/span>><\/span>\/dev\/null
\nfirewall-cmd –list-all-zones 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -40<\/span>
\nnft list ruleset |<\/span> head<\/span> -60<\/span>
\nss -lntup<\/span> |<\/span> awk<\/span> 'NR==1 || \/0.0.0.0:|\\\\[::\\\\]:\/'<\/span><\/p>\n

CIS 1.6 SELinux \u72b6\u6001<\/h4>\n

getenforce
\ngrep<\/span> ^SELINUX=<\/span> \/etc\/selinux\/config
\nsestatus
\nsemanage boolean -l<\/span> |<\/span> grep<\/span> -i<\/span> httpd |<\/span> head<\/span>
\nausearch -m<\/span> avc -ts<\/span> recent 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -5<\/span><\/p>\n

CIS 4.1 \u5ba1\u8ba1 daemon<\/h4>\n

systemctl is-active auditd
\nauditctl -l<\/span>
\ngrep<\/span> -E<\/span> '^(max_log_file|space_left_action|admin_space_left_action)'<\/span> \/etc\/audit\/auditd.conf
\naureport -s<\/span> |<\/span> head<\/span> -20<\/span>
\nls<\/span> -la<\/span> \/etc\/audit\/rules.d\/<\/p>\n

CIS 3.3 \u5185\u6838\u7f51\u7edc sysctl<\/h4>\n

sysctl<\/span> net.ipv4.ip_forward net.ipv4.conf.all.rp_filter net.ipv4.conf.all.accept_redirects
\nsysctl<\/span> net.ipv4.tcp_syncookies kernel.randomize_va_space kernel.kptr_restrict
\ngrep<\/span> -r<\/span> .<\/span> \/etc\/sysctl.d\/*.conf 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> -v<\/span> '^#'<\/span>
\nsysctl<\/span> –system<\/span> 2<\/span>><\/span>&1<\/span> |<\/span> tail<\/span> -5<\/span><\/p>\n

CIS 1.8 \u8865\u4e01\u4e0e\u8f6f\u4ef6\u6e90<\/h4>\n

apt<\/span> list –upgradable<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -20<\/span>
\ndnf updateinfo list security 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\nrpm<\/span> -q<\/span> –changelog<\/span> kernel |<\/span> head<\/span> -5<\/span>
\nunattended-upgrades -d<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -10<\/span>
\ngrep<\/span> -r<\/span> ^deb \/etc\/apt\/sources.list \/etc\/apt\/sources.list.d\/ 2<\/span>><\/span>\/dev\/null<\/p>\n

\u6f0f\u6d1e\u626b\u63cf\u4e0e SBOM<\/h4>\n

# Trivy \u4e3b\u673a+\u955c\u50cf<\/span>
\ntrivy rootfs \/
\ntrivy image –severity<\/span> HIGH,CRITICAL nginx:1.25
\n# Grype<\/span>
\nsyft dir:\/ -o<\/span> json ><\/span> sbom.json
\ngrype sbom:sbom.json<\/p>\n

# OpenSCAP<\/span>
\noscap xccdf eval<\/span> –profile<\/span> xccdf_org.ssgproject.content_profile_cis \/usr\/share\/xml\/scap\/ssg\/content\/ssg-*.xml 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -20<\/span><\/p>\n

TLS \u8bc1\u4e66\u4e0e cipher \u5ba1\u8ba1<\/h4>\n

openssl s_client -connect<\/span> example.com:443 -servername<\/span> example.com <<\/span>\/dev\/null 2<\/span>><\/span>\/dev\/null |<\/span> openssl x509 -noout<\/span> -dates<\/span> -subject<\/span> -issuer<\/span>
\ntestssl.sh –quiet<\/span> https:\/\/example.com 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> -E<\/span> 'NOT ok|OK'<\/span>
\ncertbot certificates 2<\/span>><\/span>\/dev\/null
\ngrep<\/span> -r<\/span> SSLProtocol \/etc\/httpd \/etc\/nginx 2<\/span>><\/span>\/dev\/null<\/p>\n

