# Linux iptables配置
# 查看当前规则
$ iptables -L -n

# 清除现有规则
$ iptables -F
$ iptables -X

# 设置默认策略
$ iptables -P INPUT DROP
$ iptables -P FORWARD DROP
$ iptables -P OUTPUT ACCEPT

# 允许回环接口
$ iptables -A INPUT -i lo -j ACCEPT

# 允许已建立的连接
$ iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# 允许SSH连接
$ iptables -A INPUT -p tcp –dport 22 -j ACCEPT

# 允许HTTP和HTTPS连接
$ iptables -A INPUT -p tcp –dport 80 -j ACCEPT
$ iptables -A INPUT -p tcp –dport 443 -j ACCEPT

# 允许ICMP echo请求
$ iptables -A INPUT -p icmp –icmp-type echo-request -j ACCEPT

# 记录日志
$ iptables -A INPUT -j LOG –log-prefix “DROP: ” –log-level 4

# 保存规则
$ iptables-save > /etc/iptables/rules.v4

# 配置ufw
$ ufw default deny incoming
$ ufw default allow outgoing
$ ufw allow ssh
$ ufw allow http
$ ufw allow https
$ ufw enable
$ ufw status

# Windows防火墙配置
# 查看防火墙状态
> netsh advfirewall show allprofiles state

# 配置防火墙规则
> netsh advfirewall firewall add rule name=”Allow SSH” dir=in action=allow protocol=TCP localport=22
> netsh advfirewall firewall add rule name=”Allow HTTP” dir=in action=allow protocol=TCP localport=80
> netsh advfirewall firewall add rule name=”Allow HTTPS” dir=in action=allow protocol=TCP localport=443

# 启用防火墙
> netsh advfirewall set allprofiles state on

# 安装Snort
$ apt-get update && apt-get install -y snort

# 配置Snort
$ vim /etc/snort/snort.conf

# 测试Snort
$ snort -T -c /etc/snort/snort.conf

# 运行Snort
$ snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

# 查看Snort日志
$ tail -f /var/log/snort/alert

# 安装Suricata
$ apt-get update && apt-get install -y suricata

# 配置Suricata
$ vim /etc/suricata/suricata.yaml

# 测试Suricata
$ suricata -T -c /etc/suricata/suricata.yaml

# 运行Suricata
$ systemctl start suricata
$ systemctl enable suricata

# 查看Suricata日志
$ tail -f /var/log/suricata/fast.log

# 配置Suricata为IPS模式
$ vim /etc/suricata/suricata.yaml
# 修改如下配置
# af-packet:
# – interface: eth0
# threads: auto
# cluster-id: 99
# cluster-type: cluster_flow
# defrag: yes
# tpacket-v3: yes
# use-mmap: yes

# 配置IPS规则
$ vim /etc/suricata/rules/local.rules
# 添加规则
alert tcp any any -> any 22 (msg:”SSH brute force attempt”; flow:to_server; threshold: type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:1000001; rev:1;)

# 重启Suricata
$ systemctl restart suricata

# 查看IPS日志
$ tail -f /var/log/suricata/fast.log

# 安装ModSecurity (WAF)
$ apt-get update && apt-get install -y libapache2-mod-security2

# 配置ModSecurity
$ cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
$ vim /etc/modsecurity/modsecurity.conf
# 修改SecRuleEngine为On

# 配置规则
$ mkdir -p /etc/modsecurity/rules
$ cd /etc/modsecurity/rules
$ wget https://github.com/coreruleset/coreruleset/archive/v3.3.2.tar.gz
$ tar -xzf v3.3.2.tar.gz
$ ln -s coreruleset-3.3.2/crs-setup.conf.example crs-setup.conf
$ ln -s coreruleset-3.3.2/rules/ .

