{"id":99209,"date":"2026-09-02T06:41:48","date_gmt":"2026-09-01T22:41:48","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/99209.html"},"modified":"2026-09-02T06:41:48","modified_gmt":"2026-09-01T22:41:48","slug":"centos-7-%e4%ba%91%e6%9c%8d%e5%8a%a1%e5%99%a8%e5%ae%89%e5%85%a8%e8%bf%90%e7%bb%b4%e4%b8%8e%e5%ae%89%e5%85%a8%e5%ba%94%e6%80%a5%e5%93%8d%e5%ba%94%e5%ae%9e%e6%88%98%e6%95%99%e7%a8%8b","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/99209.html","title":{"rendered":"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b"},"content":{"rendered":"<h3>TL;DR<\/h3>\n<p>\u672c\u6559\u7a0b\u7cfb\u7edf\u8bb2\u89e3 CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u65b9\u6cd5\u3002\u5b89\u5168\u8fd0\u7ef4\u5c42\u9762\u6db5\u76d6\u8d26\u6237\u6743\u9650\u7ba1\u7406\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u7cfb\u7edf\u8865\u4e01\u66f4\u65b0\u3001\u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u63aa\u65bd&#xff1b;\u5e94\u6025\u54cd\u5e94\u5c42\u9762\u5219\u7ed9\u51fa\u4ece\u4e8b\u4ef6\u53d1\u73b0\u3001\u9694\u79bb\u6b62\u635f\u3001\u53d6\u8bc1\u6eaf\u6e90\u5230\u6e05\u9664\u540e\u95e8\u3001\u6062\u590d\u4e1a\u52a1\u7684\u5b8c\u6574\u5904\u7f6e\u6d41\u7a0b&#xff0c;\u5e76\u9488\u5bf9\u6316\u77ff\u3001\u52d2\u7d22\u3001Web \u5165\u4fb5\u7b49\u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u63d0\u4f9b\u5b9e\u6218\u5904\u7f6e\u65b9\u6848\u3002\u6587\u7ae0\u8fd8\u63d0\u4f9b\u4e86\u5b89\u5168\u5de1\u68c0\u811a\u672c\u4e0e Ansible \u6279\u91cf\u52a0\u56fa\u793a\u4f8b&#xff0c;\u5e2e\u52a9\u8bfb\u8005\u5c06\u5b89\u5168\u65b9\u6848\u843d\u5730\u4e3a\u65e5\u5e38\u5236\u5ea6\u3002<\/p>\n<h3>\u76ee\u5f55<\/h3>\n<ul>\n<li>1. \u5f15\u8a00<\/li>\n<li>2. \u5b89\u5168\u8fd0\u7ef4\u57fa\u7840&#xff1a;\u8d26\u6237\u4e0e\u6743\u9650\u7ba1\u7406\n<ul>\n<li>2.1 \u7528\u6237\u8d26\u6237\u5b89\u5168\u57fa\u7ebf<\/li>\n<li>2.2 \u5bc6\u7801\u7b56\u7565\u4e0e\u8d26\u6237\u9501\u5b9a<\/li>\n<li>2.3 sudo \u6743\u9650\u6700\u5c0f\u5316<\/li>\n<\/ul>\n<\/li>\n<li>3. SSH \u5b89\u5168\u52a0\u56fa\n<ul>\n<li>3.1 \u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3\u4e0e\u7981\u7528 root \u767b\u5f55<\/li>\n<li>3.2 \u914d\u7f6e\u5bc6\u94a5\u767b\u5f55<\/li>\n<li>3.3 \u5b89\u88c5 Fail2ban \u9632\u66b4\u529b\u7834\u89e3<\/li>\n<\/ul>\n<\/li>\n<li>4. \u9632\u706b\u5899\u4e0e\u7f51\u7edc\u5b89\u5168\u914d\u7f6e\n<ul>\n<li>4.1 firewalld \u57fa\u7840\u914d\u7f6e<\/li>\n<li>4.2 \u9650\u5236\u6765\u6e90 IP<\/li>\n<li>4.3 \u4f7f\u7528\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4<\/li>\n<li>4.4 \u90e8\u7f72\u7b80\u5355\u7684\u5165\u4fb5\u9632\u5fa1<\/li>\n<\/ul>\n<\/li>\n<li>5. \u7cfb\u7edf\u66f4\u65b0\u4e0e\u6f0f\u6d1e\u7ba1\u7406\n<ul>\n<li>5.1 \u5b9a\u671f\u66f4\u65b0\u7cfb\u7edf\u8865\u4e01<\/li>\n<li>5.2 \u914d\u7f6e\u81ea\u52a8\u5b89\u5168\u66f4\u65b0<\/li>\n<li>5.3 \u6f0f\u6d1e\u626b\u63cf<\/li>\n<\/ul>\n<\/li>\n<li>6. \u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b\n<ul>\n<li>6.1 \u5173\u952e\u65e5\u5fd7\u6587\u4ef6<\/li>\n<li>6.2 \u65e5\u5fd7\u5ba1\u8ba1\u5173\u952e\u70b9<\/li>\n<li>6.3 \u914d\u7f6e rsyslog \u8fdc\u7a0b\u65e5\u5fd7<\/li>\n<li>6.4 \u90e8\u7f72\u5165\u4fb5\u68c0\u6d4b\u5de5\u5177<\/li>\n<\/ul>\n<\/li>\n<li>7. \u5b89\u5168\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b\n<ul>\n<li>7.1 \u53d1\u73b0\u4e0e\u521d\u6b65\u7814\u5224<\/li>\n<li>7.2 \u9694\u79bb\u4e0e\u6b62\u635f<\/li>\n<li>7.3 \u53d6\u8bc1\u4e0e\u6eaf\u6e90<\/li>\n<li>7.4 \u6e05\u9664\u540e\u95e8\u4e0e\u52a0\u56fa<\/li>\n<li>7.5 \u6062\u590d\u4e1a\u52a1\u4e0e\u590d\u76d8<\/li>\n<\/ul>\n<\/li>\n<li>8. \u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u5904\u7f6e\u5b9e\u6218\n<ul>\n<li>8.1 \u6316\u77ff\u75c5\u6bd2\u5904\u7f6e<\/li>\n<li>8.2 \u52d2\u7d22\u75c5\u6bd2\u5904\u7f6e<\/li>\n<li>8.3 Web \u5165\u4fb5\u5904\u7f6e<\/li>\n<\/ul>\n<\/li>\n<li>9. \u5b89\u5168\u8fd0\u7ef4\u81ea\u52a8\u5316\n<ul>\n<li>9.1 \u7f16\u5199\u5b89\u5168\u5de1\u68c0\u811a\u672c<\/li>\n<li>9.2 \u4f7f\u7528 Ansible \u6279\u91cf\u7ba1\u7406<\/li>\n<\/ul>\n<\/li>\n<li>10. \u603b\u7ed3\u4e0e\u6700\u4f73\u5b9e\u8df5\u6e05\u5355<\/li>\n<\/ul>\n<h3>1. \u5f15\u8a00<\/h3>\n<p>\u968f\u7740\u4e91\u8ba1\u7b97\u6280\u672f\u7684\u666e\u53ca&#xff0c;\u8d8a\u6765\u8d8a\u591a\u7684\u4f01\u4e1a\u548c\u4e2a\u4eba\u5c06\u4e1a\u52a1\u90e8\u7f72\u5728\u4e91\u670d\u52a1\u5668\u4e0a\u3002CentOS 7 \u4f5c\u4e3a\u4e00\u6b3e\u7a33\u5b9a\u3001\u5f00\u6e90\u4e14\u793e\u533a\u6d3b\u8dc3\u7684 Linux \u53d1\u884c\u7248&#xff0c;\u662f\u4f17\u591a\u4e91\u670d\u52a1\u5668\u7684\u4e3b\u6d41\u64cd\u4f5c\u7cfb\u7edf\u9009\u62e9\u3002\u7136\u800c&#xff0c;\u4e91\u670d\u52a1\u5668\u66b4\u9732\u5728\u516c\u7f51\u73af\u5883\u4e2d&#xff0c;\u9762\u4e34\u7740\u66b4\u529b\u7834\u89e3\u3001\u6f0f\u6d1e\u5229\u7528\u3001\u6076\u610f\u626b\u63cf\u3001\u6570\u636e\u6cc4\u9732\u7b49\u5404\u7c7b\u5b89\u5168\u5a01\u80c1\u3002\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u80fd\u529b&#xff0c;\u5df2\u6210\u4e3a\u6bcf\u4e00\u4f4d\u4e91\u670d\u52a1\u5668\u7ba1\u7406\u5458\u5fc5\u987b\u638c\u63e1\u7684\u6280\u80fd\u3002<\/p>\n<p>\u672c\u6559\u7a0b\u5c06\u4ece\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u4e24\u4e2a\u7ef4\u5ea6\u51fa\u53d1&#xff0c;\u7cfb\u7edf\u8bb2\u89e3 CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u52a0\u56fa\u65b9\u6cd5\u3001\u65e5\u5e38\u76d1\u63a7\u624b\u6bb5&#xff0c;\u4ee5\u53ca\u5b89\u5168\u4e8b\u4ef6\u53d1\u751f\u540e\u7684\u5e94\u6025\u5904\u7f6e\u6d41\u7a0b\u3002\u5185\u5bb9\u6db5\u76d6\u8d26\u6237\u5b89\u5168\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u5165\u4fb5\u68c0\u6d4b\u3001\u65e5\u5fd7\u5206\u6790\u3001\u75c5\u6bd2\u67e5\u6740\u3001\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b\u7b49\u6838\u5fc3\u4e3b\u9898&#xff0c;\u529b\u6c42\u4e3a\u8bfb\u8005\u63d0\u4f9b\u4e00\u5957\u53ef\u843d\u5730\u3001\u53ef\u6267\u884c\u7684\u5b8c\u6574\u5b89\u5168\u65b9\u6848\u3002<\/p>\n<h3>2. \u5b89\u5168\u8fd0\u7ef4\u57fa\u7840&#xff1a;\u8d26\u6237\u4e0e\u6743\u9650\u7ba1\u7406<\/h3>\n<p>\u8d26\u6237\u4e0e\u6743\u9650\u7ba1\u7406\u662f\u670d\u52a1\u5668\u5b89\u5168\u7684\u7b2c\u4e00\u9053\u9632\u7ebf\u3002\u653b\u51fb\u8005\u5165\u4fb5\u670d\u52a1\u5668\u540e&#xff0c;\u5f80\u5f80\u4f1a\u521b\u5efa\u540e\u95e8\u8d26\u6237\u3001\u4fee\u6539\u6743\u9650\u914d\u7f6e&#xff0c;\u4ee5\u7ef4\u6301\u6301\u4e45\u5316\u8bbf\u95ee\u3002\u56e0\u6b64&#xff0c;\u505a\u597d\u8d26\u6237\u4e0e\u6743\u9650\u7684\u65e5\u5e38\u7ba1\u7406\u81f3\u5173\u91cd\u8981\u3002<\/p>\n<h4>2.1 \u7528\u6237\u8d26\u6237\u5b89\u5168\u57fa\u7ebf<\/h4>\n<p>\u9996\u5148&#xff0c;\u68c0\u67e5\u7cfb\u7edf\u4e2d\u662f\u5426\u5b58\u5728\u5f02\u5e38\u8d26\u6237&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709\u672c\u5730\u7528\u6237<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/passwd<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5177\u6709\u767b\u5f55 Shell \u7684\u7528\u6237<\/span><br \/>\n<span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$7 ~ \/(bash|sh)$\/ {print $1}&#039;<\/span> \/etc\/passwd<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b UID \u4e3a 0 \u7684\u8d85\u7ea7\u7528\u6237&#xff08;\u6b63\u5e38\u5e94\u53ea\u6709 root&#xff09;<\/span><br \/>\n<span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$3 &#061;&#061; 0 {print $1}&#039;<\/span> \/etc\/passwd<\/p>\n<p>\u5b89\u5168\u57fa\u7ebf\u8981\u6c42&#xff1a;<\/p>\n<ul>\n<li>\u9664 root \u5916&#xff0c;\u4e0d\u5e94\u5b58\u5728\u5176\u4ed6 UID \u4e3a 0 \u7684\u8d26\u6237&#xff1b;<\/li>\n<li>\u7981\u7528\u4e0d\u5fc5\u8981\u7684\u7cfb\u7edf\u8d26\u6237\u767b\u5f55 Shell&#xff1b;<\/li>\n<li>\u5b9a\u671f\u6e05\u7406\u957f\u671f\u4e0d\u7528\u7684\u50f5\u5c38\u8d26\u6237&#xff1b;<\/li>\n<li>\u4e3a\u6bcf\u4e2a\u7ba1\u7406\u5458\u5206\u914d\u72ec\u7acb\u8d26\u6237&#xff0c;\u907f\u514d\u5171\u4eab root \u5bc6\u7801\u3002<\/li>\n<\/ul>\n<h4>2.2 \u5bc6\u7801\u7b56\u7565\u4e0e\u8d26\u6237\u9501\u5b9a<\/h4>\n<p>\u901a\u8fc7\u4fee\u6539 \/etc\/login.defs \u548c \/etc\/security\/pwquality.conf \u5f3a\u5316\u5bc6\u7801\u7b56\u7565&#xff1a;<\/p>\n<p><span class=\"token comment\"># \/etc\/login.defs \u5173\u952e\u914d\u7f6e<\/span><br \/>\nPASS_MAX_DAYS   <span class=\"token number\">90<\/span><br \/>\nPASS_MIN_DAYS   <span class=\"token number\">7<\/span><br \/>\nPASS_MIN_LEN    <span class=\"token number\">12<\/span><br \/>\nPASS_WARN_AGE   <span class=\"token number\">7<\/span><\/p>\n<p>\u542f\u7528\u5bc6\u7801\u590d\u6742\u5ea6\u6821\u9a8c&#xff1a;<\/p>\n<p>yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> libpwquality<\/p>\n<p>\u7f16\u8f91 \/etc\/security\/pwquality.conf&#xff1a;<\/p>\n<p>minlen &#061; 12<br \/>\ndcredit &#061; -1<br \/>\nucredit &#061; -1<br \/>\nlcredit &#061; -1<br \/>\nocredit &#061; -1<\/p>\n<p>\u914d\u7f6e\u8d26\u6237\u767b\u5f55\u5931\u8d25\u9501\u5b9a\u7b56\u7565&#xff0c;\u7f16\u8f91 \/etc\/pam.d\/password-auth \u548c \/etc\/pam.d\/system-auth&#xff0c;\u6dfb\u52a0&#xff1a;<\/p>\n<p>auth        required      pam_tally2.so deny&#061;5 unlock_time&#061;600 even_deny_root root_unlock_time&#061;600<br \/>\naccount     required      pam_tally2.so<\/p>\n<p>\u4e0a\u8ff0\u914d\u7f6e\u8868\u793a\u8fde\u7eed\u5931\u8d25 5 \u6b21\u9501\u5b9a\u8d26\u6237 10 \u5206\u949f\u3002<\/p>\n<h4>2.3 sudo \u6743\u9650\u6700\u5c0f\u5316<\/h4>\n<p>\u4e3a\u7ba1\u7406\u5458\u914d\u7f6e\u6700\u5c0f\u5316 sudo \u6743\u9650&#xff0c;\u907f\u514d\u76f4\u63a5\u4f7f\u7528 root \u64cd\u4f5c&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u7ba1\u7406\u5458\u7ec4<\/span><br \/>\n<span class=\"token function\">groupadd<\/span> admin<\/p>\n<p><span class=\"token comment\"># \u5c06\u7528\u6237\u52a0\u5165\u7ba1\u7406\u5458\u7ec4<\/span><br \/>\n<span class=\"token function\">usermod<\/span> <span class=\"token parameter variable\">-aG<\/span> admin username<\/p>\n<p><span class=\"token comment\"># \u7f16\u8f91 sudoers \u6587\u4ef6<\/span><br \/>\nvisudo<\/p>\n<p>\u5728 sudoers \u4e2d\u6dfb\u52a0&#xff1a;<\/p>\n<p>%admin  ALL&#061;(ALL)       ALL<\/p>\n<p>\u540c\u65f6\u5efa\u8bae\u7981\u7528 root \u76f4\u63a5 SSH \u767b\u5f55&#xff08;\u89c1\u4e0b\u4e00\u8282&#xff09;&#xff0c;\u5f3a\u5236\u7ba1\u7406\u5458\u901a\u8fc7\u666e\u901a\u7528\u6237 &#043; sudo \u65b9\u5f0f\u64cd\u4f5c&#xff0c;\u65e2\u4fbf\u4e8e\u5ba1\u8ba1&#xff0c;\u53c8\u80fd\u964d\u4f4e\u98ce\u9669\u3002<\/p>\n<h3>3. SSH \u5b89\u5168\u52a0\u56fa<\/h3>\n<p>SSH \u662f\u4e91\u670d\u52a1\u5668\u6700\u5e38\u7528\u7684\u8fdc\u7a0b\u7ba1\u7406\u901a\u9053&#xff0c;\u4e5f\u662f\u88ab\u66b4\u529b\u7834\u89e3\u653b\u51fb\u6700\u9891\u7e41\u7684\u670d\u52a1\u3002SSH \u52a0\u56fa\u662f\u5b89\u5168\u8fd0\u7ef4\u7684\u91cd\u4e2d\u4e4b\u91cd\u3002<\/p>\n<h4>3.1 \u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3\u4e0e\u7981\u7528 root \u767b\u5f55<\/h4>\n<p>\u7f16\u8f91 \/etc\/ssh\/sshd_config&#xff1a;<\/p>\n<p># \u4fee\u6539\u9ed8\u8ba4\u7aef\u53e3&#xff0c;\u907f\u5f00 22 \u7aef\u53e3\u7684\u6279\u91cf\u626b\u63cf<br \/>\nPort 2222<\/p>\n<p># \u7981\u6b62 root \u76f4\u63a5\u767b\u5f55<br \/>\nPermitRootLogin no<\/p>\n<p># \u9650\u5236\u5141\u8bb8\u767b\u5f55\u7684\u7528\u6237<br \/>\nAllowUsers adminuser<\/p>\n<p># \u4f7f\u7528\u5bc6\u94a5\u8ba4\u8bc1&#xff0c;\u7981\u7528\u5bc6\u7801\u8ba4\u8bc1<br \/>\nPubkeyAuthentication yes<br \/>\nPasswordAuthentication no<\/p>\n<p># \u7a7a\u95f2\u8d85\u65f6\u65ad\u5f00<br \/>\nClientAliveInterval 300<br \/>\nClientAliveCountMax 2<\/p>\n<p>\u4fee\u6539\u540e\u91cd\u542f\u670d\u52a1&#xff1a;<\/p>\n<p>systemctl restart sshd<\/p>\n<p>\u6ce8\u610f&#xff1a;\u4fee\u6539\u7aef\u53e3\u524d\u52a1\u5fc5\u5148\u5728\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u653e\u884c\u65b0\u7aef\u53e3&#xff0c;\u5e76\u786e\u8ba4\u9632\u706b\u5899\u89c4\u5219&#xff0c;\u907f\u514d\u628a\u81ea\u5df1\u9501\u5728\u95e8\u5916\u3002<\/p>\n<h4>3.2 \u914d\u7f6e\u5bc6\u94a5\u767b\u5f55<\/h4>\n<p>\u5728\u672c\u5730\u751f\u6210\u5bc6\u94a5\u5bf9&#xff1a;<\/p>\n<p>ssh-keygen <span class=\"token parameter variable\">-t<\/span> ed25519 <span class=\"token parameter variable\">-C<\/span> <span class=\"token string\">&#034;your_email&#064;example.com&#034;<\/span><\/p>\n<p>\u5c06\u516c\u94a5\u4e0a\u4f20\u81f3\u670d\u52a1\u5668&#xff1a;<\/p>\n<p>ssh-copy-id <span class=\"token parameter variable\">-p<\/span> <span class=\"token number\">2222<\/span> adminuser&#064;server_ip<\/p>\n<p>\u6216\u624b\u52a8\u5c06\u516c\u94a5\u8ffd\u52a0\u5230 ~\/.ssh\/authorized_keys&#xff0c;\u5e76\u8bbe\u7f6e\u6b63\u786e\u6743\u9650&#xff1a;<\/p>\n<p><span class=\"token function\">chmod<\/span> <span class=\"token number\">700<\/span> ~\/.ssh<br \/>\n<span class=\"token function\">chmod<\/span> <span class=\"token number\">600<\/span> ~\/.ssh\/authorized_keys<\/p>\n<h4>3.3 \u5b89\u88c5 Fail2ban \u9632\u66b4\u529b\u7834\u89e3<\/h4>\n<p>Fail2ban \u80fd\u81ea\u52a8\u68c0\u6d4b\u5e76\u5c01\u7981\u9891\u7e41\u5c1d\u8bd5\u767b\u5f55\u7684 IP&#xff1a;<\/p>\n<p>yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> epel-release<br \/>\nyum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> fail2ban<\/p>\n<p>\u521b\u5efa \/etc\/fail2ban\/jail.local&#xff1a;<\/p>\n<p>[DEFAULT]<br \/>\nbantime &#061; 3600<br \/>\nfindtime &#061; 600<br \/>\nmaxretry &#061; 5<\/p>\n<p>[sshd]<br \/>\nenabled &#061; true<br \/>\nport &#061; 2222<br \/>\nlogpath &#061; \/var\/log\/secure<br \/>\nmaxretry &#061; 5<\/p>\n<p>\u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f&#xff1a;<\/p>\n<p>systemctl start fail2ban<br \/>\nsystemctl <span class=\"token builtin class-name\">enable<\/span> fail2ban<\/p>\n<h3>4. \u9632\u706b\u5899\u4e0e\u7f51\u7edc\u5b89\u5168\u914d\u7f6e<\/h3>\n<h4>4.1 firewalld \u57fa\u7840\u914d\u7f6e<\/h4>\n<p>CentOS 7 \u9ed8\u8ba4\u4f7f\u7528 firewalld \u4f5c\u4e3a\u9632\u706b\u5899\u7ba1\u7406\u5de5\u5177&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u542f\u52a8\u5e76\u8bbe\u7f6e\u5f00\u673a\u81ea\u542f<\/span><br \/>\nsystemctl start firewalld<br \/>\nsystemctl <span class=\"token builtin class-name\">enable<\/span> firewalld<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u533a\u57df\u4e0e\u89c4\u5219<\/span><br \/>\nfirewall-cmd &#8211;list-all<\/p>\n<p><span class=\"token comment\"># \u4ec5\u653e\u884c\u5fc5\u8981\u7aef\u53e3<\/span><br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-port<span class=\"token operator\">&#061;<\/span><span class=\"token number\">2222<\/span>\/tcp<br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-port<span class=\"token operator\">&#061;<\/span><span class=\"token number\">80<\/span>\/tcp<br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-port<span class=\"token operator\">&#061;<\/span><span class=\"token number\">443<\/span>\/tcp<br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;reload<\/span><\/p>\n<h4>4.2 \u9650\u5236\u6765\u6e90 IP<\/h4>\n<p>\u5bf9\u4e8e\u7ba1\u7406\u7aef\u53e3&#xff0c;\u5efa\u8bae\u4ec5\u5141\u8bb8\u529e\u516c\u7f51 IP \u8bbf\u95ee&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u4ec5\u5141\u8bb8\u7279\u5b9a IP \u8bbf\u95ee SSH \u7aef\u53e3<\/span><br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;permanent<\/span> &#8211;add-rich-rule<span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#039;rule family&#061;&#034;ipv4&#034; source address&#061;&#034;203.0.113.10&#034; port port&#061;&#034;2222&#034; protocol&#061;&#034;tcp&#034; accept&#039;<\/span><br \/>\nfirewall-cmd <span class=\"token parameter variable\">&#8211;reload<\/span><\/p>\n<h4>4.3 \u4f7f\u7528\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4<\/h4>\n<p>\u4e91\u5e73\u53f0\u5b89\u5168\u7ec4\u662f\u670d\u52a1\u5668\u7684\u7b2c\u4e00\u5c42\u7f51\u7edc\u9632\u7ebf&#xff0c;\u5e94\u9075\u5faa\u6700\u5c0f\u5f00\u653e\u539f\u5219&#xff1a;<\/p>\n<ul>\n<li>\u4ec5\u5f00\u653e\u4e1a\u52a1\u5fc5\u9700\u7aef\u53e3&#xff1b;<\/li>\n<li>\u7ba1\u7406\u7aef\u53e3&#xff08;SSH\u3001\u6570\u636e\u5e93\u7b49&#xff09;\u9650\u5236\u6765\u6e90 IP&#xff1b;<\/li>\n<li>\u5b9a\u671f\u5ba1\u67e5\u5b89\u5168\u7ec4\u89c4\u5219&#xff0c;\u6e05\u7406\u65e0\u6548\u89c4\u5219&#xff1b;<\/li>\n<li>\u907f\u514d\u4f7f\u7528 0.0.0.0\/0 \u5168\u5f00\u653e\u7b56\u7565\u3002<\/li>\n<\/ul>\n<p>\u4e0b\u9762\u5206\u522b\u4ecb\u7ecd\u963f\u91cc\u4e91\u4e0e\u817e\u8baf\u4e91\u5b89\u5168\u7ec4\u63a7\u5236\u53f0\u7684\u914d\u7f6e\u6b65\u9aa4&#xff0c;\u8bfb\u8005\u53ef\u5bf9\u7167\u622a\u56fe\u5360\u4f4d\u8bf4\u660e\u5728\u63a7\u5236\u53f0\u5b8c\u6210\u64cd\u4f5c\u3002<\/p>\n<h5>\u963f\u91cc\u4e91\u5b89\u5168\u7ec4\u914d\u7f6e\u6b65\u9aa4<\/h5>\n<li>\u767b\u5f55\u963f\u91cc\u4e91\u63a7\u5236\u53f0&#xff0c;\u8fdb\u5165\u300c\u4e91\u670d\u52a1\u5668 ECS\u300d\u2192\u300c\u7f51\u7edc\u4e0e\u5b89\u5168\u300d\u2192\u300c\u5b89\u5168\u7ec4\u300d&#xff1b;<\/li>\n<li>\u9009\u62e9\u76ee\u6807\u5b9e\u4f8b\u6240\u5728\u7684\u5730\u57df&#xff0c;\u627e\u5230\u5e76\u70b9\u51fb\u5b9e\u4f8b\u7ed1\u5b9a\u7684\u5b89\u5168\u7ec4 ID&#xff1b;<\/li>\n<li>\u70b9\u51fb\u300c\u5165\u65b9\u5411\u300d\u2192\u300c\u624b\u52a8\u6dfb\u52a0\u300d\u6216\u300c\u5feb\u901f\u6dfb\u52a0\u300d\u89c4\u5219&#xff1b;<\/li>\n<li>\u6309\u9700\u586b\u5199\u534f\u8bae\u7c7b\u578b\u3001\u7aef\u53e3\u8303\u56f4\u3001\u6388\u6743\u5bf9\u8c61&#xff08;\u6765\u6e90 IP&#xff09;\u4e0e\u7b56\u7565&#xff1b;<\/li>\n<li>\u70b9\u51fb\u300c\u4fdd\u5b58\u300d\u540e&#xff0c;\u89c4\u5219\u5373\u65f6\u751f\u6548&#xff0c;\u65e0\u9700\u91cd\u542f\u5b9e\u4f8b\u3002<\/li>\n<p>\u622a\u56fe\u5360\u4f4d&#xff1a;\u6b64\u5904\u53ef\u63d2\u5165\u300c\u963f\u91cc\u4e91\u5b89\u5168\u7ec4\u5165\u65b9\u5411\u89c4\u5219\u914d\u7f6e\u754c\u9762\u300d\u622a\u56fe&#xff0c;\u91cd\u70b9\u6807\u6ce8\u300c\u534f\u8bae\u7c7b\u578b\u300d\u300c\u7aef\u53e3\u8303\u56f4\u300d\u300c\u6388\u6743\u5bf9\u8c61\u300d\u300c\u7b56\u7565\u300d\u56db\u4e2a\u5b57\u6bb5\u7684\u4f4d\u7f6e\u3002<\/p>\n<h5>\u817e\u8baf\u4e91\u5b89\u5168\u7ec4\u914d\u7f6e\u6b65\u9aa4<\/h5>\n<li>\u767b\u5f55\u817e\u8baf\u4e91\u63a7\u5236\u53f0&#xff0c;\u8fdb\u5165\u300c\u4e91\u670d\u52a1\u5668 CVM\u300d\u2192\u300c\u5b89\u5168\u7ec4\u300d&#xff1b;<\/li>\n<li>\u5728\u5b89\u5168\u7ec4\u5217\u8868\u4e2d\u627e\u5230\u76ee\u6807\u5b89\u5168\u7ec4&#xff0c;\u70b9\u51fb\u300c\u5165\u7ad9\u89c4\u5219\u300d\u2192\u300c\u6dfb\u52a0\u89c4\u5219\u300d&#xff1b;<\/li>\n<li>\u9009\u62e9\u7c7b\u578b&#xff08;\u5982\u81ea\u5b9a\u4e49&#xff09;\u3001\u6765\u6e90&#xff08;IP \u6216 CIDR&#xff09;\u3001\u534f\u8bae\u7aef\u53e3\u4e0e\u7b56\u7565&#xff1b;<\/li>\n<li>\u70b9\u51fb\u300c\u5b8c\u6210\u300d\u4fdd\u5b58\u89c4\u5219&#xff0c;\u5e76\u786e\u8ba4\u8be5\u5b89\u5168\u7ec4\u5df2\u5173\u8054\u5230\u76ee\u6807\u5b9e\u4f8b&#xff1b;<\/li>\n<li>\u5982\u9700\u4fee\u6539&#xff0c;\u53ef\u968f\u65f6\u5728\u300c\u5165\u7ad9\u89c4\u5219\u300d\/\u300c\u51fa\u7ad9\u89c4\u5219\u300d\u4e2d\u7f16\u8f91\u6216\u5220\u9664\u3002<\/li>\n<p>\u622a\u56fe\u5360\u4f4d&#xff1a;\u6b64\u5904\u53ef\u63d2\u5165\u300c\u817e\u8baf\u4e91\u5b89\u5168\u7ec4\u5165\u7ad9\u89c4\u5219\u914d\u7f6e\u754c\u9762\u300d\u622a\u56fe&#xff0c;\u91cd\u70b9\u6807\u6ce8\u300c\u6765\u6e90\u300d\u300c\u534f\u8bae\u7aef\u53e3\u300d\u300c\u7b56\u7565\u300d\u4e09\u4e2a\u5b57\u6bb5\u7684\u4f4d\u7f6e\u3002<\/p>\n<h5>\u5b89\u5168\u7ec4\u89c4\u5219\u793a\u4f8b<\/h5>\n<p>\u4ee5\u4e0b\u662f\u4e00\u7ec4\u5178\u578b\u7684\u5b89\u5168\u7ec4\u5165\u65b9\u5411\u89c4\u5219\u793a\u4f8b&#xff0c;\u9075\u5faa\u300c\u6700\u5c0f\u5f00\u653e\u300d\u539f\u5219&#xff1a;<\/p>\n<table>\n<tr>\u534f\u8bae\u7aef\u53e3\u6765\u6e90 IP\u7b56\u7565\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>TCP<\/td>\n<td>22<\/td>\n<td>203.0.113.10\/32<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>\u4ec5\u5141\u8bb8\u529e\u516c\u7f51 IP \u8bbf\u95ee SSH<\/td>\n<\/tr>\n<tr>\n<td>TCP<\/td>\n<td>2222<\/td>\n<td>203.0.113.10\/32<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>\u4fee\u6539\u540e\u7684 SSH \u7ba1\u7406\u7aef\u53e3&#xff0c;\u4ec5\u9650\u529e\u516c\u7f51<\/td>\n<\/tr>\n<tr>\n<td>TCP<\/td>\n<td>80<\/td>\n<td>0.0.0.0\/0<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>\u5bf9\u5916\u5f00\u653e HTTP \u670d\u52a1<\/td>\n<\/tr>\n<tr>\n<td>TCP<\/td>\n<td>443<\/td>\n<td>0.0.0.0\/0<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>\u5bf9\u5916\u5f00\u653e HTTPS \u670d\u52a1<\/td>\n<\/tr>\n<tr>\n<td>TCP<\/td>\n<td>3306<\/td>\n<td>10.0.0.0\/8<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>\u6570\u636e\u5e93\u7aef\u53e3\u4ec5\u5141\u8bb8\u5185\u7f51\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>TCP<\/td>\n<td>6379<\/td>\n<td>10.0.0.0\/8<\/td>\n<td>\u5141\u8bb8<\/td>\n<td>Redis \u7aef\u53e3\u4ec5\u5141\u8bb8\u5185\u7f51\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>\u5168\u90e8<\/td>\n<td>\u5168\u90e8<\/td>\n<td>0.0.0.0\/0<\/td>\n<td>\u62d2\u7edd<\/td>\n<td>\u515c\u5e95\u62d2\u7edd\u6240\u6709\u672a\u653e\u884c\u6d41\u91cf&#xff08;\u7f6e\u4e8e\u89c4\u5219\u5217\u8868\u672b\u5c3e&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u8bf4\u660e&#xff1a;\u5b89\u5168\u7ec4\u89c4\u5219\u6309\u4f18\u5148\u7ea7\u4ece\u4e0a\u5230\u4e0b\u5339\u914d&#xff0c;\u547d\u4e2d\u5373\u751f\u6548\u3002\u5efa\u8bae\u5c06\u300c\u62d2\u7edd\u5168\u90e8\u300d\u4f5c\u4e3a\u6700\u540e\u4e00\u6761\u515c\u5e95\u89c4\u5219&#xff0c;\u5e76\u5c06\u7ba1\u7406\u7aef\u53e3&#xff08;SSH\u3001\u6570\u636e\u5e93\u7b49&#xff09;\u7684\u6765\u6e90 IP \u4e25\u683c\u9650\u5236\u4e3a\u529e\u516c\u7f51\u6216\u5185\u7f51\u7f51\u6bb5&#xff0c;\u907f\u514d\u66b4\u9732\u5728\u516c\u7f51\u3002<\/p>\n<h4>4.4 \u90e8\u7f72\u7b80\u5355\u7684\u5165\u4fb5\u9632\u5fa1<\/h4>\n<p>\u53ef\u9009\u7528\u5f00\u6e90\u5de5\u5177\u5982 crowdsec \u6216 snort \u589e\u5f3a\u7f51\u7edc\u5c42\u68c0\u6d4b\u80fd\u529b\u3002\u4ee5 CrowdSec \u4e3a\u4f8b&#xff1a;<\/p>\n<p><span class=\"token function\">curl<\/span> <span class=\"token parameter variable\">-s<\/span> https:\/\/install.crowdsec.net <span class=\"token operator\">|<\/span> <span class=\"token function\">sh<\/span><br \/>\nsystemctl start crowdsec<br \/>\ncscli collections <span class=\"token function\">install<\/span> crowdsecurity\/sshd<br \/>\ncscli decisions list<\/p>\n<p>CrowdSec \u57fa\u4e8e\u793e\u533a\u5171\u4eab\u7684\u5a01\u80c1\u60c5\u62a5&#xff0c;\u80fd\u81ea\u52a8\u8bc6\u522b\u5e76\u5c01\u7981\u6076\u610f IP&#xff0c;\u9002\u5408\u4f5c\u4e3a Fail2ban \u7684\u589e\u5f3a\u66ff\u4ee3\u65b9\u6848\u3002<\/p>\n<h3>5. \u7cfb\u7edf\u66f4\u65b0\u4e0e\u6f0f\u6d1e\u7ba1\u7406<\/h3>\n<h4>5.1 \u5b9a\u671f\u66f4\u65b0\u7cfb\u7edf\u8865\u4e01<\/h4>\n<p>\u4fdd\u6301\u7cfb\u7edf\u8865\u4e01\u6700\u65b0\u662f\u62b5\u5fa1\u5df2\u77e5\u6f0f\u6d1e\u653b\u51fb\u7684\u6700\u6709\u6548\u624b\u6bb5&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u68c0\u67e5\u53ef\u7528\u66f4\u65b0<\/span><br \/>\nyum check-update<\/p>\n<p><span class=\"token comment\"># \u66f4\u65b0\u6240\u6709\u8f6f\u4ef6\u5305<\/span><br \/>\nyum update <span class=\"token parameter variable\">-y<\/span><\/p>\n<p><span class=\"token comment\"># \u4ec5\u66f4\u65b0\u5b89\u5168\u8865\u4e01<\/span><br \/>\nyum update <span class=\"token parameter variable\">&#8211;security<\/span> <span class=\"token parameter variable\">-y<\/span><\/p>\n<h4>5.2 \u914d\u7f6e\u81ea\u52a8\u5b89\u5168\u66f4\u65b0<\/h4>\n<p>\u5b89\u88c5\u81ea\u52a8\u66f4\u65b0\u5de5\u5177&#xff1a;<\/p>\n<p>yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> yum-cron<\/p>\n<p>\u7f16\u8f91 \/etc\/yum\/yum-cron.conf&#xff1a;<\/p>\n<p>update_cmd &#061; security<br \/>\napply_updates &#061; yes<\/p>\n<p>\u542f\u52a8\u670d\u52a1&#xff1a;<\/p>\n<p>systemctl start yum-cron<br \/>\nsystemctl <span class=\"token builtin class-name\">enable<\/span> yum-cron<\/p>\n<h4>5.3 \u6f0f\u6d1e\u626b\u63cf<\/h4>\n<p>\u5b9a\u671f\u4f7f\u7528\u6f0f\u6d1e\u626b\u63cf\u5de5\u5177\u8bc4\u4f30\u670d\u52a1\u5668\u5b89\u5168\u72b6\u51b5&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5 Lynis \u5b89\u5168\u5ba1\u8ba1\u5de5\u5177<\/span><br \/>\nyum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> epel-release<br \/>\nyum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> lynis<\/p>\n<p><span class=\"token comment\"># \u6267\u884c\u5b89\u5168\u5ba1\u8ba1<\/span><br \/>\nlynis audit system<\/p>\n<p>Lynis \u4f1a\u8f93\u51fa\u8be6\u7ec6\u7684\u5b89\u5168\u5efa\u8bae\u62a5\u544a&#xff0c;\u53ef\u4f5c\u4e3a\u52a0\u56fa\u4f9d\u636e\u3002\u6b64\u5916&#xff0c;\u4e5f\u53ef\u4f7f\u7528 nmap \u5bf9\u81ea\u8eab\u670d\u52a1\u8fdb\u884c\u7aef\u53e3\u626b\u63cf&#xff0c;\u9a8c\u8bc1\u66b4\u9732\u9762&#xff1a;<\/p>\n<p>yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> nmap<br \/>\nnmap <span class=\"token parameter variable\">-sV<\/span> -p- server_ip<\/p>\n<h3>6. \u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b<\/h3>\n<h4>6.1 \u5173\u952e\u65e5\u5fd7\u6587\u4ef6<\/h4>\n<p>CentOS 7 \u7684\u5173\u952e\u65e5\u5fd7\u4f4d\u7f6e&#xff1a;<\/p>\n<table>\n<tr>\u65e5\u5fd7\u6587\u4ef6\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\/var\/log\/messages<\/td>\n<td>\u7cfb\u7edf\u901a\u7528\u65e5\u5fd7<\/td>\n<\/tr>\n<tr>\n<td>\/var\/log\/secure<\/td>\n<td>\u5b89\u5168\u8ba4\u8bc1\u65e5\u5fd7&#xff08;SSH\u3001sudo \u7b49&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\/var\/log\/cron<\/td>\n<td>\u8ba1\u5212\u4efb\u52a1\u65e5\u5fd7<\/td>\n<\/tr>\n<tr>\n<td>\/var\/log\/boot.log<\/td>\n<td>\u7cfb\u7edf\u542f\u52a8\u65e5\u5fd7<\/td>\n<\/tr>\n<tr>\n<td>\/var\/log\/httpd\/<\/td>\n<td>Apache \u8bbf\u95ee\u4e0e\u9519\u8bef\u65e5\u5fd7<\/td>\n<\/tr>\n<tr>\n<td>\/var\/log\/nginx\/<\/td>\n<td>Nginx \u8bbf\u95ee\u4e0e\u9519\u8bef\u65e5\u5fd7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.2 \u65e5\u5fd7\u5ba1\u8ba1\u5173\u952e\u70b9<\/h4>\n<p>\u65e5\u5e38\u5de1\u68c0\u65f6\u5e94\u91cd\u70b9\u5173\u6ce8&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b SSH \u767b\u5f55\u6210\u529f\u8bb0\u5f55<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Accepted&#034;<\/span> \/var\/log\/secure<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b SSH \u767b\u5f55\u5931\u8d25\u8bb0\u5f55<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Failed password&#034;<\/span> \/var\/log\/secure <span class=\"token operator\">|<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-50<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b sudo \u4f7f\u7528\u8bb0\u5f55<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;sudo&#034;<\/span> \/var\/log\/secure<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u65b0\u589e\u7528\u6237<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;useradd&#034;<\/span> \/var\/log\/secure<\/p>\n<h4>6.3 \u914d\u7f6e rsyslog \u8fdc\u7a0b\u65e5\u5fd7<\/h4>\n<p>\u4e3a\u9632\u6b62\u653b\u51fb\u8005\u6e05\u9664\u672c\u5730\u65e5\u5fd7&#xff0c;\u5efa\u8bae\u5c06\u65e5\u5fd7\u5b9e\u65f6\u540c\u6b65\u5230\u8fdc\u7a0b\u65e5\u5fd7\u670d\u52a1\u5668\u3002\u7f16\u8f91 \/etc\/rsyslog.conf&#xff1a;<\/p>\n<p>*.