# \u672c\u5730 PEM \u8fc7\u671f\u626b\u63cf<\/span>
\nfind<\/span> \/etc\/ssl \/etc\/pki -name<\/span> '*.pem'<\/span> -exec<\/span> openssl x509 -in<\/span> {<\/span>}<\/span> -noout<\/span> -enddate<\/span> \\\\<\/span>;<\/span> 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5bb9\u5668\u5bbf\u4e3b\u673a\u52a0\u56fa<\/h4>\n

docker<\/span> info –format<\/span> '{{.SecurityOptions}}'<\/span>
\ngrep<\/span> -E<\/span> 'user.max_user_namespaces|kernel.unprivileged_userns_clone'<\/span> \/proc\/sys\/*\/* 2<\/span>><\/span>\/dev\/null
\nsystemctl show docker<\/span> -p<\/span> ExecStart |<\/span> tr<\/span> ' '<\/span> '\\\\n'<\/span> |<\/span> grep<\/span> userns
\nauditctl -w<\/span> \/usr\/bin\/docker -p<\/span> wa -k<\/span> docker_bin<\/p>\n\n\u9879\u5efa\u8bae\u547d\u4ee4<\/tr>\n\n\n\n\n
\u5957\u63a5\u5b57<\/td>\nroot \u624d\u80fd\u8fde<\/td>\nls -l \/var\/run\/docker.sock<\/td>\n<\/tr>\n
\u7528\u6237\u547d\u540d\u7a7a\u95f4<\/td>\n\u6309\u9700\u5173\u95ed<\/td>\nsysctl kernel.unprivileged_userns_clone<\/td>\n<\/tr>\n
\u955c\u50cf\u7b7e\u540d<\/td>\ncosign verify<\/td>\ncosign verify –key cosign.pub img<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

podman<\/span> info –format<\/span> '{{.Host.Security}}'<\/span>
\ngrep<\/span> NOFILE \/etc\/systemd\/system\/docker.service.d\/*.conf 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5e94\u6025\u54cd\u5e94\u53d6\u8bc1<\/h4>\n

# \u9694\u79bb\u4f46\u4fdd\u7559\u5185\u5b58（\u82e5\u53ef\u884c）<\/span>
\nip<\/span> link<\/span> set<\/span> eth0 down
\nsystemctl stop sshd
\n# \u5feb\u7167<\/span>
\ntar<\/span> czf \/media\/usb\/evidence-$(<\/span>hostname<\/span>)<\/span><\/span>–$(<\/span>date<\/span> +%F)<\/span><\/span>.tgz \/var\/log\/auth.log \/var\/log\/audit\/audit.log \/root\/.ssh 2<\/span>><\/span>\/dev\/null<\/p>\n

last -20<\/span>
\nlastb -20<\/span> 2<\/span>><\/span>\/dev\/null
\nausearch -m<\/span> USER_LOGIN -sv<\/span> no –interpret<\/span> |<\/span> tail<\/span> -20<\/span>
\nss -antp<\/span> |<\/span> awk<\/span> '$1=="ESTAB"'<\/span>
\nlsof<\/span> -i<\/span> -P<\/span> -n<\/span> |<\/span> head<\/span> -30<\/span><\/p>\n

# \u54c8\u5e0c\u53ef\u7591\u4e8c\u8fdb\u5236<\/span>
\nsha256sum \/usr\/bin\/.hidden 2<\/span>><\/span>\/dev\/null
\nrpm<\/span> -Vf<\/span> \/usr\/bin\/ss 2<\/span>><\/span>\/dev\/null
\ndebsums -c<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span><\/p>\n

