香港站群服务器安全防护全攻略：防火墙配置与多站点安全管理

[互联网]
│
├── [云端DDoS防护] ← 推荐阿里云DDoS高防/AWS Shield Advanced
│
├── [前端防火墙集群] ← 部署pfSense/OPNsense硬件防火墙
│   ├── 入侵防御系统(IPS)
│   └── 深度包检测(DPI)
│
├── [虚拟化层防火墙] ← 使用KVM/ESXi内置防火墙
│
└── [主机级防火墙] ← 各站点配置iptables/nftables

# 清空现有规则
iptables -F
iptables -X

# 默认拒绝策略
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# 允许本地回环
iptables -A INPUT -i lo -j ACCEPT

# 允许已建立的连接
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 站群Web服务开放
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 按站点细分规则（示例站点A）
iptables -N SITE_A_FILTER
iptables -A INPUT -s 192.168.1.100 -j SITE_A_FILTER
iptables -A SITE_A_FILTER -p tcp --dport 3306 -d 10.0.0.5 -j ACCEPT

# 防护SYN洪水攻击
iptables -N SYN_FLOOD
iptables -A INPUT -p tcp --syn -j SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A SYN_FLOOD -j DROP

# 记录异常流量
iptables -A INPUT -m recent --name ATTACK --rcheck --seconds 3600 -j LOG --log-prefix "Potential Attack: "

# 内核参数优化（/etc/sysctl.conf）
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_max_syn_backlog = 8192
net.core.somaxconn = 65535
net.ipv4.tcp_slow_start_after_idle = 0

# 专为香港跨境连接优化
net.ipv4.tcp_congestion_control = bbr
net.ipv4.tcp_mtu_probing = 1

# /etc/network/interfaces 片段
auto vlan100
iface vlan100 inet static
    address 192.168.100.1
    netmask 255.255.255.0
    vlan_raw_device eth0
    up iptables -A FORWARD -i vlan100 -o vlan100 -j ACCEPT
    up iptables -A FORWARD -i vlan100 ! -o vlan100 -j DROP

# 站点目录结构示例
/srv/
├── site_a/    # uid:1001, gid:1001
│   ├── www/   # 0750
│   └── logs/  # 0750
├── site_b/    # uid:1002, gid:1002
│   ├── www/   # 0750
│   └── logs/  # 0750
└── shared/    # 所有站点只读访问

# 实现命令
useradd -u 1001 -s /bin/false site_a
chown -R site_a:site_a /srv/site_a
find /srv/site_a -type d -exec chmod 0750 {} \;
setfacl -Rm g:backup_team:r-x /srv/site_a

-- 监控站群文件变更
SELECT path, md5, mtime FROM file 
WHERE directory = '/srv/site_a/www/' 
AND mtime > (SELECT strftime('%s','now')-300);

-- 检测异常进程
SELECT pid, name, cmdline FROM processes 
WHERE cmdline LIKE '%php%' AND uid = 33 
AND name NOT IN ('php-fpm','php-worker');

# 检测站点间横向移动
filter {
  if [source.ip] in ["10.0.0.0/24"] and [destination.ip] in ["10.0.0.0/24"] {
    mutate { add_tag => ["internal_movement"] }
  }
}

# 警报规则：同一IP访问多个站点管理接口
alert {
  condition => "ctx.payload.hits.total.value > 3",
  actions => [ "slack_alert" ]
}

# 站点容器示例
FROM alpine:3.14

RUN addgroup -S site1 && adduser -S site1 -G site1
USER site1

COPY --chown=site1:site1 ./www /var/www
VOLUME /var/www/data

# 安全限制
docker run --cap-drop=ALL \
           --read-only \
           --security-opt="no-new-privileges" \
           --memory="256m" \
           --pids-limit=100 \
           -d site1

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: site-isolation
spec:
  podSelector:
    matchLabels:
      app: site1
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 80
  egress:
  - to:
    - podSelector:
        matchLabels:
          service: mysql
    ports:
    - protocol: TCP
      port: 3306

# 根据用户地域分流流量
geo $is_mainland {
  default 0;
  include /etc/nginx/geoip/CN.zone;
}

server {
  location / {
    if ($is_mainland) {
      proxy_pass http://hk_mirror;
    }
    # 其他地区流量处理
  }
}

- name: 站群基线检查
  hosts: all
  tasks:
    - name: 检查站点目录权限
      stat:
        path: "/srv/{{ item }}/www"
      loop: "{{ sites }}"
      register: dir_stats
      
    - name: 报告异常权限
      debug:
        msg: "{{ item.path }} 权限异常: {{ item.stat.mode }}"
      loop: "{{ dir_stats.results }}"
      when: "item.stat.mode != '0750'"

<Rule id="xccdf_org.ssgproject.content_rule_dir_perms" severity="high">
  <title>Verify Site Directory Permissions</title>
  <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <check-export export-name="var_sites" value="/srv/site_*"/>
    <check-content-ref href="oval:org.ssgproject.oval:def:1"/>
  </check>
</Rule>