点击上方"数据与人", 右上角选择“设为星标”
分享干货，共同成长！
本文针对频发的勒索病毒事件下备份方案的防护优化提出了解决思路，并对Linux系统的部署给出了建议脚本。
近期，周边发了几起勒索病毒事件，大多事件的备份集也一并被修改加密，导致系统瘫痪、备份不可用。针对此情况，我对我们当前的备份方案紧急做了个调整优化：
原来备份的方式至挂在备份NAS，定时开启备份脚本，备份完成。修改之后，大致改为了到备份时间时，主动挂在备份NAS，调用备份脚本，开启备份，备份完成后，解挂备份NAS。另外增加操作系统挂在备份文件夹的权限管控，脚本大致如下：
#修改chattr的默认命令名称#mv usr/bin/chattr usr/bin/Lo0ckBkFi1le#0，定时任务提前3分钟连接备份存储介质，并且测试连接成功#1，连接备份存储，调用备份脚本#备份文件至文件夹：/BackUpFiles/cp /ShengChanFiles/data.csv BackUpFiles/data_20220829.csv#压缩备份文件，压缩密码为：Aa123456cd /BackUpFiles/tar -cz data_20220829.csv | openssl des3 -salt -k Aa123456 -out BackUpFiles/data_20220829.tar.gz#解压命令为：openssl des3 -d -k Aa123456 -salt -in data_20220829.tar.gz | tar xzf -#给备份文件上锁Lo0ckBkFi1le +i BackUpFiles/data_20220829.tar.gz#断开备份存储
另：针对有备份软件的公司，建议启动备份软件防勒索的功能。
大多windows感染勒索比较容易，但是现在Linux系统也频频出现中勒索的情况，建议部署Linux系统按照基线部署，可参考如下脚本：
#!/bin/sh# Name:centos7-os-init.sh# Write by:Jan# Last Modify:2019-09-20# DESC:Linux系统优化和安全加固# CMD:sh centos7-os-init.sh# CMD说明:该脚本主要用于centos调优，作为相对通用的模板，有一定的普适性，但是一般在实际生产环境##########中会根据系统的不同功能，进行不同的参数优化，请各位注意。#--------------------------------------------------------------------#0 添加epel的yum源##echo "[epel] " >> etc/yum.repos.d/epel.repo##echo "name=Extra Packages for Centos 7 - \$basearch " >> etc/yum.repos.d/epel.repo##echo "baseurl=http://centos.ustc.edu.cn/epel/7Server/\$basearch " >> etc/yum.repos.d/epel.repo##echo "failovermethod=priority " >> etc/yum.repos.d/epel.repo##echo "enabled=1 " >> etc/yum.repos.d/epel.repo##echo "gpgcheck=0 " >> etc/yum.repos.d/epel.repo###使配置生效##yum clean all##yum makecache##yum repolistyum install -y wgetwget -P etc/yum.repos.d/ http://mirrors.aliyun.com/repo/epel-7.repoyum clean allyum makecacheyum repolist##或者直接安装 rpm -ivh http://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm#1 设定时区，自动同步时间,定义为每天自动同步一次yum install -y ntpdate\cp usr/share/zoneinfo/Asia/Shanghai etc/localtimentp_path=`which ntpdate`$ntp_path 172.16.2.89hwclock -wecho "10 1 * * * $ntp_path 172.16.2.89" >> var/spool/cron/root#设置hostname,一般安装的时候就会设置好#2 创建系统默认目录：##脚本存放目录mkdir -p u01/shell##软件安装介质存放位置mkdir -p /u01/src##日志存放位置mkdir -p /u02/log##备份存放位置，一般也会挂载nas存储盘mkdir -p /u03/bakmkdir -p /u03/nas#mount -t cifs -o username="jan",password="123456a?" //172.16.2.78/DB_bak /u03/nas#3 优化内核参数##3.1 修改最大系统最大打开文件数和最大进程数。echo "* soft nproc 65536 ">>/etc/security/limits.confecho "* hard nproc 65536 ">>/etc/security/limits.confecho "* soft nofile 65536 ">>/etc/security/limits.confecho "* hard nofile 65536 ">>/etc/security/limits.confecho "* soft nproc 65536">/etc/security/limits.d/20-nproc.confecho "root soft nproc unlimited">>/etc/security/limits.d/20-nproc.confecho "测试方式:当前session退出后重新登录执行:ulimit -Sn ulimit -Hn"##3.2 调整内核参数、网络参数、安全参数以应对高并发环境。