# 配置Apache
$ vim /etc/apache2/mods-enabled/security2.conf
# 添加如下配置
# SecDataDir /var/cache/modsecurity
# Include /etc/modsecurity/modsecurity.conf
# Include /etc/modsecurity/rules/crs-setup.conf
# Include /etc/modsecurity/rules/*.conf

# 重启Apache
$ systemctl restart apache2

# 安装Nagios
$ apt-get update && apt-get install -y nagios3 nagios-plugins

# 配置Nagios
$ vim /etc/nagios3/conf.d/fgedudb_nagios2.cfg

# 重启Nagios
$ systemctl restart nagios3

# 访问Nagios Web界面
# http://fgedudb/nagios3

# 安装Zabbix
$ wget https://repo.zabbix.com/zabbix/6.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_6.0-4+ubuntu20.04_all.deb
$ dpkg -i zabbix-release_6.0-4+ubuntu20.04_all.deb
$ apt-get update
$ apt-get install -y zabbix-server-mysql zabbix-frontend-php zabbix-apache-conf zabbix-agent

# 配置Zabbix数据库
$ mysql -u root -p
> CREATE DATABASE zabbix character set utf8mb4 collate utf8mb4_bin;
> CREATE USER ‘zabbix’@’fgedudb’ IDENTIFIED BY ‘password’;
> GRANT ALL PRIVILEGES ON zabbix.* TO ‘zabbix’@’fgedudb’;
> FLUSH PRIVILEGES;
> quit;

$ zcat /usr/share/doc/zabbix-server-mysql/create.sql.gz | mysql -u zabbix -p zabbix

# 配置Zabbix Server
$ vim /etc/zabbix/zabbix_server.conf
# 修改DBPassword=password

# 配置PHP
$ vim /etc/zabbix/apache.conf
# 取消注释并设置正确的时区

# 重启服务
$ systemctl restart zabbix-server zabbix-agent apache2
$ systemctl enable zabbix-server zabbix-agent apache2

# 访问Zabbix Web界面
# http://fgedudb/zabbix

# 安装Prometheus和Grafana
$ helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
$ helm install prometheus prometheus-community/kube-prometheus-stack

# 配置网络监控
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: network-monitor
namespace: monitoring
spec:
selector:
matchLabels:
app: network
endpoints:
– port: metrics

# 应用ServiceMonitor
$ kubectl apply -f service-monitor.yaml

# 使用tcpdump捕获网络流量
$ tcpdump -i eth0 -w capture.pcap

# 分析网络流量
$ tcpdump -r capture.pcap

# 使用Wireshark分析流量
$ wireshark capture.pcap

# 使用iftop监控网络流量
$ iftop -i eth0

# 输出案例
$ iftop -i eth0

interface: eth0
IP address is: 192.168.1.100
MAC address is: 00:11:22:33:44:55

# Host name (port/service if enabled)
# last 2s last 10s last 40s cumulative
——————————————————————————–
192.168.1.101:443 => 192.168.1.100:54321 1.24Mb 1.12Mb 1.08Mb 12.3Mb
192.168.1.100:54321 => 192.168.1.101:443 8.5Kb 7.2Kb 6.8Kb 85.3Kb
192.168.1.102:80 => 192.168.1.100:54322 512Kb 486Kb 452Kb 5.2Mb
192.168.1.100:54322 => 192.168.1.102:80 4.2Kb 3.8Kb 3.5Kb 42.1Kb

# 使用nethogs监控进程网络流量
$ nethogs eth0

# 输出案例
$ nethogs eth0

PID USER PROGRAM DEV SENT RECEIVED
1234 root nginx eth0 1.2Mb 8.5Kb
5678 root sshd eth0 4.2Kb 512Kb
9012 root curl eth0 3.5Kb 2.1Mb

# 生成SSL证书
$ openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes

# 配置Apache使用SSL
$ apt-get install -y apache2
$ a2enmod ssl
$ a2ensite default-ssl

$ vim /etc/apache2/sites-available/default-ssl.conf
# 修改如下配置
# SSLCertificateFile /path/to/server.crt
# SSLCertificateKeyFile /path/to/server.key

# 重启Apache
$ systemctl restart apache2

# 配置Nginx使用SSL
$ apt-get install -y nginx

$ vim /etc/nginx/sites-available/default
# 添加如下配置
# server {
# listen 443 ssl;
# server_name fgedu.net.cn;
# ssl_certificate /path/to/server.crt;
# ssl_certificate_key /path/to/server.key;
# ssl_protocols TLSv1.2 TLSv1.3;
# ssl_ciphers ‘ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384’;
# ssl_prefer_server_ciphers off;
# ssl_session_cache shared:SSL:10m;
# ssl_session_timeout 10m;
# location / {
# root /var/www/html;
# index index.html index.htm;
# }
# }

