\u670d\u52a1\u5668\u88ab\u9ed1\u4e0d\u662f\u5c0f\u6982\u7387\u4e8b\u4ef6\u3002\u53ea\u8981\u670d\u52a1\u5668\u66b4\u9732\u5728\u516c\u7f51，\u6bcf\u65f6\u6bcf\u523b\u90fd\u5728\u88ab\u626b\u63cf\u3001\u88ab\u5c1d\u8bd5\u5f31\u53e3\u4ee4\u3001\u88ab\u63a2\u6d4b\u6f0f\u6d1e\u3002\u5b89\u5168\u52a0\u56fa\u4e0d\u662f"\u7528\u4e0d\u7528\u5fc3"\u7684\u95ee\u9898，\u800c\u662f"\u6709\u6ca1\u6709\u505a"\u7684\u95ee\u9898\u3002\u8fd9\u7bc7\u6587\u7ae0\u7ed9\u51fa\u4e00\u4efd\u5b8c\u6574\u7684 Linux \u670d\u52a1\u5668\u5b89\u5168\u52a0\u56fa\u6e05\u5355，\u6db5\u76d6\u8d26\u6237\u5b89\u5168\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u670d\u52a1\u5b89\u5168\u3001\u65e5\u5fd7\u5ba1\u8ba1\u3001\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u73af\u8282\u3002\u6bcf\u4e2a\u6761\u76ee\u90fd\u8bb2\u89e3\u4e3a\u4ec0\u4e48\u8981\u505a\u3001\u600e\u4e48\u505a\u3001\u4e0d\u505a\u7684\u98ce\u9669\u662f\u4ec0\u4e48，\u8ba9\u521d\u4e2d\u7ea7\u8fd0\u7ef4\u5de5\u7a0b\u5e08\u80fd\u7167\u7740\u64cd\u4f5c\u3001\u843d\u5730\u6267\u884c\u3002<\/p>\n
\u5b89\u5168\u52a0\u56fa\u5e94\u8be5\u5728\u670d\u52a1\u5668\u4e0a\u7ebf\u524d\u5c31\u5b8c\u6210，\u800c\u4e0d\u662f\u7b49\u5230\u88ab\u9ed1\u4e4b\u540e\u3002\u4ee5\u4e0b\u51e0\u4e2a\u8282\u70b9\u5fc5\u987b\u505a\u5b89\u5168\u52a0\u56fa：<\/p>\n
\u65b0\u670d\u52a1\u5668\u4ea4\u4ed8\u540e\u3001\u4e0a\u7ebf\u524d：\u670d\u52a1\u5668\u9ed8\u8ba4\u914d\u7f6e\u9762\u5411\u6613\u7528\u6027，\u4e0d\u9762\u5411\u5b89\u5168\u3002<\/p>\n<\/li>\n
\u7cfb\u7edf\u91cd\u88c5\u6216\u91cd\u5927\u53d8\u66f4\u540e：\u7cfb\u7edf\u53d8\u66f4\u53ef\u80fd\u91cd\u7f6e\u5b89\u5168\u914d\u7f6e\u3002<\/p>\n<\/li>\n
\u6f0f\u6d1e\u7206\u53d1\u540e：\u5982 OpenSSH RCE（CVE-2024-6387）\u3001Linux \u5185\u6838\u63d0\u6743\u6f0f\u6d1e\u7b49\u3002<\/p>\n<\/li>\n
\u901a\u8fc7\u7b49\u4fdd\u6d4b\u8bc4\u524d：\u7b49\u7ea7\u4fdd\u62a4\u8981\u6c42\u660e\u786e\u7684\u5b89\u5168\u57fa\u7ebf\u3002<\/p>\n<\/li>\n
\u670d\u52a1\u5668\u88ab\u9ed1\u540e\u590d\u76d8\u65f6：\u88ab\u9ed1\u8bf4\u660e\u5b58\u5728\u5b89\u5168\u7f3a\u53e3，\u9700\u8981\u4ea1\u7f8a\u8865\u7262\u3002<\/p>\n<\/li>\n<\/ul>\n
\u672c\u6587\u9002\u7528\u4e8e CentOS\/RHEL 7\/8\/9\u3001Ubuntu 18.04\/20.04\/22.04\u3001Debian 10\/11\/12 \u7b49\u4e3b\u6d41\u53d1\u884c\u7248\u3002<\/p>\n
\u52a0\u56fa\u662f\u9ad8\u98ce\u9669\u64cd\u4f5c，\u914d\u7f6e\u9519\u8bef\u53ef\u80fd\u5bfc\u81f4\u670d\u52a1\u5668\u65e0\u6cd5\u767b\u5f55\u6216\u670d\u52a1\u4e2d\u65ad\u3002\u64cd\u4f5c\u524d\u5fc5\u987b\u5b8c\u6210\u4ee5\u4e0b\u51c6\u5907：<\/p>\n
# \u5907\u4efd\u6240\u6709\u5373\u5c06\u4fee\u6539\u7684\u914d\u7f6e\u6587\u4ef6
\nmkdir \/opt\/security-hardening-backup-$(date +%Y%m%d)
\ncd\u00a0\/opt\/security-hardening-backup-$(date +%Y%m%d)<\/p>\n
# \u5907\u4efd\u7cfb\u7edf\u5173\u952e\u914d\u7f6e
\ncp \/etc\/ssh\/sshd_config .\/sshd_config.bak
\ncp \/etc\/pam.d\/system-auth .\/system-auth.bak
\ncp \/etc\/login.defs .\/login.defs.bak
\ncp \/etc\/fstab .\/fstab.bak
\ncp \/etc\/sysctl.conf .\/sysctl.conf.bak
\ncp \/etc\/rsyslog.conf .\/rsyslog.conf.bak
\ncp \/etc\/hosts.allow .\/hosts.allow.bak
\ncp \/etc\/hosts.deny .\/hosts.deny.bak
\ncp \/etc\/passwd .\/passwd.bak
\ncp \/etc\/shadow .\/shadow.bak
\ncp \/etc\/group .\/group.bak
\ncp -r \/etc\/iptables* .\/iptables.bak 2>\/dev\/null ||\u00a0true<\/p>\n
# \u5907\u4efd systemd \u670d\u52a1\u5217\u8868
\nsystemctl list-units –type=service –all > services-backup.txt<\/p>\n
# \u8bb0\u5f55\u5f53\u524d\u8fd0\u884c\u7684\u8fdb\u7a0b\u548c\u7f51\u7edc\u8fde\u63a5（\u57fa\u7ebf）
\nps auxf > processes-backup.txt
\nnetstat -tulnp > listening-ports-backup.txt
\nss -tulnp > ss-backup.txt<\/p>\n
# \u8bb0\u5f55\u5f53\u524d\u7528\u6237\u548c\u6743\u9650
\ncat \/etc\/passwd > users-backup.txt
\ncat \/etc\/group > groups-backup.txt
\ngetent shadow > shadow-backup.txt<\/p>\n
echo"Backup completed. Files are in \/opt\/security-hardening-backup-$(date +%Y%m%d)"<\/p>\n
\u4e91\u670d\u52a1\u5668（\u963f\u91cc\u4e91\u3001\u817e\u8baf\u4e91\u3001AWS \u7b49）\u652f\u6301\u521b\u5efa\u5feb\u7167，\u8fd9\u4e00\u6b65\u4e0d\u80fd\u7701：<\/p>\n
# \u963f\u91cc\u4e91 CLI \u521b\u5efa\u5feb\u7167（\u9700\u8981\u5148\u5b89\u88c5 aliyun CLI \u5e76\u914d\u7f6e AK）
\naliyun ecs CreateSnapshot –DiskId disk-xxx –Description\u00a0"pre-security-hardening-$(date +%Y%m%d)"<\/p>\n
# \u817e\u8baf\u4e91 CLI
\n# qcloudcli cvm CreateSnapshot –instanceId ins-xxx –snapshotName "pre-hardening-$(date +%Y%m%d)"<\/p>\n
# AWS CLI
\n# aws ec2 create-snapshot –description "pre-hardening-$(date +%Y%m%d)" –volume-id vol-xxx<\/p>\n
\u5feb\u7167\u662f\u670d\u52a1\u5668\u78c1\u76d8\u7684\u5b8c\u6574\u526f\u672c，\u51fa\u95ee\u9898\u53ef\u4ee5\u56de\u6eda，\u6bd4\u5907\u4efd\u914d\u7f6e\u6587\u4ef6\u66f4\u4fdd\u9669\u3002<\/p>\n
\u786e\u4fdd\u4f60\u8fd8\u6709\u9664\u4e86 SSH \u4ee5\u5916\u7684\u767b\u5f55\u65b9\u5f0f：<\/p>\n
\u4e91\u63a7\u5236\u53f0 VNC\/\u8fdc\u7a0b\u767b\u5f55（\u5e94\u6025\u5165\u53e3）<\/p>\n<\/li>\n
\u7269\u7406\u670d\u52a1\u5668\u4f7f\u7528 IPMI\/iLO\/iDRAC<\/p>\n<\/li>\n
\u63d0\u524d\u51c6\u5907\u4e00\u4e2a\u53ef\u4ee5\u901a\u8fc7\u4e91\u63a7\u5236\u53f0\u6267\u884c\u7684\u811a\u672c<\/p>\n<\/li>\n<\/ul>\n
\u5b89\u5168\u52a0\u56fa\u6700\u597d\u5728\u7ef4\u62a4\u7a97\u53e3\u8fdb\u884c，\u786e\u4fdd：<\/p>\n
\u4e1a\u52a1\u4f4e\u5cf0\u671f，\u4e0d\u4f1a\u5f71\u54cd\u592a\u591a\u7528\u6237<\/p>\n<\/li>\n
\u6709\u8db3\u591f\u65f6\u95f4\u6392\u67e5\u52a0\u56fa\u540e\u7684\u5f02\u5e38<\/p>\n<\/li>\n
\u6709\u4eba\u503c\u5b88，\u51fa\u95ee\u9898\u80fd\u53ca\u65f6\u54cd\u5e94<\/p>\n<\/li>\n
\u5df2\u7ecf\u901a\u77e5\u76f8\u5173\u65b9（\u4e1a\u52a1\u65b9\u3001Leader）<\/p>\n<\/li>\n<\/ul>\n
# \u5217\u51fa\u6240\u6709\u7cfb\u7edf\u8d26\u6237（\u975e\u767b\u5f55\u3001\u975e\u670d\u52a1\u8d26\u53f7\u9664\u5916）
\nawk -F:\u00a0'{print $1, $3, $7}'\u00a0\/etc\/passwd | grep -vE\u00a0"(nologin|false|sync)"\u00a0| head -50<\/p>\n
# \u68c0\u67e5\u662f\u5426\u6709\u7a7a\u5bc6\u7801\u8d26\u6237
\nawk -F:\u00a0'($2=="") {print $1}'\u00a0\/etc\/shadow<\/p>\n
# \u68c0\u67e5\u5bc6\u7801\u7b56\u7565
\ncat \/etc\/login.defs | grep -E\u00a0"(PASS_MIN_LEN|PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_WARN_AGE)"<\/p>\n
# \u67e5\u770b\u5f53\u524d\u5bc6\u7801\u7b56\u7565（CentOS\/RHEL）
\nauthconfig –test\u00a0| grep password
\n# \u6216
\npam_cracklib –test<\/p>\n
\u4fee\u6539\u00a0\/etc\/login.defs（\u5bf9\u65b0\u7528\u6237\u751f\u6548）：<\/p>\n
# \/etc\/login.defs
\nPASS_MAX_DAYS \u00a0 90 \u00a0 \u00a0 \u00a0 \u00a0# \u5bc6\u7801\u6700\u957f\u4f7f\u7528 90 \u5929
\nPASS_MIN_DAYS \u00a0 7 \u00a0 \u00a0 \u00a0 \u00a0\u00a0# \u5bc6\u7801\u6700\u5c11\u4f7f\u7528 7 \u5929\u624d\u80fd\u4fee\u6539
\nPASS_MIN_LEN \u00a0 \u00a012 \u00a0 \u00a0 \u00a0 \u00a0# \u5bc6\u7801\u6700\u5c0f\u957f\u5ea6 12 \u4f4d（\u6ce8\u610f：\u5b9e\u9645\u7531 PAM \u6a21\u5757\u63a7\u5236）
\nPASS_WARN_AGE \u00a0 14 \u00a0 \u00a0 \u00a0 \u00a0# \u5bc6\u7801\u5230\u671f\u524d 14 \u5929\u8b66\u544a<\/p>\n
\u4fee\u6539 PAM \u6a21\u5757\u5bc6\u7801\u7b56\u7565（\u5bf9\u73b0\u6709\u7528\u6237\u4e5f\u751f\u6548，CentOS\/RHEL）：<\/p>\n
# \/etc\/security\/pwquality.conf \u6216 \/etc\/pam.d\/password-auth
\n# \u627e\u5230 password requisite pam_pwquality.so \u884c，\u6539\u4e3a：
