refactor: 替换项目中的"yudao"为"AIOTAGRO"，并清理相关配置文件
This commit is contained in:
652
docs/安全文档.md
Normal file
652
docs/安全文档.md
Normal file
@@ -0,0 +1,652 @@
|
||||
# 安全文档
|
||||
|
||||
## 安全概述
|
||||
|
||||
AIOTAGRO 管理系统安全文档涵盖系统安全设计、安全配置、安全审计、应急响应等安全相关事项。本文档为开发团队和运维团队提供完整的安全指南。
|
||||
|
||||
## 安全架构
|
||||
|
||||
### 1. 安全设计原则
|
||||
|
||||
#### 最小权限原则
|
||||
- 每个组件只拥有完成其功能所需的最小权限
|
||||
- 数据库用户按功能分离权限
|
||||
- 文件系统权限严格控制
|
||||
|
||||
#### 纵深防御
|
||||
- 多层安全防护机制
|
||||
- 网络层、应用层、数据层全面防护
|
||||
- 安全监控和告警机制
|
||||
|
||||
#### 安全默认配置
|
||||
- 默认关闭不必要的服务
|
||||
- 默认启用安全功能
|
||||
- 默认使用强加密算法
|
||||
|
||||
### 2. 安全组件
|
||||
|
||||
#### 前端安全
|
||||
- CSP (Content Security Policy) 策略
|
||||
- XSS 防护机制
|
||||
- CSRF 防护机制
|
||||
- 安全头配置
|
||||
|
||||
#### 后端安全
|
||||
- 输入验证和过滤
|
||||
- SQL 注入防护
|
||||
- 文件上传安全
|
||||
- 会话安全管理
|
||||
|
||||
#### 基础设施安全
|
||||
- 网络安全配置
|
||||
- 系统安全加固
|
||||
- 访问控制机制
|
||||
- 日志审计系统
|
||||
|
||||
## 安全配置
|
||||
|
||||
### 1. 前端安全配置
|
||||
|
||||
#### CSP 配置
|
||||
|
||||
```javascript
|
||||
// vite.config.js
|
||||
export default defineConfig({
|
||||
// CSP 配置
|
||||
server: {
|
||||
headers: {
|
||||
'Content-Security-Policy': `
|
||||
default-src 'self';
|
||||
script-src 'self' 'unsafe-inline' 'unsafe-eval';
|
||||
style-src 'self' 'unsafe-inline';
|
||||
img-src 'self' data: https:;
|
||||
font-src 'self';
|
||||
connect-src 'self' https://api.aiotagro.com;
|
||||
frame-ancestors 'none';
|
||||
base-uri 'self';
|
||||
form-action 'self'
|
||||
`.replace(/\s+/g, ' ').trim()
|
||||
}
|
||||
}
|
||||
})
|
||||
```
|
||||
|
||||
#### 安全头配置
|
||||
|
||||
```nginx
|
||||
# Nginx 安全头配置
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
||||
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";
|
||||
```
|
||||
|
||||
### 2. 应用安全配置
|
||||
|
||||
#### 输入验证
|
||||
|
||||
```javascript
|
||||
// 输入验证工具
|
||||
export const validateInput = {
|
||||
// 邮箱验证
|
||||
email: (email) => {
|
||||
const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
|
||||
return regex.test(email)
|
||||
},
|
||||
|
||||
// 手机号验证
|
||||
phone: (phone) => {
|
||||
const regex = /^1[3-9]\d{9}$/
|
||||
return regex.test(phone)
|
||||
},
|
||||
|
||||
// 密码强度验证
|
||||
password: (password) => {
|
||||
return password.length >= 8 &&
|
||||
/[A-Z]/.test(password) &&
|
||||
/[a-z]/.test(password) &&
|
||||
/[0-9]/.test(password)
|
||||
},
|
||||
|
||||
// XSS 防护
|
||||
sanitize: (input) => {
|
||||
return input.replace(/[<>"'&]/g, (char) => {
|
||||
const escapeMap = {
|
||||
'<': '<',
|
||||
'>': '>',
|
||||
'"': '"',
|
||||
"'": ''',
|
||||
'&': '&'
|
||||
}
|
||||
return escapeMap[char] || char
|
||||
})
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### 会话安全
|
||||
|
||||
```javascript
|
||||
// 会话管理
|
||||
export const sessionManager = {
|
||||
// 生成安全的会话 ID
|
||||
generateSessionId: () => {
|
||||
return crypto.randomBytes(32).toString('hex')
|
||||
},
|
||||
|
||||
// 设置安全 Cookie
|
||||
setSecureCookie: (name, value, options = {}) => {
|
||||
const defaults = {
|
||||
httpOnly: true,
|
||||
secure: process.env.NODE_ENV === 'production',
|
||||
sameSite: 'strict',
|
||||