* &#064;logserver.example.com:514<\/p>\n<p>\u91cd\u542f\u670d\u52a1&#xff1a;<\/p>\n<p>systemctl restart rsyslog<\/p>\n<h4>6.4 \u90e8\u7f72\u5165\u4fb5\u68c0\u6d4b\u5de5\u5177<\/h4>\n<p>\u63a8\u8350\u4f7f\u7528 AIDE&#xff08;\u9ad8\u7ea7\u5165\u4fb5\u68c0\u6d4b\u73af\u5883&#xff09;\u76d1\u63a7\u5173\u952e\u6587\u4ef6\u5b8c\u6574\u6027&#xff1a;<\/p>\n<p>yum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> aide<\/p>\n<p>\u521d\u59cb\u5316\u6570\u636e\u5e93&#xff1a;<\/p>\n<p>aide <span class=\"token parameter variable\">&#8211;init<\/span><br \/>\n<span class=\"token function\">mv<\/span> \/var\/lib\/aide\/aide.db.new.gz \/var\/lib\/aide\/aide.db.gz<\/p>\n<p>\u5b9a\u671f\u6bd4\u5bf9&#xff1a;<\/p>\n<p>aide <span class=\"token parameter variable\">&#8211;check<\/span><\/p>\n<p>\u53ef\u5c06\u6bd4\u5bf9\u4efb\u52a1\u52a0\u5165 crontab \u6bcf\u65e5\u6267\u884c&#xff0c;\u5e76\u5c06\u7ed3\u679c\u53d1\u9001\u81f3\u7ba1\u7406\u5458\u90ae\u7bb1\u3002<\/p>\n<h3>7. \u5b89\u5168\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b<\/h3>\n<p>\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u662f\u6307\u5728\u5b89\u5168\u4e8b\u4ef6&#xff08;\u5982\u5165\u4fb5\u3001\u52d2\u7d22\u3001\u6570\u636e\u6cc4\u9732&#xff09;\u53d1\u751f\u540e&#xff0c;\u4e3a\u63a7\u5236\u635f\u5931\u3001\u6062\u590d\u4e1a\u52a1\u3001\u6eaf\u6e90\u53d6\u8bc1\u800c\u91c7\u53d6\u7684\u4e00\u7cfb\u5217\u6709\u5e8f\u884c\u52a8\u3002\u4e00\u4e2a\u89c4\u8303\u7684\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b\u901a\u5e38\u5305\u542b\u4ee5\u4e0b\u9636\u6bb5&#xff1a;<\/p>\n<p>  #mermaid-svg-XUTnxU7YIF9qUnz8{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-XUTnxU7YIF9qUnz8 .error-icon{fill:#552222;}#mermaid-svg-XUTnxU7YIF9qUnz8 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-XUTnxU7YIF9qUnz8 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .marker.cross{stroke:#333333;}#mermaid-svg-XUTnxU7YIF9qUnz8 svg{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-XUTnxU7YIF9qUnz8 p{margin:0;}#mermaid-svg-XUTnxU7YIF9qUnz8 .label{font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;color:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster-label text{fill:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster-label span{color:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster-label span p{background-color:transparent;}#mermaid-svg-XUTnxU7YIF9qUnz8 .label text,#mermaid-svg-XUTnxU7YIF9qUnz8 span{fill:#333;color:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .node rect,#mermaid-svg-XUTnxU7YIF9qUnz8 .node circle,#mermaid-svg-XUTnxU7YIF9qUnz8 .node ellipse,#mermaid-svg-XUTnxU7YIF9qUnz8 .node polygon,#mermaid-svg-XUTnxU7YIF9qUnz8 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .rough-node .label text,#mermaid-svg-XUTnxU7YIF9qUnz8 .node .label text,#mermaid-svg-XUTnxU7YIF9qUnz8 .image-shape .label,#mermaid-svg-XUTnxU7YIF9qUnz8 .icon-shape .label{text-anchor:middle;}#mermaid-svg-XUTnxU7YIF9qUnz8 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .rough-node .label,#mermaid-svg-XUTnxU7YIF9qUnz8 .node .label,#mermaid-svg-XUTnxU7YIF9qUnz8 .image-shape .label,#mermaid-svg-XUTnxU7YIF9qUnz8 .icon-shape .label{text-align:center;}#mermaid-svg-XUTnxU7YIF9qUnz8 .node.clickable{cursor:pointer;}#mermaid-svg-XUTnxU7YIF9qUnz8 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .arrowheadPath{fill:#333333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-XUTnxU7YIF9qUnz8 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-XUTnxU7YIF9qUnz8 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-XUTnxU7YIF9qUnz8 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster text{fill:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 .cluster span{color:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-XUTnxU7YIF9qUnz8 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-XUTnxU7YIF9qUnz8 rect.text{fill:none;stroke-width:0;}#mermaid-svg-XUTnxU7YIF9qUnz8 .icon-shape,#mermaid-svg-XUTnxU7YIF9qUnz8 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-XUTnxU7YIF9qUnz8 .icon-shape p,#mermaid-svg-XUTnxU7YIF9qUnz8 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-XUTnxU7YIF9qUnz8 .icon-shape .label rect,#mermaid-svg-XUTnxU7YIF9qUnz8 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-XUTnxU7YIF9qUnz8 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-XUTnxU7YIF9qUnz8 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-XUTnxU7YIF9qUnz8 :root{&#8211;mermaid-font-family:\\&#8221;trebuchet ms\\&#8221;,verdana,arial,sans-serif;}<\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"edgeLabel\"><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53d1\u73b0\u5b89\u5168\u4e8b\u4ef6<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u521d\u6b65\u7814\u5224\u4e0e\u5b9a\u7ea7<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u9694\u79bb\u4e0e\u6b62\u635f<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u53d6\u8bc1\u4e0e\u6eaf\u6e90<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6e05\u9664\u540e\u95e8\u4e0e\u52a0\u56fa<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6062\u590d\u4e1a\u52a1<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u590d\u76d8\u4e0e\u603b\u7ed3<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8bb0\u5f55\u73b0\u8c61\u3001\u65f6\u95f4\u3001\u5f71\u54cd\u8303\u56f4<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u786e\u8ba4\u4e8b\u4ef6\u7c7b\u578b\u4e0e\u5371\u5bb3\u7b49\u7ea7<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u4e8b\u4ef6\u7814\u5224\u8bb0\u5f55<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u65ad\u5f00\u5916\u7f51 \/ \u5c01\u7981\u6765\u6e90 IP<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u51bb\u7ed3\u53ef\u7591\u8d26\u6237\u3001\u7ec8\u6b62\u53ef\u7591\u8fdb\u7a0b<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u9694\u79bb\u5904\u7f6e\u6e05\u5355<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5907\u4efd\u65e5\u5fd7\u4e0e\u53ef\u7591\u6587\u4ef6<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8ba1\u7b97\u54c8\u5e0c\u3001\u8fd8\u539f\u653b\u51fb\u8def\u5f84<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u53d6\u8bc1\u62a5\u544a<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u5220\u9664\u540e\u95e8\u8d26\u6237\u4e0e\u6076\u610f\u6587\u4ef6<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6e05\u7406\u8ba1\u5212\u4efb\u52a1\u3001\u542f\u52a8\u9879\u3001SSH \u516c\u94a5<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6267\u884c\u7b2c 2-5 \u8282\u5168\u90e8\u52a0\u56fa\u63aa\u65bd<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u52a0\u56fa\u6e05\u5355<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u9010\u6b65\u6062\u590d\u4e1a\u52a1\u670d\u52a1<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u6301\u7eed\u76d1\u63a7\u5f02\u5e38\u884c\u4e3a<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u6062\u590d\u786e\u8ba4\u8bb0\u5f55<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u590d\u76d8\u4e8b\u4ef6\u65f6\u95f4\u7ebf\u4e0e\u6839\u56e0<\/p>\n<p><\/span><\/p>\n<p>         <span class=\"nodeLabel\"><\/p>\n<p>\u8f93\u51fa&#xff1a;\u5e94\u6025\u54cd\u5e94\u62a5\u544a<\/p>\n<p><\/span><\/p>\n<p>\u8bf4\u660e&#xff1a;\u4e0a\u56fe\u5c06\u5e94\u6025\u54cd\u5e94\u62c6\u89e3\u4e3a\u300c\u53d1\u73b0 \u2192 \u7814\u5224 \u2192 \u9694\u79bb \u2192 \u53d6\u8bc1 \u2192 \u6e05\u9664 \u2192 \u6062\u590d \u2192 \u590d\u76d8\u300d\u4e03\u4e2a\u9636\u6bb5\u3002\u6bcf\u4e2a\u9636\u6bb5\u90fd\u5305\u542b\u5173\u952e\u64cd\u4f5c\u6b65\u9aa4&#xff08;\u5982\u5c01\u7981 IP\u3001\u5907\u4efd\u65e5\u5fd7\u3001\u5220\u9664\u540e\u95e8&#xff09;\u4e0e\u8f93\u51fa\u7269&#xff08;\u5982\u7814\u5224\u8bb0\u5f55\u3001\u53d6\u8bc1\u62a5\u544a\u3001\u52a0\u56fa\u6e05\u5355&#xff09;&#xff0c;\u4fbf\u4e8e\u56e2\u961f\u6309\u56fe\u6267\u884c\u3001\u7559\u75d5\u5f52\u6863\u3002\u5176\u4e2d\u300c\u9694\u79bb\u4e0e\u6b62\u635f\u300d\u662f\u63a7\u5236\u635f\u5931\u6269\u5927\u7684\u5173\u952e\u8282\u70b9&#xff0c;\u52a1\u5fc5\u5728\u53d6\u8bc1\u524d\u5b8c\u6210&#xff1b;\u300c\u6e05\u9664\u540e\u95e8\u4e0e\u52a0\u56fa\u300d\u5219\u9700\u5728\u786e\u8ba4\u5165\u4fb5\u8def\u5f84\u540e\u5f7b\u5e95\u6267\u884c&#xff0c;\u9632\u6b62\u4e8c\u6b21\u5165\u4fb5\u3002<\/p>\n<h4>7.1 \u53d1\u73b0\u4e0e\u521d\u6b65\u7814\u5224<\/h4>\n<p>\u5e38\u89c1\u7684\u5b89\u5168\u4e8b\u4ef6\u4fe1\u53f7\u5305\u62ec&#xff1a;<\/p>\n<ul>\n<li>\u670d\u52a1\u5668 CPU \u5f02\u5e38\u98d9\u9ad8&#xff0c;\u5b58\u5728\u6316\u77ff\u8fdb\u7a0b&#xff1b;<\/li>\n<li>\u51fa\u73b0\u672a\u77e5\u8d26\u6237\u6216\u5f02\u5e38\u767b\u5f55\u8bb0\u5f55&#xff1b;<\/li>\n<li>\u7f51\u7ad9\u88ab\u7be1\u6539\u3001\u690d\u5165\u6076\u610f\u94fe\u63a5&#xff1b;<\/li>\n<li>\u6570\u636e\u5e93\u88ab\u52d2\u7d22&#xff0c;\u51fa\u73b0 .locked \u7b49\u540e\u7f00\u6587\u4ef6&#xff1b;<\/li>\n<li>\u5bf9\u5916\u53d1\u8d77\u5927\u91cf\u5f02\u5e38\u6d41\u91cf&#xff0c;\u88ab\u4e91\u5e73\u53f0\u544a\u8b66\u3002<\/li>\n<\/ul>\n<p>\u53d1\u73b0\u5f02\u5e38\u540e&#xff0c;\u7b2c\u4e00\u65f6\u95f4\u8bb0\u5f55\u73b0\u8c61\u3001\u65f6\u95f4\u3001\u6d89\u53ca\u7cfb\u7edf&#xff0c;\u5e76\u901a\u77e5\u76f8\u5173\u4eba\u5458&#xff0c;\u907f\u514d\u5355\u4eba\u76f2\u76ee\u64cd\u4f5c\u7834\u574f\u73b0\u573a\u3002<\/p>\n<h4>7.2 \u9694\u79bb\u4e0e\u6b62\u635f<\/h4>\n<p>\u9694\u79bb\u662f\u5e94\u6025\u54cd\u5e94\u7684\u7b2c\u4e00\u6b65&#xff0c;\u76ee\u7684\u662f\u5207\u65ad\u653b\u51fb\u8005\u7684\u63a7\u5236\u901a\u9053&#xff0c;\u9632\u6b62\u635f\u5931\u6269\u5927&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u7acb\u5373\u65ad\u5f00\u670d\u52a1\u5668\u5916\u7f51&#xff08;\u5728\u4e91\u5e73\u53f0\u63a7\u5236\u53f0\u64cd\u4f5c&#xff0c;\u6216\u76f4\u63a5\u7981\u7528\u7f51\u5361&#xff09;<\/span><br \/>\n<span class=\"token comment\"># \u6216\u901a\u8fc7\u5b89\u5168\u7ec4\u7d27\u6025\u5c01\u7981\u6765\u6e90 IP<\/span><\/p>\n<p><span class=\"token comment\"># \u51bb\u7ed3\u53ef\u7591\u8d26\u6237<\/span><br \/>\n<span class=\"token function\">usermod<\/span> <span class=\"token parameter variable\">-L<\/span> suspicious_user<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5e76\u7ec8\u6b62\u53ef\u7591\u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-i<\/span> suspicious<br \/>\n<span class=\"token function\">kill<\/span> <span class=\"token parameter variable\">-9<\/span> PID<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5e76\u6e05\u7406\u5f02\u5e38\u8ba1\u5212\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-l<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/crontab<br \/>\n<span class=\"token function\">ls<\/span> \/etc\/cron.d\/<\/p>\n<p>\u6ce8\u610f&#xff1a;\u5728\u53d6\u8bc1\u5b8c\u6210\u524d&#xff0c;\u5c3d\u91cf\u4fdd\u6301\u670d\u52a1\u5668\u8fd0\u884c\u72b6\u6001&#xff0c;\u4e0d\u8981\u76f4\u63a5\u5173\u673a\u6216\u91cd\u542f&#xff0c;\u4ee5\u514d\u4e22\u5931\u5185\u5b58\u4e2d\u7684\u5173\u952e\u8bc1\u636e\u3002<\/p>\n<h4>7.3 \u53d6\u8bc1\u4e0e\u6eaf\u6e90<\/h4>\n<p>\u53d6\u8bc1\u9636\u6bb5\u7684\u76ee\u6807\u662f\u8fd8\u539f\u653b\u51fb\u8def\u5f84\u3001\u786e\u8ba4\u5165\u4fb5\u65b9\u5f0f\u3002\u5173\u952e\u53d6\u8bc1\u64cd\u4f5c&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u8bb0\u5f55\u5f53\u524d\u7cfb\u7edf\u65f6\u95f4\u4e0e\u8fd0\u884c\u65f6\u957f<\/span><br \/>\n<span class=\"token function\">date<\/span><br \/>\n<span class=\"token function\">uptime<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u767b\u5f55\u7528\u6237<\/span><br \/>\n<span class=\"token function\">who<\/span><br \/>\nw<br \/>\nlast<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u5386\u53f2\u547d\u4ee4<\/span><br \/>\n<span class=\"token function\">history<\/span><br \/>\n<span class=\"token function\">cat<\/span> ~\/.bash_history<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b SSH \u767b\u5f55\u65e5\u5fd7<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Accepted&#034;<\/span> \/var\/log\/secure <span class=\"token operator\">|<\/span> <span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-100<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7f51\u7edc\u8fde\u63a5<\/span><br \/>\n<span class=\"token function\">netstat<\/span> <span class=\"token parameter variable\">-antlp<\/span><br \/>\nss <span class=\"token parameter variable\">-antlp<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">ps<\/span> <span class=\"token parameter variable\">-ef<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u542f\u52a8\u9879<\/span><br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/rc.d\/<br \/>\n<span class=\"token function\">cat<\/span> \/etc\/rc.local<br \/>\nsystemctl list-unit-files <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> enabled<\/p>\n<p>\u5bf9\u53ef\u7591\u6587\u4ef6\u8fdb\u884c\u5907\u4efd\u5e76\u8ba1\u7b97\u54c8\u5e0c\u503c&#xff0c;\u4f5c\u4e3a\u540e\u7eed\u5206\u6790\u4f9d\u636e&#xff1a;<\/p>\n<p><span class=\"token function\">cp<\/span> \/tmp\/suspicious_file \/evidence\/<br \/>\nmd5sum \/tmp\/suspicious_file<br \/>\nsha256sum \/tmp\/suspicious_file<\/p>\n<h4>7.4 \u6e05\u9664\u540e\u95e8\u4e0e\u52a0\u56fa<\/h4>\n<p>\u786e\u8ba4\u5165\u4fb5\u65b9\u5f0f\u540e&#xff0c;\u5f7b\u5e95\u6e05\u9664\u540e\u95e8\u5e76\u4fee\u590d\u6f0f\u6d1e&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u53ef\u7591\u8d26\u6237<\/span><br \/>\n<span class=\"token function\">userdel<\/span> <span class=\"token parameter variable\">-r<\/span> suspicious_user<\/p>\n<p><span class=\"token comment\"># \u6e05\u7406 SSH \u540e\u95e8\u516c\u94a5<\/span><br \/>\n<span class=\"token function\">cat<\/span> ~\/.ssh\/authorized_keys<br \/>\n<span class=\"token comment\"># \u5220\u9664\u53ef\u7591\u6761\u76ee<\/span><\/p>\n<p><span class=\"token comment\"># \u6e05\u7406\u5f02\u5e38\u8ba1\u5212\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-r<\/span><\/p>\n<p><span class=\"token comment\"># \u6e05\u7406\u5f02\u5e38\u542f\u52a8\u9879<\/span><br \/>\n<span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-f<\/span> \/etc\/rc.d\/rc*.d\/S99backdoor<\/p>\n<p><span class=\"token comment\"># \u68c0\u67e5\u5e76\u6e05\u7406 LD_PRELOAD \u540e\u95e8<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/ld.so.preload<\/p>\n<p>\u6e05\u9664\u540e\u95e8\u540e&#xff0c;\u7acb\u5373\u6267\u884c\u7b2c 2 \u81f3 5 \u8282\u7684\u5168\u90e8\u52a0\u56fa\u63aa\u65bd&#xff0c;\u4fee\u6539\u6240\u6709\u5bc6\u7801\u548c\u5bc6\u94a5&#xff0c;\u66f4\u65b0\u7cfb\u7edf\u8865\u4e01\u3002<\/p>\n<h4>7.5 \u6062\u590d\u4e1a\u52a1\u4e0e\u590d\u76d8<\/h4>\n<p>\u786e\u8ba4\u7cfb\u7edf\u5e72\u51c0\u540e&#xff0c;\u9010\u6b65\u6062\u590d\u4e1a\u52a1\u670d\u52a1&#xff0c;\u5e76\u6301\u7eed\u89c2\u5bdf\u4e00\u6bb5\u65f6\u95f4\u3002\u6700\u540e\u8fdb\u884c\u590d\u76d8\u603b\u7ed3&#xff0c;\u8f93\u51fa\u5e94\u6025\u54cd\u5e94\u62a5\u544a&#xff0c;\u5185\u5bb9\u5305\u62ec&#xff1a;<\/p>\n<ul>\n<li>\u4e8b\u4ef6\u65f6\u95f4\u7ebf\u4e0e\u5f71\u54cd\u8303\u56f4&#xff1b;<\/li>\n<li>\u653b\u51fb\u8def\u5f84\u4e0e\u5165\u4fb5\u65b9\u5f0f&#xff1b;<\/li>\n<li>\u5df2\u91c7\u53d6\u7684\u63aa\u65bd\u4e0e\u4fee\u590d\u7ed3\u679c&#xff1b;<\/li>\n<li>\u66b4\u9732\u7684\u7ba1\u7406\u77ed\u677f\u4e0e\u6539\u8fdb\u8ba1\u5212\u3002<\/li>\n<\/ul>\n<h3>8. \u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u5904\u7f6e\u5b9e\u6218<\/h3>\n<h4>8.1 \u6316\u77ff\u75c5\u6bd2\u5904\u7f6e<\/h4>\n<p>\u6316\u77ff\u75c5\u6bd2\u662f\u4e91\u670d\u52a1\u5668\u6700\u5e38\u89c1\u7684\u5165\u4fb5\u7c7b\u578b&#xff0c;\u5178\u578b\u7279\u5f81\u662f CPU \u5360\u7528\u7387\u98d9\u5347\u3002\u5904\u7f6e\u6b65\u9aa4&#xff1a;<\/p>\n<p><span class=\"token comment\"># 1. \u5b9a\u4f4d\u9ad8 CPU \u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">top<\/span> <span class=\"token parameter variable\">-c<\/span><\/p>\n<p><span class=\"token comment\"># 2. \u67e5\u770b\u8fdb\u7a0b\u8be6\u60c5<\/span><br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-l<\/span> \/proc\/PID\/exe<br \/>\n<span class=\"token function\">cat<\/span> \/proc\/PID\/cmdline<\/p>\n<p><span class=\"token comment\"># 3. \u7ec8\u6b62\u8fdb\u7a0b\u5e76\u5220\u9664\u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">kill<\/span> <span class=\"token parameter variable\">-9<\/span> PID<br \/>\n<span class=\"token function\">rm<\/span> <span class=\"token parameter variable\">-f<\/span> \/tmp\/.xmr-stak<\/p>\n<p><span class=\"token comment\"># 4. \u6e05\u7406\u8ba1\u5212\u4efb\u52a1\u4e0e\u542f\u52a8\u9879<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-l<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-r<\/span><\/p>\n<p><span class=\"token comment\"># 5. \u68c0\u67e5 SSH \u540e\u95e8<\/span><br \/>\n<span class=\"token function\">cat<\/span> ~\/.ssh\/authorized_keys<\/p>\n<h4>8.2 \u52d2\u7d22\u75c5\u6bd2\u5904\u7f6e<\/h4>\n<p>\u53d1\u73b0\u52d2\u7d22\u75c5\u6bd2&#xff08;\u6587\u4ef6\u88ab\u52a0\u5bc6\u3001\u51fa\u73b0\u52d2\u7d22\u63d0\u793a&#xff09;\u65f6&#xff1a;<\/p>\n<li>\u7acb\u5373\u9694\u79bb&#xff1a;\u65ad\u5f00\u670d\u52a1\u5668\u7f51\u7edc&#xff0c;\u9632\u6b62\u6a2a\u5411\u6269\u6563&#xff1b;<\/li>\n<li>\u4fdd\u7559\u73b0\u573a&#xff1a;\u4e0d\u8981\u5220\u9664\u52d2\u7d22\u63d0\u793a\u6587\u4ef6&#xff0c;\u4e0d\u8981\u91cd\u542f&#xff1b;<\/li>\n<li>\u5907\u4efd\u53d6\u8bc1&#xff1a;\u590d\u5236\u88ab\u52a0\u5bc6\u6587\u4ef6\u6837\u672c\u548c\u52d2\u7d22\u63d0\u793a&#xff1b;<\/li>\n<li>\u67e5\u627e\u5165\u53e3&#xff1a;\u6392\u67e5\u5f31\u53e3\u4ee4\u3001\u672a\u4fee\u590d\u6f0f\u6d1e\u3001\u66b4\u9732\u7684\u6570\u636e\u5e93\u7aef\u53e3&#xff1b;<\/li>\n<li>\u8bc4\u4f30\u6062\u590d&#xff1a;\u68c0\u67e5\u662f\u5426\u6709\u5907\u4efd\u53ef\u6062\u590d&#xff0c;\u8bc4\u4f30\u89e3\u5bc6\u5de5\u5177\u53ef\u884c\u6027&#xff1b;<\/li>\n<li>\u91cd\u5efa\u7cfb\u7edf&#xff1a;\u5982\u65e0\u5907\u4efd&#xff0c;\u5efa\u8bae\u91cd\u88c5\u7cfb\u7edf\u5e76\u5168\u9762\u52a0\u56fa\u540e\u6062\u590d\u4e1a\u52a1\u3002<\/li>\n<h4>8.3 Web \u5165\u4fb5\u5904\u7f6e<\/h4>\n<p>\u7f51\u7ad9\u88ab\u7be1\u6539\u6216\u690d\u5165\u6076\u610f\u4ee3\u7801\u65f6&#xff1a;<\/p>\n<p><span class=\"token comment\"># 1. \u67e5\u770b Web \u8bbf\u95ee\u65e5\u5fd7&#xff0c;\u5b9a\u4f4d\u653b\u51fb\u6765\u6e90<\/span><br \/>\n<span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-100<\/span> \/var\/log\/nginx\/access.log<\/p>\n<p><span class=\"token comment\"># 2. \u626b\u63cf Web \u76ee\u5f55\u4e2d\u7684\u6076\u610f\u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token string\">&#034;eval(&#034;<\/span> \/var\/www\/html\/<br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token string\">&#034;base64_decode&#034;<\/span> \/var\/www\/html\/<\/p>\n<p><span class=\"token comment\"># 3. \u68c0\u67e5\u6587\u4ef6\u5b8c\u6574\u6027<\/span><br \/>\n<span class=\"token function\">find<\/span> \/var\/www\/html <span class=\"token parameter variable\">-type<\/span> f <span class=\"token parameter variable\">-mtime<\/span> <span class=\"token parameter variable\">-3<\/span><\/p>\n<p><span class=\"token comment\"># 4. \u68c0\u67e5 Web \u670d\u52a1\u8fd0\u884c\u8d26\u6237\u6743\u9650<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> nginx<\/p>\n<h4>8.4 \u5e38\u89c1\u95ee\u9898\u5feb\u901f\u6392\u67e5\u8868<\/h4>\n<table>\n<tr>\u75c7\u72b6\u53ef\u80fd\u539f\u56e0\u6392\u67e5\u547d\u4ee4\u5904\u7f6e\u5efa\u8bae<\/tr>\n<tbody>\n<tr>\n<td>SSH \u767b\u5f55\u6162<\/td>\n<td>DNS \u53cd\u5411\u89e3\u6790\u8d85\u65f6\u3001GSSAPI \u8ba4\u8bc1\u5ef6\u8fdf<\/td>\n<td>grep -i &#034;sshd&#034; \/var\/log\/secure\u3001ss -antlp | grep :22<\/td>\n<td>\u5728 sshd_config \u4e2d\u8bbe\u7f6e UseDNS no \u548c GSSAPIAuthentication no&#xff0c;\u91cd\u542f sshd<\/td>\n<\/tr>\n<tr>\n<td>\u7aef\u53e3\u88ab\u9891\u7e41\u626b\u63cf<\/td>\n<td>\u66b4\u9732\u5728\u516c\u7f51\u3001\u672a\u9650\u5236\u6765\u6e90 IP<\/td>\n<td>grep &#034;Failed password&#034; \/var\/log\/secure | awk &#039;{print $(NF-3)}&#039; | sort | uniq -c | sort -nr | head<\/td>\n<td>\u4fee\u6539 SSH \u9ed8\u8ba4\u7aef\u53e3\u3001\u914d\u7f6e Fail2ban\u3001\u901a\u8fc7\u5b89\u5168\u7ec4\u9650\u5236\u6765\u6e90 IP<\/td>\n<\/tr>\n<tr>\n<td>CPU \u98d9\u9ad8<\/td>\n<td>\u6316\u77ff\u75c5\u6bd2\u3001\u5f02\u5e38\u8fdb\u7a0b\u3001\u8d44\u6e90\u8017\u5c3d<\/td>\n<td>top -c\u3001ps aux &#8211;sort&#061;-%cpu | head\u3001ls -l \/proc\/PID\/exe<\/td>\n<td>\u5b9a\u4f4d\u5e76\u7ec8\u6b62\u53ef\u7591\u8fdb\u7a0b&#xff0c;\u6e05\u7406\u8ba1\u5212\u4efb\u52a1\u4e0e\u542f\u52a8\u9879&#xff0c;\u5220\u9664\u6076\u610f\u6587\u4ef6<\/td>\n<\/tr>\n<tr>\n<td>\u6587\u4ef6\u88ab\u7be1\u6539<\/td>\n<td>Web \u5165\u4fb5\u3001\u540e\u95e8\u690d\u5165\u3001\u6743\u9650\u914d\u7f6e\u4e0d\u5f53<\/td>\n<td>find \/var\/www\/html -type f -mtime -3\u3001aide &#8211;check\u3001grep -r &#034;eval(&#034; \/var\/www\/html\/<\/td>\n<td>\u6062\u590d\u5907\u4efd\u3001\u4fee\u590d\u6f0f\u6d1e\u3001\u6536\u7d27 Web \u76ee\u5f55\u6743\u9650&#xff0c;\u5fc5\u8981\u65f6\u91cd\u5efa\u7cfb\u7edf<\/td>\n<\/tr>\n<tr>\n<td>\u5f02\u5e38\u5916\u8fde<\/td>\n<td>\u6728\u9a6c\u56de\u8fde\u3001\u6570\u636e\u5916\u4f20\u3001\u88ab\u690d\u5165\u540e\u95e8<\/td>\n<td>ss -antlp\u3001netstat -antlp\u3001lsof -i<\/td>\n<td>\u8bb0\u5f55\u76ee\u6807 IP \u4e0e\u8fdb\u7a0b&#xff0c;\u7ec8\u6b62\u53ef\u7591\u8fde\u63a5&#xff0c;\u6e05\u9664\u540e\u95e8\u5e76\u5c01\u7981\u5916\u8fde IP<\/td>\n<\/tr>\n<tr>\n<td>\u8d26\u6237\u5f02\u5e38\u767b\u5f55<\/td>\n<td>\u5f31\u53e3\u4ee4\u88ab\u7206\u7834\u3001\u8d26\u6237\u6cc4\u9732<\/td>\n<td>last\u3001grep &#034;Accepted&#034; \/var\/log\/secure\u3001awk -F: &#039;$3 &#061;&#061; 0 {print $1}&#039; \/etc\/passwd<\/td>\n<td>\u51bb\u7ed3\u53ef\u7591\u8d26\u6237\u3001\u4fee\u6539\u5bc6\u7801\u3001\u542f\u7528\u5bc6\u94a5\u8ba4\u8bc1\u5e76\u914d\u7f6e\u767b\u5f55\u5931\u8d25\u9501\u5b9a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>8.5 \u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94 CTF \u5e38\u7528\u547d\u4ee4\u5927\u5168<\/h4>\n<p>CTF \u7ade\u8d5b\u4e2d\u7684\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u9898\u76ee&#xff0c;\u901a\u5e38\u8981\u6c42\u9009\u624b\u5728\u6a21\u62df\u88ab\u5165\u4fb5\u7684\u670d\u52a1\u5668\u4e2d\u5feb\u901f\u5b9a\u4f4d\u540e\u95e8\u3001\u8fd8\u539f\u653b\u51fb\u8def\u5f84\u3001\u63d0\u53d6\u6076\u610f\u6837\u672c\u3002\u4ee5\u4e0b\u547d\u4ee4\u6309\u573a\u666f\u5206\u7c7b\u6574\u7406&#xff0c;\u53ef\u4f5c\u4e3a\u5b9e\u6218\u901f\u67e5\u624b\u518c\u3002<\/p>\n<h5>8.5.1 \u4fe1\u606f\u6536\u96c6\u4e0e\u7cfb\u7edf\u72b6\u6001<\/h5>\n<p><span class=\"token comment\"># \u7cfb\u7edf\u57fa\u672c\u4fe1\u606f<\/span><br \/>\n<span class=\"token function\">uname<\/span> <span class=\"token parameter variable\">-a<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/redhat-release<br \/>\n<span class=\"token function\">hostname<\/span><br \/>\n<span class=\"token function\">id<\/span><\/p>\n<p><span class=\"token comment\"># \u5f53\u524d\u767b\u5f55\u7528\u6237\u4e0e\u767b\u5f55\u5386\u53f2<\/span><br \/>\n<span class=\"token function\">who<\/span><br \/>\nw<br \/>\nlast<br \/>\nlastlog<\/p>\n<p><span class=\"token comment\"># \u7cfb\u7edf\u8fd0\u884c\u65f6\u95f4\u4e0e\u8d1f\u8f7d<\/span><br \/>\n<span class=\"token function\">uptime<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/proc\/loadavg<\/p>\n<p><span class=\"token comment\"># \u73af\u5883\u53d8\u91cf&#xff08;\u6392\u67e5\u53ef\u7591 PATH \u52ab\u6301&#xff09;<\/span><br \/>\n<span class=\"token function\">env<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token environment constant\">$PATH<\/span><\/p>\n<h5>8.5.2 \u8fdb\u7a0b\u6392\u67e5<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709\u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">ps<\/span> <span class=\"token parameter variable\">-ef<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux<\/p>\n<p><span class=\"token comment\"># \u6309 CPU \/ \u5185\u5b58\u6392\u5e8f&#xff0c;\u5b9a\u4f4d\u5f02\u5e38\u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%cpu <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-20<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%mem <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-20<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u8fdb\u7a0b\u53ef\u6267\u884c\u6587\u4ef6\u8def\u5f84\u4e0e\u542f\u52a8\u547d\u4ee4<\/span><br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-l<\/span> \/proc\/PID\/exe<br \/>\n<span class=\"token function\">cat<\/span> \/proc\/PID\/cmdline <span class=\"token operator\">|<\/span> <span class=\"token function\">tr<\/span> <span class=\"token string\">&#039;\\\\0&#039;<\/span> <span class=\"token string\">&#039; &#039;<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/proc\/PID\/environ <span class=\"token operator\">|<\/span> <span class=\"token function\">tr<\/span> <span class=\"token string\">&#039;\\\\0&#039;<\/span> <span class=\"token string\">&#039;\\\\n&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u8fdb\u7a0b\u6253\u5f00\u7684\u6587\u4ef6\u4e0e\u7f51\u7edc\u8fde\u63a5<\/span><br \/>\n<span class=\"token function\">lsof<\/span> <span class=\"token parameter variable\">-p<\/span> PID<br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-l<\/span> \/proc\/PID\/fd<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u8fdb\u7a0b\u5de5\u4f5c\u76ee\u5f55<\/span><br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-l<\/span> \/proc\/PID\/cwd<\/p>\n<h5>8.5.3 \u7f51\u7edc\u8fde\u63a5\u6392\u67e5<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709 TCP\/UDP \u8fde\u63a5\u53ca\u5bf9\u5e94\u8fdb\u7a0b<\/span><br \/>\n<span class=\"token function\">netstat<\/span> <span class=\"token parameter variable\">-antlp<\/span><br \/>\nss <span class=\"token parameter variable\">-antlp<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u76d1\u542c\u7aef\u53e3<\/span><br \/>\n<span class=\"token function\">netstat<\/span> <span class=\"token parameter variable\">-tlnp<\/span><br \/>\nss <span class=\"token parameter variable\">-tlnp<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b ESTABLISHED \u72b6\u6001\u7684\u8fde\u63a5&#xff08;\u6392\u67e5\u5916\u8fde&#xff09;<\/span><br \/>\nss <span class=\"token parameter variable\">-antp<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> ESTAB<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u4e0e\u67d0 IP \u7684\u901a\u4fe1<\/span><br \/>\nss <span class=\"token parameter