尧图网站建设 
蓝队主机安全基线配置基于 CIS Benchmark 的加固实录在蓝队防御体系中端点主机是抵御攻击者横向移动、特权提升与持久化控制的最后防线。未加固的操作系统默认配置通常包含大量宽松的权限、过时的加密算法与脆弱的内核参数。**CIS Benchmark互联网安全中心基准**提供了公认的系统安全硬化行业标准。在生产环境中实施 CIS 加固既要在系统底层最大化收敛攻击面又要避免过度硬化引发线上服务中断。生产级加固架构与核心加固维度主机加固必须覆盖系统访问、身份认证、网络协议栈与审计追踪四个核心维度------------------------------------------------------------------------- | [Layer 1] Access Control (SSH Hardening) | | - Disable root login, Enforce Ed25519, Strip weak ciphers MACs | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 2] Identity PAM (Pluggable Authentication Modules) | | - Account lockout (pam_faillock), Password policy, Restrict su access | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 3] Kernel Network Stack Hardening (sysctl.conf) | | - Full ASLR (randomize_va_space2), SYN Cookies, Reverse Path Filtering | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 4] Continuous Auditing Monitoring (auditd) | | - Monitor /etc/shadow, Module loading, SUID execution, Privileged calls | -------------------------------------------------------------------------核心加固实战配置1. SSH 服务端安全硬化 (/etc/ssh/sshd_config)消除弱加密套件强制实施密钥认证与最小权限原则# 协议与端口约束 Port 22 Protocol 2 # 身份验证策略 PermitRootLogin no MaxAuthTries 3 PubkeyAuthentication yes PasswordAuthentication no PermitEmptyPasswords no AuthenticationMethods publickey # 算法套件强约束剔除 SHA1、CBC 及弱 Diffie-Hellman 组 KexAlgorithms curve25519-sha256,curve25519-sha256libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 Ciphers chacha20-poly1305openssh.com,aes256-gcmopenssh.com,aes128-gcmopenssh.com MACs hmac-sha2-512-etmopenssh.com,hmac-sha2-256-etmopenssh.com # 会话与环境控制 ClientAliveInterval 300 ClientAliveCountMax 2 X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no2. PAM 认证与防暴力破解策略 (/etc/pam.d/system-authpassword-auth)在 RHEL/CentOS 8 与 Ubuntu 22.04 中使用pam_faillock替代过时的pam_tally2# 连续失败 5 次锁定 900 秒同时记录审计日志 auth required pam_env.so auth required pam_faillock.so preauth audit silent deny5 unlock_time900 auth sufficient pam_unix.so try_first_pass auth [defaultdie] pam_faillock.so authfail audit deny5 unlock_time900 account required pam_faillock.so限制普通用户通过su切换为 root仅允许wheel组用户# /etc/pam.d/su auth required pam_wheel.so use_uid3. 内核与网络协议栈加固 (/etc/sysctl.d/99-cis-security.conf)防范 SYN Flood、IP 欺骗、中间人嗅探及内存地址预测攻击# 启用完全地址空间随机化 (ASLR) kernel.randomize_va_space 2 # 限制 dmesg 内核日志访问权限给 root kernel.dmesg_restrict 1 # 限制 ptrace 进程追踪范围防进程注入 kernel.yama.ptrace_scope 2 # 禁用核心转储中的 SUID 程序内存 fs.suid_dumpable 0 # 开启 TCP SYN Cookies 防御 DoS net.ipv4.tcp_syncookies 1 # 严格反向路径过滤防 IP 欺骗 net.ipv4.conf.all.rp_filter 1 net.ipv4.conf.default.rp_filter 1 # 禁用 ICMP 重定向报文接收与发送防路由劫持 net.ipv4.conf.all.accept_redirects 0 net.ipv4.conf.default.accept_redirects 0 net.ipv4.conf.all.send_redirects 0 net.ipv4.conf.default.send_redirects 0 # 禁用数据包转发功能非路由器主机 net.ipv4.ip_forward 0执行生效命令sysctl -p /etc/sysctl.d/99-cis-security.conf4. 生产级 Auditd 审计规则定制 (/etc/audit/rules.d/cis.rules)实时捕获特权文件访问、时间变更与恶意模块加载# 删除所有已有规则并设置缓冲区大小 -D -b 8192 # 监控系统时间篡改 -a always,exit -F archb64 -S adjtimex -S settimeofday -k time-change -a always,exit -F archb64 -S clock_settime -k time-change -w /etc/localtime -p wa -k time-change # 监控账户与特权文件篡改 -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity # 监控内核模块动态加载与卸载 -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F archb64 -S init_module -S delete_module -k modules # 锁定 auditd 配置防止攻击者禁用审计 -e 2自动化合规基线检查脚本以下为自动化检查脚本可集成至运维巡检与 CI/CD 镜像构建流程#!