\npassword requisite pam_pwquality.so try_first_pass local_users_only retry=3 \\\\
\n\u00a0 \u00a0 minlen=12 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 \\\\
\n\u00a0 \u00a0 enforce_for_root<\/p>\n
# \u542b\u4e49：
\n# minlen=12 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u6700\u5c0f\u957f\u5ea6 12 \u4f4d
\n# dcredit=-1 \u00a0 \u00a0 \u00a0 \u00a0\u81f3\u5c11\u5305\u542b 1 \u4e2a\u6570\u5b57（dcredit \u8d1f\u6570\u8868\u793a"\u81f3\u5c11"）
\n# ucredit=-1 \u00a0 \u00a0 \u00a0 \u00a0\u81f3\u5c11\u5305\u542b 1 \u4e2a\u5927\u5199\u5b57\u6bcd
\n# lcredit=-1 \u00a0 \u00a0 \u00a0 \u00a0\u81f3\u5c11\u5305\u542b 1 \u4e2a\u5c0f\u5199\u5b57\u6bcd
\n# ocredit=-1 \u00a0 \u00a0 \u00a0 \u00a0\u81f3\u5c11\u5305\u542b 1 \u4e2a\u7279\u6b8a\u5b57\u7b26
\n# enforce_for_root \u00a0root \u7528\u6237\u4e5f\u5f3a\u5236\u6267\u884c<\/p>\n
Ubuntu\/Debian \u4e2d\u7f16\u8f91\u00a0\/etc\/security\/pwquality.conf\u00a0\u6216\u00a0\/etc\/pam.d\/common-password：<\/p>\n
password requisite pam_pwquality.so retry=3 minlen=12 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1<\/p>\n
\u5f88\u591a\u670d\u52a1\u4f1a\u521b\u5efa\u7cfb\u7edf\u8d26\u6237，\u8fd9\u4e9b\u8d26\u6237\u4e0d\u5e94\u8be5\u7528\u4e8e\u767b\u5f55：<\/p>\n
# \u9501\u5b9a\u4e0d\u9700\u8981\u767b\u5f55\u7684\u8d26\u6237
\nfor\u00a0user\u00a0in\u00a0bin daemon news uucp games gnats smmsp nobody nfsnobody;\u00a0do
\n\u00a0 \u00a0 usermod -L\u00a0$user\u00a02>\/dev\/null &&\u00a0echo\u00a0"Locked\u00a0$user"\u00a0||\u00a0echo\u00a0"$user\u00a0not found or already locked"
\ndone<\/p>\n
# \u68c0\u67e5\u662f\u5426\u8fd8\u6709\u8d26\u6237\u662f \/bin\/bash \u767b\u5f55
\nawk -F:\u00a0'{print $1, $7}'\u00a0\/etc\/passwd | grep -E\u00a0"bash$"\u00a0| grep -v -E\u00a0"^(root|admin|deploy|app):"<\/p>\n
# \u786e\u4fdd root \u8d26\u6237\u4e0d\u80fd\u901a\u8fc7 SSH \u767b\u5f55
\n# \u8fd9\u4e2a\u5728 SSH \u52a0\u56fa\u90e8\u5206\u4f1a\u8be6\u7ec6\u8bf4<\/p>\n
\u53ea\u5141\u8bb8\u7279\u5b9a\u7528\u6237\u4f7f\u7528 su \u5207\u6362\u5230 root：<\/p>\n
# \u5728 \/etc\/pam.d\/su \u4e2d\u6dfb\u52a0（\u9ed8\u8ba4\u5df2\u6709\u6ce8\u91ca，\u53d6\u6d88\u6ce8\u91ca\u5373\u53ef）
\n# auth required pam_wheel.so use_uid<\/p>\n
# \u5c06\u4fe1\u4efb\u7684\u7528\u6237\u52a0\u5165 wheel \u7ec4
\nusermod -aG wheel admin_user<\/p>\n
# \u9a8c\u8bc1 wheel \u7ec4\u914d\u7f6e
\ngrep\u00a0"^wheel"\u00a0\/etc\/group<\/p>\n
# \u6d4b\u8bd5：\u975e wheel \u7ec4\u7528\u6237\u4e0d\u80fd su –
\nsu – admin_user \u00a0# \u5148\u5207\u6362\u5230\u666e\u901a\u7528\u6237
\nsu – root \u00a0 \u00a0 \u00a0 \u00a0# \u5e94\u8be5\u62a5\u9519：Permission denied<\/p>\n
# \u67e5\u770b\u5f53\u524d\u767b\u5f55\u7528\u6237
\nwho
\nw
\nlast<\/p>\n
# \u8e22\u51fa\u5f02\u5e38\u767b\u5f55（\u5047\u8bbe\u53d1\u73b0 hack user）
\npkill -KILL -u hack_user<\/p>\n
# \u7acb\u5373\u7981\u7528\u8be5\u8d26\u6237
\nusermod -L hack_user
\nusermod -s \/sbin\/nologin hack_user<\/p>\n
SSH \u662f\u670d\u52a1\u5668\u88ab\u5165\u4fb5\u7684\u6700\u4e3b\u8981\u5165\u53e3\u3002\u5927\u91cf\u653b\u51fb\u8005\u7528\u5f31\u53e3\u4ee4\u5b57\u5178\u6279\u91cf\u626b SSH\u3002SSH \u52a0\u56fa\u662f\u5b89\u5168\u52a0\u56fa\u4e2d\u6700\u91cd\u8981\u7684\u4e00\u73af\u3002<\/p>\n
SSH \u9ed8\u8ba4\u76d1\u542c 22 \u7aef\u53e3，\u5168\u4e16\u754c\u626b\u63cf\u5668\u90fd\u5728\u626b 22\u3002\u6539\u6210\u9ad8\u4f4d\u7aef\u53e3\u80fd\u51cf\u5c11 99% \u7684\u626b\u63cf\u6d41\u91cf：<\/p>\n
# \u7f16\u8f91 \/etc\/ssh\/sshd_config
\nPort 22022 \u00a0# \u4e0d\u8981\u7528 2222，\u6709\u4e9b\u626b\u63cf\u5668\u4e5f\u4f1a\u626b<\/p>\n
# \u4fee\u6539\u540e\u91cd\u542f SSH
\nsystemctl restart sshd<\/p>\n
# \u6ce8\u610f：\u4fee\u6539\u7aef\u53e3\u540e，\u540e\u7eed SSH \u8fde\u63a5\u9700\u8981\u6307\u5b9a\u7aef\u53e3
\nssh -p 22022 root@server_ip<\/p>\n
# \u9632\u706b\u5899\u653e\u884c\u65b0\u7aef\u53e3（\u7a0d\u540e\u9632\u706b\u5899\u90e8\u5206\u4f1a\u8bb2）<\/p>\n
\u98ce\u9669\u63d0\u9192：<\/p>\n
\u6539\u5b8c\u7aef\u53e3\u540e\u786e\u4fdd\u5f53\u524d SSH \u4f1a\u8bdd\u4e0d\u65ad（\u65b0\u7aef\u53e3\u751f\u6548\u540e\u518d\u9000\u51fa）\u3002<\/p>\n<\/li>\n
\u4fee\u6539\u7aef\u53e3\u540e\u76d1\u63a7\u5de5\u5177（\u5982 ansible）\u9700\u8981\u540c\u6b65\u66f4\u65b0\u3002<\/p>\n<\/li>\n
\u9ad8\u4f4d\u7aef\u53e3（\u5982 22022）\u53ef\u80fd\u4e0e\u4f01\u4e1a\u5185\u7f51\u7b56\u7565\u51b2\u7a81，\u6ce8\u610f\u8bc4\u4f30\u3002<\/p>\n<\/li>\n<\/ul>\n
root \u662f\u6700\u9ad8\u6743\u9650\u8d26\u6237，\u7981\u7528\u76f4\u63a5\u767b\u5f55，\u5f3a\u5236\u4f7f\u7528\u666e\u901a\u7528\u6237 + sudo：<\/p>\n
# \/etc\/ssh\/sshd_config
\nPermitRootLogin no<\/p>\n
# \u786e\u4fdd\u6709\u53ef\u7528\u7684 sudo \u7528\u6237
\nuseradd -m -s \/bin\/bash admin_user
\nusermod -aG wheel admin_user
\necho\u00a0"admin_user:Str0ngP@ssw0rd"\u00a0| chpasswd<\/p>\n
# \u6d4b\u8bd5\u65b0\u7528\u6237\u53ef\u4ee5 sudo
\nssh admin_user@server_ip
\nsudo -l \u00a0# \u5e94\u8be5\u663e\u793a admin_user can run commands<\/p>\n
\u5bc6\u94a5\u767b\u5f55\u4ece\u6839\u672c\u4e0a\u675c\u7edd\u4e86\u66b4\u529b\u7834\u89e3\u3002\u5bc6\u7801\u767b\u5f55\u5373\u4f7f\u518d\u590d\u6742，\u4e5f\u662f\u53ef\u88ab\u7834\u89e3\u7684：<\/p>\n
# \u5728\u672c\u5730\u673a\u5668（\u4f60\u7684\u7b14\u8bb0\u672c\/\u53f0\u5f0f\u673a）\u751f\u6210\u5bc6\u94a5\u5bf9
\nssh-keygen -t ed25519 -C\u00a0"your_email@example.com"\u00a0-f ~\/.ssh\/id_ed25519_server<\/p>\n
# \u5c06\u516c\u94a5\u4e0a\u4f20\u5230\u670d\u52a1\u5668
\nssh-copy-id -i ~\/.ssh\/id_ed25519_server.pub -p 22022 admin_user@server_ip<\/p>\n
# \u6216\u8005\u624b\u52a8\u8ffd\u52a0
\n# cat ~\/.ssh\/id_ed25519_server.pub | ssh -p 22022 admin_user@server_ip "mkdir -p ~\/.ssh && chmod 700 ~\/.ssh && cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys"<\/p>\n
# \u4fee\u6539 SSH \u914d\u7f6e
\n# \/etc\/ssh\/sshd_config
\nPubkeyAuthentication yes
\nPasswordAuthentication no
\nPermitEmptyPasswords no
\nChallengeResponseAuthentication no<\/p>\n
# \u91cd\u542f SSH
\nsystemctl restart sshd<\/p>\n
# \/etc\/ssh\/sshd_config
\nAllowUsers admin_user deploy_user@10.0.0.0\/8 admin_user@192.168.1.0\/24<\/p>\n
# \u53ea\u5141\u8bb8\u7279\u5b9a\u7ec4
\nAllowGroups wheel admin<\/p>\n
# \u9650\u5236 sshd \u76d1\u542c\u5730\u5740（\u53ea\u76d1\u542c\u5185\u7f51 IP，\u4e0d\u76d1\u542c\u516c\u7f51）
\nListenAddress 0.0.0.0 \u00a0# \u9ed8\u8ba4，\u5efa\u8bae\u6539\u4e3a\u5185\u7f51\u5730\u5740
\n# ListenAddress 10.0.0.100<\/p>\n
# \/etc\/ssh\/sshd_config \u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9
\n# \u7981\u7528\u7a7a\u5bc6\u7801
\nPermitEmptyPasswords no<\/p>\n
# \u7981\u7528 .rhosts \u6587\u4ef6
\nIgnoreRhosts yes<\/p>\n
# \u7981\u7528\u57fa\u4e8e\u4e3b\u673a\u7684\u8ba4\u8bc1
\nHostbasedAuthentication no<\/p>\n
# \u5173\u95ed X11 \u8f6c\u53d1（\u9664\u975e\u771f\u7684\u9700\u8981）
\nX11Forwarding no<\/p>\n
# \u5173\u95ed TCP \u8f6c\u53d1（\u9632\u6b62 SSH \u88ab\u7528\u4f5c\u4ee3\u7406）
\nAllowTcpForwarding no<\/p>\n
# \u5173\u95ed Agent \u8f6c\u53d1
\nAllowAgentForwarding no<\/p>\n
# \u8bbe\u7f6e\u7a7a\u95f2\u8d85\u65f6（\u5ba2\u6237\u7aef 10 \u5206\u949f\u65e0\u64cd\u4f5c\u81ea\u52a8\u65ad\u5f00）
\nClientAliveInterval 600
\nClientAliveCountMax 2<\/p>\n