\u8bef\u914d\u6848\u4f8b\u4e0e\u4fee\u590d<\/h4>\n\n\u8bef\u914d\u68c0\u6d4b\u4fee\u590d<\/tr>\n\n\n\n\n\n\n\n
\/etc\/ssh\/sshd_config \u672b\u5c3e PermitRootLogin yes \u8986\u76d6\u524d\u9762 no<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\n`sshd -T<\/td>\n<\/tr>\n
firewalld public \u533a –add-service=ssh \u4f46\u672a –permanent<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\n\u91cd\u542f\u4e22\u89c4\u5219；firewall-cmd –runtime-to-permanent\u3002<\/td>\n<\/tr>\n
audit \u89c4\u5219 -e 2 \u672a\u751f\u6548<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\nauditctl -s \u770b enabled；fix \/etc\/audit\/rules.d\/ \u540e augenrules –load\u3002<\/td>\n<\/tr>\n
net.ipv4.ip_forward=1 \u5fd8\u8bb0\u5173<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\n\u975e\u7f51\u5173\u4e3b\u673a：sysctl -w net.ipv4.ip_forward=0 \u5199\u5165 sysctl.d\u3002<\/td>\n<\/tr>\n
Docker 0.0.0.0:2375 \u65e0 TLS<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\n`ss -lntp<\/td>\n<\/tr>\n
sudoers %wheel ALL=(ALL) NOPASSWD: ALL<\/td>\n\u89c1\u4e0a\u8282\u547d\u4ee4<\/td>\ngrep NOPASSWD \/etc\/sudoers.d\/*；\u6539\u56de\u9700\u5bc6\u7801\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

# \u4e00\u952e\u5bfc\u51fa\u52a0\u56fa\u5feb\u7167（\u4e0d\u542b\u5bc6\u94a5）<\/span>
\n{<\/span>
\n echo<\/span> '== sshd -T =='<\/span>;<\/span> sshd -T<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -30<\/span>
\n echo<\/span> '== sudoers =='<\/span>;<\/span> visudo -c<\/span>
\n echo<\/span> '== firewall =='<\/span>;<\/span> nft list ruleset 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -20<\/span>
\n echo<\/span> '== selinux =='<\/span>;<\/span> getenforce
\n echo<\/span> '== audit =='<\/span>;<\/span> auditctl -s<\/span>
\n}<\/span> ><\/span> \/tmp\/hardening-snapshot.txt<\/p>\n

\u52a0\u56fa\u6f14\u7ec3 1：SSH \u5bc6\u94a5\u8f6e\u6362<\/h5>\n

find<\/span> \/etc\/ssh -name<\/span> 'ssh_host_*_key.pub'<\/span> -exec<\/span> ssh-keygen -lf<\/span> {<\/span>}<\/span> \\\\<\/span>;<\/span>
\nssh-keygen -t<\/span> ed25519 -f<\/span> \/etc\/ssh\/ssh_host_ed25519_key -N<\/span> ''<\/span><\/p>\n

\u52a0\u56fa\u6f14\u7ec3 2：PAM faillock<\/h5>\n

grep<\/span> pam_faillock \/etc\/pam.d\/system-auth \/etc\/pam.d\/password-auth 2<\/span>><\/span>\/dev\/null
\nfaillock –user<\/span> baduser<\/p>\n

\u52a0\u56fa\u6f14\u7ec3 3：chroot sftp<\/h5>\n

grep<\/span> -i<\/span> chroot<\/span> \/etc\/ssh\/sshd_config
\nMatch Group sftpusers
\nChrootDirectory \/srv\/sftp\/%u<\/p>\n

\u52a0\u56fa\u6f14\u7ec3 4：nft \u9650\u6d41<\/h5>\n

nft list chain inet filter input 2<\/span>><\/span>\/dev\/null
\nnft add<\/span> rule inet filter input tcp dport 22<\/span> ct state new limit rate 5<\/span>\/minute accept<\/p>\n

\u52a0\u56fa\u6f14\u7ec3 5：AIDE \u5b8c\u6574\u6027<\/h5>\n

aide –check<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -5<\/span>
\naideinit &&<\/span> mv<\/span> \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz<\/p>\n