/usr/bin/env bash set -euo pipefail RED\033[0;31m GREEN\033[0;32m NC\033[0m pass_count0 fail_count0 check_item() { local title$1 local cmd$2 local expected$3 actual$(eval $cmd 2/dev/null || true) if [[ $actual $expected ]]; then echo -e [ ${GREEN}PASS${NC} ] $title pass_count$((pass_count 1)) else echo -e [ ${RED}FAIL${NC} ] $title (Expected: $expected, Got: $actual) fail_count$((fail_count 1)) fi } echo echo Linux CIS Benchmark Baseline Check echo # 1. SSH 检查 check_item SSH PermitRootLogin is no \ grep -Ei ^\s*PermitRootLogin\sno /etc/ssh/sshd_config | awk {print \$2} \ no check_item SSH PasswordAuthentication is no \ grep -Ei ^\s*PasswordAuthentication\sno /etc/ssh/sshd_config | awk {print \$2} \ no # 2. 内核参数检查 check_item Kernel ASLR is set to 2 \ sysctl -n kernel.randomize_va_space \ 2 check_item TCP SYN Cookies enabled \ sysctl -n net.ipv4.tcp_syncookies \ 1 check_item IPv4 IP Forwarding disabled \ sysctl -n net.ipv4.ip_forward \ 0 # 3. 审计服务状态 check_item Auditd service is active \ systemctl is-active auditd \ active echo echo Check Completed: $pass_count Passed, $fail_count Failed. echo 生产运维防踩坑实录SSH 配置双会话验证在修改/etc/ssh/sshd_config并重启sshd服务前务必保持当前 SSH 会话不要断开在另一个终端发起新连接测试。一旦配置错误如公钥格式问题或 PAM 冲突当前会话尚可用于紧急回滚。Auditd 缓冲区防溢出若主机承载高并发读写业务如 Redis、Kafka、DB-b 8192缓冲区可能被打满导致系统拒绝服务。必须根据负载压测合理设置auditd.conf中的backlog_wait_time与action_mail_acct。suid_dumpable 导致调试受阻将fs.suid_dumpable设为 0 会导致生产环境 crash 时无法生成 coredump 文件排查段错误时应结合临时开关或配合 systemd-coredump 集中收集。通过在镜像发布与节点初始化阶段固化 CIS 加固基线企业可大幅提高攻击者的渗透成本有效遏制利用弱口令与系统缺陷进行的横向渗透。 蓝队主机安全基线配置：基于 CIS Benchmark 的加固实录
蓝队主机安全基线配置基于 CIS Benchmark 的加固实录在蓝队防御体系中端点主机是抵御攻击者横向移动、特权提升与持久化控制的最后防线。未加固的操作系统默认配置通常包含大量宽松的权限、过时的加密算法与脆弱的内核参数。**CIS Benchmark互联网安全中心基准**提供了公认的系统安全硬化行业标准。在生产环境中实施 CIS 加固既要在系统底层最大化收敛攻击面又要避免过度硬化引发线上服务中断。生产级加固架构与核心加固维度主机加固必须覆盖系统访问、身份认证、网络协议栈与审计追踪四个核心维度------------------------------------------------------------------------- | [Layer 1] Access Control (SSH Hardening) | | - Disable root login, Enforce Ed25519, Strip weak ciphers MACs | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 2] Identity PAM (Pluggable Authentication Modules) | | - Account lockout (pam_faillock), Password policy, Restrict su access | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 3] Kernel Network Stack Hardening (sysctl.conf) | | - Full ASLR (randomize_va_space2), SYN Cookies, Reverse Path Filtering | ------------------------------------------------------------------------- │ ------------------------------------------------------------------------- | [Layer 4] Continuous Auditing Monitoring (auditd) | | - Monitor /etc/shadow, Module loading, SUID execution, Privileged calls | -------------------------------------------------------------------------核心加固实战配置1. SSH 服务端安全硬化 (/etc/ssh/sshd_config)消除弱加密套件强制实施密钥认证与最小权限原则# 协议与端口约束 Port 22 Protocol 2 # 身份验证策略 PermitRootLogin no MaxAuthTries 3 PubkeyAuthentication yes PasswordAuthentication no PermitEmptyPasswords no AuthenticationMethods publickey # 算法套件强约束剔除 SHA1、CBC 及弱 Diffie-Hellman 组 KexAlgorithms curve25519-sha256,curve25519-sha256libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 Ciphers chacha20-poly1305openssh.com,aes256-gcmopenssh.com,aes128-gcmopenssh.com MACs hmac-sha2-512-etmopenssh.com,hmac-sha2-256-etmopenssh.com # 会话与环境控制 ClientAliveInterval 300 ClientAliveCountMax 