Linux 中的最佳安全实践
在维护 Linux 服务器时，您强烈推荐哪些安全最佳实践？
（即启动防火墙、禁用不必要的服务、提防 suid 可执行文件等等。）
另外：是否有关于 Selinux 的明确参考？
编辑：是的，我计划将机器放在互联网上，至少有 openvpn、ssh 和 apache（目前没有动态内容），并为某些人提供 shell 访问。
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
对于 SELinux，我发现SELinux 示例非常有用。 它非常深入地探讨了如何确保服务器尽可能安全，并且针对如此广泛的主题写得非常好。
但总的来说：
For SELinux I've found SELinux By Example to be really useful. It goes quite in-depth into keeping a sever as secure as possible and is pretty well written for such a wide topic.
In general though:
简短的回答是，这取决于。 这取决于您使用它的目的，这反过来又会影响您应该投入多少精力来保护该东西。
这个问题的答案中有一些方便的提示：
保护 Linux Web 服务器以供公共访问
如果您不将盒子扔到互联网上，其中一些答案不相关。 如果您将其扔到互联网上并在其上托管一些甚至模糊有趣的内容，那么这些答案对您来说就太自由放任了。
The short answer is, it depends. It depends on what you're using it for, which in turn influences how much effort you should put into securing the thing.
There are some handy hints in the answers to this question:
Securing a linux webserver for public access
If you're not throwing the box up onto the internet, some of those answers won't be relevant. if you're throwing it up onto the internet and hosting something even vaguely interesting on it, those answers are far too laissez-faire for you.
NSA 文档“NSA Security Guide for RHEL5”位于：
http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf
这非常有帮助，至少是系统的。
There's an NSA document "NSA Security Guide for RHEL5" available at:
http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf
which is pretty helpful and at least systematic.
这或多或少就是我会做的。
编辑：我添加了一些我之前忘记命名的想法......
That's more or less what I would do.
Edit : I added some ideas that I previously forgot to name ...
1.) 仅启用必要且相关的端口。
2.) 定期扫描网络数据输入 - 输出
3.) 定期扫描访问服务器的 IP 地址，并验证是否从日志/跟踪中发现与这些 IP 地址相关的任何异常数据活动
4.) 如果存在某些关键和机密的情况数据和代码，需要存在于服务器上，可能可以加密
-AD
1.) Enabling only necessary and relevant ports.
2.) Regular scan of the network data in - out
3.) Regular Scan of ip addresses accessing the server and verify if any unusual data activity associated with those ip address as found from logs/traces
4.) If some some critical and confidential data and code, needs to be present on the server , may be it can be encrypted
-AD
目标：
最困难的部分始终是定义您的安全目标。 那时其他一切都相对容易。
探索/研究：
考虑攻击者会采取的相同方法，即网络侦察（namp对此非常有帮助）。
更多信息：
SELinux 的例子是一本很有帮助的书，但找到一个好的集中的 SELinux 信息源仍然很困难。
我有一小部分有用的链接，我有时觉得它们很有用 http://delicious.com/reverand_13/selinux有用
的解决方案/工具：
就像大多数人会说的那样，少即是多。 对于带有 SELinux 的开箱即用的精简框，我建议使用 Clip (http://oss.tresys. com/projects/clip）。 我的一个朋友在一次学术模拟中使用了它，其中该盒子受到其他参与者的直接攻击。 我记得这个故事的结局对这个盒子来说非常有利。
您需要熟悉 SELinux 策略的编写。 模块化政策也可能会有所帮助。 诸如 SLIDE 和 seeedit（尚未尝试）之类的工具可能会对您有所帮助。
Goals:
The hardest part is always defining your security goals. Everything else is relatively easy at that point.
Probing/research:
Consider the same approach that attackers would take, ie network reconnaissance (namp is pretty helpful for that).
More information:
SELinux by example is a helpful book, finding a good centralized source for SELinux information is still hard.
I have a small list of helpful links that I find useful time to time http://delicious.com/reverand_13/selinux
Helpful solution/tools:
As with what most people will say less is more. For an out of the box stripped down box with SELinux I would suggest clip (http://oss.tresys.com/projects/clip). A friend of mine used it in an academic simulation in which the box was under direct attack from other participants. I recall the story concluded very favorably for said box.