CIS 5.4 \u8d26\u6237\u4e0e\u53e3\u4ee4\u7b56\u7565<\/h4>\n

login.defs \u63a7\u5236 PASS_MAX_DAYS\u3001UMASK\u3002<\/p>\n

grep<\/span> -E<\/span> 'PASS_MAX_DAYS|PASS_MIN_DAYS|UMASK|ENCRYPT_METHOD'<\/span> \/etc\/login.defs
\nchage -l<\/span> root
\nawk<\/span> -F: '($2=="" || $2=="!") {print}'<\/span> \/etc\/shadow # \u7a7a\u53e3\u4ee4<\/span>
\npam-auth-update –list<\/span> 2<\/span>><\/span>\/dev\/null<\/p>\n

CIS 2.2 \u4e0d\u5fc5\u8981\u670d\u52a1<\/h4>\n

systemctl list-unit-files –state<\/span>=<\/span>enabled –type<\/span>=<\/span>service |<\/span> grep<\/span> -Ei<\/span> 'telnet|rsh|ftp|tftp'<\/span>
\nss -lntup<\/span> |<\/span> grep<\/span> -E<\/span> ':23|:21|:513'<\/span>
\nchkconfig<\/span> –list<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> on
\nrpm<\/span> -q<\/span> telnet-server vsftpd 2<\/span>><\/span>\/dev\/null<\/p>\n

CIS 4.2 \u65e5\u5fd7\u6743\u9650<\/h4>\n

ls<\/span> -l<\/span> \/var\/log\/secure \/var\/log\/auth.log \/var\/log\/audit\/audit.log 2<\/span>><\/span>\/dev\/null
\ngrep<\/span> ^$ \/etc\/rsyslog.conf \/etc\/rsyslog.d\/*.conf 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\nsystemctl status rsyslog journald |<\/span> head<\/span> -6<\/span>
\njournalctl –verify<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -3<\/span><\/p>\n

CIS 3.7 \u7981\u7528\u65e0\u7ebf<\/h4>\n

nmcli radio wifi 2<\/span>><\/span>\/dev\/null
\nrfkill list
\nlsmod |<\/span> grep<\/span> -E<\/span> 'bluetooth|wifi'<\/span>
\nsystemctl is-enabled bluetooth 2<\/span>><\/span>\/dev\/null<\/p>\n

CIS 6.1 \u6587\u4ef6\u6743\u9650\u5ba1\u8ba1<\/h4>\n

find<\/span> \/etc -perm<\/span> \/077 -type<\/span> f 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -10<\/span>
\nfind<\/span> \/ -xdev<\/span> -nouser<\/span> -o<\/span> -nogroup<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\nrpm<\/span> -Va<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> '^..5'<\/span> |<\/span> head<\/span>
\ndebsums -c<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span><\/p>\n

Lynis \u4e0e OpenVAS \u91c7\u6837<\/h4>\n

lynis audit system –quick<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -30<\/span>
\ngrep<\/span> Suggestion \/var\/log\/lynis.log 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -10<\/span>
\ngvm-cli socket –xml<\/span> '<get_tasks\/>'<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span><\/p>\n

nginx\/apache TLS \u7247\u6bb5<\/h4>\n

nginx -T<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> -E<\/span> 'ssl_protocols|ssl_ciphers|ssl_prefer'<\/span>
\napachectl -S<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\ngrep<\/span> -r<\/span> SSLCertificate \/etc\/httpd \/etc\/apache2 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span>
\nopenssl ciphers -v<\/span> 'ECDHE+AESGCM'<\/span> |<\/span> head<\/span><\/p>\n