# \u9650\u5236\u6700\u5927\u8ba4\u8bc1\u5c1d\u8bd5\u6b21\u6570
\nMaxAuthTries 3<\/p>\n
# \u8bbe\u7f6e\u767b\u5f55\u6210\u529f\u540e\u7684 Banner（\u53ef\u9009，\u8d77\u5230\u5a01\u6151\u4f5c\u7528）
\nPrintMotd yes
\nPrintLastLog yes<\/p>\n
# SSH \u534f\u8bae\u7248\u672c（\u5fc5\u987b\u4e3a 2）
\nProtocol 2<\/p>\n
\u5373\u4f7f\u505a\u4e86\u4ee5\u4e0a\u52a0\u56fa，\u653b\u51fb\u8005\u4ecd\u53ef\u80fd\u5c1d\u8bd5\u5bc6\u94a5\u7834\u89e3\u6216\u5185\u90e8\u8d26\u6237\u5f31\u53e3\u4ee4\u3002fail2ban \u80fd\u81ea\u52a8\u5c01\u7981\u9891\u7e41\u5c1d\u8bd5\u767b\u5f55\u7684 IP：<\/p>\n
# CentOS\/RHEL \u5b89\u88c5
\nyum install -y epel-release
\nyum install -y fail2ban<\/p>\n
# Ubuntu\/Debian \u5b89\u88c5
\napt install -y fail2ban<\/p>\n
# \u914d\u7f6e fail2ban（\u4e0d\u4fee\u6539 \/etc\/fail2ban\/jail.conf，\u521b\u5efa local \u8986\u76d6\u6587\u4ef6）
\ncat > \/etc\/fail2ban\/jail.local <<\u00a0'EOF'
\n[DEFAULT]
\nbantime = 3600 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0# \u5c01\u7981 1 \u5c0f\u65f6
\nfindtime = 600 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0# 10 \u5206\u949f\u5185
\nmaxretry = 3 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0# \u5931\u8d25 3 \u6b21\u5373\u5c01\u7981
\nignoreip = 127.0.0.1\/8 10.0.0.0\/8 192.168.0.0\/16 \u00a0# \u4e0d\u5c01\u7981\u8fd9\u4e9b IP<\/p>\n
[sshd]
\nenabled =\u00a0true
\nport = 22022
\nfilter = sshd
\nlogpath = \/var\/log\/secure \u00a0# CentOS\/RHEL
\n# logpath = \/var\/log\/auth.log \u00a0# Ubuntu\/Debian
\nmaxretry = 3<\/p>\n
[sshd-ddos]
\nenabled =\u00a0true
\nport = 22022
\nfilter = sshd-ddos
\nlogpath = \/var\/log\/secure
\nmaxretry = 10
\nEOF<\/p>\n
# \u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f
\nsystemctl\u00a0enable\u00a0fail2ban
\nsystemctl start fail2ban<\/p>\n
# \u67e5\u770b\u88ab\u5c01\u7981\u7684 IP
\nfail2ban-client status sshd
\nfail2ban-client banned sshd<\/p>\n
# \u624b\u52a8\u89e3\u5c01\u67d0\u4e2a IP
\nfail2ban-client\u00a0set\u00a0sshd unbanip 192.168.1.100<\/p>\n
# \u68c0\u67e5\u5f53\u524d SSH \u914d\u7f6e\u662f\u5426\u6b63\u786e
\nsshd -t<\/p>\n
# \u67e5\u770b SSH \u76d1\u542c\u7aef\u53e3
\nss -tulnp | grep sshd<\/p>\n
# \u67e5\u770b\u8c01\u66fe\u7ecf\u767b\u5f55\u8fc7（\u7528\u4e8e\u5ba1\u8ba1）
\nlast
\nlastlog | head -50<\/p>\n
# \u67e5\u770b SSH \u5931\u8d25\u767b\u5f55\u8bb0\u5f55
\n# CentOS\/RHEL
\ncat \/var\/log\/secure | grep -i\u00a0"failed password"\u00a0| tail -50
\n# Ubuntu\/Debian
\ncat \/var\/log\/auth.log | grep -i\u00a0"failed password"\u00a0| tail -50<\/p>\n
# \u67e5\u770b fail2ban \u65e5\u5fd7
\ntail -100 \/var\/log\/fail2ban.log<\/p>\n
\u653b\u51fb\u8005\u7ecf\u5e38\u5229\u7528 \/tmp \u548c \/var\/tmp \u5199\u5165\u540e\u95e8\u6587\u4ef6\u3002\u5e94\u8be5\u5c06\u8fd9\u4e9b\u76ee\u5f55\u8bbe\u7f6e\u4e3a noexec\u3001nosuid\u3001nodev：<\/p>\n
# \u67e5\u770b\u5f53\u524d \/tmp \u6302\u8f7d\u9009\u9879
\nmount | grep \/tmp<\/p>\n
# \u5982\u679c \/tmp \u662f\u72ec\u7acb\u5206\u533a，\u6dfb\u52a0\u5b89\u5168\u6302\u8f7d\u9009\u9879
\n# \u7f16\u8f91 \/etc\/fstab
\nUUID=xxxx-xxxx-xxxx \/tmp ext4 defaults,noexec,nosuid,nodev 0 0<\/p>\n
# \u5982\u679c \/tmp \u4e0d\u662f\u72ec\u7acb\u5206\u533a（\u5927\u591a\u6570\u4e91\u670d\u52a1\u5668\u9ed8\u8ba4），\u521b\u5efa\u4e00\u4e2a\u72ec\u7acb\u7684 \/tmp \u5206\u533a
\n# \u5148\u521b\u5efa 2G \u5927\u5c0f\u7684\u955c\u50cf\u6587\u4ef6
\ndd\u00a0if=\/dev\/zero of=\/var\/tmp.mount bs=1M count=2048
\nmkfs.ext4 \/var\/tmp.mount<\/p>\n
# \u5907\u4efd\u539f \/tmp \u5185\u5bb9
\ncp -a \/tmp \/tmp.bak<\/p>\n
# \u6302\u8f7d\u65b0\u5206\u533a
\nmount –bind\u00a0\/var\/tmp.mount \/tmp<\/p>\n
# \u6062\u590d\u5185\u5bb9
\ncp -a \/tmp.bak\/* \/tmp\/<\/p>\n
# \u8bbe\u7f6e\u6743\u9650
\nchmod 1777 \/tmp<\/p>\n
# \u6dfb\u52a0\u5230 \/etc\/fstab \u786e\u4fdd\u91cd\u542f\u540e\u751f\u6548
\necho"\/var\/tmp.mount \/tmp ext4 defaults,bind,noexec,nosuid,nodev 0 0"\u00a0>> \/etc\/fstab<\/p>\n
\u9632\u6b62\u653b\u51fb\u8005\u52a0\u8f7d\u6076\u610f\u5185\u6838\u6a21\u5757：<\/p>\n
# \u7981\u7528\u6a21\u5757\u52a0\u8f7d\u80fd\u529b
\necho"install usb-storage \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install bluetooth \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install freevxfs \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install jffs2 \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install hfs \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install hfsplus \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install squashfs \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install udf \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf
\necho"install dccp \/bin\/true"\u00a0>> \/etc\/modprobe.d\/no-usb.conf<\/p>\n
\u6536\u7d27\u7528\u6237\u7684\u9ed8\u8ba4\u6587\u4ef6\u521b\u5efa\u6743\u9650：<\/p>\n
# \/etc\/profile \u4e2d\u8bbe\u7f6e\u66f4\u4e25\u683c\u7684 umask
\n# \u627e\u5230 umask \u90a3\u884c，\u6539\u4e3a：
\numask\u00a00027 \u00a0# \u9ed8\u8ba4\u521b\u5efa\u6587\u4ef6 640，\u76ee\u5f55 750<\/p>\n
# \/etc\/csh.cshrc \u4e2d\u4e5f\u4fee\u6539：
\nset\u00a0umask\u00a00027<\/p>\n
# \u68c0\u67e5\u5173\u952e\u6587\u4ef6\u6743\u9650
\nchmod 644 \/etc\/passwd
\nchmod 000 \/etc\/shadow \u00a0 \u00a0 \u00a0# shadow \u6587\u4ef6\u53ea\u6709 root \u53ef\u8bfb\u5199
\nchmod 644 \/etc\/group
\nchmod 640 \/etc\/gshadow
\nchmod 600 \/etc\/crontab
\nchmod 600 \/etc\/anacrontab
\nchmod 700 \/var\/spool\/cron
\nchmod 600 \/etc\/ssh\/sshd_config
\nchmod 644 \/etc\/hosts.allow
\nchmod 644 \/etc\/hosts.deny
\nchmod 600 \/etc\/rsyslog.conf
\nchmod 700 \/etc\/cron.d
\nchmod 700 \/etc\/cron.daily
\nchmod 700 \/etc\/cron.hourly
\nchmod 700 \/etc\/cron.monthly
\nchmod 700 \/etc\/cron.weekly<\/p>\n
\u4f7f\u7528 iptables \u6216 firewalld \u9650\u5236\u5165\u7ad9\u6d41\u91cf\u3002\u539f\u5219：\u9ed8\u8ba4\u62d2\u7edd\u6240\u6709，\u53ea\u653e\u884c\u5fc5\u8981\u7684\u7aef\u53e3\u3002<\/p>\n
\u4f7f\u7528 firewalld（CentOS\/RHEL 7+）：<\/p>\n
# \u67e5\u770b\u5f53\u524d\u89c4\u5219
\nfirewall-cmd –list-all
\nfirewall-cmd –list-ports
\nfirewall-cmd –list-services<\/p>\n
# \u653e\u884c\u5fc5\u8981\u7aef\u53e3
\nfirewall-cmd –permanent –add-port=22022\/tcp \u00a0 \u00a0# SSH
\nfirewall-cmd –permanent –add-port=80\/tcp \u00a0 \u00a0 \u00a0 \u00a0# HTTP
\nfirewall-cmd –permanent –add-port=443\/tcp \u00a0 \u00a0 \u00a0\u00a0# HTTPS
\nfirewall-cmd –permanent –add-port=3306\/tcp \u00a0 \u00a0 \u00a0# MySQL（\u5982\u679c\u9700\u8981\u4ece\u5185\u7f51\u76f4\u63a5\u8bbf\u95ee）
\nfirewall-cmd –permanent –add-port=6379\/tcp \u00a0 \u00a0 \u00a0# Redis（\u4ec5\u5185\u7f51）<\/p>\n
# \u653e\u884c\u5fc5\u8981\u670d\u52a1
\nfirewall-cmd –permanent –add-service=http
\nfirewall-cmd –permanent –add-service=https
\nfirewall-cmd –permanent –add-service=ssh<\/p>\n
# \u7981\u6b62 Ping（\u9632\u626b\u63cf）
\nfirewall-cmd –permanent –add-icmp-block=echo-request<\/p>\n
# \u9ed8\u8ba4\u62d2\u7edd\u6240\u6709\u5165\u7ad9
\nfirewall-cmd –set-default-zone=drop<\/p>\n
# \u53ea\u5141\u8bb8\u7279\u5b9a\u6765\u6e90 IP \u8bbf\u95ee SSH
\nfirewall-cmd –permanent –zone=trusted –add-source=10.0.0.0\/8
\nfirewall-cmd –permanent –zone=trusted –add-source=192.168.0.0\/16