2 X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no2. PAM 认证与防暴力破解策略 (/etc/pam.d/system-authpassword-auth)在 RHEL/CentOS 8 与 Ubuntu 22.04 中使用pam_faillock替代过时的pam_tally2# 连续失败 5 次锁定 900 秒同时记录审计日志 auth required pam_env.so auth required pam_faillock.so preauth audit silent deny5 unlock_time900 auth sufficient pam_unix.so try_first_pass auth [defaultdie] pam_faillock.so authfail audit deny5 unlock_time900 account required pam_faillock.so限制普通用户通过su切换为 root仅允许wheel组用户# /etc/pam.d/su auth required pam_wheel.so use_uid3. 内核与网络协议栈加固 (/etc/sysctl.d/99-cis-security.conf)防范 SYN Flood、IP 欺骗、中间人嗅探及内存地址预测攻击# 启用完全地址空间随机化 (ASLR) kernel.randomize_va_space 2 # 限制 dmesg 内核日志访问权限给 root kernel.dmesg_restrict 1 # 限制 ptrace 进程追踪范围防进程注入 kernel.yama.ptrace_scope 2 # 禁用核心转储中的 SUID 程序内存 fs.suid_dumpable 0 # 开启 TCP SYN Cookies 防御 DoS net.ipv4.tcp_syncookies 1 # 严格反向路径过滤防 IP 欺骗 net.ipv4.conf.all.rp_filter 1 net.ipv4.conf.default.rp_filter 1 # 禁用 ICMP 重定向报文接收与发送防路由劫持 net.ipv4.conf.all.accept_redirects 0 net.ipv4.conf.default.accept_redirects 0 net.ipv4.conf.all.send_redirects 0 net.ipv4.conf.default.send_redirects 0 # 禁用数据包转发功能非路由器主机 net.ipv4.ip_forward 0执行生效命令sysctl -p /etc/sysctl.d/99-cis-security.conf4. 生产级 Auditd 审计规则定制 (/etc/audit/rules.d/cis.rules)实时捕获特权文件访问、时间变更与恶意模块加载# 删除所有已有规则并设置缓冲区大小 -D -b 8192 # 监控系统时间篡改 -a always,exit -F archb64 -S adjtimex -S settimeofday -k time-change -a always,exit -F archb64 -S clock_settime -k time-change -w /etc/localtime -p wa -k time-change # 监控账户与特权文件篡改 -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity # 监控内核模块动态加载与卸载 -w /sbin/insmod -p x -k modules -w /sbin/rmmod -p x -k modules -w /sbin/modprobe -p x -k modules -a always,exit -F archb64 -S init_module -S delete_module -k modules # 锁定 auditd 配置防止攻击者禁用审计 -e 2自动化合规基线检查脚本以下为自动化检查脚本可集成至运维巡检与 CI/CD 镜像构建流程#!/usr/bin/env bash set -euo pipefail RED\033[0;31m GREEN\033[0;32m NC\033[0m pass_count0 fail_count0 check_item() { local title$1 local cmd$2 local expected$3 actual$(eval $cmd 2/dev/null || true) if [[ $actual $expected ]]; then echo -e [ ${GREEN}PASS${NC} ] $title pass_count$((pass_count 1)) else echo -e [ ${RED}FAIL${NC} ] $title (Expected: $expected, Got: $actual) fail_count$((fail_count 1)) fi } echo echo Linux CIS Benchmark Baseline Check echo # 1. SSH 检查 check_item SSH PermitRootLogin is no \ grep -Ei ^\s*PermitRootLogin\sno /etc/ssh/sshd_config | awk {print \$2} \ no check_item SSH PasswordAuthentication is no \ grep -Ei ^\s*PasswordAuthentication\sno /etc/ssh/sshd_config | awk {print \$2} \ no # 2. 内核参数检查 check_item Kernel ASLR is set to 2 \ sysctl -n kernel.randomize_va_space \ 2 check_item TCP SYN Cookies enabled \ sysctl -n net.ipv4.tcp_syncookies \ 1 check_item IPv4 IP Forwarding disabled \ sysctl -n net.ipv4.ip_forward \ 0 # 3. 审计服务状态 check_item Auditd service is active \ systemctl is-active auditd \ active echo echo Check Completed: $pass_count Passed, $fail_count Failed. echo 生产运维防踩坑实录SSH 配置双会话验证在修改/etc/ssh/sshd_config并重启sshd服务前务必保持当前 SSH 会话不要断开在另一个终端发起新连接测试。一旦配置错误如公钥格式问题或 PAM 冲突当前会话尚可用于紧急回滚。Auditd 缓冲区防溢出若主机承载高并发读写业务如 Redis、Kafka、DB-b 8192缓冲区可能被打满导致系统拒绝服务。必须根据负载压测合理设置auditd.conf中的backlog_wait_time与action_mail_acct。suid_dumpable 导致调试受阻将fs.suid_dumpable设为 0 会导致生产环境 crash 时无法生成 coredump 文件排查段错误时应结合临时开关或配合 systemd-coredump 集中收集。通过在镜像发布与节点初始化阶段固化 CIS 加固基线企业可大幅提高攻击者的渗透成本有效遏制利用弱口令与系统缺陷进行的横向渗透。