\u5bb9\u5668 runtime \u52a0\u56fa\u5bf9\u7167<\/h4>\n\n\u68c0\u67e5\u547d\u4ee4\u671f\u671b<\/tr>\n\n\n\n\n\n
seccomp<\/td>\ndocker inspect –format '{{.HostConfig.SecurityOpt}}' id<\/td>\n\u975e unconfined<\/td>\n<\/tr>\n
cap drop<\/td>\ndocker inspect –format '{{.HostConfig.CapDrop}}' id<\/td>\n\u53bb\u6389 ALL \u518d add<\/td>\n<\/tr>\n
read-only root<\/td>\n–read-only<\/td>\n\u771f<\/td>\n<\/tr>\n
AppArmor<\/td>\ndocker inspect .HostConfig.SecurityOpt<\/td>\ndocker-default<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

docker<\/span> run –rm<\/span> –read-only –cap-drop ALL alpine id<\/span>
\ncrictl inspect $(<\/span>crictl ps<\/span> -q<\/span> |<\/span> head<\/span> -1<\/span>)<\/span><\/span> 2<\/span>><\/span>\/dev\/null |<\/span> jq .info.runtimeSpec.linux.security<\/p>\n

\u5e94\u6025\u9694\u79bb playbook<\/h4>\n

# 1. \u65ad\u5916\u7f51\u4fdd\u5185\u7f51\u6392\u969c<\/span>
\niptables -I<\/span> OUTPUT 1<\/span> -d<\/span> 10.0<\/span>.0.0\/8 -j<\/span> ACCEPT
\niptables -A<\/span> OUTPUT -j<\/span> DROP
\n# 2. \u4fdd\u7559\u5ba1\u8ba1<\/span>
\nsystemctl restart auditd
\nauditctl -l<\/span> |<\/span> head<\/span>
\n# 3. \u5bfc\u51fa\u8fde\u63a5<\/span>
\nss -antp<\/span> ><\/span> \/root\/incident-ss.txt<\/p>\n

\u8bef\u914d\u6df1\u5ea6\u6848\u4f8b<\/h4>\n\n\u6848\u4f8b\u68c0\u6d4b\u4fee\u590d<\/tr>\n\n\n\n\n\n\n
\/etc\/pam.d\/sshd \u7f3a pam_faillock<\/td>\ngrep faillock \/etc\/pam.d\/sshd<\/td>\n\u590d\u5236 password-auth \u4e2d faillock \u6bb5<\/td>\n<\/tr>\n
journald \u672a\u6301\u4e45\u5316<\/td>\ngrep Storage \/etc\/systemd\/journald.conf<\/td>\nStorage=persistent \u540e restart journald<\/td>\n<\/tr>\n
IPv6 \u5168\u66b4\u9732<\/td>\n`ss -lntp6<\/td>\ngrep -v tcp6.*127`<\/td>\n<\/tr>\n
world-writable cron<\/td>\nfind \/etc\/cron* -perm -002<\/td>\nchmod o-w<\/td>\n<\/tr>\n
nginx \u4ee5 root \u8fd0\u884c<\/td>\n`ps -o user,cmd -C nginx<\/td>\nhead`<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

sshd -T<\/span> |<\/span> grep<\/span> -Ei<\/span> 'ciphers|macs|kexalgorithms'<\/span> |<\/span> tr<\/span> ','<\/span> '\\\\n'<\/span> |<\/span> head<\/span> -15<\/span>
\nupdate-crypto-policies –show<\/span> 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5408\u89c4\u5feb\u7167\u547d\u4ee4\u7ec4<\/h4>\n

\u5feb\u7167 1：\u8d26\u6237\u6307\u7eb9<\/h5>\n

getent passwd<\/span> |<\/span> awk<\/span> -F: '$3>=1000 && $3<65534 {print $1,$3,$7}'<\/span><\/p>\n

\u5feb\u7167 2：\u76d1\u542c\u7aef\u53e3<\/h5>\n

ss -lntup<\/span> |<\/span> awk<\/span> 'NR>1{print $5,$7}'<\/span> |<\/span> sort<\/span> -u<\/span><\/p>\n

