# 安装OpenSCAP
$ dnf install -y openscap-scanner scap-security-guide

# 安装Auditd
$ dnf install -y audit
$ systemctl start auditd
$ systemctl enable auditd

# 安装ELK Stack
# 安装Elasticsearch
$ dnf install -y elasticsearch
$ systemctl start elasticsearch
$ systemctl enable elasticsearch

# 安装Logstash
$ dnf install -y logstash
$ systemctl start logstash
$ systemctl enable logstash

# 安装Kibana
$ dnf install -y kibana
$ systemctl start kibana
$ systemctl enable kibana

# 配置OpenSCAP
$ oscap xccdf eval –profile xccdf_org.ssgproject.content_profile_rhel8_stig –report /var/log/oscap-report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.更多视频教程www.fgedu.net.cnxml

# 配置Auditd
$ vi /etc/audit/audit.rules
—
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k privilege
-w /var/log/ -p wa -k logs
—

$ systemctl restart auditd

# 配置ELK Stack
$ vi /etc/logstash/conf.d/audit.conf
—
input {
file {
path => “/var/log/audit/audit.log”
start_position => “beginning”
sincedb_path => “/dev/null”
}
}

filter {
grok {
match => {
“message” => “type=%{WORD:type} msg=\’%{GREEDYDATA:msg}\”
}
}
}

output {
elasticsearch {
hosts => [“localhost:9200”]
index => “audit-%{+YYYY.MM.dd}”
}
}
—

$ systemctl restart logstash

# 验证部署
$ systemctl status openscap-scanner
$ systemctl status auditd
$ systemctl status elasticsearch
$ systemctl status logstash
$ systemctl status kibana

# 安装Trivy
$ dnf install -y trivy

# 安装Falco
$ dnf install -y falco
$ systemctl start falco
$ systemctl enable falco

# 配置Trivy
$ vi /etc/trivy/config.yaml
—
global:
cache_dir: /var/cache/trivy
timeout: 10m
debug: false

severity:
– UNKNOWN
– LOW
– MEDIUM
– HIGH
– CRITICAL

vulnerability:
ignoreStatus: false
severityThreshold: “MEDIUM”
—

# 配置Falco
$ vi /etc/falco/falco.yaml
—
syscall_buffer_size: 8388608
plugins:
– name: k8s_audit
library_path: /usr/share/falco/plugins/libk8s_audit.so
init_config: {}
open_params: “”

rules_file:
– /etc/falco/falco_rules.yaml
– /etc/falco/falco_rules.local.yaml
– /etc/falco/k8s_audit_rules.yaml

falco_outputs:
– name: stdout
enabled: true
– name: syslog
enabled: true

falco_syslog_output:
facility: local0
priority: debug
—

# 验证部署
$ trivy –version
$ systemctl status falco

## 1. 配置系统安全
$ vi /etc/security/limits.conf
—
# 限制用户进程数
* soft nproc 1024
* hard nproc 4096

# 限制文件打开数
* soft nofile 4096
* hard nofile 65536

# 限制核心文件大小
* soft core 0
* hard core 0
—

$ vi /etc/sysctl.conf
—
# 安全相关内核参数
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
—

$ sysctl -p

## 2. 配置SSH安全
$ vi /etc/ssh/sshd_config
—
# 禁用root登录
PermitRootLogin no

# 禁用密码登录
PasswordAuthentication no

# 启用公钥认证
PubkeyAuthentication yes

# 限制登录尝试次数
MaxAuthTries 3

# 限制登录时间
LoginGraceTime 30

# 禁用X11转发
X11Forwarding no

# 禁用TCP端口转发
AllowTcpForwarding no

# 禁用Agent转发
AllowAgentForwarding no
—

$ systemctl restart sshd

## 3. 配置防火墙
$ firewall-cmd –permanent –add-service=ssh
$ firewall-cmd –permanent –add-service=http
$ firewall-cmd –permanent –add-service=https
$ firewall-cmd –permanent –remove-service=telnet
$ firewall-cmd –permanent –remove-service=ftp
$ firewall-cmd –reload