\nfirewall-cmd –permanent –add-rich-rule='rule family="ipv4" source address="your_office_ip\/32" port port="22022" protocol="tcp" accept'<\/p>\n
# \u91cd\u8f7d\u9632\u706b\u5899
\nfirewall-cmd –reload<\/p>\n
# \u67e5\u770b\u751f\u6548\u89c4\u5219
\nfirewall-cmd –list-all<\/p>\n
\u4f7f\u7528 iptables（Ubuntu\/Debian \u6216 CentOS\/RHEL 6）：<\/p>\n
# \u4fdd\u5b58\u73b0\u6709\u89c4\u5219
\niptables-save > \/opt\/iptables-backup-$(date +%Y%m%d).rules<\/p>\n
# \u7f16\u5199\u89c4\u5219\u811a\u672c
\ncat > \/opt\/iptables-rules.sh <<\u00a0'EOF'
\n#!\/bin\/bash
\n# \u6e05\u7a7a\u73b0\u6709\u89c4\u5219
\niptables -F
\niptables -X
\niptables -t nat -F
\niptables -t nat -X<\/p>\n
# \u9ed8\u8ba4\u62d2\u7edd\u6240\u6709\u5165\u7ad9
\niptables -P INPUT DROP
\niptables -P FORWARD DROP
\niptables -P OUTPUT ACCEPT<\/p>\n
# \u5141\u8bb8\u672c\u5730\u56de\u73af
\niptables -A INPUT -i lo -j ACCEPT
\niptables -A OUTPUT -o lo -j ACCEPT<\/p>\n
# \u5141\u8bb8\u5df2\u5efa\u7acb\u8fde\u63a5\u7684\u5305
\niptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT<\/p>\n
# \u5141\u8bb8 SSH（\u6539\u6210\u4f60\u7684\u7aef\u53e3）
\niptables -A INPUT -p tcp –dport 22022 -j ACCEPT<\/p>\n
# \u5141\u8bb8 HTTP\/HTTPS
\niptables -A INPUT -p tcp –dport 80 -j ACCEPT
\niptables -A INPUT -p tcp –dport 443 -j ACCEPT<\/p>\n
# \u5141\u8bb8 Ping
\niptables -A INPUT -p icmp –icmp-type\u00a0echo-request -j ACCEPT<\/p>\n
# \u5141\u8bb8\u6765\u81ea\u5185\u7f51\u7684\u8fde\u63a5
\niptables -A INPUT -s 10.0.0.0\/8 -j ACCEPT
\niptables -A INPUT -s 192.168.0.0\/16 -j ACCEPT<\/p>\n
# \u8bb0\u5f55\u88ab\u62d2\u7edd\u7684\u5305（\u53ef\u9009，\u65b9\u4fbf\u6392\u67e5）
\niptables -A INPUT -m\u00a0limit\u00a0–limit\u00a05\/min -j LOG –log-prefix\u00a0"iptables DROP: "\u00a0–log-level 4<\/p>\n
# \u4fdd\u5b58\u89c4\u5219
\niptables-save > \/etc\/iptables\/rules.v4
\nEOF<\/p>\n
chmod +x \/opt\/iptables-rules.sh
\n\/opt\/iptables-rules.sh<\/p>\n
# \u67e5\u770b\u89c4\u5219
\niptables -L -n -v<\/p>\n
\u4fee\u6539\u00a0\/etc\/sysctl.conf，\u6536\u7d27\u7f51\u7edc\u5c42\u9762\u7684\u5b89\u5168\u53c2\u6570：<\/p>\n
# \/etc\/sysctl.conf \u6dfb\u52a0\u6216\u4fee\u6539\u4ee5\u4e0b\u5185\u5bb9<\/p>\n
# \u5173\u95ed IP \u8f6c\u53d1（\u9664\u975e\u670d\u52a1\u5668\u505a\u8def\u7531\u5668）
\nnet.ipv4.ip_forward = 0<\/p>\n
# \u5173\u95ed\u6570\u636e\u5305\u8f6c\u53d1（\u9632\u6b62\u670d\u52a1\u5668\u6210\u4e3a\u8def\u7531\u8df3\u677f）
\nnet.ipv4.conf.all.forwarding = 0
\nnet.ipv4.conf.default.forwarding = 0<\/p>\n
# \u7981\u7528\u6e90\u8def\u7531\u5305（\u9632\u6b62 IP \u4f2a\u88c5\u653b\u51fb）
\nnet.ipv4.conf.all.accept_source_route = 0
\nnet.ipv4.conf.default.accept_source_route = 0<\/p>\n
# \u5173\u95ed ICMP \u91cd\u5b9a\u5411
\nnet.ipv4.conf.all.accept_redirects = 0
\nnet.ipv4.conf.default.accept_redirects = 0
\nnet.ipv6.conf.all.accept_redirects = 0
\nnet.ipv6.conf.default.accept_redirects = 0<\/p>\n
# \u5f00\u542f SYN Flood \u9632\u62a4
\nnet.ipv4.tcp_syncookies = 1
\nnet.ipv4.tcp_syn_retries = 2
\nnet.ipv4.tcp_synack_retries = 2
\nnet.ipv4.tcp_max_syn_backlog = 4096<\/p>\n
# \u7981\u6b62 ICMP Ping \u5e7f\u64ad
\nnet.ipv4.icmp_echo_ignore_broadcasts = 1<\/p>\n
# \u5ffd\u7565 ICMP Ping（\u53ef\u9009，\u5f71\u54cd\u76d1\u63a7\u63a2\u6d3b）
\nnet.ipv4.icmp_echo_ignore_all = 0 \u00a0# \u5efa\u8bae\u4fdd\u6301 0，\u65b9\u4fbf\u81ea\u5df1\u76d1\u63a7<\/p>\n
# \u7981\u6b62\u8def\u7531\u8bb0\u5f55（ traceroute \u4f7f\u7528）
\nnet.ipv4.conf.all.log_martians = 1
\nnet.ipv4.conf.default.log_martians = 1<\/p>\n
# TIME_WAIT \u5feb\u901f\u56de\u6536
\nnet.ipv4.tcp_fin_timeout = 30
\nnet.ipv4.tcp_tw_reuse = 1<\/p>\n
# \u6700\u5927\u6587\u4ef6\u63cf\u8ff0\u7b26
\nfs.file-max = 6553600<\/p>\n
# \u5e94\u7528\u914d\u7f6e
\nsysctl -p<\/p>\n
# \u7981\u6b62\u901a\u8fc7 ICMP \u8def\u7531\u8ffd\u8e2a（\u9632\u6b62\u653b\u51fb\u8005\u63a2\u6d4b\u7f51\u7edc\u62d3\u6251）
\necho\u00a01 > \/proc\/sys\/net\/ipv4\/conf\/all\/accept_source_route
\n# \u4e0a\u9762\u5df2\u7ecf\u5728 sysctl.conf \u4e2d\u8bbe\u7f6e<\/p>\n
# \u7981\u6b62\u4fee\u6539\u8def\u7531\u8868
\necho\u00a00 > \/proc\/sys\/net\/ipv4\/conf\/all\/accept_redirects
\necho\u00a00 > \/proc\/sys\/net\/ipv6\/conf\/all\/accept_redirects<\/p>\n
\u670d\u52a1\u5668\u4e0a\u4e0d\u9700\u8981\u7684\u670d\u52a1\u8d8a\u591a，\u653b\u51fb\u9762\u8d8a\u5927\u3002\u68c0\u67e5\u5e76\u7981\u7528\u4e0d\u9700\u8981\u7684\u670d\u52a1：<\/p>\n
# \u67e5\u770b\u6240\u6709\u5f00\u673a\u81ea\u542f\u670d\u52a1
\nsystemctl list-unit-files –type=service –state=enabled<\/p>\n
# \u67e5\u770b\u6b63\u5728\u8fd0\u884c\u7684\u670d\u52a1
\nsystemctl –type=service –state=running<\/p>\n
# \u5e38\u89c1\u9700\u8981\u68c0\u67e5\u548c\u7981\u7528\u7684\u670d\u52a1（\u6309\u9700\u8c03\u6574）
\n# telnet-server：\u660e\u6587\u4f20\u8f93，\u5e94\u7981\u7528
\nsystemctl\u00a0disable\u00a0telnet.socket 2>\/dev\/null
\nsystemctl stop telnet.socket 2>\/dev\/null<\/p>\n
# vsftpd：\u5982\u679c\u4e0d\u7528 FTP \u5c31\u7981\u7528
\nsystemctl\u00a0disable\u00a0vsftpd 2>\/dev\/null<\/p>\n
# sendmail：\u90ae\u4ef6\u670d\u52a1，\u5982\u4e0d\u9700\u8981\u5c31\u7981\u7528
\nsystemctl\u00a0disable\u00a0sendmail 2>\/dev\/null<\/p>\n
# postfix：\u5982\u679c\u4e0d\u7528\u90ae\u4ef6\u5c31\u7981\u7528
\nsystemctl\u00a0disable\u00a0postfix 2>\/dev\/null<\/p>\n
# cups：\u6253\u5370\u670d\u52a1，\u4e91\u670d\u52a1\u5668\u4e0d\u9700\u8981
\nsystemctl\u00a0disable\u00a0cups 2>\/dev\/null<\/p>\n
# dovecot：\u5982\u679c\u4e0d\u7528 IMAP\/POP3 \u5c31\u7981\u7528
\nsystemctl\u00a0disable\u00a0dovecot 2>\/dev\/null<\/p>\n
# nfslock\/nfs：\u5982\u679c\u4e0d\u505a NFS \u6587\u4ef6\u5171\u4eab\u5c31\u7981\u7528
\nsystemctl\u00a0disable\u00a0nfs-lock 2>\/dev\/null
\nsystemctl\u00a0disable\u00a0nfs 2>\/dev\/null<\/p>\n
# rpcbind：NFS \u4f9d\u8d56\u7684\u670d\u52a1
\nsystemctl\u00a0disable\u00a0rpcbind 2>\/dev\/null<\/p>\n
# bluetooth：\u4e91\u670d\u52a1\u5668\u4e0d\u9700\u8981\u84dd\u7259
\nsystemctl\u00a0disable\u00a0bluetooth 2>\/dev\/null
\nsystemctl stop bluetooth 2>\/dev\/null<\/p>\n
# \u786e\u8ba4\u6ca1\u6709\u4e0d\u9700\u8981\u7684\u670d\u52a1\u5728\u8fd0\u884c
\nsystemctl –type=service –state=running | grep -v -E\u00a0"(sshd|cron|rsyslog|systemd|dbus|network|polkit|irqbalance|sssd)"<\/p>\n
\u786e\u4fdd\u670d\u52a1\u5668\u4e0a\u53ea\u6709\u4f60\u77e5\u9053\u7684\u7aef\u53e3\u5728\u76d1\u542c：<\/p>\n
# \u67e5\u770b\u6240\u6709\u76d1\u542c\u7aef\u53e3
\nss -tulnp
\n# \u6216
\nnetstat -tulnp<\/p>\n
# \u7279\u522b\u5173\u6ce8\u4ee5\u4e0b\u51e0\u70b9：
\n# 1. \u662f\u5426\u6709\u4e0d\u660e\u670d\u52a1\u76d1\u542c\u5728\u9ad8\u5371\u7aef\u53e3（\u5982 4444\u30015555 \u662f Metasploit \u5e38\u7528\u7aef\u53e3）
\n# 2. \u662f\u5426\u6709\u670d\u52a1\u76d1\u542c\u5728 0.0.0.0（\u5e94\u8be5\u5927\u90e8\u5206\u670d\u52a1\u53ea\u76d1\u542c 127.0.0.1 \u6216\u5185\u7f51 IP）
\n# 3. \u662f\u5426\u6709\u670d\u52a1\u76d1\u542c\u5728\u516c\u7f51 IP \u4f46\u4e0d\u5e94\u8be5\u66b4\u9732（\u5982\u6570\u636e\u5e93\u3001Redis）<\/p>\n
# \u793a\u4f8b：\u68c0\u67e5\u975e\u9884\u671f\u7684\u76d1\u542c
\nss -tulnp | grep -v -E\u00a0"(22|80|443|22022)"<\/p>\n
\u5f88\u591a\u670d\u52a1\u4f1a\u5728 banner \u4e2d\u663e\u793a\u7248\u672c\u53f7，\u653b\u51fb\u8005\u5229\u7528\u7248\u672c\u4fe1\u606f\u67e5\u627e\u5bf9\u5e94\u6f0f\u6d1e：<\/p>\n