maxAge: 24 * 60 * 60 * 1000 // 24小时
|
||||
}
|
||||
|
||||
document.cookie = `${name}=${value}; ${Object.entries({...defaults, ...options})
|
||||
.map(([key, val]) => `${key}=${val}`)
|
||||
.join('; ')}`
|
||||
},
|
||||
|
||||
// 验证会话
|
||||
validateSession: (sessionId) => {
|
||||
// 验证会话有效性和权限
|
||||
return true
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 3. 基础设施安全
|
||||
|
||||
#### 网络安全配置
|
||||
|
||||
```nginx
|
||||
# 网络安全配置
|
||||
# 限制请求大小
|
||||
client_max_body_size 10m;
|
||||
|
||||
# 限制请求速率
|
||||
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
|
||||
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
|
||||
|
||||
# IP 黑名单
|
||||
geo $blacklist {
|
||||
default 0;
|
||||
192.168.1.100 1;
|
||||
10.0.0.50 1;
|
||||
}
|
||||
|
||||
server {
|
||||
# 黑名单处理
|
||||
if ($blacklist) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
# API 速率限制
|
||||
location /api/ {
|
||||
limit_req zone=api burst=20 nodelay;
|
||||
# ...
|
||||
}
|
||||
|
||||
# 登录速率限制
|
||||
location /api/auth/login {
|
||||
limit_req zone=login burst=5 nodelay;
|
||||
# ...
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### 系统安全加固
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# system-hardening.sh
|
||||
|
||||
echo "开始系统安全加固..."
|
||||
|
||||
# 1. 更新系统
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
|
||||
# 2. 配置防火墙
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
sudo ufw allow ssh
|
||||
sudo ufw allow http
|
||||
sudo ufw allow https
|
||||
sudo ufw --force enable
|
||||
|
||||
# 3. 禁用不必要的服务
|
||||
sudo systemctl disable apache2
|
||||
sudo systemctl disable mysql
|
||||
sudo systemctl disable postgresql
|
||||
|
||||
# 4. 配置 SSH 安全
|
||||
sudo sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sudo sed -i 's/#MaxAuthTries 6/MaxAuthTries 3/' /etc/ssh/sshd_config
|
||||
sudo systemctl restart sshd
|
||||
|
||||
# 5. 配置文件权限
|
||||
sudo chmod 600 /etc/ssl/private/aiotagro.key
|
||||
sudo chmod 644 /etc/ssl/certs/aiotagro.crt
|
||||
sudo chown -R www-data:www-data /var/www/aiotagro
|
||||
|
||||
# 6. 配置日志审计
|
||||
sudo apt install auditd
|
||||
sudo auditctl -e 1
|
||||
sudo systemctl enable auditd
|
||||
|
||||
echo "系统安全加固完成"
|
||||
```
|
||||
|
||||
## 安全审计
|
||||
|
||||
### 1. 代码安全审计
|
||||
|
||||
#### 静态代码分析
|
||||
|
||||
```yaml
|
||||
# .github/workflows/code-scan.yml
|
||||
name: Code Security Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main, develop ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
schedule:
|
||||
- cron: '0 2 * * 1' # 每周一凌晨2点
|
||||
|
||||
jobs:
|
||||
security-scan:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Run ESLint security rules
|
||||
run: |
|
||||
npx eslint . --ext .js,.vue,.ts --config .eslintrc.security.js
|
||||
|
||||
- name: Run SAST scan
|
||||
uses: github/codeql-action/init@v2
|
||||
with:
|
||||
languages: javascript
|
||||
queries: security-extended
|
||||
|
||||
- name: Run SAST analysis
|
||||
uses: github/codeql-action/analyze@v2
|
||||
|
||||
- name: Run dependency check
|
||||
uses: dependency-check/Dependency-Check_Action@main
|
||||
with:
|
||||
project: 'AIOTAGRO Frontend'
|
||||
path: '.'