\u5feb\u7167 3：SUID \u5217\u8868<\/h5>\n

find<\/span> \/usr \/bin -xdev<\/span> -perm<\/span> -4000<\/span> -type<\/span> f 2<\/span>><\/span>\/dev\/null |<\/span> head<\/span> -20<\/span><\/p>\n

\u5feb\u7167 4：\u8ba1\u5212\u4efb\u52a1<\/h5>\n

systemctl list-timers –all<\/span> |<\/span> head<\/span> -15<\/span><\/p>\n

\u5feb\u7167 5：\u5185\u6838\u6a21\u5757<\/h5>\n

lsmod |<\/span> awk<\/span> 'NR>1{print $1,$2}'<\/span> |<\/span> sort<\/span> -k2<\/span> -rn<\/span> |<\/span> head<\/span><\/p>\n

\u5feb\u7167 6：\u6302\u8f7d\u9009\u9879<\/h5>\n

findmnt -lo<\/span> TARGET,OPTIONS |<\/span> grep<\/span> -v<\/span> nodev<\/p>\n

\u5feb\u7167 7：PAM \u6808<\/h5>\n

grep<\/span> -v<\/span> '^#'<\/span> \/etc\/pam.d\/sshd |<\/span> head<\/span> -10<\/span><\/p>\n

\u5feb\u7167 8：DNS \u4fe1\u4efb<\/h5>\n

resolvectl domain 2<\/span>><\/span>\/dev\/null;<\/span> cat<\/span> \/etc\/resolv.conf<\/p>\n

\u5feb\u7167 9：\u65f6\u95f4\u540c\u6b65<\/h5>\n

timedatectl show |<\/span> grep<\/span> -E<\/span> 'NTPSynchronized|Timezone'<\/span><\/p>\n

\u5feb\u7167 10：\u5bb9\u5668\u5957\u63a5\u5b57<\/h5>\n

ls<\/span> -l<\/span> \/var\/run\/docker.sock \/run\/podman\/podman.sock 2<\/span>><\/span>\/dev\/null<\/p>\n

SSH \u5ba2\u6237\u7aef\u52a0\u56fa<\/h4>\n

ssh<\/span> -G<\/span> user@host 2<\/span>><\/span>\/dev\/null |<\/span> grep<\/span> -Ei<\/span> 'ciphers|macs|hostkeyalgorithms'<\/span>
\ngrep<\/span> -Ei<\/span> 'HashKnownHosts|StrictHostKeyChecking'<\/span> \/etc\/ssh\/ssh_config \/etc\/ssh\/ssh_config.d\/* 2<\/span>><\/span>\/dev\/null<\/p>\n

sudo \u65e5\u5fd7\u4e0e I\/O \u65e5\u5fd7<\/h4>\n

grep<\/span> -r<\/span> logfile \/etc\/sudoers \/etc\/sudoers.d\/ 2<\/span>><\/span>\/dev\/null
\ngrep<\/span> iolog_dir \/etc\/sudoers 2<\/span>><\/span>\/dev\/null
\ntail<\/span> \/var\/log\/sudo.log 2<\/span>><\/span>\/dev\/null<\/p>\n

firewalld rich rule \u6837\u4f8b<\/h4>\n

firewall-cmd –permanent<\/span> –add-rich-rule=<\/span>'rule family=ipv4 source address=10.0.0.0\/8 port port=22 protocol=tcp accept'<\/span>
\nfirewall-cmd –reload<\/span>
\nfirewall-cmd –list-rich-rules<\/p>\n

audit \u5173\u952e\u89c4\u5219\u6837\u4f8b<\/h4>\n

grep<\/span> -r<\/span> execve \/etc\/audit\/rules.d\/
\nauditctl -w<\/span> \/etc\/passwd -p<\/span> wa -k<\/span> passwd_changes
\nausearch -k<\/span> passwd_changes -ts<\/span> recent 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span><\/p>\n

sysctl \u786c\u5316\u7247\u6bb5\u6587\u4ef6<\/h4>\n

cat<\/span> ><\/span> \/etc\/sysctl.d\/99-hardening.conf <<<\/span>'EOF'
\nnet.ipv4.conf.all.send_redirects = 0
\nnet.ipv4.conf.all.accept_source_route = 0
\nfs.protected_hardlinks = 1
\nEOF<\/span>
\nsysctl<\/span> –system<\/span> |<\/span> tail<\/span> -5<\/span><\/p>\n