variable\">-antp<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token number\">1.2<\/span>.3.4<\/p>\n<p><span class=\"token comment\"># \u6293\u5305\u5206\u6790<\/span><br \/>\ntcpdump <span class=\"token parameter variable\">-i<\/span> eth0 <span class=\"token parameter variable\">-nn<\/span> <span class=\"token parameter variable\">-s<\/span> <span class=\"token number\">0<\/span> <span class=\"token parameter variable\">-w<\/span> \/tmp\/capture.pcap<br \/>\ntcpdump <span class=\"token parameter variable\">-i<\/span> eth0 <span class=\"token parameter variable\">-nn<\/span> port <span class=\"token number\">4444<\/span><\/p>\n<h5>8.5.4 \u8d26\u6237\u4e0e\u6743\u9650\u6392\u67e5<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709\u7528\u6237\u4e0e UID \u4e3a 0 \u7684\u8d26\u6237<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/passwd<br \/>\n<span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$3 &#061;&#061; 0 {print $1}&#039;<\/span> \/etc\/passwd<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u53ef\u767b\u5f55 Shell \u7684\u7528\u6237<\/span><br \/>\n<span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$7 ~ \/(bash|sh)$\/ {print $1}&#039;<\/span> \/etc\/passwd<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b sudo \u6743\u9650<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/sudoers<br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/sudoers.d\/<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6700\u8fd1\u767b\u5f55\u8bb0\u5f55<\/span><br \/>\nlast<br \/>\nlastb<br \/>\n<span class=\"token function\">cat<\/span> \/var\/log\/secure <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Accepted&#034;<\/span><\/p>\n<h5>8.5.5 \u6587\u4ef6\u4e0e\u540e\u95e8\u6392\u67e5<\/h5>\n<p><span class=\"token comment\"># \u67e5\u627e\u6700\u8fd1\u4fee\u6539\u7684\u6587\u4ef6&#xff08;\u5b9a\u4f4d\u88ab\u7be1\u6539\/\u690d\u5165\u6587\u4ef6&#xff09;<\/span><br \/>\n<span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-type<\/span> f <span class=\"token parameter variable\">-mtime<\/span> <span class=\"token parameter variable\">-3<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<br \/>\n<span class=\"token function\">find<\/span> \/tmp \/var\/tmp \/dev\/shm <span class=\"token parameter variable\">-type<\/span> f <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<\/p>\n<p><span class=\"token comment\"># \u67e5\u627e SUID \u63d0\u6743\u6587\u4ef6<\/span><br \/>\n<span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-perm<\/span> <span class=\"token parameter variable\">-4000<\/span> <span class=\"token parameter variable\">-type<\/span> f <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<\/p>\n<p><span class=\"token comment\"># \u67e5\u627e\u9690\u85cf\u6587\u4ef6\u4e0e\u53ef\u7591\u811a\u672c<\/span><br \/>\n<span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-name<\/span> <span class=\"token string\">&#034;.*&#034;<\/span> <span class=\"token parameter variable\">-type<\/span> f <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-50<\/span><br \/>\n<span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-name<\/span> <span class=\"token string\">&#034;*.sh&#034;<\/span> <span class=\"token parameter variable\">-newer<\/span> \/etc\/passwd <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<\/p>\n<p><span class=\"token comment\"># \u68c0\u67e5 SSH \u540e\u95e8\u516c\u94a5<\/span><br \/>\n<span class=\"token function\">cat<\/span> ~\/.ssh\/authorized_keys<br \/>\n<span class=\"token function\">cat<\/span> \/root\/.ssh\/authorized_keys<\/p>\n<p><span class=\"token comment\"># \u68c0\u67e5 LD_PRELOAD \u540e\u95e8<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/ld.so.preload<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token variable\">$LD_PRELOAD<\/span><\/p>\n<p><span class=\"token comment\"># \u68c0\u67e5\u542f\u52a8\u9879<\/span><br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/rc.d\/<br \/>\n<span class=\"token function\">cat<\/span> \/etc\/rc.local<br \/>\nsystemctl list-unit-files <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> enabled<\/p>\n<h5>8.5.6 \u8ba1\u5212\u4efb\u52a1\u6392\u67e5<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u7528\u6237\u4e0e root \u7684\u8ba1\u5212\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-l<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-u<\/span> root <span class=\"token parameter variable\">-l<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7cfb\u7edf\u7ea7\u8ba1\u5212\u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/crontab<br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/cron.d\/<br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/cron.daily\/<br \/>\n<span class=\"token function\">ls<\/span> <span class=\"token parameter variable\">-la<\/span> \/etc\/cron.hourly\/<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b anacron \u4e0e at \u4efb\u52a1<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/anacrontab<br \/>\natq<\/p>\n<h5>8.5.7 \u65e5\u5fd7\u5206\u6790<\/h5>\n<p><span class=\"token comment\"># SSH \u767b\u5f55\u6210\u529f\/\u5931\u8d25\u8bb0\u5f55<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Accepted&#034;<\/span> \/var\/log\/secure<br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Failed password&#034;<\/span> \/var\/log\/secure<\/p>\n<p><span class=\"token comment\"># \u6309 IP \u7edf\u8ba1\u767b\u5f55\u5931\u8d25\u6b21\u6570<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Failed password&#034;<\/span> \/var\/log\/secure <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;{print $(NF-3)}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">uniq<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token parameter variable\">-nr<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b sudo \u4e0e\u7528\u6237\u521b\u5efa\u8bb0\u5f55<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;sudo&#034;<\/span> \/var\/log\/secure<br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;useradd&#034;<\/span> \/var\/log\/secure<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b Web \u8bbf\u95ee\u65e5\u5fd7\u4e2d\u7684\u6076\u610f\u8bf7\u6c42<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-E<\/span> <span class=\"token string\">&#034;(eval|base64|cmd|exec)&#034;<\/span> \/var\/log\/nginx\/access.log<br \/>\n<span class=\"token function\">tail<\/span> <span class=\"token parameter variable\">-100<\/span> \/var\/log\/nginx\/access.log<\/p>\n<h5>8.5.8 \u6076\u610f\u6837\u672c\u63d0\u53d6\u4e0e\u54c8\u5e0c<\/h5>\n<p><span class=\"token comment\"># \u5907\u4efd\u53ef\u7591\u6587\u4ef6\u5e76\u8ba1\u7b97\u54c8\u5e0c<\/span><br \/>\n<span class=\"token function\">cp<\/span> \/tmp\/suspicious \/evidence\/<br \/>\nmd5sum \/tmp\/suspicious<br \/>\nsha1sum \/tmp\/suspicious<br \/>\nsha256sum \/tmp\/suspicious<\/p>\n<p><span class=\"token comment\"># \u63d0\u53d6\u5185\u5b58\u4e2d\u7684\u8fdb\u7a0b\u955c\u50cf&#xff08;\u9700 root&#xff09;<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/proc\/PID\/mem <span class=\"token operator\">&gt;<\/span> \/evidence\/mem_dump.bin<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6587\u4ef6\u7c7b\u578b\u4e0e\u5b57\u7b26\u4e32<\/span><br \/>\n<span class=\"token function\">file<\/span> \/tmp\/suspicious<br \/>\nstrings \/tmp\/suspicious <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-50<\/span><\/p>\n<h5>8.5.9 \u5e38\u7528\u63d0\u6743\u4e0e\u6f0f\u6d1e\u5229\u7528\u8f85\u52a9<\/h5>\n<p><span class=\"token comment\"># \u67e5\u770b\u5185\u6838\u7248\u672c\u4e0e\u53d1\u884c\u7248&#xff08;\u5339\u914d\u5df2\u77e5\u6f0f\u6d1e&#xff09;<\/span><br \/>\n<span class=\"token function\">uname<\/span> <span class=\"token parameter variable\">-a<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/redhat-release<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u53ef\u5199\u6587\u4ef6\u4e0e\u76ee\u5f55<\/span><br \/>\n<span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-writable<\/span> <span class=\"token parameter variable\">-type<\/span> f <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-v<\/span> proc <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-50<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u73af\u5883\u53d8\u91cf\u4e2d\u7684\u53ef\u7591\u8def\u5f84<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token environment constant\">$PATH<\/span><br \/>\n<span class=\"token function\">cat<\/span> \/etc\/profile<br \/>\n<span class=\"token function\">cat<\/span> ~\/.bashrc<\/p>\n<p>\u63d0\u793a&#xff1a;CTF \u5e94\u6025\u54cd\u5e94\u9898\u7684\u6838\u5fc3\u601d\u8def\u662f\u300c\u5148\u9694\u79bb\u3001\u518d\u53d6\u8bc1\u3001\u540e\u6e05\u9664\u300d\u3002\u62ff\u5230\u9898\u76ee\u540e\u5148\u5907\u4efd\u5173\u952e\u65e5\u5fd7\u4e0e\u53ef\u7591\u6587\u4ef6&#xff0c;\u518d\u6309\u300c\u8fdb\u7a0b \u2192 \u7f51\u7edc \u2192 \u8d26\u6237 \u2192 \u6587\u4ef6 \u2192 \u8ba1\u5212\u4efb\u52a1 \u2192 \u65e5\u5fd7\u300d\u7684\u987a\u5e8f\u9010\u5c42\u6392\u67e5&#xff0c;\u907f\u514d\u9057\u6f0f\u540e\u95e8\u3002<\/p>\n<h3>9. \u5b89\u5168\u8fd0\u7ef4\u81ea\u52a8\u5316<\/h3>\n<h4>9.1 \u7f16\u5199\u5b89\u5168\u5de1\u68c0\u811a\u672c<\/h4>\n<p>\u5c06\u65e5\u5e38\u5de1\u68c0\u5de5\u4f5c\u811a\u672c\u5316&#xff0c;\u53ef\u663e\u8457\u63d0\u5347\u6548\u7387\u3002\u4ee5\u4e0b\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u5de1\u68c0\u811a\u672c\u793a\u4f8b&#xff1a;<\/p>\n<p><span class=\"token shebang important\">#!\/bin\/bash<\/span><br \/>\n<span class=\"token comment\"># security_check.sh &#8211; \u6bcf\u65e5\u5b89\u5168\u5de1\u68c0\u811a\u672c<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#061;&#061;&#061;&#061;&#061; \u7cfb\u7edf\u5b89\u5168\u5de1\u68c0\u62a5\u544a <span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">date<\/span><span class=\"token variable\">)<\/span><\/span> &#061;&#061;&#061;&#061;&#061;&#034;<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 1. \u6700\u8fd1\u767b\u5f55\u8bb0\u5f55 &#8212;&#034;<\/span><br \/>\nlast <span class=\"token parameter variable\">-10<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 2. SSH \u767b\u5f55\u5931\u8d25\u7edf\u8ba1 &#8212;&#034;<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;Failed password&#034;<\/span> \/var\/log\/secure <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;{print $(NF-3)}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">uniq<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token parameter variable\">-nr<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-10<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 3. \u65b0\u589e\u7528\u6237\u68c0\u67e5 &#8212;&#034;<\/span><br \/>\n<span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$3 &gt;&#061; 1000 {print $1, $3}&#039;<\/span> \/etc\/passwd<\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 4. \u9ad8 CPU \u8fdb\u7a0b &#8212;&#034;<\/span><br \/>\n<span class=\"token function\">ps<\/span> aux <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%cpu <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-6<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 5. \u5f02\u5e38\u8ba1\u5212\u4efb\u52a1 &#8212;&#034;<\/span><br \/>\n<span class=\"token function\">crontab<\/span> <span class=\"token parameter variable\">-l<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<\/p>\n<p>\u52a0\u5165 crontab \u6bcf\u65e5\u6267\u884c&#xff1a;<\/p>\n<p><span class=\"token function\">chmod<\/span> &#043;x \/usr\/local\/bin\/security_check.sh<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;0 8 * * * \/usr\/local\/bin\/security_check.sh | mail -s &#039;Daily Security Report&#039; admin&#064;example.com&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">crontab<\/span> &#8211;<\/p>\n<p>\u9664\u4e86\u4e0a\u8ff0\u57fa\u7840\u5de1\u68c0\u811a\u672c&#xff0c;\u4e0b\u9762\u63d0\u4f9b\u4e00\u4e2a\u66f4\u5168\u9762\u7684\u5b89\u5168\u57fa\u7ebf\u68c0\u67e5\u811a\u672c\u3002\u5b83\u9010\u9879\u68c0\u67e5\u8d26\u6237\u6743\u9650\u3001SSH \u914d\u7f6e\u3001\u9632\u706b\u5899\u89c4\u5219\u3001\u5173\u952e\u6587\u4ef6\u6743\u9650\u3001\u5f02\u5e38\u8fdb\u7a0b\u4e0e\u7f51\u7edc\u8fde\u63a5&#xff0c;\u5e76\u4e3a\u6bcf\u9879\u8f93\u51fa PASS\/FAIL \u72b6\u6001\u548c\u5bf9\u5e94\u7684\u4fee\u590d\u5efa\u8bae&#xff0c;\u9002\u5408\u4f5c\u4e3a\u5b9a\u671f\u5b89\u5168\u5ba1\u8ba1\u7684\u81ea\u52a8\u5316\u5de5\u5177&#xff1a;<\/p>\n<p><span class=\"token shebang important\">#!