You will want to become familiar with writing SELinux policy. Modular policy can also become helpful. such tools as SLIDE and seedit (have not tried) may help you.
除非必要，否则不要使用 DNS 服务器。 BIND 一直是安全问题和漏洞利用的热点。
Don't use a DNS Server unless you have to . BIND has been a hotspot of security issues and exploits.
强化 Linux 服务器是一个广泛的话题，它主要取决于您的需求。
一般来说，您需要考虑以下几组问题（我将给出每组中的最佳实践示例）：
启动和磁盘
Ex1：禁用从外部设备启动。
示例2：为 GRUB 引导加载程序设置密码 - 参考。
文件系统分区
Ex1：将用户分区（
/home、/tmp、/var）与操作系统分区分开。示例 2：在分区上设置
nosuid– 以防止使用setuid位进行权限升级。内核
Ex1：更新安全补丁。
示例 2：在此处了解更多信息。
网络
Ex1：关闭未使用的端口。
Ex2: 禁用 IP 转发。
Ex3：禁用发送数据包重定向。
用户/帐户
Ex1：强制执行强密码 (SHA512)。
例2：设置密码时效和过期时间。
Ex3：限制用户使用旧密码。
审核和记录
示例1：配置
auditd- ref 。示例2：使用journald配置日志记录 - ref。
服务
Ex1：删除未使用的服务，例如：FTP、DNS、LDAP、SMB、DHCP、NFS、SNMP 等。
EX2：如果您使用的是 Apache 或 nginx 等 Web 服务器 - 不要以 root 身份运行它们 - 阅读更多内容 这里。
Ex3：安全 SSH ref。
软件
确保删除未使用的软件包。
阅读更多：
https://www.computerworld.com/article/3144985/linux-hardening-a-15-step-checklist-for-a-secure-linux-server.html
https://www.howtoing.com/linux-server-hardening-security-tips/
https://cisofy.com/checklist/linux-security/
https://www.ucd.ie/t4cms/UCD%20Linux%20Security%20Checklist。 pdf
https://www.cyberciti。 biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
https ://securecompliance.co/linux-server-hardening-checklist/
现在专门针对 SELinux：
首先，确保您的计算机启用了 SELinux。
继续以下指南：
https： //www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts
https://linuxtechlab.com/beginners-guide-to-selinux/
https://www.computernetworkingnotes.com/rhce-study-guide/selinux-explained- with-examples-in-easy-language.html
Hardening a Linux server is a vast topic and it primarily depend on your needs.
In general, you need to consider the following groups of concern (I'll give example of best practices in each group):
Boot and Disk
Ex1: Disable booting from external devices.
Ex2: Set a password for the GRUB bootloader - Ref.
File system partitioning
Ex1: Separate user Partitions (
/home,/tmp,/var) from OS Partitions.Ex2: Setup
nosuidon partitions – in order to prevent privilege escalation with thesetuidbit.Kernel
Ex1: Update security patches.
Ex2: Read more in here.
Networking
Ex1: Close unused ports.
Ex2: Disable IP forwarding.
Ex3: Disable send packet redirects.
Users / Accounts
Ex1 : Enforce strong passwords (SHA512).
Ex2: Set up password aging and expiration.
Ex3: Restrict Users to Use Old Passwords.
Auditing and logging
Ex1: Configure
auditd- ref.Ex2: Configure logging with journald - ref.
Services
Ex1: Remove unused services like: FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc'.
EX2: If you're using a web server like Apache or nginx - don't run them as root - read more here.
Ex3: Secure SSH ref.
Software
Make sure you remove unused packages.
Read more:
https://www.computerworld.com/article/3144985/linux-hardening-a-15-step-checklist-for-a-secure-linux-server.html
https://www.tecmint.com/linux-server-hardening-security-tips/
https://cisofy.com/checklist/linux-security/
https://www.ucd.ie/t4cms/UCD%20Linux%20Security%20Checklist.pdf
https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
https://securecompliance.co/linux-server-hardening-checklist/
Now specifically for SELinux:
First of all, make sure that SELinux is enabled in your machine.
Continue with the following guides:
https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts
https://linuxtechlab.com/beginners-guide-to-selinux/
https://www.computernetworkingnotes.com/rhce-study-guide/selinux-explained-with-examples-in-easy-language.html