## 4. 配置SELinux
$ setenforce 1
$ vi /etc/selinux/config
—
SELINUX=enforcing
SELINUXTYPE=targeted
—

# 验证系统安全加固平台进阶策略
# 检查系统安全配置
$ oscap xccdf eval –profile xccdf_org.ssgproject.content_profile_rhel8_stig /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

# 检查SSH配置
$ sshd -t

# 检查防火墙配置
$ firewall-cmd –list-all

# 检查SELinux状态
$ sestatus

## 1. 创建Jenkinsfile
$ vi Jenkinsfile
—
pipeline {
agent any

stages {
stage(‘Checkout’) {
steps {
git branch: ‘main’, url: ‘https://github.com/example/security-hardening.git’
}
}

stage(‘Security Scan’) {
steps {
sh ‘trivy image –severity HIGH,CRITICAL myapp:latest’
sh ‘oscap xccdf eval –profile xccdf_org.ssgproject.content_profile_rhel8_stig /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml’
}
}

stage(‘Apply Hardening’) {
steps {
sh ‘ansible-playbook playbooks/apply-hardening.yml’
}
}

stage(‘Verify Security’) {
steps {
sh ‘oscap xccdf eval –profile xccdf_org.ssgproject.content_profile_rhel8_stig /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml’
sh ‘trivy image –severity HIGH,CRITICAL myapp:latest’
}
}
}

post {
always {
archiveArtifacts artifacts: ‘**/security-report.html’, fingerprint: true
}
success {
echo ‘Security hardening pipeline completed successfully!’
}
failure {
echo ‘Security hardening pipeline failed!’
mail to: ‘admin@fgedu.net.cn’, subject: ‘Security hardening pipeline failure’, body: ‘Security hardening pipeline failed in Jenkins’
}
}
}
—

# 集成系统安全加固平台进阶与监控系统
# 配置Prometheus + Grafana

## 1. 配置Prometheus监控
$ vi /etc/prometheus/prometheus.yml
—
global:
scrape_interval: 15s

scrape_configs:
– job_name: ‘node’
static_configs:
– targets: [‘localhost:9100’]

– job_name: ‘auditd’
static_configs:
– targets: [‘localhost:9100’]

– job_name: ‘falco’
static_configs:
– targets: [‘localhost:9376’]
—

## 2. 配置Grafana仪表盘
# 导入安全监控仪表盘

# 集成系统安全加固平台进阶与容器编排系统
# 配置Kubernetes

## 1. 配置Pod Security Policy
$ vi pod-security-policy.yaml
—
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:学习交流加群风哥微信: itpux-com
seccomp.security.alpha.kubernetes.io/allowedProfileNames: ‘docker/default’
apparmor.security.beta.kubernetes.io/allowedProfileNames: ‘runtime/default’
seccomp.security.alpha.kubernetes.io/defaultProfileName: ‘docker/default’
apparmor.security.beta.kubernetes.io/defaultProfileName: ‘runtime/default’
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
– ALL
volumes:
– ‘configMap’
– ’emptyDir’
– ‘projected’
– ‘secret’
– ‘downwardAPI’
– ‘persistentVolumeClaim’
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: ‘MustRunAsNonRoot’
seLinux:
rule: ‘RunAsAny’
supplementalGroups:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
fsGroup:
rule: ‘MustRunAs’
ranges:
– min: 1
max: 65535
readOnlyRootFilesystem: false
—

$ kubectl apply -f pod-security-policy.yaml

# 验证系统安全加固平台进阶集成
# 检查CI/CD集成
# 运行Jenkins Pipeline

# 检查监控集成
$ curl http://prometheus-server:9090/targets

# 检查容器编排集成
$ kubectl get psp
风哥提示：