搜索结果: "security"

tags: [linux, docker, kubernetes, deployment, networking, security, monitoring, production]

| 21 | 如何实现容器安全？ | 官方基础镜像 + 最小化 + 漏洞扫描 + 非 root + 只读文件系统 + 限制权限 + 网络策略 | [[server-security-hardening-checklist]] |

| 51 | Pod hostPath 权限问题？ | 宿主机权限 700 vs 非 root Pod → Permission denied；用 securityContext.runAsUser + fsGroup 解决 | [[pod-troubleshooting]] |

| 59 | K8s 安全实践？ | 零信任 + RBAC + NetworkPolicy + 镜像安全 + 机密管理(Vault) + TLS + 运行时安全 + 审计合规 | [[server-security-hardening-checklist]] |

| [[server-security-hardening-checklist]] | 服务器安全加固 |

tags: [kubernetes, troubleshooting, production, debugging, pod, node, service, storage, networking, security]

| 镜像仓库白名单 | 检查 Firewall / Security Group / Registry IP 限制 | 确认仓库可达 |

| 挂载后无法写入 | 卷权限/fsgroup 设置 | 检查 securityContext.fsGroup |

**诊断入口：** `kubectl get pod -n -o yaml | grep -A 20 securityContext`

| **Pod Security Standards** | 命名空间级别：privileged / baseline / restricted | Pod 违反策略→无法创建 |

tags: [linux, security, production, monitoring, debugging, networking]

| **应用层** | ModSecurity / OpenRASP | SQL注入、XSS、命令注入 | 业务逻辑漏洞难以覆盖 |

安全加固（预防）与入侵检测（发现/响应）的体系关系参见 [[server-security-hardening-checklist]]。

0 3 * * * root /usr/bin/aide --check | mail -s "AIDE Report" security@company.com

# /etc/audit/rules.d/security.rules

tags: [security, linux, production, monitoring, networking, debugging]

sources: [raw/articles/server-security-hardening-checklist.md]

# /etc/security/pwquality.conf

echo "net.ipv4.icmp_echo_ignore_all = 1" >> /etc/sysctl.d/99-security.conf

sysctl -p /etc/sysctl.d/99-security.conf

tags: [nginx, security, networking, production, monitoring, debugging]

sources: [raw/articles/nginx-security-config-guide.md]

# /etc/nginx/conf.d/security/realip.conf

tail -n 20 /var/log/nginx/access.security.log | awk '{print $1}'

log_format security_main '$realip_remote_addr [$time_local] '

├── security.tf # 安全组

**3. 安全组** → `security.tf`

resource "alicloud_security_group" "web" {

resource "alicloud_security_group_rule" "allow_ssh" {

security_group_id = alicloud_security_group.web.id

- Created raw: raw/articles/server-security-hardening-checklist.md

- Created concepts: server-security-hardening-checklist

- Updated: server-security-hardening-checklist（Docker daemon 安全加固引用）

- Updated: server-security-hardening-checklist（入链引用，安全体系从预防扩展到检测与响应）

- Created raw: raw/articles/nginx-security-config-guide.md

tags: [linux, networking, database, troubleshooting, production, security, monitoring, docker]

参见 [[nginx-security-config-guide]]（SSL 配置实践）。

参见 [[server-security-hardening-checklist]]（安全配置联动监控）。

| [[nginx-security-config-guide]] | Nginx 安全配置 |

tags: [kubernetes, deployment, architecture, build, networking, storage, monitoring, configmap, security, certificate, docker, container]

security:

globalJobDslSecurity: true

| [[server-security-hardening-checklist]] | 基础设施安全基线，Gateway TLS 证书使用 |

tags: [kubernetes, deployment, troubleshooting, production, networking, security]

| 37 | 安全最佳实践？ | RBAC + Pod Security Standards + 镜像扫描 + 网络策略 + TLS + 非 root 运行 | [[server-security-hardening-checklist]] |

| 57 | Pod 安全策略？ | PodSecurityStandards：Privileged/Baseline/Restricted 三级 | — |

| [[server-security-hardening-checklist]] | 服务器安全加固（含 K8s 相关） |

tags: [linux, security, production, troubleshooting]