\/bin\/bash<\/span><br \/>\n<span class=\"token comment\"># security_baseline_check.sh &#8211; \u5b89\u5168\u57fa\u7ebf\u68c0\u67e5\u811a\u672c<\/span><br \/>\n<span class=\"token comment\"># \u7528\u6cd5&#xff1a;sudo bash security_baseline_check.sh<\/span><\/p>\n<p><span class=\"token assign-left variable\">PASS<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span><br \/>\n<span class=\"token assign-left variable\">FAIL<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span><br \/>\n<span class=\"token assign-left variable\">WARN<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token number\">0<\/span><\/p>\n<p><span class=\"token function-name function\">check<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span><br \/>\n    <span class=\"token builtin class-name\">local<\/span> <span class=\"token assign-left variable\">name<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;<span class=\"token variable\">$1<\/span>&#034;<\/span><br \/>\n    <span class=\"token builtin class-name\">local<\/span> <span class=\"token assign-left variable\">status<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;<span class=\"token variable\">$2<\/span>&#034;<\/span><br \/>\n    <span class=\"token builtin class-name\">local<\/span> <span class=\"token assign-left variable\">advice<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;<span class=\"token variable\">$3<\/span>&#034;<\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$status<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n        <span class=\"token assign-left variable\">PASS<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$((<\/span>PASS<span class=\"token operator\">&#043;<\/span><span class=\"token number\">1<\/span><span class=\"token variable\">))<\/span><\/span><br \/>\n        <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;[PASS] <span class=\"token variable\">$name<\/span>&#034;<\/span><br \/>\n    <span class=\"token keyword\">elif<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$status<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n        <span class=\"token assign-left variable\">WARN<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$((<\/span>WARN<span class=\"token operator\">&#043;<\/span><span class=\"token number\">1<\/span><span class=\"token variable\">))<\/span><\/span><br \/>\n        <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;[WARN] <span class=\"token variable\">$name<\/span> &#8211; <span class=\"token variable\">$advice<\/span>&#034;<\/span><br \/>\n    <span class=\"token keyword\">else<\/span><br \/>\n        <span class=\"token assign-left variable\">FAIL<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$((<\/span>FAIL<span class=\"token operator\">&#043;<\/span><span class=\"token number\">1<\/span><span class=\"token variable\">))<\/span><\/span><br \/>\n        <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;[FAIL] <span class=\"token variable\">$name<\/span> &#8211; <span class=\"token variable\">$advice<\/span>&#034;<\/span><br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n<span class=\"token punctuation\">}<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#061;&#061;&#061;&#061;&#061; CentOS 7 \u5b89\u5168\u57fa\u7ebf\u68c0\u67e5\u62a5\u544a <span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">date<\/span><span class=\"token variable\">)<\/span><\/span> &#061;&#061;&#061;&#061;&#061;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 1. \u8d26\u6237\u4e0e\u6743\u9650\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 1. \u8d26\u6237\u4e0e\u6743\u9650 &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 1.1 \u68c0\u67e5 UID \u4e3a 0 \u7684\u8d26\u6237&#xff08;\u6b63\u5e38\u5e94\u53ea\u6709 root&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">uid0<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$3 &#061;&#061; 0 {print $1}&#039;<\/span> \/etc\/passwd <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token string\">&#039;^root$&#039;<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$uid0<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;UID 0 \u8d26\u6237\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;UID 0 \u8d26\u6237\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u5b58\u5728\u975e root \u7684 UID 0 \u8d26\u6237: <span class=\"token variable\">$uid0<\/span>&#xff0c;\u8bf7\u7acb\u5373\u6392\u67e5\u5e76\u5220\u9664: userdel -r <span class=\"token variable\">$uid0<\/span>&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 1.2 \u68c0\u67e5\u7a7a\u5bc6\u7801\u8d26\u6237<\/span><br \/>\n<span class=\"token assign-left variable\">empty_pw<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;($2 &#061;&#061; &#034;&#034; || $2 &#061;&#061; &#034;!&#034;) &amp;&amp; $3 &gt;&#061; 1000 {print $1}&#039;<\/span> \/etc\/shadow <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$empty_pw<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u7a7a\u5bc6\u7801\u8d26\u6237\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u7a7a\u5bc6\u7801\u8d26\u6237\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u5b58\u5728\u7a7a\u5bc6\u7801\u8d26\u6237: <span class=\"token variable\">$empty_pw<\/span>&#xff0c;\u8bf7\u8bbe\u7f6e\u5f3a\u5bc6\u7801: passwd <span class=\"token variable\">$empty_pw<\/span>&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 1.3 \u68c0\u67e5\u53ef\u767b\u5f55\u8d26\u6237\u6570\u91cf&#xff08;\u6392\u9664\u7cfb\u7edf\u8d26\u6237&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">login_users<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">awk<\/span> -F: <span class=\"token string\">&#039;$7 ~ \/(bash|sh)$\/ &amp;&amp; $3 &gt;&#061; 1000 {print $1}&#039;<\/span> \/etc\/passwd <span class=\"token operator\">|<\/span> <span class=\"token function\">wc<\/span> <span class=\"token parameter variable\">-l<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$login_users<\/span>&#034;<\/span> <span class=\"token parameter variable\">-le<\/span> <span class=\"token number\">5<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u53ef\u767b\u5f55\u8d26\u6237\u6570\u91cf&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u53ef\u767b\u5f55\u8d26\u6237\u6570\u91cf&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u53ef\u767b\u5f55\u8d26\u6237\u8f83\u591a&#xff08;<span class=\"token variable\">$login_users<\/span> \u4e2a&#xff09;&#xff0c;\u8bf7\u786e\u8ba4\u662f\u5426\u5747\u4e3a\u5fc5\u8981\u8d26\u6237&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 1.4 \u68c0\u67e5 sudoers \u662f\u5426\u5305\u542b NOPASSWD<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token string\">&#034;NOPASSWD&#034;<\/span> \/etc\/sudoers \/etc\/sudoers.d\/ <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token string\">&#039;^#&#039;<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;sudo NOPASSWD \u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u5b58\u5728\u514d\u5bc6 sudo \u914d\u7f6e&#xff0c;\u5efa\u8bae\u79fb\u9664 NOPASSWD \u4ee5\u964d\u4f4e\u98ce\u9669&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;sudo NOPASSWD \u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 2. SSH \u914d\u7f6e\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 2. SSH \u914d\u7f6e &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 2.1 \u68c0\u67e5 PermitRootLogin<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-q<\/span> <span class=\"token string\">&#034;^PermitRootLogin no&#034;<\/span> \/etc\/ssh\/sshd_config <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7981\u7528 root \u767b\u5f55&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7981\u7528 root \u767b\u5f55&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u672a\u7981\u7528 root \u767b\u5f55&#xff0c;\u8bf7\u5728 \/etc\/ssh\/sshd_config \u8bbe\u7f6e PermitRootLogin no \u5e76\u91cd\u542f sshd&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 2.2 \u68c0\u67e5\u5bc6\u7801\u8ba4\u8bc1\u662f\u5426\u7981\u7528<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-q<\/span> <span class=\"token string\">&#034;^PasswordAuthentication no&#034;<\/span> \/etc\/ssh\/sshd_config <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7981\u7528\u5bc6\u7801\u8ba4\u8bc1&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7981\u7528\u5bc6\u7801\u8ba4\u8bc1&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u672a\u7981\u7528\u5bc6\u7801\u8ba4\u8bc1&#xff0c;\u5efa\u8bae\u542f\u7528\u5bc6\u94a5\u8ba4\u8bc1\u5e76\u8bbe\u7f6e PasswordAuthentication no&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 2.3 \u68c0\u67e5 SSH \u7aef\u53e3\u662f\u5426\u4e3a\u9ed8\u8ba4 22<\/span><br \/>\n<span class=\"token assign-left variable\">ssh_port<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-E<\/span> <span class=\"token string\">&#034;^Port &#034;<\/span> \/etc\/ssh\/sshd_config <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;{print $2}&#039;<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$ssh_port<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span> <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$ssh_port<\/span>&#034;<\/span> <span class=\"token operator\">!&#061;<\/span> <span class=\"token string\">&#034;22&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7aef\u53e3\u975e\u9ed8\u8ba4&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;SSH \u7aef\u53e3\u975e\u9ed8\u8ba4&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;SSH \u4ecd\u4f7f\u7528\u9ed8\u8ba4\u7aef\u53e3 22&#xff0c;\u5efa\u8bae\u4fee\u6539\u4e3a\u9ad8\u4f4d\u7aef\u53e3\u4ee5\u964d\u4f4e\u88ab\u626b\u63cf\u98ce\u9669&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 2.4 \u68c0\u67e5 authorized_keys \u6743\u9650<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-f<\/span> \/root\/.ssh\/authorized_keys <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    <span class=\"token assign-left variable\">perm<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">stat<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;%a&#034;<\/span> \/root\/.ssh\/authorized_keys<span class=\"token variable\">)<\/span><\/span><br \/>\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;600&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n        check <span class=\"token string\">&#034;authorized_keys \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n    <span class=\"token keyword\">else<\/span><br \/>\n        check <span class=\"token string\">&#034;authorized_keys \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u6743\u9650\u4e3a <span class=\"token variable\">$perm<\/span>&#xff0c;\u5e94\u8bbe\u4e3a 600: chmod 600 \/root\/.ssh\/authorized_keys&#034;<\/span><br \/>\n    <span class=\"token keyword\">fi<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;authorized_keys \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u672a\u627e\u5230 \/root\/.ssh\/authorized_keys&#xff0c;\u5982\u4f7f\u7528\u5bc6\u94a5\u767b\u5f55\u8bf7\u68c0\u67e5\u914d\u7f6e&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 3. \u9632\u706b\u5899\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 3. \u9632\u706b\u5899 &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 3.1 \u68c0\u67e5 firewalld \u662f\u5426\u8fd0\u884c<\/span><br \/>\n<span class=\"token keyword\">if<\/span> systemctl is-active firewalld <span class=\"token operator\">&gt;<\/span>\/dev\/null <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span><span class=\"token file-descriptor important\">&amp;1<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;firewalld \u8fd0\u884c\u72b6\u6001&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;firewalld \u8fd0\u884c\u72b6\u6001&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;firewalld \u672a\u8fd0\u884c&#xff0c;\u8bf7\u542f\u52a8: systemctl start firewalld &amp;&amp; systemctl enable firewalld&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 3.2 \u68c0\u67e5\u662f\u5426\u653e\u884c\u4e86 SSH \u7aef\u53e3<\/span><br \/>\n<span class=\"token assign-left variable\">ssh_port_check<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\">${ssh_port<span class=\"token operator\">:-<\/span>22}<\/span><br \/>\n<span class=\"token keyword\">if<\/span> firewall-cmd &#8211;list-ports <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-q<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$ssh_port_check<\/span>\/tcp&#034;<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9632\u706b\u5899\u653e\u884c SSH \u7aef\u53e3&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9632\u706b\u5899\u653e\u884c SSH \u7aef\u53e3&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u9632\u706b\u5899\u672a\u663e\u5f0f\u653e\u884c SSH \u7aef\u53e3 <span class=\"token variable\">$ssh_port_check<\/span>&#xff0c;\u8bf7\u786e\u8ba4\u89c4\u5219: firewall-cmd &#8211;list-all&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 3.3 \u68c0\u67e5\u9ed8\u8ba4\u533a\u57df\u7b56\u7565<\/span><br \/>\n<span class=\"token assign-left variable\">default_zone<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span>firewall-cmd &#8211;get-default-zone <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$default_zone<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;drop&#034;<\/span> <span class=\"token punctuation\">]<\/span> <span class=\"token operator\">||<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$default_zone<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;public&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9632\u706b\u5899\u9ed8\u8ba4\u533a\u57df&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9632\u706b\u5899\u9ed8\u8ba4\u533a\u57df&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u9ed8\u8ba4\u533a\u57df\u4e3a <span class=\"token variable\">$default_zone<\/span>&#xff0c;\u5efa\u8bae\u4f7f\u7528 public \u6216 drop \u4ee5\u9ed8\u8ba4\u62d2\u7edd\u672a\u653e\u884c\u6d41\u91cf&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 4. \u5173\u952e\u6587\u4ef6\u6743\u9650\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 