# Nginx \u7248\u672c\u9690\u85cf（\u5728 nginx.conf \u4e2d）
\nserver_tokens off;<\/p>\n
# MySQL \u7248\u672c\u9690\u85cf
\n# MySQL 5.7+: \u5728 my.cnf [mysqld] \u4e2d
\n# MySQL 8.0+: \u4e0d\u9700\u8981\u5355\u72ec\u914d\u7f6e，\u9ed8\u8ba4\u4e0d\u663e\u793a\u7248\u672c<\/p>\n
# SSH \u7248\u672c（\u5728 \/etc\/ssh\/sshd_config \u4e2d）
\n# SSH \u9ed8\u8ba4 banner \u65e0\u6cd5\u5b8c\u5168\u9690\u85cf，\u4f46\u53ef\u4ee5\u964d\u7ea7\u653b\u51fb\u8005\u4fe1\u5fc3
\n# \u7f16\u8f91 \/etc\/ssh\/sshd_config
\n# \u627e\u5230\u00a0#Banner\u00a0none，\u6539\u4e3a：
\n# Banner \/etc\/ssh\/banner
\n# \u521b\u5efa\u81ea\u5b9a\u4e49 banner \u6587\u4ef6
\necho"Welcome to Secure Server"\u00a0> \/etc\/ssh\/banner<\/p>\n
# Redis \u9ed8\u8ba4\u76d1\u542c 6379，\u4e14\u65e0\u8ba4\u8bc1
\n# \u5982\u679c\u5fc5\u987b\u66b4\u9732\u5728\u5916\u7f51，\u5fc5\u987b\u8bbe\u7f6e\u5bc6\u7801
\n# \/etc\/redis\/redis.conf
\n# requirepass your_strong_password_here
\n# bind 127.0.0.1
\n# rename-command FLUSHDB "" \u00a0 # \u7981\u7528 FLUSHDB \u547d\u4ee4
\n# rename-command FLUSHALL "" \u00a0 # \u7981\u7528 FLUSHALL \u547d\u4ee4
\n# rename-command KEYS "" \u00a0 \u00a0 \u00a0 # \u7981\u6b62 KEYS \u547d\u4ee4（\u6216\u7528 SCAN \u66ff\u4ee3）<\/p>\n
SELinux \u662f\u5185\u6838\u7ea7\u7684\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf，\u80fd\u9650\u5236\u88ab\u5165\u4fb5\u540e\u7684\u6a2a\u5411\u79fb\u52a8：<\/p>\n
# \u68c0\u67e5 SELinux \u72b6\u6001
\ngetenforce
\nsestatus<\/p>\n
# \u5982\u679c\u662f Permissive，\u6539\u4e3a Enforcing
\n# \u7f16\u8f91 \/etc\/selinux\/config
\nSELINUX=enforcing
\nSELINUXTYPE=targeted<\/p>\n
# \u4e34\u65f6\u751f\u6548
\nsetenforce 1<\/p>\n
# SELinux \u5e38\u7528\u7ba1\u7406\u547d\u4ee4
\n# \u67e5\u770b\u6587\u4ef6\u5b89\u5168\u4e0a\u4e0b\u6587
\nls -Z \/var\/www\/html
\nps auxZ | grep nginx<\/p>\n
# \u4fee\u6539\u76ee\u5f55\u5b89\u5168\u4e0a\u4e0b\u6587（Web \u76ee\u5f55\u8fc1\u79fb\u540e\u5e38\u7528）
\nsemanage fcontext -a -t httpd_sys_content_t\u00a0"\/var\/www(\/.*)?"
\nrestorecon -Rv \/var\/www<\/p>\n
# \u5141\u8bb8\u670d\u52a1\u4f7f\u7528\u975e\u6807\u51c6\u7aef\u53e3
\nsemanage port -a -t http_port_t -p tcp 8080<\/p>\n
\u98ce\u9669\u63d0\u9192：<\/p>\n
\u5f00\u542f SELinux \u524d\u8981\u786e\u4fdd\u719f\u6089\u5e38\u89c1\u5e94\u7528\u7684\u914d\u7f6e，\u5426\u5219\u4f1a\u5bfc\u81f4\u670d\u52a1\u542f\u52a8\u5931\u8d25\u3002<\/p>\n<\/li>\n
\u5982\u679c\u4e1a\u52a1\u5e94\u7528\u5728 Permissive \u6a21\u5f0f\u4e0b\u8fd0\u884c\u6b63\u5e38\u518d\u5207\u6362\u5230 Enforcing\u3002<\/p>\n<\/li>\n
\u9047\u5230\u6743\u9650\u95ee\u9898\u65f6，\u4f18\u5148\u7528\u00a0ausearch\u3001sealert\u00a0\u67e5\u770b SELinux \u62d2\u7edd\u65e5\u5fd7，\u800c\u4e0d\u662f\u76f4\u63a5\u964d\u7ea7\u5230 Permissive\u3002<\/p>\n<\/li>\n<\/ul>\n
# \u68c0\u67e5 AppArmor \u72b6\u6001
\naa-status<\/p>\n
# \u67e5\u770b\u6240\u6709\u914d\u7f6e\u6587\u4ef6\u7684\u52a0\u8f7d\u72b6\u6001
\napparmor_status<\/p>\n
# AppArmor \u914d\u7f6e\u6587\u4ef6\u5728 \/etc\/apparmor.d\/
\n# \u7981\u7528\u4e0d\u5fc5\u8981\u914d\u7f6e\u7684\u6fc0\u8fdb\u6a21\u5f0f（\u5982\u679c\u786e\u8ba4\u67d0\u670d\u52a1\u4e0d\u9700\u8981\u7f51\u7edc\u8bbf\u95ee）
\n# \u7f16\u8f91 \/etc\/apparmor.d\/usr.sbin.httpd \u6216\u5bf9\u5e94\u7684 Nginx \u914d\u7f6e\u6587\u4ef6
\n# \u9650\u5236\u7f51\u7edc\u8bbf\u95ee：
\n# network inet tcp,
\n# deny network inet6 tcp,<\/p>\n
\u670d\u52a1\u5668\u88ab\u9ed1\u540e，\u653b\u51fb\u8005\u7b2c\u4e00\u4ef6\u4e8b\u5f80\u5f80\u662f\u6e05\u7406\u65e5\u5fd7\u3002\u65e5\u5fd7\u5fc5\u987b\u96c6\u4e2d\u5230\u8fdc\u7a0b\u670d\u52a1\u5668：<\/p>\n
# rsyslog \u5ba2\u6237\u7aef\u914d\u7f6e，\u5c06\u65e5\u5fd7\u53d1\u9001\u5230\u8fdc\u7a0b\u65e5\u5fd7\u670d\u52a1\u5668
\n# \/etc\/rsyslog.conf \u6dfb\u52a0：
\n*.* @@log-server.example.com:514<\/p>\n
# \u6216\u4f7f\u7528 UDP（\u6027\u80fd\u597d\u4f46\u53ef\u80fd\u4e22\u5305）：
\n*.* @log-server.example.com:514<\/p>\n
# CentOS\/RHEL \u91cd\u542f rsyslog
\nsystemctl restart rsyslog<\/p>\n
# Ubuntu\/Debian
\nsystemctl restart rsyslog<\/p>\n
Linux \u5ba1\u8ba1\u5b88\u62a4\u8fdb\u7a0b（auditd）\u8bb0\u5f55\u7cfb\u7edf\u8c03\u7528，\u662f\u53d6\u8bc1\u7684\u91cd\u8981\u4f9d\u636e：<\/p>\n
# \u5b89\u88c5 auditd
\nyum install -y audit \u00a0# CentOS\/RHEL
\napt install -y auditd \u00a0# Ubuntu\/Debian<\/p>\n
# \u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f
\nsystemctl\u00a0enable\u00a0auditd
\nsystemctl start auditd<\/p>\n
# \u914d\u7f6e\u5ba1\u8ba1\u89c4\u5219
\n# \/etc\/audit\/rules.d\/audit.rules \u6216 \/etc\/audit\/audit.rules
\n# \u8bb0\u5f55\u6240\u6709\u4fee\u6539 \/etc\/passwd\u3001\/etc\/shadow\u3001\/etc\/group \u7684\u64cd\u4f5c
\n-w \/etc\/passwd -p wa -k identity_changes
\n-w \/etc\/shadow -p wa -k identity_changes
\n-w \/etc\/group -p wa -k identity_changes
\n-w \/etc\/gshadow -p wa -k identity_changes<\/p>\n
# \u8bb0\u5f55\u6240\u6709 sudo \u547d\u4ee4
\n-w \/usr\/bin\/sudo -p x -k privileged_commands<\/p>\n
# \u8bb0\u5f55 SSH \u767b\u5f55\u4e8b\u4ef6
\n-w \/etc\/ssh\/sshd_config -p wa -k ssh_config_changes
\n-a always,exit\u00a0-F arch=b64 -S sshd -F auid>=1000 -F auid!=4294967295 -k sshd_login<\/p>\n
# \u8bb0\u5f55\u7f51\u7edc\u914d\u7f6e\u53d8\u66f4
\n-w \/etc\/sysconfig\/network -p wa -k network_changes
\n-w \/etc\/sysconfig\/network-scripts\/ -p wa -k network_changes<\/p>\n
# \u8bb0\u5f55\u654f\u611f\u6587\u4ef6\u7684\u6267\u884c
\n-a always,exit\u00a0-F arch=b64 -S execve -F path=\/usr\/bin\/wget -k network_download
\n-a always,exit\u00a0-F arch=b64 -S execve -F path=\/usr\/bin\/curl -k network_download
\n-a always,exit\u00a0-F arch=b64 -S execve -F path=\/usr\/bin\/python* -k interpreter_usage
\n-a always,exit\u00a0-F arch=b64 -S execve -F path=\/usr\/bin\/perl -k interpreter_usage<\/p>\n
# \u4f7f\u89c4\u5219\u751f\u6548
\naugenrules –load<\/p>\n
# \u67e5\u770b\u5ba1\u8ba1\u65e5\u5fd7
\nausearch -k identity_changes | head -20
\nausearch -k sshd_login | head -20<\/p>\n
# \u67e5\u770b\u6700\u8fd1\u7684\u5ba1\u8ba1\u4e8b\u4ef6
\naureport –latest-events
\naureport –auth | head -30<\/p>\n
\u653b\u51fb\u8005\u53ef\u80fd\u4fee\u6539\u65e5\u5fd7\u63a9\u76d6\u5165\u4fb5\u75d5\u8ff9\u3002\u4f7f\u7528 AIDE \u6216 Tripwire \u505a\u6587\u4ef6\u5b8c\u6574\u6027\u68c0\u67e5：<\/p>\n
# \u5b89\u88c5 AIDE
\nyum install -y aide \u00a0# CentOS\/RHEL
\napt install -y aide \u00a0\u00a0# Ubuntu\/Debian<\/p>\n
# \u521d\u59cb\u5316 AIDE \u6570\u636e\u5e93（\u7b2c\u4e00\u6b21\u8fd0\u884c）
\naide –init<\/p>\n
# \u79fb\u52a8\u521d\u59cb\u6570\u636e\u5e93
\nmv \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz<\/p>\n
# \u5b9a\u671f\u68c0\u67e5（\u624b\u52a8）
\naide –check<\/p>\n
# \u66f4\u65b0\u6570\u636e\u5e93（\u5728\u786e\u8ba4\u7cfb\u7edf\u6b63\u5e38\u540e）
\naide –update
\nmv \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz<\/p>\n
# \u6bcf\u5929\u81ea\u52a8\u68c0\u67e5（\u52a0\u5165 crontab）
\necho"0 3 * * * \/usr\/sbin\/aide –check"\u00a0>> \/etc\/crontab<\/p>\n
# \u5b89\u88c5 rkhunter
\nyum install -y rkhunter \u00a0# CentOS\/RHEL
\napt install -y rkhunter \u00a0# Ubuntu\/Debian<\/p>\n
# \u66f4\u65b0\u7279\u5f81\u5e93
\nrkhunter –update<\/p>\n
# \u6267\u884c\u68c0\u67e5
\nrkhunter –check –sk –rwo<\/p>\n