\u5de5\u5177\u94fe 1：ModSecurity \u91c7\u6837<\/h5>\n

nginx -V<\/span> 2<\/span>><\/span>&1<\/span> |<\/span> grep<\/span> -i<\/span> modsecurity
\ntail<\/span> \/var\/log\/modsec_audit.log 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5de5\u5177\u94fe 2：ClamAV \u66f4\u65b0<\/h5>\n

freshclam 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -3<\/span>
\nclamscan -r<\/span> \/tmp 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -3<\/span><\/p>\n

\u5de5\u5177\u94fe 3：RKHunter<\/h5>\n

rkhunter –check<\/span> –sk<\/span> 2<\/span>><\/span>\/dev\/null |<\/span> tail<\/span> -5<\/span>
\ngrep<\/span> Warning \/var\/log\/rkhunter.log 2<\/span>><\/span>\/dev\/null<\/p>\n

\u5de5\u5177\u94fe 4：USB \u5b58\u50a8\u7981<\/h5>\n

grep<\/span> usb-storage \/etc\/modprobe.d\/* 2<\/span>><\/span>\/dev\/null
\nlsmod |<\/span> grep<\/span> usb_storage<\/p>\n

\u5de5\u5177\u94fe 5：\u5bc6\u7801\u54c8\u5e0c<\/h5>\n

grep<\/span> ENCRYPT_METHOD \/etc\/login.defs
\nawk<\/span> -F: '{print $2}'<\/span> \/etc\/shadow |<\/span> head<\/span> |<\/span> cut<\/span> -c1-3<\/p>\n

\u6700\u5c0f\u66b4\u9732\u670d\u52a1\u57fa\u7ebf<\/h4>\n

systemctl list-units –type<\/span>=<\/span>service –state<\/span>=<\/span>running –no-pager |<\/span> wc<\/span> -l<\/span>
\nss -lntup<\/span> |<\/span> awk<\/span> 'NR>1{print $5}'<\/span> |<\/span> sort<\/span> -u<\/span><\/p>\n

\u57fa\u7ebf\u5ef6\u4f38 1：\u7a7a\u53e3\u4ee4\u8d26\u6237<\/h5>\n

awk<\/span> -F: '($2=="" || $2=="x") && $1!="root" {print $1}'<\/span> \/etc\/shadow<\/p>\n","protected":false},"excerpt":{"rendered":"

