linux主机安全加固-个人经验

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

说明：我并没有一个系统的网络安全知识体系，随笔里面提到的内容是个人在从事运维行业这几年中总结出来的一点经验，仅供大家参考。

说到linux主机安全加固，我可以想到的就是三个方向吧，基线整改、访问控制和主机漏洞修复。运维小伙伴在做基线整改、设置访问策略或者修复主机漏洞前需要考虑的一个问题是这样操作后是否会对业务造成影响，所以在做安全加固前，一定要做好验证，相应的回退方案也要准备好。

（1）基线整改

基线扫描报告一般是由各安全厂商给出，比如绿盟、安恒、启明星辰等等，使用安全产品或离线脚本等对目标主机进行扫描，扫描完成后生成基线报告，关于基线报告的内容大家可以自行百度，一般报告中会包含“口令策略”、“系统服务”、“文件权限”、“日志审计”等等几个大类，每个大类下面还会有一些具体基线项，针对每一项会有该项的检查结果、判定依据、检查点和加固方案等内容。下图是启明星辰的基线检查报告中的部分内容。

基线检查报告中我们需要关注的就是检查结果为“不合规”的检查项。然后根据检查点和加固方案进行整改。

（2）访问控制

linux主机的访问控制包括：账号管理、配置iptables、文件权限管理。下面我主要说一下关于iptables如何进行规划和配置。

配置iptables：很多运维场景其实是内网服务器iptables全部关闭，selinux全部disabled，并没有做好每台主机的防火墙策略。假如给你一个工作，让你独立规划某个业务平台（10台主机）的防火墙策略，你该如何下手？

我的经验：

①确认每台主机上部署了什么中间件，比如tomcat、mysql、kafka、redis、自研程序，开启了哪些端口。我常用的命令是 netstat 和 lsof 这两个命令结合起来进行分析。举个栗子：

以message-1服务器上kafka服务为例：通过netstat命令查看到该服务器上开启9092端口

root@message-1:~# netstat -tlunp | grep 9092

tcp6       0      0 192.168.66.95:9092      :::*                    LISTEN      16437/java

root@message-1:~#

然后，我们想看下现在9092端口都有哪些连接，我们可以用lsof命令查看，可以看到 public-1和public-2同message-1建立连接的，

root@message-1:~# lsof -i:9092

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME

java    16437 root   97u  IPv6  58655      0t0  TCP message-1:9092 (LISTEN)

java    16437 root  114u  IPv6 158945      0t0  TCP message-1:9092->public-2:44528 (ESTABLISHED)

java    16437 root  157u  IPv6  79706      0t0  TCP message-1:9092->public-1:55198 (ESTABLISHED)

java    16437 root  158u  IPv6  79990      0t0  TCP message-1:9092->public-1:19143 (ESTABLISHED)

java    16437 root  186u  IPv6  73525      0t0  TCP message-1:9092->public-2:3933 (ESTABLISHED)

java    16437 root  187u  IPv6  73449      0t0  TCP message-1:9092->public-1:37570 (ESTABLISHED)

java    16437 root  188u  IPv6  73526      0t0  TCP message-1:9092->public-2:44505 (ESTABLISHED)

java    16437 root  189u  IPv6  73451      0t0  TCP message-1:9092->public-1:42576 (ESTABLISHED)

java    16437 root  194u  IPv6 158973      0t0  TCP message-1:9092->public-1:46261 (ESTABLISHED)

java    16437 root  212u  IPv6  79713      0t0  TCP message-1:9092->public-1:3805 (ESTABLISHED)

java    16437 root  213u  IPv6  79712      0t0  TCP message-1:9092->public-1:39880 (ESTABLISHED)

java    16437 root  214u  IPv6  79714      0t0  TCP message-1:9092->public-1:37571 (ESTABLISHED)

java    16437 root  215u  IPv6  79715      0t0  TCP message-1:9092->public-1:62056 (ESTABLISHED)

java    16437 root  217u  IPv6  79716      0t0  TCP message-1:9092->public-1:34639 (ESTABLISHED)

java    16437 root  218u  IPv6  79717      0t0  TCP message-1:9092->public-1:1315 (ESTABLISHED)