4. \u5173\u952e\u6587\u4ef6\u6743\u9650 &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 4.1 \/etc\/passwd \u6743\u9650<\/span><br \/>\n<span class=\"token assign-left variable\">perm<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">stat<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;%a&#034;<\/span> \/etc\/passwd<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;644&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\/etc\/passwd \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\/etc\/passwd \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u6743\u9650\u4e3a <span class=\"token variable\">$perm<\/span>&#xff0c;\u5e94\u8bbe\u4e3a 644: chmod 644 \/etc\/passwd&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 4.2 \/etc\/shadow \u6743\u9650<\/span><br \/>\n<span class=\"token assign-left variable\">perm<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">stat<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;%a&#034;<\/span> \/etc\/shadow<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;000&#034;<\/span> <span class=\"token punctuation\">]<\/span> <span class=\"token operator\">||<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;400&#034;<\/span> <span class=\"token punctuation\">]<\/span> <span class=\"token operator\">||<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;600&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\/etc\/shadow \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\/etc\/shadow \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u6743\u9650\u4e3a <span class=\"token variable\">$perm<\/span>&#xff0c;\u5e94\u8bbe\u4e3a 000 \u6216 600: chmod 600 \/etc\/shadow&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 4.3 \/etc\/ssh\/sshd_config \u6743\u9650<\/span><br \/>\n<span class=\"token assign-left variable\">perm<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">stat<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;%a&#034;<\/span> \/etc\/ssh\/sshd_config<span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$perm<\/span>&#034;<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token string\">&#034;600&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;sshd_config \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;sshd_config \u6743\u9650&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u6743\u9650\u4e3a <span class=\"token variable\">$perm<\/span>&#xff0c;\u5e94\u8bbe\u4e3a 600: chmod 600 \/etc\/ssh\/sshd_config&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 4.4 \u67e5\u627e\u5168\u5c40\u53ef\u5199\u6587\u4ef6&#xff08;\u6392\u9664 \/proc \/sys \/dev&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">world_writable<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">find<\/span> \/ <span class=\"token parameter variable\">-xdev<\/span> <span class=\"token parameter variable\">-type<\/span> f <span class=\"token parameter variable\">-perm<\/span> <span class=\"token parameter variable\">-0002<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-vE<\/span> <span class=\"token string\">&#039;^\/(proc|sys|dev)&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-5<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$world_writable<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5168\u5c40\u53ef\u5199\u6587\u4ef6\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5168\u5c40\u53ef\u5199\u6587\u4ef6\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u5b58\u5728\u5168\u5c40\u53ef\u5199\u6587\u4ef6: <span class=\"token variable\">$world_writable<\/span>&#xff0c;\u8bf7\u6536\u7d27\u6743\u9650: chmod o-w &lt;file&gt;&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 5. \u5f02\u5e38\u8fdb\u7a0b\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 5. \u5f02\u5e38\u8fdb\u7a0b &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 5.1 \u68c0\u67e5\u9ad8 CPU \u8fdb\u7a0b&#xff08;\u9608\u503c 80%&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">high_cpu<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">ps<\/span> aux <span class=\"token parameter variable\">&#8211;sort<\/span><span class=\"token operator\">&#061;<\/span>-%cpu <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;NR&gt;1 &amp;&amp; $3 &gt; 80 {print $11, &#034;CPU:&#034;$3&#034;%&#034;}&#039;<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$high_cpu<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9ad8 CPU \u8fdb\u7a0b\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u9ad8 CPU \u8fdb\u7a0b\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u5b58\u5728\u9ad8 CPU \u8fdb\u7a0b: <span class=\"token variable\">$high_cpu<\/span>&#xff0c;\u8bf7\u786e\u8ba4\u662f\u5426\u4e3a\u6316\u77ff\u7b49\u6076\u610f\u8fdb\u7a0b&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 5.2 \u68c0\u67e5\u5e38\u89c1\u6316\u77ff\u8fdb\u7a0b\u540d<\/span><br \/>\n<span class=\"token assign-left variable\">miner<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span><span class=\"token function\">ps<\/span> aux <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-iE<\/span> <span class=\"token string\">&#034;(xmrig|minerd|kdevtmpfsi|kinsing|watchdogs)&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-v<\/span> <span class=\"token function\">grep<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$miner<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u6316\u77ff\u8fdb\u7a0b\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u6316\u77ff\u8fdb\u7a0b\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;FAIL&#034;<\/span> <span class=\"token string\">&#034;\u53d1\u73b0\u7591\u4f3c\u6316\u77ff\u8fdb\u7a0b: <span class=\"token variable\">$miner<\/span>&#xff0c;\u8bf7\u7acb\u5373\u7ec8\u6b62\u5e76\u6392\u67e5: kill -9 PID&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># &#8212;&#8212;&#8212;- 6. \u7f51\u7edc\u8fde\u63a5\u68c0\u67e5 &#8212;&#8212;&#8212;-<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#8212; 6. \u7f51\u7edc\u8fde\u63a5 &#8212;&#034;<\/span><\/p>\n<p><span class=\"token comment\"># 6.1 \u68c0\u67e5\u5f02\u5e38\u5916\u8fde&#xff08;\u6392\u9664\u5e38\u89c1\u7aef\u53e3 80\/443\/53\/22&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">estab<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span>ss <span class=\"token parameter variable\">-antp<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> ESTAB <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;{print $5}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-vE<\/span> <span class=\"token string\">&#039;:(80|443|53|22)$&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-5<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$estab<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5f02\u5e38\u5916\u8fde\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5f02\u5e38\u5916\u8fde\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u53d1\u73b0\u975e\u5e38\u89c1\u7aef\u53e3\u7684\u5916\u8fde: <span class=\"token variable\">$estab<\/span>&#xff0c;\u8bf7\u786e\u8ba4\u662f\u5426\u4e3a\u4e1a\u52a1\u9700\u8981&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token comment\"># 6.2 \u68c0\u67e5\u76d1\u542c\u7aef\u53e3&#xff08;\u6392\u9664\u5e38\u89c1\u670d\u52a1\u7aef\u53e3&#xff09;<\/span><br \/>\n<span class=\"token assign-left variable\">listen<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token variable\"><span class=\"token variable\">$(<\/span>ss <span class=\"token parameter variable\">-tlnp<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span>\/dev\/null <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;NR&gt;1 {print $4}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-vE<\/span> <span class=\"token string\">&#039;:(22|80|443|3306|6379|11211)$&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-5<\/span><span class=\"token variable\">)<\/span><\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token parameter variable\">-z<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$listen<\/span>&#034;<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5f02\u5e38\u76d1\u542c\u7aef\u53e3\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;PASS&#034;<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    check <span class=\"token string\">&#034;\u5f02\u5e38\u76d1\u542c\u7aef\u53e3\u68c0\u67e5&#034;<\/span> <span class=\"token string\">&#034;WARN&#034;<\/span> <span class=\"token string\">&#034;\u53d1\u73b0\u975e\u5e38\u89c1\u76d1\u542c\u7aef\u53e3: <span class=\"token variable\">$listen<\/span>&#xff0c;\u8bf7\u786e\u8ba4\u662f\u5426\u4e3a\u540e\u95e8\u6216\u672a\u6388\u6743\u670d\u52a1&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p><span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&#061;&#061;&#061;&#061;&#061; \u68c0\u67e5\u5b8c\u6210 &#061;&#061;&#061;&#061;&#061;&#034;<\/span><br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;PASS: <span class=\"token variable\">$PASS<\/span>  FAIL: <span class=\"token variable\">$FAIL<\/span>  WARN: <span class=\"token variable\">$WARN<\/span>&#034;<\/span><br \/>\n<span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">[<\/span> <span class=\"token string\">&#034;<span class=\"token variable\">$FAIL<\/span>&#034;<\/span> <span class=\"token parameter variable\">-gt<\/span> <span class=\"token number\">0<\/span> <span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">;<\/span> <span class=\"token keyword\">then<\/span><br \/>\n    <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&gt;&gt;&gt; \u5b58\u5728 <span class=\"token variable\">$FAIL<\/span> \u9879\u672a\u901a\u8fc7&#xff0c;\u8bf7\u6309\u4e0a\u65b9\u5efa\u8bae\u7acb\u5373\u4fee\u590d&#xff01;&#034;<\/span><br \/>\n<span class=\"token keyword\">else<\/span><br \/>\n    <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;&gt;&gt;&gt; \u6240\u6709\u5173\u952e\u68c0\u67e5\u9879\u5747\u901a\u8fc7\u3002&#034;<\/span><br \/>\n<span class=\"token keyword\">fi<\/span><\/p>\n<p>\u8bf4\u660e&#xff1a;\u8be5\u811a\u672c\u5c06\u68c0\u67e5\u7ed3\u679c\u5206\u4e3a PASS&#xff08;\u7b26\u5408\u57fa\u7ebf&#xff09;\u3001FAIL&#xff08;\u5fc5\u987b\u4fee\u590d&#xff09;\u548c WARN&#xff08;\u5efa\u8bae\u5173\u6ce8&#xff09;\u4e09\u6863\u3002FAIL \u9879\u901a\u5e38\u610f\u5473\u7740\u5b58\u5728\u660e\u786e\u7684\u5b89\u5168\u98ce\u9669&#xff08;\u5982 root \u53ef\u767b\u5f55\u3001\u7a7a\u5bc6\u7801\u8d26\u6237\u3001\u5173\u952e\u6587\u4ef6\u6743\u9650\u9519\u8bef&#xff09;&#xff0c;\u5e94\u4f18\u5148\u5904\u7406&#xff1b;WARN \u9879\u591a\u4e3a\u52a0\u56fa\u5efa\u8bae&#xff08;\u5982\u9ed8\u8ba4 SSH \u7aef\u53e3\u3001\u5f02\u5e38\u5916\u8fde&#xff09;&#xff0c;\u9700\u7ed3\u5408\u4e1a\u52a1\u573a\u666f\u5224\u65ad\u3002\u5efa\u8bae\u5c06\u8be5\u811a\u672c\u52a0\u5165 crontab \u6bcf\u65e5\u6267\u884c&#xff0c;\u5e76\u5c06\u8f93\u51fa\u91cd\u5b9a\u5411\u5230\u65e5\u5fd7\u6587\u4ef6&#xff0c;\u4fbf\u4e8e\u6301\u7eed\u8ddf\u8e2a\u5b89\u5168\u72b6\u6001&#xff1a;<\/p>\n<p><span class=\"token function\">chmod<\/span> &#043;x \/usr\/local\/bin\/security_baseline_check.sh<br \/>\n<span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;0 9 * * * \/usr\/local\/bin\/security_baseline_check.sh &gt; \/var\/log\/security_baseline.log 2&gt;&amp;1&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">crontab<\/span> &#8211;<\/p>\n<h5>security_check.sh \u6267\u884c\u7ed3\u679c\u793a\u4f8b<\/h5>\n<p>\u4ee5\u4e0b\u662f\u4e00\u6b21\u5b9e\u9645\u8fd0\u884c security_check.sh \u540e\u7684\u8f93\u51fa\u793a\u4f8b&#xff0c;\u5c55\u793a\u4e86\u811a\u672c\u751f\u6210\u7684\u5b8c\u6574\u5de1\u68c0\u62a5\u544a\u6548\u679c&#xff1a;<\/p>\n<p>&#061;&#061;&#061;&#061;&#061; \u7cfb\u7edf\u5b89\u5168\u5de1\u68c0\u62a5\u544a 2026-08-31 08:00:01 &#061;&#061;&#061;&#061;&#061;<\/p>\n<p>&#8212; 1. \u6700\u8fd1\u767b\u5f55\u8bb0\u5f55 &#8212;<br \/>\nadmin    pts\/0        203.0.113.10    Sat Aug 31 07:55   still logged in<br \/>\nadmin    pts\/0        203.0.113.10    Sat Aug 31 07:30   still logged in<br \/>\nroot     pts\/1        198.51.100.23   Sat Aug 31 06:12 &#8211; 06:15  (00:03)<br \/>\nadmin    pts\/0        203.0.113.10    Fri Aug 30 22:40 &#8211; 23:10  (00:30)<br \/>\nroot     pts\/0        203.0.113.10    Fri Aug 30 18:05 &#8211; 18:20  (00:15)<\/p>\n<p>&#8212; 2. SSH \u767b\u5f55\u5931\u8d25\u7edf\u8ba1 &#8212;<br \/>\n    156 203.0.113.66<br \/>\n     89 198.51.100.77<br \/>\n     12 203.0.113.10<br \/>\n      3 192.0.2.15<\/p>\n<p>&#8212; 3. \u65b0\u589e\u7528\u6237\u68c0\u67e5 &#8212;<br \/>\nadmin 1000<br \/>\ndeploy 1001<br \/>\nmysql 1002<\/p>\n<p>&#8212; 4. \u9ad8 CPU \u8fdb\u7a0b &#8212;<br \/>\nUSER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND<br \/>\nroot      1234 98.7  2.1 123456 45678 ?        S    06:00   45:32 \/tmp\/.xmr-stak<br \/>\nroot       567  3.2  0.4  56789 12345 ?        S    05:30   12:10 \/usr\/sbin\/sshd<br \/>\nadmin     2345  1.1  0.2  34567  8901 ?        