## 1. 操作系统加固
– 更新系统
$ yum update -y

– 安装安全补丁
$ yum install -y security-patch

– 关闭不必要的服务
$ systemctl stop postfix
$ systemctl disable postfix
$ systemctl stop cups
$ systemctl disable cups

– 配置防火墙
$ firewall-cmd –permanent –add-port=5432/tcp
$ firewall-cmd –permanent –add-source=192.168.1.0/24
$ firewall-cmd –reload

– 启用SELinux
$ setenforce 1
$ sed -i ‘s/SELINUX=permissive/SELINUX=enforcing/’ /etc/selinux/config

– 限制su命令
$ echo “auth required pam_wheel.so use_uid” >> /etc/pam.d/su

– 设置密码策略
$ cat >> /etc/security/pwquality.conf << EOF minlen = 12 minclass = 4 dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1 EOF - 限制登录尝试次数 $ cat >> /etc/pam.d/system-auth << EOF auth required pam_tally2.so deny=5 unlock_time=300 EOF ## 2. 硬件安全 - 物理访问控制：限制物理访问服务器 - 硬件防火墙：使用硬件防火墙保护网络 - 电源备份：配置UPS，确保电源稳定 - 温度监控：监控服务器温度，防止过热 ## 3. 系统监控 - 安装监控工具 $ yum install -y nagios nrpe - 配置监控项 $ cat >> /etc/nagios/nrpe.cfg << EOF command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20 command[check_disk]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -p / command[check_mem]=/usr/lib64/nagios/plugins/check_mem -w 80% -c 90% EOF - 启动监控服务 $ systemctl start nrpe $ systemctl enable nrpe

## 1. 数据库配置加固
– 修改默认端口
$ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # 修改默认端口 port = 54321 EOF - 限制连接数 $ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # 限制连接数 max_connections = 100 EOF - 禁用远程超级用户访问 $ cat >> /yashanb/fgdata/fgedudb/pg_hba.conf << EOF # 禁用远程超级用户访问 host all postgres 0.0.0.0/0 reject EOF - 限制访问来源 $ cat >> /yashanb/fgdata/fgedudb/pg_hba.conf << EOF # 限制访问来源 host all all 192.168.1.0/24 md5 EOF - 启用SSL/TLS $ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # SSL配置 ssl = on ssl_cert_file = '/yashanb/app/yasdb/etc/server.crt' ssl_key_file = '/yashanb/app/yasdb/etc/server.key' EOF ## 2. 用户权限加固 - 创建最小权限用户 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "CREATE ROLE app_user WITH LOGIN PASSWORD 'app_pass';" $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "GRANT SELECT, INSERT, UPDATE, DELETE ON fgedu_orders TO app_user;" - 移除不必要的用户 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "DROP ROLE IF EXISTS test_user;" - 限制超级用户权限 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM public;" - 定期检查用户权限 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "SELECT usename, usesysid, valuntil FROM pg_user;" $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "SELECT grantee, privilege_type, table_name FROM information_schema.role_table_grants WHERE grantee = 'app_user';" ## 3. 数据安全加固 - 加密敏感数据 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "CREATE TABLE fgedu_users (id INT, username VARCHAR(100), password BYTEA);" $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "INSERT INTO fgedu_users VALUES (1, 'user1', encrypt('password123', 'encryption_key', 'aes-cbc/pad:pkcs'));" - 备份加密 $ /yashanb/app/yasdb/bin/pg_dump -U fgedu -d fgedudb -F c -f - | gpg --symmetric --cipher-algo AES256 -o /yashanb/backup/fgedudb_$(date +"%Y%m%d").backup.gpg - 定期备份 $ crontab -e 0 2 * * * /yashanb/app/yasdb/bin/pg_dump -U fgedu -d fgedudb -F c -f /yashanb/backup/fgedudb_$(date +"%Y%m%d").backup ## 4. 审计加固 - 启用审计功能 $ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # 审计配置 log_connections = on log_disconnections = on log_statement = 'all' log_min_duration_statement = 0 log_line_prefix = '%t [%p]: [%l-1] user=%u,db=%d,app=%a,client=%h ' EOF - 安装pgAudit扩展 $ /yashanb/app/yasdb/bin/psql -U fgedu -d fgedudb -c "CREATE EXTENSION pgaudit;" - 配置pgAudit $ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # pgAudit配置 shared_preload_libraries = 'pgaudit' pgaudit.log = 'all' pgaudit.log_catalog = on pgaudit.log_parameter = on pgaudit.log_level = 'notice' EOF