java    16437 root  219u  IPv6  79718      0t0  TCP message-1:9092->public-1:12077 (ESTABLISHED)

java    16437 root  220u  IPv6  79719      0t0  TCP message-1:9092->public-1:54739 (ESTABLISHED)

java    16437 root  221u  IPv6  79720      0t0  TCP message-1:9092->public-1:62374 (ESTABLISHED)

java    16437 root  222u  IPv6  73527      0t0  TCP message-1:9092->public-2:14295 (ESTABLISHED)

java    16437 root  223u  IPv6  77294      0t0  TCP message-1:9092->public-1:22867 (ESTABLISHED)

java    16437 root  224u  IPv6  72642      0t0  TCP message-1:9092->public-1:38827 (ESTABLISHED)

java    16437 root  225u  IPv6  72643      0t0  TCP message-1:9092->public-1:34489 (ESTABLISHED)

java    16437 root  226u  IPv6  79930      0t0  TCP message-1:9092->public-1:25297 (ESTABLISHED)

java    16437 root  230u  IPv6  73341      0t0  TCP message-1:9092->public-1:44317 (ESTABLISHED)

java    16437 root  231u  IPv6  81406      0t0  TCP message-1:9092->public-2:64640 (ESTABLISHED)

java    16437 root  233u  IPv6  80129      0t0  TCP message-1:9092->public-1:42729 (ESTABLISHED)

java    16437 root  234u  IPv6  80130      0t0  TCP message-1:9092->public-1:38797 (ESTABLISHED)

java    16437 root  235u  IPv6  73452      0t0  TCP message-1:9092->public-1:30003 (ESTABLISHED)

java    16437 root  236u  IPv6  77295      0t0  TCP message-1:9092->public-1:27578 (ESTABLISHED)

java    16437 root  237u  IPv6  77296      0t0  TCP message-1:9092->public-1:11596 (ESTABLISHED)

java    16437 root  238u  IPv6  77297      0t0  TCP message-1:9092->public-1:57318 (ESTABLISHED)

java    16437 root  240u  IPv6  77298      0t0  TCP message-1:9092->public-1:13398 (ESTABLISHED)

java    16437 root  241u  IPv6  80132      0t0  TCP message-1:9092->public-1:51598 (ESTABLISHED)

java    16437 root  242u  IPv6  80133      0t0  TCP message-1:9092->public-1:8571 (ESTABLISHED)

java    16437 root  243u  IPv6  80134      0t0  TCP message-1:9092->public-1:38849 (ESTABLISHED)

java    16437 root  244u  IPv6  80135      0t0  TCP message-1:9092->public-1:58260 (ESTABLISHED)

java    16437 root  246u  IPv6  80162      0t0  TCP message-1:9092->public-1:27890 (ESTABLISHED)

java    16437 root  247u  IPv6  80163      0t0  TCP message-1:9092->public-1:24008 (ESTABLISHED)

java    16437 root  253u  IPv6  83011      0t0  TCP message-1:9092->public-2:50076 (ESTABLISHED)

java    16437 root  254u  IPv6  83012      0t0  TCP message-1:9092->public-2:8293 (ESTABLISHED)

java    16437 root  255u  IPv6  83013      0t0  TCP message-1:9092->public-2:55405 (ESTABLISHED)

java    16437 root  256u  IPv6  83014      0t0  TCP message-1:9092->public-2:25186 (ESTABLISHED)

java    16437 root  257u  IPv6  83015      0t0  TCP message-1:9092->public-2:55834 (ESTABLISHED)

java    16437 root  258u  IPv6  83016      0t0  TCP message-1:9092->public-2:14103 (ESTABLISHED)

java    16437 root  259u  IPv6  83017      0t0  TCP message-1:9092->public-2:51100 (ESTABLISHED)

java    16437 root  260u  IPv6  73528      0t0  TCP message-1:9092->public-2:11548 (ESTABLISHED)

java    16437 root  261u  IPv6  73529      0t0  TCP message-1:9092->public-2:6708 (ESTABLISHED)

java    16437 root  262u  IPv6  83018      0t0  TCP message-1:9092->public-2:55665 (ESTABLISHED)

java    16437 root  266u  IPv6  73538      0t0  TCP message-1:9092->public-2:27084 (ESTABLISHED)

root@message-1:~#