# 重启Nginx
$ systemctl restart nginx

# 测试SSL配置
$ openssl s_client -connect fgedu.net.cn:443

# 使用Let’s Encrypt获取免费SSL证书
$ apt-get install -y certbot python3-certbot-apache
$ certbot –apache -d fgedu.net.cn

# 自动续期
$ certbot renew –dry-run

# 使用SSH加密通信
$ ssh-keygen -t rsa -b 4096 -C “user@fgedu.net.cn”
$ ssh-copy-id user@remote-server
$ ssh user@remote-server

# 配置SSH安全选项
$ vim /etc/ssh/sshd_config
# 修改如下配置
# Port 22
# PermitRootLogin no
# PasswordAuthentication no
# PubkeyAuthentication yes
# AuthorizedKeysFile .ssh/authorized_keys
# ChallengeResponseAuthentication no
# UsePAM yes
# X11Forwarding yes
# PrintMotd no
# AcceptEnv LANG LC_*
# Subsystem sftp /usr/lib/openssh/sftp-server

# 重启SSH服务
$ systemctl restart sshd

# 使用VPN加密通信
# 安装OpenVPN
$ apt-get update && apt-get install -y openvpn easy-rsa

# 配置Easy-RSA
$ make-cadir ~/openvpn-ca
$ cd ~/openvpn-ca
$ source vars
$ ./clean-all
$ ./build-ca
$ ./build-key-server server
$ ./build-dh
$ openvpn –genkey –secret keys/ta.key

# 配置OpenVPN服务器
$ cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
$ gzip -d /etc/openvpn/server.conf.gz
$ vim /etc/openvpn/server.conf
# 修改如下配置
# ca ca.crt
# cert server.crt
# key server.key
# dh dh2048.pem
# tls-auth ta.key 0
# server 10.8.0.0 255.255.255.0
# push “redirect-gateway def1 bypass-dhcp”
# push “dhcp-option DNS 8.8.8.8”
# push “dhcp-option DNS 8.8.4.4”
# keepalive 10 120
# tls-server
# cipher AES-256-CBC
# user nobody
# group nogroup
# persist-key
# persist-tun
# status openvpn-status.log
# verb 3

# 复制证书和密钥
$ cp ~/openvpn-ca/keys/{ca.crt,server.crt,server.key,dh2048.pem,ta.key} /etc/openvpn/

# 启动OpenVPN服务
$ systemctl start openvpn@server
$ systemctl enable openvpn@server

# 配置客户端
$ cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client.conf
$ vim ~/client.conf
# 修改如下配置
# remote server-ip 1194
# ca ca.crt
# cert client.crt
# key client.key
# tls-auth ta.key 1
# cipher AES-256-CBC

# 生成客户端证书
$ cd ~/openvpn-ca
$ ./build-key client

# 复制客户端文件
$ mkdir -p ~/client-configs/files
$ cp ~/openvpn-ca/keys/{ca.crt,client.crt,client.key,ta.key} ~/client-configs/files/
$ cp ~/client.conf ~/client-configs/files/

# 配置网络ACL
# AWS网络ACL
$ aws ec2 create-network-acl \
–vpc-id vpc-0123456789abcdef0

$ aws ec2 create-network-acl-entry \
–network-acl-id acl-0123456789abcdef0 \
–rule-number 100 \
–protocol tcp \
–port-range From=22,To=22 \
–cidr-block 0.0.0.0/0 \
–rule-action allow

$ aws ec2 associate-network-acl \
–network-acl-id acl-0123456789abcdef0 \
–subnet-id subnet-0123456789abcdef0

# 配置VLAN
# 创建VLAN
$ vconfig add eth0 100
$ ifconfig eth0.100 up
$ ifconfig eth0.100 192.168.100.1 netmask 255.255.255.0

# 配置访问控制列表
$ sudo apt-get install -y acl

# 设置文件ACL
$ setfacl -m u:user:rwx /path/to/file
$ setfacl -m g:group:rx /path/to/file

# 查看文件ACL
$ getfacl /path/to/file

# 配置sudo
$ visudo
# 添加如下配置
# user ALL=(ALL:ALL) ALL

# 配置PAM
$ vim /etc/pam.d/common-auth
# 添加如下配置
# auth required pam_tally2.so deny=5 unlock_time=300

# 配置登录失败锁定
$ vim /etc/security/faillock.conf
# 修改如下配置
# deny = 5
# unlock_time = 300
# even_deny_root = yes

# 配置LDAP认证
$ apt-get update && apt-get install -y libnss-ldap libpam-ldap ldap-utils

$ vim /etc/ldap/ldap.conf
# 修改如下配置
# base dc=example,dc=com
# uri ldap://ldap.fgedu.net.cn
# binddn cn=admin,dc=example,dc=com
# bindpw password