## 1. 网络访问控制
– 配置防火墙
$ firewall-cmd –permanent –add-port=54321/tcp
$ firewall-cmd –permanent –add-source=192.168.1.0/24
$ firewall-cmd –reload

– 使用VPN
$ yum install -y openvpn
$ systemctl start openvpn
$ systemctl enable openvpn

– 网络隔离
$ ip route add 192.168.2.0/24 via 192.168.1.1 dev eth0
$ iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.1.0/24 -j ACCEPT
$ iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT
$ iptables -P FORWARD DROP

## 2. 通信加密
– 启用SSL/TLS
$ cat >> /yashanb/fgdata/fgedudb/postgresql.conf << EOF # SSL配置 ssl = on ssl_cert_file = '/yashanb/app/yasdb/etc/server.crt' ssl_key_file = '/yashanb/app/yasdb/etc/server.key' EOF - 配置客户端使用SSL $ /yashanb/app/yasdb/bin/psql "host=localhost port=54321 dbname=fgedudb user=fgedu sslmode=require" ## 3. 网络监控 - 安装网络监控工具 $ yum install -y ntopng $ systemctl start ntopng $ systemctl enable ntopng - 监控网络流量 $ sar -n DEV 1 5 - 检测异常流量 $ tcpdump -i eth0 port 54321 ## 4. 网络安全扫描 - 使用Nmap扫描网络 $ nmap -sV -p 54321 192.168.1.100 - 使用OpenVAS扫描漏洞 $ openvas-cli --target=192.168.1.100 --port=54321 - 定期安全扫描 $ crontab -e 0 0 * * 0 nmap -sV -p 54321 192.168.1.100 > /yashanb/log/network_scan.log

## 1. 应用程序加固
– 防止SQL注入
// 使用参数化查询
String query = “SELECT * FROM fgedu_users WHERE username = ? AND password = ?”;
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();

– 防止XSS攻击
// 对输入进行转义
String safeInput = ESAPI.encoder().encodeForHTML(input);

– 防止CSRF攻击
// 使用CSRF令牌
String token = generateCSRFToken();
session.setAttribute(“csrfToken”, token);

## 2. 接口安全
– 使用HTTPS
// 配置HTTPS
server.ssl.key-store=classpath:keystore.jks
server.ssl.key-store-password=password
server.ssl.key-password=password

– 接口认证
// 使用JWT认证
String token = Jwts.builder()
.setSubject(username)
.setExpiration(new Date(System.currentTimeMillis() + 86400000))
.signWith(SignatureAlgorithm.HS256, secretKey)
.compact();

– 接口限流
// 使用Redis实现限流
String key = “rate_limit:” + ip;
Long current = redisTemplate.opsForValue().increment(key);
if (current == 1) {
redisTemplate.expire(key, 1, TimeUnit.MINUTES);
}
if (current > 100) {
throw new RateLimitException(“Too many requests”);
}

## 3. 应用监控
– 安装应用监控工具
$ yum install -y prometheus grafana
$ systemctl start prometheus grafana
$ systemctl enable prometheus grafana

– 配置应用监控
// 配置Prometheus
scrape_configs:
– job_name: ‘app’
static_configs:
– targets: [‘192.168.1.100:8080’]

– 监控应用性能
// 配置Grafana面板
– 监控应用错误
// 配置错误日志监控

## 4. 应用安全测试
– 渗透测试
$ sqlmap -u “http://example.com/login.php” –data=”username=test&password=test”

– 漏洞扫描
$ OWASP ZAP

– 代码审计
$ sonarqube