# 安全基线内容
1. 账号安全：密码策略、登录限制
2.更多视频教程www.fgedu.net.cn学习交流加群风哥QQ113257174 服务安全：关闭不必要服务
3. 网络安全：防火墙配置
4. 文件安全：权限设置
5. 日志安全：审计配置

# 配置工具
Ansible、Puppet、SaltStack

# 标准内容
1. CIS Benchmark
2. 等保2.0要求
3. 企业内部标准
4. 行业合规要求

# 创建Ansible Playbook
$ cat > security_baseline.yml << 'EOF' --- - name: Configure Security Baseline hosts: all become: yes tasks: - name: Disable root SSH login lineinfile: path: /etc/ssh/sshd_config regexp: '^PermitRootLogin' line: 'PermitRootLogin no' notify: restart sshd - name: Set password policy lineinfile: path: /etc/login.defs regexp: '{{ item.regexp }}' line: '{{ item.line }}' loop: - { regexp: '^PASS_MAX_DAYS', line: 'PASS_MAX_DAYS 90' } - { regexp: '^PASS_MIN_DAYS', line: 'PASS_MIN_DAYS 7' } - { regexp: '^PASS_MIN_LEN', line: 'PASS_MIN_LEN 8' } - name: Install security packages dnf: name: - fail2ban - audit state: present - name: Enable firewall systemd: name: firewalld state: started enabled: yes handlers: - name: restart sshd systemd: name: sshd state: restarted EOF # 执行Playbook $ ansible-playbook -i inventory security_baseline.yml

# 创建检查脚本
$ cat > /usr/local/bin/security_check.sh << 'EOF' #!/bin/bash echo "=== 安全基线检查 ===" # 1. 检查SSH配置 echo "[SSH配置]" grep "^PermitRootLogin" /etc/ssh/sshd_config grep "^PasswordAuthentication" /etc/ssh/sshd_config # 2. 检查密码策略 echo "[密码策略]" grep "^PASS_MAX_DAYS" /etc/login.defs grep "^PASS_MIN_LEN" /etc/login.defs # 3. 检查防火墙状态 echo "[防火墙状态]" systemctl is-active firewalld # 4. 检查不必要的服务 echo "[运行的服务]" systemctl list-units --type=service --state=running | grep -E "telnet|ftp|rsh" # 5. 检查开放端口 echo "[开放端口]" ss -tuln # 6. 检查用户账号 echo "[用户账号]" awk -F: '$3 == 0 {print $1}' /etc/passwd EOF # 执行检查 $ chmod +x /usr/local/bin/security_check.sh $ /usr/local/bin/security_check.sh

# 场景：企业100台服务器安全基线配置

# 1. 准备主机清单
$ cat > inventory << 'EOF' [webservers] web[01:50].fgedu.net.cn [dbservers] db[01:20].fgedu.net.cn [appservers] app[01:30].fgedu.net.cn EOF # 2. 执行安全基线配置 $ ansible-playbook -i inventory security_baseline.yml -f 10 # 3. 验证配置结果 $ ansible all -i inventory -m shell -a "/usr/local/bin/security_check.sh" # 4. 生成合规报告 $ ansible all -i inventory -m shell -a "cat /var/log/security_check.log" > compliance_report.txt