k8s CKS 2021【25】---系统加固减少攻击面

文章目录1. 介绍2. Systemctl and Services3. Install and investigate Services4. Disable application on port5.Investigate Linux Users6. 总结1. 介绍2. Systemctl and Servicesroot@node2:~# apt-get install snapdroot@n

ghostwritten

963人浏览 · 2021-05-25 20:46:25

ghostwritten · 2021-05-25 20:46:25 发布

文章目录

1. 介绍

在这里插入图片描述

2. Systemctl and Services

在这里插入图片描述

root@node2:~# apt-get install snapd
root@node2:~# systemctl start snapd
root@node2:~# systemctl status snapd
● snapd.service - Snap Daemon
   Loaded: loaded (/lib/systemd/system/snapd.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2021-05-25 05:18:53 PDT; 1s ago
 Main PID: 16265 (snapd)
    Tasks: 9 (limit: 2333)
   CGroup: /system.slice/snapd.service
           └─16265 /usr/lib/snapd/snapd

May 25 05:18:53 node2 systemd[1]: Starting Snap Daemon...
May 25 05:18:53 node2 snapd[16265]: AppArmor status: apparmor is enabled and all features are available
May 25 05:18:53 node2 snapd[16265]: patch.go:64: Patching system state level 6 to sublevel 1...
May 25 05:18:53 node2 snapd[16265]: patch.go:64: Patching system state level 6 to sublevel 2...
May 25 05:18:53 node2 snapd[16265]: patch.go:64: Patching system state level 6 to sublevel 3...
May 25 05:18:53 node2 snapd[16265]: daemon.go:347: started snapd/2.49.2+18.04 (series 16; classic) ubuntu/16.04 (amd64) linux/4.4.0-142-generic.
May 25 05:18:53 node2 snapd[16265]: daemon.go:440: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
May 25 05:18:53 node2 systemd[1]: Started Snap Daemon.


root@node2:~# systemctl list-units --type=service --state=running |grep snap
snapd.service               loaded active running Snap Daemon    


root@node2:~# systemctl stop snapd
Warning: Stopping snapd.service, but it can still be activated by:
  snapd.socket
root@node2:~# systemctl disable snapd
Removed /etc/systemd/system/multi-user.target.wants/snapd.service.

3. Install and investigate Services

在这里插入图片描述

root@node2:~# apt-get install -y vsftpd samba

root@node2:~# systemctl status vsftpd
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2021-05-25 05:25:26 PDT; 47s ago
 Main PID: 26713 (vsftpd)
    Tasks: 1 (limit: 2333)
   CGroup: /system.slice/vsftpd.service
           └─26713 /usr/sbin/vsftpd /etc/vsftpd.conf

May 25 05:25:26 node2 systemd[1]: Starting vsftpd FTP server...
May 25 05:25:26 node2 systemd[1]: Started vsftpd FTP server.
root@node2:~# systemctl status smbd
● smbd.service - Samba SMB Daemon
   Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:smbd(8)
           man:samba(7)
           man:smb.conf(5)
root@node2:~# systemctl start smbd
root@node2:~# systemctl status smbd
● smbd.service - Samba SMB Daemon
   Loaded: loaded (/lib/systemd/system/smbd.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2021-05-25 05:26:32 PDT; 1s ago
     Docs: man:smbd(8)
           man:samba(7)
           man:smb.conf(5)
 Main PID: 29800 (smbd)
   Status: "smbd: ready to serve connections..."
    Tasks: 4 (limit: 2333)
   CGroup: /system.slice/smbd.service
           ├─29800 /usr/sbin/smbd --foreground --no-process-group
           ├─29803 /usr/sbin/smbd --foreground --no-process-group
           ├─29804 /usr/sbin/smbd --foreground --no-process-group
           └─29805 /usr/sbin/smbd --foreground --no-process-group

May 25 05:26:31 node2 systemd[1]: Starting Samba SMB Daemon...
May 25 05:26:32 node2 systemd[1]: Started Samba SMB Daemon.


root@node2:~# ps aux |grep vsftpd
root      26713  0.0  0.1  27068  2860 ?        Ss   05:25   0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
root      31002  0.0  0.0  14416  1124 pts/0    S+   05:27   0:00 grep --color=auto vsftpd
root@node2:~# ps aux |grep smbd
root      29800  0.1  1.0 351556 20892 ?        Ss   05:26   0:00 /usr/sbin/smbd --foreground --no-process-group
root      29803  0.0  0.2 341808  5796 ?        S    05:26   0:00 /usr/sbin/smbd --foreground --no-process-group
root      29804  0.0  0.2 341800  4500 ?        S    05:26   0:00 /usr/sbin/smbd --foreground --no-process-group
root      29805  0.0  0.2 351556  5484 ?        S    05:26   0:00 /usr/sbin/smbd --foreground --no-process-group
root      31218  0.0  0.0  14416  1048 pts/0    S+   05:27   0:00 grep --color=auto smbd



root@node2:~# netstat -ntlp 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:10248         0.0.0.0:*               LISTEN      9920/kubelet    
tcp        0      0 127.0.0.1:10249         0.0.0.0:*               LISTEN      13541/kube-proxy
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      29800/smbd      
tcp        0      0 192.168.211.42:9099     0.0.0.0:*               LISTEN      59899/calico-node
tcp        0      0 0.0.0.0:179             0.0.0.0:*               LISTEN      14549/bird      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      897/sshd        
tcp        0      0 192.168.211.42:36632    0.0.0.0:*               LISTEN      9920/kubelet    
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      29800/smbd      
tcp6       0      0 :::10250                :::*                    LISTEN      9920/kubelet    
tcp6       0      0 :::139                  :::*                    LISTEN      29800/smbd      
tcp6       0      0 :::10256                :::*                    LISTEN      13541/kube-proxy
tcp6       0      0 :::21                   :::*                    LISTEN      26713/vsftpd    
tcp6       0      0 :::22                   :::*                    LISTEN      897/sshd        
tcp6       0      0 :::445                  :::*                    LISTEN      29800/smbd      



