# 查看可用配置文件
$ sudo oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# 扫描系统
$ sudo oscap xccdf eval –profile xccdf_org.ssgproject.content_profile_stig \
–report /tmp/scan-report.html \
/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# 查看扫描结果
$ firefox /tmp/scan-report.html

# 生成修复脚本
$ sudo oscap xccdf generate fix \
–profile xccdf_org.ssgproject.content_profile_stig \
–output /tmp/remediation.sh \
/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.学习交流加群风哥微信: itpux-comxml

# 执行修复
$ sudo bash /tmp/remediation.sh

# 使用OpenSCAP Daemon持续监控
$ sudo dnf install -y oscapd
$ sudo systemctl start oscapd
$ sudo systemctl enable oscapd

# 查看安全更新
$ sudo dnf updateinfo list security

# 安装安全更新
$ sudo dnf update –security

# 安装特定安全更新
$ sudo dnf update –security –advisory=RHSA-2026:1234

# 查看更新历史
$ sudo dnf history list

# 配置自动更新
$ sudo dnf install -y dnf-automatic

$ sudo tee /etc/dnf/automatic.conf << 'EOF' [commands] upgrade_type = security random_sleep = 0 download_updates = yes apply_updates = yes [emitters] emit_via = stdio,email [email] email_from = root@fgedu.net.cn email_更多学习教程公众号风哥教程itpux_comto = admin@fgedu.net.cn email_host = localhost EOF # 启用自动更新 $ sudo systemctl enable --now dnf-automatic.timer # 查看定时器状态 $ sudo systemctl list-timers dnf-automatic.timer # 手动触发更新 $ sudo systemctl start dnf-automatic

# 启动Nessus
$ sudo systemctl start nessusd
$ sudo systemctl enable nessusd

# 访问Web界面
https://localhost:8834

# 创建扫描策略
1. 登录Nessus
2. 创建新扫描策略
3. 选择扫描类型
– Basic Network Scan
– Advanced Scan
– Malware Scan
– Web Application Tests

# 执行扫描
1. 创建新扫描
2. 选择扫描策略
3. 配置目标主机
4. 设置扫描计划
5. 启动扫描

# 分析扫描结果
1. 查看漏洞列表
2. 评估风险等级
– Critical: 立即修复
– High: 尽快修复
– Medium: 计划修复
– Low: 可选修复
3. 查看修复建议
4. 导出扫描报告

# 使用命令行扫描
$ /opt/nessus/bin/nasl -t 192.168.1.100 script.nasl

2. 风险评估
– 评估漏洞严重程度
– 分析影响范围
– 确定修复优先级

3. 修复计划
– 制定修复方案
– 准备测试环境
– 安排修复时间

学习交流加群风哥QQ1132571744. 修复实施
– 备份系统
– 应用补丁
– 验证修复效果

5. 验证测试
– 功能测试
– 性能测试
– 安全测试

# 漏洞修复脚本
$ cat > /usr/local/bin/vuln-fix.sh << 'EOF' #!/bin/bash LOG_FILE="/var/log/vuln-fix.log" BACKUP_DIR="/backup/vuln-fix/$(date +%Y%m%d)" log() { echo "$(date): $1" >> $LOG_FILE
}

backup() {
log “Creating backup…”
mkdir -p $BACKUP_DIR
tar -czf $BACKUP_DIR/etc-backup.tar.gz /etc
}

scan() {
log “Scanning for vulnerabilities…”
sudo dnf updateinfo list security > $BACKUP_DIR/security-updates.txt
}

fix() {
log “Applying security updates…”
sudo dnf update -y –security >> $LOG_FILE 2>&1
}

verify() {
log “Verifying fixes…”
sudo dnf updateinfo list security > $BACKUP_DIR/remaining-updates.txt
if [ -s $BACKUP_DIR/remaining-updates.txt ]; then
log “Some vulnerabilities remain”
return 1
else
log “All vulnerabilities fixed”
return 0
fi
}

report() {
log “Generating report…”
mail -s “Vulnerability Fix Report $(date)” admin@fgedu.net.cn < $LOG_FILE } main() { backup scan fix verify report } main EOF chmod +x /usr/local/bin/vuln-fix.sh # 配置定期扫描 $ cat > /etc/cron.weekly/vuln-scan << 'EOF' #!/bin/bash /usr/local/bin/vuln-fix.sh EOF chmod +x /etc/cron.weekly/vuln-scan