### 1. 密码复杂度策略：`/etc/security/pwquality.conf`

# /etc/security/pwquality.conf

- [[server-security-hardening-checklist]] — 服务器安全加固清单：用户管理、密码策略、禁用 root 登录等基线配置（本文的延伸实践）

tags: [nginx, troubleshooting, networking, production, security, deployment]

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# /etc/security/limits.conf

完整的安全配置体系（限流/WAF/防DDoS/连接层防护）参见 [[nginx-security-config-guide]]。

tags: [docker, container, troubleshooting, security, production, networking, debugging]

参见 [[server-security-hardening-checklist]] 的服务器安全加固总纲，以及 [[ssh-brute-force-protection-guide]] 的访问控制实践。

| [[server-security-hardening-checklist]] | 服务器安全加固总纲（含 Docker daemon 安全） |

sources: [raw/articles/linux-kernel-tuning-production.md, raw/articles/server-security-hardening-checklist.md]

以下参数针对**网络安全防护**，与性能调优不同，应单独放在 `/etc/sysctl.d/99-security.conf`：

完整安全加固清单参见 [[server-security-hardening-checklist]]。

tags: [security, linux, production, networking, troubleshooting, automation]

sources: [raw/articles/ssh-brute-force-protection-guide.md, raw/articles/server-security-hardening-checklist.md, raw/articles/7招锁死SSH-从端口伪装到Fail2ban-教你把暴力破解挡在门外.md]

| [[server-security-hardening-checklist]] | 新机器上线安全加固清单（20 项全面基线）——SSH 加固是其中核心环节 |

# /etc/security/limits.conf

securityContext:

- [[nginx-security-config-guide]] — Nginx 安全加固配置

tags: [security, linux, tools]

| [[server-security-hardening-checklist]] | 服务器安全加固清单—20 项新机器上线基线 |

├── security/ / pam.d/ # PAM 认证配置

- [[server-security-hardening-checklist]] — 服务器安全加固（/etc 配置项）

tags: [linux, performance, networking, security, tcp, memory, scheduling]

修改 `/etc/security/limits.conf`：

tags: [nginx, monitoring, performance, troubleshooting, automation, security]

- [[nginx-security-config-guide]] — Nginx 安全配置

- [[nginx-security-config-guide]] — Nginx 安全配置实战：防DDoS/限流/WAF 规则编写（连接层/请求层/规则层三层防御）

- [[server-security-hardening-checklist]] — 服务器安全加固清单：20 项新机器上线前必做操作/账号权限/防火墙/系统安全/SSH 加固

- security: 安全/RBAC/权限

- [[server-security-hardening-checklist]] — 运营安全：服务器安全加固清单（运维与电商共同的底线思维）

tags: [docker, image, container, build, deployment, security]

- [[nginx-security-config-guide]] — Nginx 安全配置（连接层/请求层限流机制）

- [[nginx-security-config-guide]] — Nginx 安全配置实战（连接层/请求层限流配置）

stage('Security Scan') {

tags: [kubernetes, networking, deployment, architecture, monitoring, troubleshooting, automation, security]

tags: [kubernetes, troubleshooting, security, hpa, deployment]

-Djava.security.egd=file:/dev/urandom # 加速随机数生成

tags: [linux, command, performance, case-study, security, networking]

### /etc/security/limits.conf — 进程限制

tags: [linux, troubleshooting, nfs, storage, networking, performance, monitoring, security]

tags: [linux, networking, troubleshooting, security, debugging]

tags: [networking, tcp, troubleshooting, linux, security, case-study]

- [[nginx-security-config-guide]] — Nginx 安全配置

tags: [nginx, deployment, production, security, networking]

| [[nginx-security-config-guide]] | WSS/WSS 安全配置与连接层防护 |