$ vim /etc/nsswitch.conf
# 修改如下配置
# passwd: files ldap
# group: files ldap
# shadow: files ldap

$ vim /etc/pam.d/common-auth
# 添加如下配置
# auth sufficient pam_ldap.so

$ vim /etc/pam.d/common-account
# 添加如下配置
# account sufficient pam_ldap.so

# 配置RADIUS认证
$ apt-get update && apt-get install -y freeradius

$ vim /etc/freeradius/3.0/users
# 添加如下配置
# user Cleartext-Password := “password”
# Service-Type = Framed-User,
# Framed-Protocol = PPP,
# Framed-IP-Address = 192.168.1.100,
# Framed-Routing = None,
# Framed-Compression = Van-Jacobson-TCP-IP

# 重启RADIUS服务
$ systemctl restart freeradius

# 配置双因素认证
$ apt-get update && apt-get install -y libpam-google-authenticator

$ google-authenticator
# 按照提示配置

$ vim /etc/pam.d/sshd
# 添加如下配置
# auth required pam_google_authenticator.so

$ vim /etc/ssh/sshd_config
# 修改如下配置
# ChallengeResponseAuthentication yes
# UsePAM yes

# 重启SSH服务
$ systemctl restart sshd

# 安装Nmap
$ apt-get update && apt-get install -y nmap

# 扫描开放端口
$ nmap -sV 192.168.1.1/24

# 输出案例
$ nmap -sV 192.168.1.100

Starting Nmap 7.80 ( https://nmap.org ) at 2026-04-03 10:00 UTC
Nmap scan report for 192.168.1.100
Host is up (0.001s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4
80/tcp open http Apache httpd 2.4.41
443/tcp open ssl/http Apache httpd 2.4.41
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds

# 安装OpenVAS/Greenbone
$ apt-get update && apt-get install -y gvm

# 启动GVM服务
$ gvm-setup
$ gvm-start

# 访问GVM Web界面
# https://fgedudb:9392

# 安装Nikto
$ apt-get update && apt-get install -y nikto

# 扫描Web服务器
$ nikto -h http://fgedu.net.cn

# 输出案例
$ nikto -h http://fgedu.net.cn

– Nikto v2.1.6
—————————————————————————
+ Target: http://fgedu.net.cn
+ Server: Apache/2.4.41 (Ubuntu)
+ Retrieved X-Powered-By header: PHP/7.4.3
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use ‘-C all’ to force check all possible dirs)
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-12184: /admin/: Admin directory found.
+ OSVDB-3268: /config/: Configuration directory found.
+ 8714 requests: 0 error(s) and 8 item(s) reported on remote host
+ End Time: 2026-04-03 10:05:00 (GMT)
—————————————————————————
+ 1 host(s) tested

# 安装安全更新
$ apt-get update && apt-get upgrade -y
$ apt-get dist-upgrade -y

# 检查安全更新
$ apt-get update && apt-get list –upgradable | grep security

# 配置自动安全更新
$ apt-get install -y unattended-upgrades
$ vim /etc/apt/apt.conf.d/50unattended-upgrades
# 修改如下配置
# Unattended-Upgrade::Allowed-Origins {
# “${distro_id}:${distro_codename}-security”;
# };

$ vim /etc/apt/apt.conf.d/20auto-upgrades
# 修改如下配置
# APT::Periodic::Update-Package-Lists “1”;
# APT::Periodic::Unattended-Upgrade “1”;