cp /etc/sysctl.conf /etc/sysctl.conf.bkecho ''>/etc/sysctl.conf#关闭ipv6echo "net.ipv6.conf.all.disable_ipv6 = 1">>/etc/sysctl.confecho "net.ipv6.conf.default.disable_ipv6 = 1">>/etc/sysctl.conf# 避免放大攻击echo "net.ipv4.icmp_echo_ignore_broadcasts = 1">>/etc/sysctl.conf# 开启恶意icmp错误消息保护echo "net.ipv4.icmp_ignore_bogus_error_responses = 1">>/etc/sysctl.conf#关闭路由转发echo "net.ipv4.ip_forward = 0">>/etc/sysctl.confecho "net.ipv4.conf.all.send_redirects = 0">>/etc/sysctl.confecho "net.ipv4.conf.default.send_redirects = 0">>/etc/sysctl.conf#开启反向路径过滤echo "net.ipv4.conf.all.rp_filter = 1">>/etc/sysctl.confecho "net.ipv4.conf.default.rp_filter = 1">>/etc/sysctl.conf#处理无源路由的包echo "net.ipv4.conf.all.accept_source_route = 0">>/etc/sysctl.confecho "net.ipv4.conf.default.accept_source_route = 0">>/etc/sysctl.conf#关闭sysrq功能echo "kernel.sysrq = 0">>/etc/sysctl.conf#core文件名中添加pid作为扩展名echo "kernel.core_uses_pid = 1">>/etc/sysctl.conf# 开启SYN洪水攻击保护echo "net.ipv4.tcp_syncookies = 1">>/etc/sysctl.conf#修改消息队列长度echo "kernel.msgmnb = 65536">>/etc/sysctl.confecho "kernel.msgmax = 65536">>/etc/sysctl.conf#设置最大内存共享段大小bytes，这两个参数主要在安装oracle数据库的时候，结合SGA使用echo "kernel.shmmax = 17179869184">>/etc/sysctl.conf #建议修改为内存大小例如16G内存echo "kernel.shmall = 4194304">>/etc/sysctl.conf #默认=kernel.shmmax/4KB(4096)#timewait的数量，默认180000echo "net.ipv4.tcp_max_tw_buckets = 6000">>/etc/sysctl.confecho "net.ipv4.tcp_sack = 1">>/etc/sysctl.confecho "net.ipv4.tcp_window_scaling = 1">>/etc/sysctl.confecho "net.ipv4.tcp_rmem = 4096 87380 4194304">>/etc/sysctl.confecho "net.ipv4.tcp_wmem = 4096 16384 4194304">>/etc/sysctl.confecho "net.core.wmem_default = 8388608">>/etc/sysctl.confecho "net.core.rmem_default = 8388608">>/etc/sysctl.confecho "net.core.rmem_max = 16777216">>/etc/sysctl.confecho "net.core.wmem_max = 16777216">>/etc/sysctl.conf#每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许送到队列的数据包的最大数目echo "net.core.netdev_max_backlog = 262144">>/etc/sysctl.conf#限制仅仅是为了防止简单的DoS 攻击echo "net.ipv4.tcp_max_orphans = 3276800">>/etc/sysctl.conf#未收到客户端确认信息的连接请求的最大值echo "net.ipv4.tcp_max_syn_backlog = 262144">>/etc/sysctl.confecho "net.ipv4.tcp_timestamps = 0">>/etc/sysctl.conf#内核放弃建立连接之前发送SYNACK 包的数量echo "net.ipv4.tcp_synack_retries = 1">>/etc/sysctl.conf#内核放弃建立连接之前发送SYN 包的数量echo "net.ipv4.tcp_syn_retries = 1">>/etc/sysctl.conf#启用timewait 快速回收echo "net.ipv4.tcp_tw_recycle = 1">>/etc/sysctl.conf#开启重用。允许将TIME-WAIT sockets 重新用于新的TCP 连接echo "net.ipv4.tcp_tw_reuse = 1">>/etc/sysctl.confecho "net.ipv4.tcp_mem = 94500000 915000000 927000000">>/etc/sysctl.confecho "net.ipv4.tcp_fin_timeout = 1">>/etc/sysctl.conf#当keepalive 起用的时候，TCP 发送keepalive 消息的频度。缺省是2 小时echo "net.ipv4.tcp_keepalive_time = 30">>/etc/sysctl.conf#允许系统打开的端口范围echo "net.ipv4.ip_local_port_range = 32768 65000">>/etc/sysctl.conf#修改防火墙表大小，默认65536#net.netfilter.nf_conntrack_max=655350#net.netfilter.nf_conntrack_tcp_timeout_established=1200# 确保无人能修改路由表echo "net.ipv4.conf.all.accept_redirects = 0">>/etc/sysctl.confecho "net.ipv4.conf.default.accept_redirects = 0">>/etc/sysctl.confecho "net.ipv4.conf.all.secure_redirects = 0">>/etc/sysctl.confecho "net.ipv4.conf.default.secure_redirects = 0">>/etc/sysctl.conf# 开启并记录欺骗，源路由和重定向包echo "net.ipv4.conf.all.log_martians = 1 ">>/etc/sysctl.confecho "net.ipv4.conf.default.log_martians = 1 ">>/etc/sysctl.confecho "fs.file-max = 6815744 ">>/etc/sysctl.confecho "fs.aio-max-nr = 1048576 ">>/etc/sysctl.confecho "kernel.shmmni = 4096 ">>/etc/sysctl.confecho "kernel.sem = 250 32000 100 128 ">>/etc/sysctl.confecho "net.ipv4.route.gc_timeout=100 ">>/etc/sysctl.conf#启用内核中的SYN cookie保护：(一般情况下操作系统已经默认开启)echo "1" > /proc/sys/net/ipv4/tcp_syncookies#优化swapecho "vm.swappiness=10">>/etc/sysctl.confsysctl -p#4 安全加固相关：#4.1 关闭selinuxsed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config#4.2 关闭不常用服务。根据服务器的用途和安装系统时候的选择进行优化，将不必要的服务关闭，提高性能。#chkconfig iptables off#chkconfig ip6tables off#chkconfig abrt-ccpp off#chkconfig abrtd off#chkconfig acpid off#chkconfig atd off#chkconfig auditd off#chkconfig autofs off#chkconfig blk-availability off#chkconfig bluetooth off#chkconfig certmonger off#chkconfig cpuspeed off#chkconfig cups off#chkconfig dnsmasq off#chkconfig firstboot off#chkconfig kdump off#chkconfig mdmonitor off#chkconfig netconsole off#chkconfig postfix off#chkconfig quota_nld off#chkconfig rdisc off#chkconfig restorecond off#chkconfig saslauthd off#chkconfig smartd off#chkconfig wpa_supplicant off#chkconfig ypbind off#4.3 安装监控客户端##安装监控客户端#4.4 清除不必要的系统帐户userdel admuserdel lpuserdel syncuserdel shutdownuserdel haltuserdel operatoruserdel ftp#4.5 隐藏linux版本号#>/etc/issue#>/etc/issue.net#4.6 系统关闭Ping#关闭ping，使系统对ping不做反应，对网络安全大有好处。#echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all#echo "echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all" >> /etc/rc.d/rc.local#恢复系统的Ping响应：#echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all###4.7 升级OpenSSH OpenSSL至安全版本#######禁止root账户远程登录,更改ssh端口##sed -i 's/#Port 22/Port 2022/g' /etc/ssh/sshd_config##sed -i 's/#PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config#4.8 安装telnetyum install -y telnet###4.9 创建普通用户,指定/u01 u02 u03所属##groupadd gapp##useradd -g gapp appuser##echo "apuserPWD" | passwd --stdin appuser##chown -R appuser.gapp /u01##chown -R appuser.gapp /u02##chown -R appuser.gapp /u03##chown -R appuser.gapp /etc/rc.local##chown -R appuser.gapp /etc/rc.d/rc.local##chown -R appuser.gapp /etc/profile##chown -R appuser.gapp /var/spool/cron##chown -R root.root /var/spool/cron/root###4.10 锁定关键文件系统禁止被修改##chattr +i /etc/passwd##chattr +i /etc/inittab##chattr +i /etc/group##chattr +i /etc/shadow##chattr +i /etc/gshadow##chattr +a /var/log/messages###使用chattr命令后，为了安全我们需要将其改名##mv /usr/bin/chattr /usr/bin/lockkeyfile#4.11 history命令加入时间和操作者IP的属性#echo "HISTFILESIZE=4000">>/etc/profile#echo "HISTSIZE=4000">>/etc/profile#echo 'HISTTIMEFORMAT="%F %T `who am i|cut -d\( -f2|cut -d\) -f1` `whoami` "'>>/etc/profile#echo "export HISTTIMEFORMAT">>/etc/profileecho "HISTFILESIZE=4000HISTSIZE=4000HISTTIMEFORMAT=\"%F %T \`who am i|cut -d\( -f2|cut -d\) -f1\` \`whoami\` \"export HISTTIMEFORMAT">>/etc/profilesource /etc/profilesystemctl stop firewalld.servicesystemctl disable firewalld.service#5 系统重启yum install -y gccreboot
