# 查看安全编译选项
# 检查二进制文件的保护特性
apk add checksec
checksec --file=/usr/bin/ls

# 查看 PaX 标志
cat /proc/sys/kernel/randomize_va_space  # 2 = 完全 ASLR

# 查看内核安全选项
zgrep -i "PAX\|SECCOMP\|NAMESPACE" /proc/config.gz 2>/dev/null || \
cat /boot/config-* 2>/dev/null | grep -i "PAX\|SECCOMP\|NAMESPACE"

# 安全更新策略

# 1. 定期更新（推荐每周）
# crontab
0 3 * * 0 apk update && apk upgrade >> /var/log/apk-upgrade.log 2>&1

# 2. 仅安全更新
apk upgrade --available

# 3. 锁定特定包版本（避免意外升级）
apk add "nginx=1.26.2-r0"
echo "nginx" >> /etc/apk/world.pinned

# 4. 查看可用更新
apk update
apk version -l '<'

# 5. 安全公告监控
# Alpine 安全公告: https://alpinelinux.org/posts/
# CVE 查询: https://cve.mitre.org/

# 自动安全更新脚本
cat > /usr/local/bin/security-update << 'SCRIPT'
#!/bin/sh
LOG="/var/log/security-update.log"
echo "=== Security Update: $(date) ===" >> "$LOG"

apk update >> "$LOG" 2>&1

# 获取可更新包列表
UPDATES=$(apk version -l '<' | wc -l)
echo "Available updates: $UPDATES" >> "$LOG"

if [ "$UPDATES" -gt 0 ]; then
    apk upgrade >> "$LOG" 2>&1
    echo "Update completed" >> "$LOG"
    
    # 检查是否需要重启
    if [ -f /var/run/reboot-required ]; then
        echo "REBOOT REQUIRED" >> "$LOG"
    fi
fi
SCRIPT
chmod +x /usr/local/bin/security-update

# 安装 AppArmor
apk add apparmor apparmor-utils apparmor-profiles

# 启用 AppArmor
echo "apparmor=1 security=apparmor" >> /etc/update-extlinux.conf
update-extlinux

# 重启后检查状态
rc-service apparmor status
aa-status

# 加载配置文件
aa-enforce /etc/apparmor.d/usr.sbin.nginx

# 查看配置文件
ls /etc/apparmor.d/

# 创建自定义配置文件
cat > /etc/apparmor.d/usr.local.bin.myapp << 'EOF'
#include <tunables/global>

/usr/local/bin/myapp {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    
    # 允许读取配置
    /etc/myapp/** r,
    
    # 允许读写日志
    /var/log/myapp/** rw,
    
    # 允许创建临时文件
    /tmp/myapp.* rw,
    
    # 网络访问
    network inet stream,
    network inet dgram,
    
    # 拒绝其他所有
    deny /** w,
}
EOF

# 重新加载配置
apparmor_parser -r /etc/apparmor.d/usr.local.bin.myapp

# SELinux 在 Alpine 上需要自定义内核
# 安装基础工具
apk add policycoreutils selinux-utils

# 注意：Alpine 默认内核不支持 SELinux
# 如需 SELinux，需重新编译内核

# 检查 SELinux 状态
getenforce
sestatus

# 临时禁用
setenforce 0

# 设置模式
# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

# 只读挂载关键目录
# /etc/fstab
proc            /proc       proc    defaults,hidepid=2    0 0
tmpfs           /tmp        tmpfs   defaults,noexec,nosuid,nodev,size=2G 0 0
tmpfs           /run        tmpfs   defaults,noexec,nosuid,nodev,mode=0755 0 0

# 文件权限检查
# 关键文件权限
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 600 /etc/ssh/sshd_config
chmod 700 /root
chmod 600 /etc/crontabs/*

# 查找 SUID/SGID 文件
find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -la {} \; 2>/dev/null

# 查找全局可写文件
find / -type f -perm -o+w ! -path "/proc/*" ! -path "/sys/*" 2>/dev/null

# 查找无主文件
find / -nouser -o -nogroup 2>/dev/null

# 安装 AIDE（高级入侵检测环境）
apk add aide

# 初始化数据库
aide --init
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# 检查文件系统变化
aide --check

# 更新数据库
aide --update

# 定期检查
echo "0 4 * * * /usr/bin/aide --check | mail -s 'AIDE Report' admin@example.com" >> /etc/crontabs/root

# /etc/ssh/sshd_config 安全配置
cat > /etc/ssh/sshd_config << 'EOF'
# 基本设置
Port 22
Protocol 2
AddressFamily inet

# 认证
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 30

# 加密算法（仅允许强算法）
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# 安全选项
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
ClientAliveInterval 300
ClientAliveCountMax 2

# 日志
LogLevel VERBOSE

# 限制用户
AllowUsers myuser admin
# 或使用组
# AllowGroups ssh-users
EOF

# 生成强密钥
ssh-keygen -t ed25519 -a 100
# 或 RSA 4096 位
ssh-keygen -t rsa -b 4096

# 禁用弱主机密钥
rm -f /etc/ssh/ssh_host_dsa_key*
rm -f /etc/ssh/ssh_host_ecdsa_key*

# 安装 Fail2Ban
apk add fail2ban

# 配置
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
banaction = iptables-multiport

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/messages
maxretry = 3
bantime = 86400
EOF

rc-update add fail2ban
rc-service fail2ban start

# 查看被封禁的 IP
fail2ban-client status sshd

cat >> /etc/sysctl.conf << 'EOF'
# 网络安全参数
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# IPv6 安全
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# 内核安全
kernel.sysrq = 0
kernel.core_uses_pid = 1
kernel.randomize_va_space = 2
EOF

sysctl -p

# 安装审计框架
apk add audit

# 审计规则
cat > /etc/audit/audit.rules << 'EOF'
# 删除所有规则
-D

# 监控关键文件修改
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers

# 监控 SSH 配置
-w /etc/ssh/sshd_config -p wa -k sshd_config

# 监控 cron
-w /etc/crontabs -p wa -k cron

# 监控系统启动
-w /etc/init.d -p wa -k init
EOF

rc-update add auditd
rc-service auditd start

# 查询审计日志
ausearch -k identity -ts recent
aureport --summary

# 安装 Lynis 安全审计工具
apk add lynis

# 运行安全审计
lynis audit system

# 查看加固建议
lynis audit system --quick 2>&1 | grep "Hardening"

# 安装 ClamAV 杀毒
apk add clamav clamav-daemon
freshclam  # 更新病毒库
clamscan -r /home/

# rootkit 检测
apk add rkhunter
rkhunter --check
rkhunter --update