# \u5173\u952e\u68c0\u67e5\u9879：
\n# – \u68c0\u67e5\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684\u9690\u85cf\u6587\u4ef6
\n# – \u68c0\u67e5\u5e38\u89c1\u7684 Rootkit \u7279\u5f81
\n# – \u68c0\u67e5\u53ef\u7591\u7684 LKM（Loadable Kernel Module）
\n# – \u68c0\u67e5\u7f51\u7edc\u8fde\u63a5
\n# – \u68c0\u67e5\u7cfb\u7edf\u547d\u4ee4\u662f\u5426\u88ab\u66ff\u6362<\/p>\n
# \u5b89\u88c5 chkrootkit
\nyum install -y chkrootkit \u00a0# CentOS\/RHEL
\napt install -y chkrootkit \u00a0# Ubuntu\/Debian<\/p>\n
# \u8fd0\u884c\u68c0\u67e5
\nchkrootkit | grep -v -E\u00a0"(Checking|not found|Nothing found|Not tested)"<\/p>\n
# \u67e5\u770b\u7f51\u7edc\u76f8\u5173
\nchkrootkit -r<\/p>\n
# \u6ce8\u610f：\u6709\u4e9b\u5b89\u5168\u8f6f\u4ef6\u4f1a\u8bef\u62a5
\n# \u5982\u6709\u8bef\u62a5，\u67e5\u770b\u5177\u4f53\u547d\u4ee4\u662f\u5426\u88ab\u66ff\u6362
\nwhich\u00a0ls
\nrpm -qf \/bin\/ls
\nmd5sum \/bin\/ls<\/p>\n
# \u67e5\u770b\u6240\u6709\u8fdb\u7a0b（\u5305\u62ec\u9690\u85cf\u8fdb\u7a0b）
\nps auxf
\nps -ef<\/p>\n
# \u67e5\u770b\u7f51\u7edc\u8fde\u63a5\u548c\u5bf9\u5e94\u8fdb\u7a0b
\nss -tulnp
\nnetstat -antp<\/p>\n
# \u68c0\u67e5\u662f\u5426\u6709\u8fdb\u7a0b\u76d1\u542c\u5f02\u5e38\u7aef\u53e3
\nss -tulnp | grep -v -E\u00a0"(22|80|443|22022)"<\/p>\n
# \u68c0\u67e5\u662f\u5426\u6709\u5230\u5916\u7f51\u7684\u5f02\u5e38\u8fde\u63a5（\u88ab\u63a7\u670d\u52a1\u5668\u4f1a\u5411\u5916\u53d1\u9001\u6570\u636e）
\nss -tnp | grep -v -E\u00a0"(10\\\\.|192\\\\.168\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.)"<\/p>\n
# \u68c0\u67e5\u662f\u5426\u6709\u8fdb\u7a0b\u5728\u8fd0\u884c\u4f46 ps \u770b\u4e0d\u5230（\u9ad8\u7ea7 Rootkit \u7279\u5f81）
\n# \u5982\u679c ps \u548c \/proc \u91cc\u770b\u5230\u8fdb\u7a0b\u4f46 ss\/netstat \u770b\u4e0d\u5230\u76d1\u542c\u7aef\u53e3，\u8bf4\u660e\u53ef\u80fd\u662f\u540e\u95e8
\nfor\u00a0pid\u00a0in\u00a0$(ls \/proc | grep\u00a0'^[0-9]');\u00a0do
\n\u00a0 \u00a0\u00a0if\u00a0[ -f \/proc\/$pid\/cmdline ];\u00a0then
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0echo"PID\u00a0$pid:\u00a0$(cat \/proc\/$pid\/cmdline | tr '\\\\0' ' ')"
\n\u00a0 \u00a0\u00a0fi
\ndone\u00a0| head -50<\/p>\n
# \u68c0\u67e5 crontab \u662f\u5426\u6709\u53ef\u7591\u4efb\u52a1
\ncrontab -l
\ncat \/etc\/crontab
\nls -la \/etc\/cron.d\/
\nls -la \/var\/spool\/cron\/
\ncat \/etc\/cron.d\/* 2>\/dev\/null<\/p>\n
# \u67e5\u770b\u6240\u6709\u7528\u6237\u7684 SSH authorized_keys（\u53ef\u80fd\u88ab\u6dfb\u52a0\u4e86\u653b\u51fb\u8005\u7684\u516c\u94a5）
\nfor\u00a0user\u00a0in\u00a0$(cut -d: -f1 \/etc\/passwd);\u00a0do
\n\u00a0 \u00a0 keyfile="\/home\/$user\/.ssh\/authorized_keys"
\n\u00a0 \u00a0\u00a0if\u00a0[ -f\u00a0"$keyfile"\u00a0];\u00a0then
\n\u00a0 \u00a0 \u00a0 \u00a0\u00a0echo"===\u00a0$user\u00a0authorized_keys ==="
\n\u00a0 \u00a0 \u00a0 \u00a0 cat\u00a0"$keyfile"
\n\u00a0 \u00a0\u00a0fi
\ndone<\/p>\n
# \u68c0\u67e5 root \u7684 authorized_keys（root \u76f4\u63a5\u767b\u5f55\u5df2\u88ab\u7981\u7528，\u4f46 keys \u672c\u8eab\u4e5f\u53ef\u80fd\u88ab\u7be1\u6539）
\nif\u00a0[ -f \/root\/.ssh\/authorized_keys ];\u00a0then
\n\u00a0 \u00a0\u00a0echo"=== root authorized_keys ==="
\n\u00a0 \u00a0 cat \/root\/.ssh\/authorized_keys
\nfi<\/p>\n
# \u68c0\u67e5 SSH \u767b\u5f55\u8bb0\u5f55（\u770b\u662f\u5426\u6709\u5f02\u5e38\u767b\u5f55\u65f6\u95f4\/IP）
\nlast | head -30
\nlastlog | grep -v\u00a0"Never"<\/p>\n
\u9632\u6b62\u5355\u4e2a\u8fdb\u7a0b\u8017\u5c3d\u7cfb\u7edf\u8d44\u6e90\u5bfc\u81f4 DoS：<\/p>\n
# \/etc\/security\/limits.conf \u6dfb\u52a0：
\n# \u9650\u5236\u6700\u5927\u8fdb\u7a0b\u6570
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 soft \u00a0 \u00a0nproc \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4096
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 hard \u00a0 \u00a0nproc \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 8192<\/p>\n
# \u9650\u5236\u6700\u5927\u6587\u4ef6\u63cf\u8ff0\u7b26
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 soft \u00a0 \u00a0nofile \u00a0 \u00a0 \u00a0 \u00a0 \u00a065536
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 hard \u00a0 \u00a0nofile \u00a0 \u00a0 \u00a0 \u00a0 \u00a065536<\/p>\n
# \u9650\u5236 core dump \u5927\u5c0f（\u9632\u6b62\u6cc4\u9732\u654f\u611f\u5185\u5b58\u6570\u636e）
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 soft \u00a0 \u00a0core \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a00
\n* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 hard \u00a0 \u00a0core \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a00<\/p>\n
# \u9650\u5236\u666e\u901a\u7528\u6237\u53ef\u4ee5\u4f7f\u7528\u7684\u5185\u5b58
\n# \u8fd9\u4e2a\u9700\u8981\u6839\u636e\u5b9e\u9645\u5185\u5b58\u8c03\u6574
\n# @student \u00a0 \u00a0 \u00a0 hard \u00a0 \u00a0memlock \u00a0 \u00a0 \u00a0 \u00a02097152<\/p>\n
# \u5728 \/etc\/sysctl.conf \u4e2d\u5df2\u7ecf\u914d\u7f6e
\n# \u518d\u6b21\u786e\u8ba4
\ngrep -E\u00a0"icmp_(echo_ignore_all|accept_redirects)"\u00a0\/etc\/sysctl.conf<\/p>\n
# \u7acb\u5373\u751f\u6548
\nsysctl -p<\/p>\n
\u51cf\u5c11\u5185\u6838\u652f\u6301\u7684\u653b\u51fb\u9762：<\/p>\n
# \/etc\/modprobe.d\/disable-filesystems.conf
\ninstall cramfs \/bin\/true
\ninstall freevxfs \/bin\/true
\ninstall jffs2 \/bin\/true
\ninstall hfs \/bin\/true
\ninstall hfsplus \/bin\/true
\ninstall squashfs \/bin\/true
\ninstall udf \/bin\/true
\ninstall vfat \/bin\/true<\/p>\n
# CentOS\/RHEL：\u4f7f\u7528 yum-cron
\nyum install -y yum-cron<\/p>\n
# \u7f16\u8f91 \/etc\/yum\/yum-cron.conf
\nupdate_cmd = security
\nupdate_messages = yes
\ndownload_updates = yes
\napply_updates = yes<\/p>\n
systemctl\u00a0enable\u00a0yum-cron
\nsystemctl start yum-cron<\/p>\n
# Ubuntu\/Debian：\u4f7f\u7528 unattended-upgrades
\napt install -y unattended-upgrades
\ndpkg-reconfigure -plow unattended-upgrades
\n# \u9009\u62e9 "Yes" \u542f\u7528\u81ea\u52a8\u5b89\u5168\u66f4\u65b0<\/p>\n
# \u67e5\u770b\u81ea\u52a8\u66f4\u65b0\u65e5\u5fd7
\ntail -50 \/var\/log\/yum.log \u00a0# CentOS
\ntail -50 \/var\/log\/unattended-upgrades\/ \u00a0# Ubuntu<\/p>\n
# \u5b89\u88c5 OpenVAS \u6216\u4f7f\u7528 yum\/cve-check（CentOS）
\nyum install -y yum-plugin-security
\nyum updateinfo list security<\/p>\n
# Ubuntu
\napt install -y unattended-upgrades
\n\/usr\/lib\/update-notifier\/update-notifier.notify-matches-available-security-updates<\/p>\n
# \u5982\u679c\u6709\u5546\u4e1a\u6f0f\u6d1e\u626b\u63cf\u5668（Qualys\u3001Rapid7），\u5b9a\u671f\u626b\u63cf\u751f\u4ea7\u670d\u52a1\u5668
\n# \u626b\u63cf\u524d\u901a\u77e5\u76f8\u5173\u65b9，\u9009\u62e9\u7ef4\u62a4\u7a97\u53e3<\/p>\n
\u5185\u6838\u6f0f\u6d1e\u5371\u5bb3\u6781\u5927，\u4f46\u5347\u7ea7\u5185\u6838\u6709\u98ce\u9669（\u53ef\u80fd\u5f71\u54cd\u9a71\u52a8\u3001\u4e1a\u52a1\u4f9d\u8d56）：<\/p>\n
# CentOS\/RHEL \u67e5\u770b\u53ef\u7528\u5185\u6838
\ngrub2-mkconfig -o \/boot\/grub2\/grub.cfg
\nawk -F\\\\' '\/menuentry\/ {print\u00a0$2}' \/boot\/grub2\/grub.cfg<\/p>\n
# \u5b89\u88c5\u6700\u65b0\u7248\u5185\u6838
\nyum update -y kernel<\/p>\n
# \u91cd\u542f\u540e\u9009\u62e9\u65b0\u5185\u6838
\nreboot<\/p>\n
# \u786e\u8ba4\u4f7f\u7528\u7684\u662f\u65b0\u5185\u6838
\nuname -r<\/p>\n