S    07:00    0:45 -bash<\/p>\n<p>&#8212; 5. \u5f02\u5e38\u8ba1\u5212\u4efb\u52a1 &#8212;<br \/>\n*\/5 * * * * \/tmp\/.update.sh &gt;\/dev\/null 2&gt;&amp;1<\/p>\n<h5>\u5982\u4f55\u89e3\u8bfb\u5de1\u68c0\u7ed3\u679c<\/h5>\n<p>\u62ff\u5230\u4e0a\u8ff0\u62a5\u544a\u540e&#xff0c;\u5e94\u6309\u4e0b\u8ff0\u601d\u8def\u9010\u9879\u5206\u6790&#xff0c;\u5feb\u901f\u5b9a\u4f4d\u6f5c\u5728\u5b89\u5168\u95ee\u9898&#xff1a;<\/p>\n<ul>\n<li>\u6700\u8fd1\u767b\u5f55\u8bb0\u5f55&#xff1a;\u91cd\u70b9\u6838\u5bf9\u767b\u5f55\u6765\u6e90 IP \u662f\u5426\u5c5e\u4e8e\u529e\u516c\u7f51\u6216\u5df2\u77e5\u8fd0\u7ef4\u7f51\u6bb5\u3002\u82e5\u51fa\u73b0\u964c\u751f IP\u3001\u975e\u5de5\u4f5c\u65f6\u95f4\u767b\u5f55\u3001\u6216 root \u76f4\u63a5\u767b\u5f55&#xff08;\u8bf4\u660e\u672a\u7981\u7528 root SSH&#xff09;&#xff0c;\u5e94\u7acb\u5373\u6392\u67e5\u3002\u793a\u4f8b\u4e2d 198.51.100.23 \u7684 root \u767b\u5f55\u9700\u786e\u8ba4\u662f\u5426\u4e3a\u7ba1\u7406\u5458\u672c\u4eba\u64cd\u4f5c\u3002<\/li>\n<li>SSH \u767b\u5f55\u5931\u8d25\u7edf\u8ba1&#xff1a;\u8fd9\u662f\u5224\u65ad\u662f\u5426\u906d\u53d7\u66b4\u529b\u7834\u89e3\u7684\u6838\u5fc3\u6307\u6807\u3002\u793a\u4f8b\u4e2d 203.0.113.66 \u5728\u77ed\u65f6\u95f4\u5185\u5931\u8d25 156 \u6b21&#xff0c;\u660e\u663e\u662f\u7206\u7834\u653b\u51fb\u6e90&#xff0c;\u5e94\u901a\u8fc7 Fail2ban \u6216\u9632\u706b\u5899\u5c01\u7981\u8be5 IP&#xff0c;\u5e76\u786e\u8ba4\u662f\u5426\u5df2\u6709\u8d26\u6237\u88ab\u653b\u7834\u3002<\/li>\n<li>\u65b0\u589e\u7528\u6237\u68c0\u67e5&#xff1a;\u5bf9\u6bd4\u8f93\u51fa\u4e0e\u5df2\u77e5\u8d26\u6237\u6e05\u5355&#xff0c;\u51fa\u73b0\u964c\u751f UID \u2265 1000 \u7684\u8d26\u6237\u5373\u4e3a\u540e\u95e8\u8d26\u6237\u3002\u793a\u4f8b\u4e2d deploy\u3001mysql \u9700\u786e\u8ba4\u662f\u5426\u4e3a\u4e1a\u52a1\u6240\u9700&#xff0c;\u82e5\u65e0\u6cd5\u8bf4\u660e\u6765\u6e90\u5e94\u7acb\u5373\u51bb\u7ed3\u5e76\u5220\u9664\u3002<\/li>\n<li>\u9ad8 CPU \u8fdb\u7a0b&#xff1a;CPU \u5360\u7528\u7387\u5f02\u5e38\u9ad8\u7684\u8fdb\u7a0b\u662f\u6316\u77ff\u75c5\u6bd2\u7684\u6700\u5178\u578b\u7279\u5f81\u3002\u793a\u4f8b\u4e2d \/tmp\/.xmr-stak \u5360\u7528 98.7% CPU&#xff0c;\u4e14\u8def\u5f84\u4f4d\u4e8e \/tmp \u4e0b&#xff0c;\u51e0\u4e4e\u53ef\u4ee5\u5224\u5b9a\u4e3a\u6316\u77ff\u6728\u9a6c&#xff0c;\u9700\u6309\u7b2c 8.1 \u8282\u6d41\u7a0b\u5904\u7f6e\u3002<\/li>\n<li>\u5f02\u5e38\u8ba1\u5212\u4efb\u52a1&#xff1a;\u8ba1\u5212\u4efb\u52a1\u662f\u653b\u51fb\u8005\u7ef4\u6301\u6301\u4e45\u5316\u7684\u5e38\u7528\u624b\u6bb5\u3002\u793a\u4f8b\u4e2d \/tmp\/.update.sh \u6bcf 5 \u5206\u949f\u6267\u884c\u4e00\u6b21&#xff0c;\u8def\u5f84\u53ef\u7591&#xff0c;\u5e94\u67e5\u770b\u811a\u672c\u5185\u5bb9\u5e76\u6e05\u7406&#xff0c;\u540c\u65f6\u68c0\u67e5 crontab \u662f\u5426\u88ab\u7be1\u6539\u3002<\/li>\n<\/ul>\n<p>\u63d0\u793a&#xff1a;\u5de1\u68c0\u811a\u672c\u7684\u4ef7\u503c\u5728\u4e8e\u300c\u6301\u7eed\u5bf9\u6bd4\u300d\u3002\u5efa\u8bae\u5c06\u6bcf\u65e5\u8f93\u51fa\u4fdd\u5b58\u4e3a\u65e5\u5fd7&#xff0c;\u4e0e\u5386\u53f2\u62a5\u544a\u5bf9\u6bd4&#xff0c;\u4efb\u4f55\u300c\u65b0\u589e\u7684\u964c\u751f IP\u3001\u65b0\u51fa\u73b0\u7684\u8d26\u6237\u3001\u65b0\u51fa\u73b0\u7684\u8ba1\u5212\u4efb\u52a1\u3001CPU \u7a81\u7136\u98d9\u9ad8\u300d\u90fd\u662f\u9700\u8981\u7acb\u5373\u5173\u6ce8\u7684\u5b89\u5168\u4fe1\u53f7\u3002\u82e5\u53d1\u73b0\u5f02\u5e38&#xff0c;\u5e94\u7ed3\u5408\u7b2c 7 \u8282\u5e94\u6025\u54cd\u5e94\u6d41\u7a0b\u4e0e\u7b2c 8 \u8282\u5904\u7f6e\u5b9e\u6218\u8fdb\u884c\u6392\u67e5\u3002<\/p>\n<h4>9.2 \u4f7f\u7528 Ansible \u6279\u91cf\u7ba1\u7406<\/h4>\n<p>\u5bf9\u4e8e\u591a\u53f0\u670d\u52a1\u5668&#xff0c;\u53ef\u4f7f\u7528 Ansible \u7edf\u4e00\u6267\u884c\u5b89\u5168\u52a0\u56fa&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5 Ansible<\/span><br \/>\nyum <span class=\"token function\">install<\/span> <span class=\"token parameter variable\">-y<\/span> ansible<\/p>\n<p><span class=\"token comment\"># \u7f16\u5199\u52a0\u56fa Playbook<\/span><br \/>\n<span class=\"token function\">cat<\/span> <span class=\"token operator\">&gt;<\/span> \/etc\/ansible\/harden.yml <span class=\"token operator\">&lt;&lt;<\/span> <span class=\"token string\">&#039;EOF&#039;<br \/>\n&#8212;<br \/>\n&#8211; hosts: all<br \/>\n  become: yes<br \/>\n  tasks:<br \/>\n    &#8211; name: \u7981\u7528 root SSH \u767b\u5f55<br \/>\n      lineinfile:<br \/>\n        path: \/etc\/ssh\/sshd_config<br \/>\n        regexp: &#039;^PermitRootLogin&#039;<br \/>\n        line: &#039;PermitRootLogin no&#039;<br \/>\n      notify: restart sshd<\/p>\n<p>    &#8211; name: \u5b89\u88c5 Fail2ban<br \/>\n      yum:<br \/>\n        name: fail2ban<br \/>\n        state: present<\/p>\n<p>  handlers:<br \/>\n    &#8211; name: restart sshd<br \/>\n      service:<br \/>\n        name: sshd<br \/>\n        state: restarted<br \/>\nEOF<\/span><\/p>\n<p><span class=\"token comment\"># \u6267\u884c\u52a0\u56fa<\/span><br \/>\nansible-playbook <span class=\"token parameter variable\">-i<\/span> hosts harden.yml<\/p>\n<h3>10. \u603b\u7ed3\u4e0e\u6700\u4f73\u5b9e\u8df5\u6e05\u5355<\/h3>\n<p>CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u662f\u4e00\u9879\u7cfb\u7edf\u5de5\u7a0b&#xff0c;\u9700\u8981\u4ece\u9884\u9632\u3001\u76d1\u63a7\u3001\u54cd\u5e94\u4e09\u4e2a\u5c42\u9762\u6301\u7eed\u6295\u5165\u3002\u4ee5\u4e0b\u662f\u672c\u6559\u7a0b\u7684\u6838\u5fc3\u8981\u70b9\u603b\u7ed3&#xff1a;<\/p>\n<h4>\u5b89\u5168\u8fd0\u7ef4\u6700\u4f73\u5b9e\u8df5\u6e05\u5355<\/h4>\n<ul>\n<li class=\"task-list-item\"> \u7981\u7528 root \u76f4\u63a5 SSH \u767b\u5f55&#xff0c;\u4f7f\u7528\u5bc6\u94a5\u8ba4\u8bc1&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u4fee\u6539 SSH \u9ed8\u8ba4\u7aef\u53e3&#xff0c;\u914d\u7f6e Fail2ban \u9632\u66b4\u529b\u7834\u89e3&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u9075\u5faa\u6700\u5c0f\u6743\u9650\u539f\u5219&#xff0c;\u4e3a\u8d26\u6237\u914d\u7f6e\u72ec\u7acb sudo \u6743\u9650&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u9632\u706b\u5899\u4e0e\u5b89\u5168\u7ec4\u4ec5\u5f00\u653e\u5fc5\u8981\u7aef\u53e3&#xff0c;\u7ba1\u7406\u7aef\u53e3\u9650\u5236\u6765\u6e90 IP&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u5b9a\u671f\u66f4\u65b0\u7cfb\u7edf\u5b89\u5168\u8865\u4e01&#xff0c;\u914d\u7f6e\u81ea\u52a8\u66f4\u65b0&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u90e8\u7f72 AIDE \u6587\u4ef6\u5b8c\u6574\u6027\u76d1\u63a7\u4e0e\u65e5\u5fd7\u8fdc\u7a0b\u5907\u4efd&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u5b9a\u671f\u6267\u884c\u5b89\u5168\u5de1\u68c0&#xff0c;\u5173\u6ce8\u5f02\u5e38\u767b\u5f55\u4e0e\u9ad8 CPU \u8fdb\u7a0b&#xff1b;<\/li>\n<li class=\"task-list-item\"> \u5236\u5b9a\u5e76\u6f14\u7ec3\u5e94\u6025\u54cd\u5e94\u9884\u6848&#xff0c;\u660e\u786e\u8d23\u4efb\u4eba\u3002<\/li>\n<\/ul>\n<h4>\u5e94\u6025\u54cd\u5e94\u6838\u5fc3\u539f\u5219<\/h4>\n<ul>\n<li>\u5148\u9694\u79bb&#xff0c;\u540e\u5904\u7f6e&#xff1a;\u7b2c\u4e00\u65f6\u95f4\u5207\u65ad\u653b\u51fb\u901a\u9053&#xff1b;<\/li>\n<li>\u4fdd\u7559\u73b0\u573a&#xff1a;\u53d6\u8bc1\u5b8c\u6210\u524d\u4e0d\u91cd\u542f\u3001\u4e0d\u5220\u9664\u5173\u952e\u8bc1\u636e&#xff1b;<\/li>\n<li>\u5f7b\u5e95\u6e05\u9664&#xff1a;\u6e05\u9664\u540e\u95e8\u540e\u5fc5\u987b\u5168\u9762\u52a0\u56fa&#xff0c;\u9632\u6b62\u4e8c\u6b21\u5165\u4fb5&#xff1b;<\/li>\n<li>\u590d\u76d8\u6539\u8fdb&#xff1a;\u6bcf\u6b21\u4e8b\u4ef6\u540e\u603b\u7ed3\u7ecf\u9a8c&#xff0c;\u6301\u7eed\u5b8c\u5584\u5b89\u5168\u4f53\u7cfb\u3002<\/li>\n<\/ul>\n<p>\u5b89\u5168\u8fd0\u7ef4\u6ca1\u6709\u7ec8\u70b9&#xff0c;\u800c\u662f\u4e00\u4e2a\u6301\u7eed\u8fed\u4ee3\u7684\u8fc7\u7a0b\u3002\u5efa\u8bae\u8bfb\u8005\u7ed3\u5408\u81ea\u8eab\u4e1a\u52a1\u573a\u666f&#xff0c;\u5c06\u672c\u6559\u7a0b\u4e2d\u7684\u65b9\u6848\u843d\u5730\u4e3a\u65e5\u5e38\u5236\u5ea6&#xff0c;\u5e76\u5b9a\u671f\u8fdb\u884c\u5b89\u5168\u6f14\u7ec3&#xff0c;\u771f\u6b63\u505a\u5230\u300c\u9632\u60a3\u4e8e\u672a\u7136&#xff0c;\u5904\u7f6e\u4e8e\u53ca\u65f6\u300d\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR<br \/>\n\u672c\u6559\u7a0b\u7cfb\u7edf\u8bb2\u89e3 CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u65b9\u6cd5\u3002\u5b89\u5168\u8fd0\u7ef4\u5c42\u9762\u6db5\u76d6\u8d26\u6237\u6743\u9650\u7ba1\u7406\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u7cfb\u7edf\u8865\u4e01\u66f4\u65b0\u3001\u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u63aa\u65bd&#xff1b;\u5e94\u6025\u54cd\u5e94\u5c42\u9762\u5219\u7ed9\u51fa\u4ece\u4e8b\u4ef6\u53d1\u73b0\u3001\u9694\u79bb\u6b62\u635f\u3001\u53d6\u8bc1\u6eaf\u6e90\u5230\u6e05\u9664\u540e\u95e8\u3001\u6062\u590d\u4e1a\u52a1\u7684\u5b8c\u6574\u5904\u7f6e\u6d41\u7a0b&#xff0c;\u5e76\u9488\u5bf9\u6316\u77ff\u3001\u52d2\u7d22\u3001Web \u5165\u4fb5\u7b49\u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u63d0\u4f9b\u5b9e\u6218\u5904\u7f6e\u65b9\u6848\u3002\u6587\u7ae0\u8fd8\u63d0\u4f9b\u4e86\u5b89\u5168\u5de1\u68c0\u811a\u672c\u4e0e Ansible \u6279\u91cf\u52a0\u56fa\u793a\u4f8b&#xff0c;\u5e2e\u52a9\u8bfb\u8005\u5c06\u5b89\u5168\u65b9\u6848\u843d\u5730\u4e3a\u65e5\u5e38\u5236\u5ea6\u3002<br \/>\n\u76ee\u5f55<br \/>\n1. <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[59,43,44],"topic":[],"class_list":["post-99209","post","type-post","status-publish","format-standard","hentry","category-server","tag-centos","tag-43","tag-44"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/99209.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"TL;DR \u672c\u6559\u7a0b\u7cfb\u7edf\u8bb2\u89e3 CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u65b9\u6cd5\u3002\u5b89\u5168\u8fd0\u7ef4\u5c42\u9762\u6db5\u76d6\u8d26\u6237\u6743\u9650\u7ba1\u7406\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u7cfb\u7edf\u8865\u4e01\u66f4\u65b0\u3001\u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u63aa\u65bd&#xff1b;\u5e94\u6025\u54cd\u5e94\u5c42\u9762\u5219\u7ed9\u51fa\u4ece\u4e8b\u4ef6\u53d1\u73b0\u3001\u9694\u79bb\u6b62\u635f\u3001\u53d6\u8bc1\u6eaf\u6e90\u5230\u6e05\u9664\u540e\u95e8\u3001\u6062\u590d\u4e1a\u52a1\u7684\u5b8c\u6574\u5904\u7f6e\u6d41\u7a0b&#xff0c;\u5e76\u9488\u5bf9\u6316\u77ff\u3001\u52d2\u7d22\u3001Web \u5165\u4fb5\u7b49\u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u63d0\u4f9b\u5b9e\u6218\u5904\u7f6e\u65b9\u6848\u3002\u6587\u7ae0\u8fd8\u63d0\u4f9b\u4e86\u5b89\u5168\u5de1\u68c0\u811a\u672c\u4e0e Ansible \u6279\u91cf\u52a0\u56fa\u793a\u4f8b&#xff0c;\u5e2e\u52a9\u8bfb\u8005\u5c06\u5b89\u5168\u65b9\u6848\u843d\u5730\u4e3a\u65e5\u5e38\u5236\u5ea6\u3002 \u76ee\u5f55 1.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/99209.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T22:41:48+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/99209.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/99209.html\",\"name\":\"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-01T22:41:48+00:00\",\"dateModified\":\"2026-09-01T22:41:48+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/99209.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/99209.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/99209.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/99209.html","og_locale":"zh_CN","og_type":"article","og_title":"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"TL;DR \u672c\u6559\u7a0b\u7cfb\u7edf\u8bb2\u89e3 CentOS 7 \u4e91\u670d\u52a1\u5668\u7684\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5e94\u6025\u54cd\u5e94\u65b9\u6cd5\u3002\u5b89\u5168\u8fd0\u7ef4\u5c42\u9762\u6db5\u76d6\u8d26\u6237\u6743\u9650\u7ba1\u7406\u3001SSH \u52a0\u56fa\u3001\u9632\u706b\u5899\u914d\u7f6e\u3001\u7cfb\u7edf\u8865\u4e01\u66f4\u65b0\u3001\u65e5\u5fd7\u76d1\u63a7\u4e0e\u5165\u4fb5\u68c0\u6d4b\u7b49\u6838\u5fc3\u63aa\u65bd&#xff1b;\u5e94\u6025\u54cd\u5e94\u5c42\u9762\u5219\u7ed9\u51fa\u4ece\u4e8b\u4ef6\u53d1\u73b0\u3001\u9694\u79bb\u6b62\u635f\u3001\u53d6\u8bc1\u6eaf\u6e90\u5230\u6e05\u9664\u540e\u95e8\u3001\u6062\u590d\u4e1a\u52a1\u7684\u5b8c\u6574\u5904\u7f6e\u6d41\u7a0b&#xff0c;\u5e76\u9488\u5bf9\u6316\u77ff\u3001\u52d2\u7d22\u3001Web \u5165\u4fb5\u7b49\u5e38\u89c1\u5b89\u5168\u4e8b\u4ef6\u63d0\u4f9b\u5b9e\u6218\u5904\u7f6e\u65b9\u6848\u3002\u6587\u7ae0\u8fd8\u63d0\u4f9b\u4e86\u5b89\u5168\u5de1\u68c0\u811a\u672c\u4e0e Ansible \u6279\u91cf\u52a0\u56fa\u793a\u4f8b&#xff0c;\u5e2e\u52a9\u8bfb\u8005\u5c06\u5b89\u5168\u65b9\u6848\u843d\u5730\u4e3a\u65e5\u5e38\u5236\u5ea6\u3002 \u76ee\u5f55 1.","og_url":"https:\/\/www.wsisp.com\/helps\/99209.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-01T22:41:48+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"16 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/99209.html","url":"https:\/\/www.wsisp.com\/helps\/99209.html","name":"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-01T22:41:48+00:00","dateModified":"2026-09-01T22:41:48+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/99209.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/99209.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/99209.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"CentOS 7 \u4e91\u670d\u52a1\u5668\u5b89\u5168\u8fd0\u7ef4\u4e0e\u5b89\u5168\u5e94\u6025\u54cd\u5e94\u5b9e\u6218\u6559\u7a0b"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/99209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=99209"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/99209\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=99209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=99209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=99209"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=99209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}