\u300c\u5bc6\u94a5\u6cc4\u9732\u4ecd\u88ab\u626b\u7aef\u53e3\u7206\u7834\u300d\u300csudo NOPASSWD \u5168\u6743\u9650\u300d\u300c\u9632\u706b\u5899\u5f00\u4e86\u4f46 Docker \u7ed5\u8fc7\u300d\u2014\u2014\u52a0\u56fa\u5931\u8d25\u591a\u5728 \u9ed8\u8ba4\u914d\u7f6e\u672a\u6539\u3001\u89c4\u5219\u987a\u5e8f\u9519\u8bef\u3001MAC \u672a Enforcing\u3002\u672c\u6587\u6309 OpenSSH\u3001firewalld\/nftables\u3001auditd \u771f\u5b9e\u8def\u5f84\u5c55\u5f00\u3002
\n\u6e90\u7801\u951a\u70b9\u8def\u5f84 \/ \u914d\u7f6e\u4f5c\u7528\/etc\/ssh\/sshd_configSSH \u670d\u52a1\u7aef\/etc\/ssh\/ssh_configSSH \u5ba2\u6237\u7aefman sshd_config\u6307\u4ee4\u8bf4\u660e\/etc\/sudoerssudo \u4e3b\u914d\u7f6e<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[58,77,61],"topic":[],"class_list":["post-105247","post","type-post","status-publish","format-standard","hentry","category-server","tag-linux","tag-ssh","tag-61"],"yoast_head":"\nLinux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/105247.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u300c\u5bc6\u94a5\u6cc4\u9732\u4ecd\u88ab\u626b\u7aef\u53e3\u7206\u7834\u300d\u300csudo NOPASSWD \u5168\u6743\u9650\u300d\u300c\u9632\u706b\u5899\u5f00\u4e86\u4f46 Docker \u7ed5\u8fc7\u300d\u2014\u2014\u52a0\u56fa\u5931\u8d25\u591a\u5728 \u9ed8\u8ba4\u914d\u7f6e\u672a\u6539\u3001\u89c4\u5219\u987a\u5e8f\u9519\u8bef\u3001MAC \u672a Enforcing\u3002\u672c\u6587\u6309 OpenSSH\u3001firewalld\/nftables\u3001auditd \u771f\u5b9e\u8def\u5f84\u5c55\u5f00\u3002 \u6e90\u7801\u951a\u70b9\u8def\u5f84 \/ \u914d\u7f6e\u4f5c\u7528\/etc\/ssh\/sshd_configSSH \u670d\u52a1\u7aef\/etc\/ssh\/ssh_configSSH \u5ba2\u6237\u7aefman sshd_config\u6307\u4ee4\u8bf4\u660e\/etc\/sudoerssudo \u4e3b\u914d\u7f6e\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/105247.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-14T23:00:22+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/105247.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/105247.html\",\"name\":\"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-14T23:00:22+00:00\",\"dateModified\":\"2026-09-14T23:00:22+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/105247.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/105247.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/105247.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/105247.html","og_locale":"zh_CN","og_type":"article","og_title":"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u300c\u5bc6\u94a5\u6cc4\u9732\u4ecd\u88ab\u626b\u7aef\u53e3\u7206\u7834\u300d\u300csudo NOPASSWD \u5168\u6743\u9650\u300d\u300c\u9632\u706b\u5899\u5f00\u4e86\u4f46 Docker \u7ed5\u8fc7\u300d\u2014\u2014\u52a0\u56fa\u5931\u8d25\u591a\u5728 \u9ed8\u8ba4\u914d\u7f6e\u672a\u6539\u3001\u89c4\u5219\u987a\u5e8f\u9519\u8bef\u3001MAC \u672a Enforcing\u3002\u672c\u6587\u6309 OpenSSH\u3001firewalld\/nftables\u3001auditd \u771f\u5b9e\u8def\u5f84\u5c55\u5f00\u3002 \u6e90\u7801\u951a\u70b9\u8def\u5f84 \/ \u914d\u7f6e\u4f5c\u7528\/etc\/ssh\/sshd_configSSH \u670d\u52a1\u7aef\/etc\/ssh\/ssh_configSSH \u5ba2\u6237\u7aefman sshd_config\u6307\u4ee4\u8bf4\u660e\/etc\/sudoerssudo \u4e3b\u914d\u7f6e","og_url":"https:\/\/www.wsisp.com\/helps\/105247.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-14T23:00:22+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"16 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/105247.html","url":"https:\/\/www.wsisp.com\/helps\/105247.html","name":"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-14T23:00:22+00:00","dateModified":"2026-09-14T23:00:22+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/105247.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/105247.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/105247.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Linux \u5b89\u5168\u52a0\u56fa\u5b8c\u6574\u7bc7\uff1a\u4ece SSH\u3001\u9632\u706b\u5899\u5230SELinux\/AppArmor \u4e0e\u5ba1\u8ba1"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/105247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=105247"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/105247\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=105247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=105247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=105247"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=105247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}