# \u8bbe\u7f6e\u9ed8\u8ba4\u542f\u52a8\u9879（\u9632\u6b62\u8bef\u56de\u6eda）
\ngrub2-set-default "CentOS Linux (6.14.1-1.el8.x86_64) 8 (Core)"
\ngrub2-mkconfig -o \/boot\/grub2\/grub.cfg<\/p>\n
\u98ce\u9669\u63d0\u9192：<\/p>\n
\u5185\u6838\u5347\u7ea7\u5fc5\u987b\u901a\u8fc7\u6d4b\u8bd5\u73af\u5883\u9a8c\u8bc1\u3002<\/p>\n<\/li>\n
\u4e91\u670d\u52a1\u5668\u5347\u7ea7\u5185\u6838\u524d\u786e\u4fdd\u6709\u4e91\u63a7\u5236\u53f0\u6551\u63f4\u65b9\u5f0f\u3002<\/p>\n<\/li>\n
\u5347\u7ea7\u524d\u8bb0\u5f55\u5f53\u524d\u5185\u6838\u7248\u672c\u548c\u542f\u52a8\u9879，\u4fdd\u7559\u56de\u6eda\u80fd\u529b\u3002<\/p>\n<\/li>\n<\/ul>\n
# \u76d1\u63a7 \/etc\/passwd\u3001\/etc\/shadow\u3001\/etc\/group \u7684\u53d8\u66f4
\n# \u4f7f\u7528 auditd（\u524d\u9762\u5df2\u914d\u7f6e）\u8bb0\u5f55\u53d8\u66f4
\n# \u914d\u5408\u4ee5\u4e0b\u811a\u672c\u6bcf\u65e5\u6bd4\u5bf9<\/p>\n
cat > \/opt\/check-accounts.sh <<\u00a0'EOF'
\n#!\/bin\/bash
\n# \u5bf9\u6bd4\u5f53\u65e5\u548c\u6628\u65e5\u7684\u8d26\u6237\u6570\u636e<\/p>\n
YESTERDAY=$(date -d\u00a0"yesterday"\u00a0+%Y%m%d)
\nTODAY=$(date +%Y%m%d)
\nBACKUP_DIR="\/opt\/security-hardening-backup"<\/p>\n
if\u00a0[ ! -f\u00a0"$BACKUP_DIR\/passwd.bak"\u00a0];\u00a0then
\n\u00a0 \u00a0\u00a0echo"No baseline found"
\n\u00a0 \u00a0\u00a0exit\u00a01
\nfi<\/p>\n
echo"=== Checking for new users ==="
\ndiff <(sort \/opt\/security-hardening-backup\/passwd.bak | cut -d: -f1) \\\\
\n\u00a0 \u00a0 \u00a0<(sort \/etc\/passwd | cut -d: -f1) | grep\u00a0"^>"<\/p>\n
echo"=== Checking for removed users ==="
\ndiff <(sort \/opt\/security-hardening-backup\/passwd.bak | cut -d: -f1) \\\\
\n\u00a0 \u00a0 \u00a0<(sort \/etc\/passwd | cut -d: -f1) | grep\u00a0"^<"<\/p>\n
echo"=== Checking for users with changed shells ==="
\ndiff <(sort \/opt\/security-hardening-backup\/passwd.bak | awk -F:\u00a0'{print $1":"$7}') \\\\
\n\u00a0 \u00a0 \u00a0<(sort \/etc\/passwd | awk -F:\u00a0'{print $1":"$7}') | grep\u00a0"^>"<\/p>\n
echo"=== Checking for UID 0 users ==="
\nawk -F:\u00a0'($3==0) {print $1}'\u00a0\/etc\/passwd
\nEOF<\/p>\n
chmod +x \/opt\/check-accounts.sh<\/p>\n
# \u52a0\u5165 crontab \u6bcf\u65e5\u68c0\u67e5
\necho"0 6 * * * root \/opt\/check-accounts.sh"\u00a0>> \/etc\/crontab<\/p>\n
# \u76d1\u63a7\u662f\u5426\u6709\u65b0\u589e\u76d1\u542c\u7aef\u53e3（\u53ef\u80fd\u540e\u95e8\u76d1\u542c）
\ncat > \/opt\/check-ports.sh <<\u00a0'EOF'
\n#!\/bin\/bash
\nYESTERDAY_PORTS="\/var\/tmp\/listening-ports-backup.txt"
\nTODAY_PORTS="\/var\/tmp\/listening-ports-$(date +%Y%m%d).txt"<\/p>\n
ss -tulnp >\u00a0"$TODAY_PORTS"<\/p>\n
if\u00a0[ -f\u00a0"$YESTERDAY_PORTS"\u00a0];\u00a0then
\n\u00a0 \u00a0\u00a0echo"=== NEW listening ports ==="
\n\u00a0 \u00a0 diff\u00a0"$YESTERDAY_PORTS""$TODAY_PORTS"\u00a0| grep\u00a0"^>"\u00a0||\u00a0echo"None"
\n\u00a0 \u00a0\u00a0echo"=== REMOVED listening ports ==="
\n\u00a0 \u00a0 diff\u00a0"$YESTERDAY_PORTS""$TODAY_PORTS"\u00a0| grep\u00a0"^<"\u00a0||\u00a0echo"None"
\nfi<\/p>\n
cp\u00a0"$TODAY_PORTS""$YESTERDAY_PORTS"
\nEOF<\/p>\n
chmod +x \/opt\/check-ports.sh<\/p>\n
# node_exporter \u91c7\u96c6\u7cfb\u7edf\u6307\u6807
\n# \u5b89\u88c5 node_exporter
\nwget https:\/\/github.com\/prometheus\/node_exporter\/releases\/download\/v1.7.0\/node_exporter-1.7.0.linux-amd64.tar.gz
\ntar xvf node_exporter-1.7.0.linux-amd64.tar.gz
\nmv node_exporter-1.7.0.linux-amd64\/node_exporter \/usr\/local\/bin\/<\/p>\n
# \u521b\u5efa systemd \u670d\u52a1（\u542f\u7528 textfile collector \u7528\u4e8e\u81ea\u5b9a\u4e49\u6307\u6807）
\ncat > \/etc\/systemd\/system\/node_exporter.service <<\u00a0'EOF'
\n[Unit]
\nDescription=Node Exporter
\nAfter=network.target<\/p>\n
[Service]
\nExecStart=\/usr\/local\/bin\/node_exporter –collector.textfile.directory=\/var\/lib\/node_exporter\/textfile_collector
\nRestart=on-failure<\/p>\n
[Install]
\nWantedBy=multi-user.target
\nEOF<\/p>\n
systemctl daemon-reload
\nsystemctl\u00a0enable\u00a0node_exporter
\nsystemctl start node_exporter<\/p>\n
# \u521b\u5efa\u81ea\u5b9a\u4e49\u6307\u6807\u91c7\u96c6\u811a\u672c，\u7edf\u8ba1\u76d1\u542c\u7aef\u53e3\u6570\u91cf
\n# \u901a\u8fc7 ss -tuln \u8f93\u51fa\u7edf\u8ba1\u5f53\u524d\u76d1\u542c TCP\/UDP \u7aef\u53e3\u6570，\u7528\u4e8e\u68c0\u6d4b\u88ab\u63a7\u540e\u65b0\u589e\u76d1\u542c\u7aef\u53e3
\nmkdir -p \/var\/lib\/node_exporter\/textfile_collector
\ncat > \/usr\/local\/bin\/node_sock_listen.sh <<\u00a0'SCRIPT'
\n#!\/bin\/bash
\nOUTFILE="\/var\/lib\/node_exporter\/textfile_collector\/node_sock_listen.prom"<\/p>\n
# \u7edf\u8ba1\u5f53\u524d\u76d1\u542c\u4e2d\u7684 TCP \u7aef\u53e3\u6570\u91cf（\u6392\u9664\u56de\u73af\u548c\u76d1\u542c\u72b6\u6001\u4e3a\u7a7a\u7684\u884c）
\nTCP_LISTEN=$(ss -tuln | grep -c\u00a0"LISTEN"\u00a0||\u00a0echo\u00a00)<\/p>\n
# \u7edf\u8ba1\u5f53\u524d\u76d1\u542c\u4e2d\u7684 UDP \u7aef\u53e3\u6570\u91cf
\nUDP_LISTEN=$(ss -uuln | grep -c\u00a0"UNCONN"\u00a0||\u00a0echo\u00a00)<\/p>\n
# \u8f93\u51fa Prometheus textfile \u683c\u5f0f
\ncat >\u00a0"${OUTFILE}.tmp"\u00a0<< EOF
\n# HELP node_sock_listen_count Number of listening sockets by protocol
\n# TYPE node_sock_listen_count gauge
\nnode_sock_listen_count{protocol="tcp"}\u00a0${TCP_LISTEN}
\nnode_sock_listen_count{protocol="udp"}\u00a0${UDP_LISTEN}
\nEOF
\nmv\u00a0"${OUTFILE}.tmp""${OUTFILE}"
\nSCRIPT<\/p>\n
chmod +x \/usr\/local\/bin\/node_sock_listen.sh<\/p>\n
# \u52a0\u5165 crontab，\u6bcf\u5206\u949f\u6267\u884c\u4e00\u6b21
\necho"* * * * * root \/usr\/local\/bin\/node_sock_listen.sh"\u00a0>> \/etc\/crontab<\/p>\n
# \u624b\u52a8\u6267\u884c\u4e00\u6b21\u6d4b\u8bd5
\n\/usr\/local\/bin\/node_sock_listen.sh
\ncat \/var\/lib\/node_exporter\/textfile_collector\/node_sock_listen.prom<\/p>\n
# \u5173\u952e\u544a\u8b66\u89c4\u5219（Prometheus rule file）
\n# \/etc\/prometheus\/rules.yml
\ngroups:
\n– name: security
\n\u00a0 rules:
\n# SSH \u767b\u5f55\u5931\u8d25\u8fc7\u591a（\u9700\u8981\u90e8\u7f72 prometheus\/sshd_exporter \u5e76\u5728 sshd \u914d\u7f6e\u4e2d\u542f\u7528 SyslogFacility AUTHPRIV）
\n\u00a0 – alert: SSHBruteForce
\n\u00a0 \u00a0 expr: rate(sshd_failed_authentication_total[5m]) > 10
\n\u00a0 \u00a0\u00a0for: 2m
\n\u00a0 \u00a0 labels:
\n\u00a0 \u00a0 \u00a0 severity: warning
\n\u00a0 \u00a0 annotations:
\n\u00a0 \u00a0 \u00a0 summary:\u00a0"SSH brute force detected"
\n\u00a0 \u00a0 \u00a0 description:\u00a0"More than 10 failed SSH auth per 5min from {{\u00a0$labels.instance }}"<\/p>\n
# \u65b0\u589e\u76d1\u542c\u7aef\u53e3（\u88ab\u63a7\u7279\u5f81）
\n# \u901a\u8fc7 node_exporter \u7684 textfile collector \u66b4\u9732 ss -tuln \u7edf\u8ba1\u7684\u76d1\u542c\u7aef\u53e3\u6570
\n# \u81ea\u5b9a\u4e49\u91c7\u96c6\u811a\u672c（\u89c1 13.3 \u8282）\u751f\u6210 node_sock_listen_count \u6307\u6807
\n\u00a0 – alert: NewListeningPort
\n\u00a0 \u00a0 expr: count by (instance) (node_sock_listen_count) > on(instance) count by (instance) (node_sock_listen_count offset 1h)
\n\u00a0 \u00a0\u00a0for: 5m
\n\u00a0 \u00a0 labels:
\n\u00a0 \u00a0 \u00a0 severity: critical
\n\u00a0 \u00a0 annotations:
\n\u00a0 \u00a0 \u00a0 summary:\u00a0"New listening port detected on {{\u00a0$labels.instance }}"<\/p>\n
\u5b8c\u6210\u52a0\u56fa\u540e，\u5fc5\u987b\u8fdb\u884c\u9a8c\u8bc1：<\/p>\n
# SSH \u914d\u7f6e\u9a8c\u8bc1
\nsshd -t