root@node2:~# vim /etc/samba/smb.conf 
interfaces = 127.0.0.0/8 eth0  #取消注释

bind interfaces only = yes     #取消注释

root@node2:~# systemctl restart smbd.service 

#127.0.0.1绑定
root@node2:~# netstat -ntlp |grep smbd
tcp        0      0 127.0.0.1:139           0.0.0.0:*               LISTEN      36416/smbd      
tcp        0      0 127.0.0.1:445           0.0.0.0:*               LISTEN      36416/smbd

4. Disable application on port

在这里插入图片描述

root@node2:~# netstat -nltp |grep 21
tcp        0      0 192.168.211.42:9099     0.0.0.0:*               LISTEN      59899/calico-node
tcp        0      0 192.168.211.42:36632    0.0.0.0:*               LISTEN      9920/kubelet    
tcp6       0      0 :::21                   :::*                    LISTEN      26713/vsftpd    
root@node2:~# lsof -i :21
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
vsftpd  26713 root    3u  IPv6 19811710      0t0  TCP *:ftp (LISTEN)
root@node2:~# systemctl list-units --type service |grep ftp
vsftpd.service                     loaded active running vsftpd FTP server                                                 
root@node2:~# systemctl status vsftpd
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2021-05-25 05:25:26 PDT; 8min ago
 Main PID: 26713 (vsftpd)
    Tasks: 1 (limit: 2333)
   CGroup: /system.slice/vsftpd.service
           └─26713 /usr/sbin/vsftpd /etc/vsftpd.conf

May 25 05:25:26 node2 systemd[1]: Starting vsftpd FTP server...
May 25 05:25:26 node2 systemd[1]: Started vsftpd FTP server.
root@node2:~# systemctl stop vsftpd
root@node2:~# systemctl status vsftpd
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2021-05-25 05:34:07 PDT; 2s ago
  Process: 26713 ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf (code=killed, signal=TERM)
 Main PID: 26713 (code=killed, signal=TERM)

May 25 05:25:26 node2 systemd[1]: Starting vsftpd FTP server...
May 25 05:25:26 node2 systemd[1]: Started vsftpd FTP server.
May 25 05:34:07 node2 systemd[1]: Stopping vsftpd FTP server...
May 25 05:34:07 node2 systemd[1]: Stopped vsftpd FTP server.
root@node2:~# netstat -nltp |grep 21
tcp        0      0 192.168.211.42:9099     0.0.0.0:*               LISTEN      59899/calico-node
tcp        0      0 192.168.211.42:36632    0.0.0.0:*               LISTEN      9920/kubelet

5. Investigate Linux Users

在这里插入图片描述

root@node2:~# whoami
root
root@node2:~# tail /etc/passwd
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
spectre:x:1000:1000:ubuntu64,,,:/home/spectre:/bin/bash
sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin
grafana:x:1001:1001::/home/grafana:
ftp:x:103:105:ftp daemon,,,:/srv/ftp:/bin/false
root@node2:~# su ubuntu
No passwd entry for user 'ubuntu'
root@node2:~# su - ubuntu
No passwd entry for user 'ubuntu'
root@node2:~# useradd test
root@node2:~# passwd test
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
root@node2:~# su test
test@node2:/root$ whoami
test
test@node2:/root$ exit
exit
root@node2:~# ps aux |grep bash
root      49317  0.0  0.0  14416  1068 pts/0    S+   05:40   0:00 grep --color=auto bash
spectre   62942  0.0  0.2  22708  5016 pts/0    Ss   May24   0:00 -bash
root      63061  0.0  0.2  23060  5736 pts/0    S    May24   0:00 -bash
root@node2:~# su test
test@node2:/root$ ps aux |grep bash
test      49440  0.0  0.1  21384  3936 pts/0    S    05:40   0:00 bash
test      49555  0.0  0.0  14416  1128 pts/0    S+   05:40   0:00 grep bash
spectre   62942  0.0  0.2  22708  5016 pts/0    Ss   May24   0:00 -bash
root      63061  0.0  0.2  23060  5736 pts/0    S    May24   0:00 -bash

6. 总结

在这里插入图片描述

K8S/Kubernetes

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐

【深度】阿里巴巴万级规模 K8s 集群全局高可用体系之美

作者 | 韩堂、柘远、沉醉来源 | 阿里巴巴云原生公众号前言台湾作家林清玄在接受记者采访的时候，如此评价自己 30 多年写作生涯：“第一个十年我才华横溢，‘贼光闪现’，令周边黯然失色；第二个十年，我终于‘宝光现形’，不再去抢风头，反而与身边的美丽相得益彰；进入第三个十年，繁华落尽见真醇，我进入了‘醇光初现’的阶段，真正体味到了境界之美”。长夜有穷，真水无香。领略过了 K8s“身在江

K8S/Kubernetes

如何基于 K8s 构建下一代 DevOps 平台？

作者 | 孙健波（天元）导读：当前云原生 DevOps 体系现状如何？面临哪些挑战？如何通过 OAM 解决云原生 DevOps 场景下的诸多问题？云原生开发应用模型 OAM(Open Application Model) 社区核心成员孙健波将为大家一一解答，并分享如何基于 OAM 和 Kubernetes 打造无限能力的下一代 DevOps 平台。什么是 DevOps？为什么基于 Kub