# 修复Web应用漏洞
# 安装OWASP ZAP
$ apt-get update && apt-get install -y zaproxy

# 运行ZAP扫描
$ zap-cli quick-scan –self-contained –start-options “-config api.disablekey=true” http://fgedu.net.cn

# 输出案例
$ zap-cli quick-scan –self-contained –start-options “-config api.disablekey=true” http://fgedu.net.cn

[INFO] Starting ZAP daemon
[INFO] Running quick scan for http://fgedu.net.cn
[INFO] Issue found: Cookie without HttpOnly flag
[INFO] Issue found: Cookie without Secure flag
[INFO] Issue found: X-Content-Type-Options header missing
[INFO] Issue found: X-Frame-Options header missing
[INFO] Issue found: X-XSS-Protection header missing
[INFO] Issue found: Server header exposed
[INFO] Issue found: X-Powered-By header exposed
[INFO] Scan complete

# 修复配置漏洞
$ vim /etc/apache2/conf-available/security.conf
# 修改如下配置
# ServerTokens Prod
# ServerSignature Off
# Header set X-Content-Type-Options “nosniff”
# Header set X-Frame-Options “SAMEORIGIN”
# Header set X-XSS-Protection “1; mode=block”
# Header set Strict-Transport-Security “max-age=31536000; includeSubDomains”

# 重启Apache
$ systemctl restart apache2

# 安全事件响应流程
1. 准备：建立响应团队，制定响应计划，准备工具和资源
2. 检测：监控和检测安全事件
3. 分析：分析事件的性质和影响
4. 遏制：采取措施遏制事件的扩散
5. 消除：消除事件的根源
6. 恢复：恢复系统和服务
7. 风哥总结：总结经验教训，改进响应流程

# 配置日志收集
$ apt-get update && apt-get install -y rsyslog

$ vim /etc/rsyslog.conf
# 修改如下配置
# *.* @remote-log-server:514

# 重启rsyslog
$ systemctl restart rsyslog

# 配置ELK Stack
$ docker-compose up -d

# 安全事件响应工具
# 安装TheHive
$ docker run -d –name thehive \
-p 9000:9000 \
-e “JVM_OPTS=-Xmx4G” \
-v /path/to/data:/data \
thehiveproject/thehive:4.1.19

# 安装MISP
$ docker run -d –name misp \
-p 80:80 \
-v /path/to/data:/var/www/MISP \
harvarditsecurity/misp

# 安装Wazuh
$ docker-compose up -d

# 分析日志
$ grep “Failed password” /var/log/auth.log

# 输出案例
$ grep “Failed password” /var/log/auth.log

Apr 3 10:00:01 server sshd[12345]: Failed password for root from 192.168.1.101 port 54321 ssh2
Apr 3 10:00:02 server sshd[12346]: Failed password for root from 192.168.1.101 port 54322 ssh2
Apr 3 10:00:03 server sshd[12347]: Failed password for root from 192.168.1.101 port 54323 ssh2

# 使用Logstash分析日志
$ cat logstash.conf
input {
file {
path => “/var/log/auth.log”
start_position => “beginning”
}
}

filter {
if [message] =~ /Failed password/ {
grok {
match => { “message” => “%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:service}%{NUMBER:pid}: Failed password for %{USER:user} from %{IP:source_ip} port %{NUMBER:port} %{DATA:protocol}”
}
}
}

output {
elasticsearch {
hosts => [“fgedudb:9200”]
index => “security-events”
}
}

# 运行Logstash
$ logstash -f logstash.conf

# 使用Kibana分析事件
# http://fgedudb:5601

# 分析网络流量
$ tcpdump -i eth0 -w capture.pcap
$ wireshark capture.pcap

# 分析系统状态
$ top
$ netstat -tuln
$ ps aux
$ lsof -i

# 网络安全防护实施步骤
1. 评估现状：分析当前网络安全状况
2. 制定策略：制定网络安全防护策略
3. 实施防护措施：部署防火墙、IDS/IPS等
4. 配置安全设置：优化系统和应用的安全配置
5. 监控和检测：部署监控工具，检测安全事件
6. 响应和修复：建立响应流程，及时处理安全事件
7. 培训和意识：培训员工，提高安全意识
8. 持续改进：定期评估和改进安全措施

# 示例实施计划
– 第1-2周：评估现状，制定策略
– 第3-4周：部署防火墙和IDS/IPS
– 第5-6周：配置安全设置，加密敏感数据
– 第7-8周：部署监控工具，建立响应流程
– 第9-10周：培训员工，提高安全意识
– 第11-12周：评估效果，持续改进