\nssh -p 22022 -o PreferredAuthentications=password -o PubkeyAuthentication=no admin_user@127.0.0.1
\n# \u5e94\u8be5\u62a5\u9519：Permission denied (password refused \u6216\u76f4\u63a5\u62d2\u7edd\u8fde\u63a5)<\/p>\n
# \u5bc6\u94a5\u767b\u5f55\u5e94\u8be5\u6210\u529f
\nssh -p 22022 -i ~\/.ssh\/id_ed25519_server.pub admin_user@127.0.0.1<\/p>\n
# root \u767b\u5f55\u5e94\u8be5\u5931\u8d25
\nssh -p 22022 root@127.0.0.1
\n# \u5e94\u8be5\u62a5\u9519：Permission denied<\/p>\n
# \u9632\u706b\u5899\u9a8c\u8bc1
\n# \u4ece\u5916\u90e8 IP \u8bbf\u95ee\u975e\u767d\u540d\u5355\u7aef\u53e3\u5e94\u8be5\u88ab\u62d2\u7edd
\n# \u4ece\u767d\u540d\u5355 IP \u8bbf\u95ee\u5e94\u8be5\u6b63\u5e38<\/p>\n
# \u6587\u4ef6\u6743\u9650\u9a8c\u8bc1
\nls -la \/etc\/shadow \u00a0# \u5e94\u8be5\u663e\u793a ———-<\/p>\n
# SELinux \u9a8c\u8bc1（CentOS）
\ngetenforce \u00a0# \u5e94\u8be5\u663e\u793a Enforcing<\/p>\n
# fail2ban \u9a8c\u8bc1
\nfail2ban-client status sshd
\n# \u5e94\u8be5\u663e\u793a\u76d1\u72f1\u72b6\u6001\u548c\u89c4\u5219<\/p>\n
# \u670d\u52a1\u7981\u7528\u9a8c\u8bc1
\nsystemctl status telnet.socket \u00a0# \u5e94\u8be5\u663e\u793a inactive
\nsystemctl status bluetooth \u00a0# \u5e94\u8be5\u663e\u793a inactive<\/p>\n
\u6bcf\u6b21\u52a0\u56fa\u5b8c\u6210，\u5fc5\u987b\u8f93\u51fa\u52a0\u56fa\u62a5\u544a，\u5305\u542b：<\/p>\n
\u52a0\u56fa\u65f6\u95f4\u3001\u4eba\u5458<\/p>\n<\/li>\n
\u4fee\u6539\u524d\u7684\u914d\u7f6e\u5907\u4efd\u8def\u5f84<\/p>\n<\/li>\n
\u6bcf\u9879\u52a0\u56fa\u7684\u5177\u4f53\u64cd\u4f5c<\/p>\n<\/li>\n
\u9a8c\u8bc1\u7ed3\u679c<\/p>\n<\/li>\n
\u9057\u7559\u98ce\u9669\u548c\u540e\u7eed\u8ba1\u5212<\/p>\n<\/li>\n<\/ul>\n
cat > \/opt\/security-hardening-report-$(date +%Y%m%d).txt <<\u00a0'EOF'
\n\u5b89\u5168\u52a0\u56fa\u62a5\u544a
\n====================
\n\u65e5\u671f: $(date +%Y-%m-%d)
\n\u64cd\u4f5c\u4eba: admin_user
\n\u670d\u52a1\u5668: $(hostname) \/ $(curl -s ifconfig.me ||\u00a0echo"N\/A")<\/p>\n
\u4e00\u3001\u52a0\u56fa\u9879\u76ee
\n———
\n1. SSH \u5b89\u5168
\n\u00a0 \u00a0– \u7aef\u53e3: 22 -> 22022
\n\u00a0 \u00a0– \u7981\u7528 root \u767b\u5f55: yes
\n\u00a0 \u00a0– \u5bc6\u94a5\u767b\u5f55: yes
\n\u00a0 \u00a0– fail2ban: enabled
\n2. \u9632\u706b\u5899
\n\u00a0 \u00a0– firewalld: enabled
\n\u00a0 \u00a0– \u9ed8\u8ba4\u7b56\u7565: drop
\n\u00a0 \u00a0– \u653e\u884c\u7aef\u53e3: 22022, 80, 443
\n3. \u8d26\u6237\u5b89\u5168
\n\u00a0 \u00a0– \u5bc6\u7801\u7b56\u7565: minlen=12, dcredit=-1, …
\n\u00a0 \u00a0– wheel \u7ec4\u9650\u5236: enabled
\n\u00a0 \u00a0– \u7a7a\u5bc6\u7801\u8d26\u6237: 0
\n4. SELinux: Enforcing (CentOS)
\n5. \u5185\u6838\u53c2\u6570: \u5df2\u52a0\u56fa（sysctl.conf）
\n6. \u65e5\u5fd7\u5ba1\u8ba1: auditd enabled, rsyslog forwarded<\/p>\n
\u4e8c\u3001\u9a8c\u8bc1\u7ed3\u679c
\n———
\n– [x] SSH \u914d\u7f6e\u8bed\u6cd5\u6b63\u786e
\n– [x] root \u65e0\u6cd5\u767b\u5f55
\n– [x] fail2ban \u8fd0\u884c\u6b63\u5e38
\n– [x] firewall-cmd \u89c4\u5219\u751f\u6548
\n– [x] \u5173\u952e\u6587\u4ef6\u6743\u9650\u6b63\u786e
\n– [ ] \u4ece\u5916\u90e8 IP \u5b9e\u9645\u6d4b\u8bd5（\u5f85\u6267\u884c）<\/p>\n
\u4e09\u3001\u9057\u7559\u98ce\u9669
\n———
\n– [ ] \u4e91\u5e73\u53f0\u63a7\u5236\u53f0\u767b\u5f55 MFA \u672a\u914d\u7f6e
\n– [ ] \u6570\u636e\u5e93 Redis \u5bc6\u7801\u9700\u8981\u5b9a\u671f\u8f6e\u6362<\/p>\n
\u56db\u3001\u4e0b\u6b21\u52a0\u56fa\u8ba1\u5212
\n————-
\n– \u6dfb\u52a0 AIDE \u6587\u4ef6\u5b8c\u6574\u6027\u68c0\u67e5
\n– \u914d\u7f6e OSSEC \u4e3b\u673a\u5165\u4fb5\u68c0\u6d4b
\nEOF<\/p>\n
\u5b89\u5168\u52a0\u56fa\u4e0d\u662f\u4e00\u6b21\u6027\u5de5\u4f5c，\u800c\u662f\u6301\u7eed\u7684\u8fc7\u7a0b\u3002\u6838\u5fc3\u539f\u5219\u8981\u8bb0\u4f4f：<\/p>\n
\u6700\u5c0f\u6743\u9650\u539f\u5219：\u00a0\u4e0d\u9700\u8981\u7684\u7aef\u53e3\u5c31\u4e0d\u5f00，\u4e0d\u9700\u8981\u7684\u670d\u52a1\u5c31\u7981\u7528，\u4e0d\u9700\u8981\u7684\u529f\u80fd\u5c31\u5173\u95ed\u3002\u6bcf\u4e2a\u5f00\u653e\u90fd\u5e94\u8be5\u662f\u660e\u786e\u6709\u7406\u7531\u7684\u3002<\/p>\n
\u7eb5\u6df1\u9632\u5fa1\u539f\u5219：\u00a0\u6bcf\u4e00\u5c42\u9632\u7ebf\u5931\u6548\u540e\u8fd8\u6709\u4e0b\u4e00\u5c42\u3002SSH \u5bc6\u94a5\u767b\u5f55\u5931\u6548\u8fd8\u6709 fail2ban \u5c01\u7981，\u9632\u706b\u5899\u5931\u6548\u8fd8\u6709 SELinux \u9650\u5236，\u540e\u95e8\u690d\u5165\u8fd8\u6709 auditd \u8bb0\u5f55\u3002<\/p>\n
\u53ef\u5ba1\u8ba1\u539f\u5219：\u00a0\u4e00\u5207\u64cd\u4f5c\u7686\u6709\u8bb0\u5f55，\u6240\u6709\u53d8\u66f4\u53ef\u8ffd\u6eaf\u3002\u65e5\u5fd7\u4e0d\u4ec5\u8981\u5728，\u800c\u4e14\u4e0d\u80fd\u88ab\u7be1\u6539\u3002\u5b9a\u671f\u68c0\u67e5\u5ba1\u8ba1\u65e5\u5fd7\u6bd4\u88ab\u653b\u51fb\u540e\u624d\u53d1\u73b0\u8981\u597d\u5f97\u591a\u3002<\/p>\n
\u52a0\u56fa\u540e\u8981\u9a8c\u8bc1：\u00a0\u914d\u7f6e\u6539\u4e86\u4e0d\u4ee3\u8868\u751f\u6548，\u8981\u5b9e\u9645\u6d4b\u8bd5\u3002\u6bcf\u505a\u4e00\u9879\u52a0\u56fa，\u9a6c\u4e0a\u9a8c\u8bc1\u662f\u5426\u751f\u6548\u3001\u662f\u5426\u5f71\u54cd\u6b63\u5e38\u529f\u80fd\u3002<\/p>\n
\u4fdd\u6301\u66f4\u65b0：\u00a0\u6f0f\u6d1e\u6bcf\u5929\u90fd\u5728\u88ab\u53d1\u73b0，\u7cfb\u7edf\u6bcf\u5929\u90fd\u5728\u8fd0\u884c\u65b0\u7684\u653b\u51fb\u3002\u5b89\u5168\u52a0\u56fa\u662f\u6301\u7eed\u5de5\u4f5c，\u4e0d\u662f\u505a\u5b8c\u4e00\u6b21\u5c31\u80fd\u9ad8\u6795\u65e0\u5fe7\u3002<\/p>\n
\u6700\u540e\u63d0\u9192：\u52a0\u56fa\u662f\u4e3a\u4e86\u63d0\u9ad8\u653b\u51fb\u6210\u672c，\u800c\u4e0d\u662f\u8ba9\u670d\u52a1\u5668\u5b8c\u5168\u4e0d\u88ab\u653b\u7834\u3002\u518d\u5b8c\u5584\u7684\u52a0\u56fa\u4e5f\u65e0\u6cd5\u4fdd\u8bc1 100% \u5b89\u5168，\u6240\u4ee5\u65e5\u5fd7\u76d1\u63a7\u3001\u5165\u4fb5\u68c0\u6d4b\u3001\u5e94\u6025\u54cd\u5e94\u80fd\u529b\u540c\u6837\u91cd\u8981\u3002\u9632\u5b88\u662f\u4f53\u7cfb，\u52a0\u56fa\u53ea\u662f\u7b2c\u4e00\u6b65\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u670d\u52a1\u5668\u88ab\u653b\u51fb！\u5b8c\u6574\u5b89\u5168\u52a0\u56fa\u6e05\u5355\u6c47\u603b
\n\u670d\u52a1\u5668\u88ab\u9ed1\u4e0d\u662f\u5c0f\u6982\u7387\u4e8b\u4ef6\u3002\u53ea\u8981\u670d\u52a1\u5668\u66b4\u9732\u5728\u516c\u7f51，\u6bcf\u65f6\u6bcf\u523b\u90fd\u5728\u88ab\u626b\u63cf\u3001\u88ab\u5c1d\u8bd5\u5f31\u53e3\u4ee4\u3001\u88ab\u63a2\u6d4b\u6f0f\u6d1e\u3002\u5b89\u5168\u52a0\u56fa\u4e0d\u662f\\”\u7528\u4e0d\u7528\u5fc3\\”\u7684\u95ee\u9898，\u800c\u662f\\”\u6709\u6ca1\u6709\u505a\\”\u7684\u95ee\u9898\u3002\u8fd9\u7bc7\u6587\u7ae0\u7ed9\u51fa\u4e00\u4efd\u5b8c\u6574\u7684 Linux \u670d\u52a1\u5668\u5b89\u5168\u52a0\u56fa\u6e05\u5355，\u6db5\u76d6\u8d26\u6237\u5b89\u5168\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u670d\u52a1\u5b89\u5168\u3001\u65e5\u5fd7\u5ba1\u8ba1\u3001\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u73af\u8282\u3002\u6bcf\u4e2a\u6761\u76ee\u90fd\u8bb2\u89e3\u4e3a\u4ec0\u4e48\u8981\u505a\u3001\u600e\u4e48\u505a\u3001\u4e0d\u505a\u7684\u98ce\u9669\u662f\u4ec0\u4e48，\u8ba9\u521d\u4e2d\u7ea7\u8fd0\u7ef4\u5de5\u7a0b\u5e08\u80fd\u7167\u7740\u64cd\u4f5c\u3001\u843d\u5730<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[61,43,44],"topic":[],"class_list":["post-95958","post","type-post","status-publish","format-standard","hentry","category-server","tag-61","tag-43","tag-44"],"yoast_head":"\n