|
||||
format: 'HTML'
|
||||
|
||||
- name: Upload security report
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: security-reports
|
||||
path: reports/
|
||||
```
|
||||
|
||||
#### 安全规则配置
|
||||
|
||||
```javascript
|
||||
// .eslintrc.security.js
|
||||
module.exports = {
|
||||
extends: [
|
||||
'eslint:recommended',
|
||||
'plugin:security/recommended'
|
||||
],
|
||||
plugins: ['security'],
|
||||
rules: {
|
||||
'security/detect-object-injection': 'error',
|
||||
'security/detect-possible-timing-attacks': 'error',
|
||||
'security/detect-non-literal-require': 'error',
|
||||
'security/detect-non-literal-fs-filename': 'error',
|
||||
'security/detect-eval-with-expression': 'error',
|
||||
'security/detect-pseudoRandomBytes': 'error',
|
||||
'security/detect-unsafe-regex': 'error'
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 2. 依赖安全审计
|
||||
|
||||
#### 依赖安全检查
|
||||
|
||||
```json
|
||||
{
|
||||
"scripts": {
|
||||
"security:audit": "npm audit --audit-level moderate",
|
||||
"security:fix": "npm audit fix",
|
||||
"security:outdated": "npm outdated",
|
||||
"security:check": "npx snyk test"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
#### 自动化安全更新
|
||||
|
||||
```yaml
|
||||
# .github/workflows/security-update.yml
|
||||
name: Security Updates
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 3 * * 0' # 每周日凌晨3点
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
security-update:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v3
|
||||
with:
|
||||
node-version: '18'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Check for security vulnerabilities
|
||||
run: npm audit --audit-level moderate
|
||||
|
||||
- name: Update dependencies
|
||||
if: always()
|
||||
run: |
|
||||
npm update --save
|
||||
npm audit fix
|
||||
|
||||
- name: Create Pull Request
|
||||
if: always()
|
||||
uses: peter-evans/create-pull-request@v4
|
||||
with:
|
||||
title: '安全依赖更新'
|
||||
body: '自动安全依赖更新'
|
||||
branch: 'security-updates'
|
||||
commit-message: '更新安全依赖'
|
||||
```
|
||||
|
||||
### 3. 运行时安全监控
|
||||
|
||||
#### 安全事件监控
|
||||
|
||||
```javascript
|
||||
// 安全监控工具
|
||||
export const securityMonitor = {
|
||||
// 记录安全事件
|
||||
logSecurityEvent: (event) => {
|
||||
const securityLog = {
|
||||
timestamp: new Date().toISOString(),
|
||||
event: event.type,
|
||||
severity: event.severity || 'info',
|
||||
userAgent: navigator.userAgent,
|
||||
url: window.location.href,
|
||||
details: event.details
|
||||
}
|
||||
|
||||
// 发送到安全日志服务
|
||||
fetch('/api/security/log', {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/json'
|
||||
},
|
||||
body: JSON.stringify(securityLog)
|
||||
}).catch(console.error)
|
||||
},
|
||||
|
||||
// 检测异常行为
|
||||
detectAnomalies: () => {
|
||||
// 检测异常请求模式
|
||||
// 检测可疑用户行为
|
||||
// 检测安全策略违规
|
||||
},
|
||||
|
||||
// 实时告警
|
||||
alert: (message, level = 'warning') => {
|
||||
console[level](`[安全告警] ${message}`)
|
||||
// 发送到告警系统
|
||||
}
|
||||
}
|
||||
|
||||
// 监控全局错误
|
||||
window.addEventListener('error', (event) => {
|
||||
securityMonitor.logSecurityEvent({
|
||||
type: 'javascript_error',
|
||||
severity: 'error',
|
||||
details: {
|
||||
message: event.message,
|
||||
filename: event.filename,
|
||||
lineno: event.lineno,
|
||||
colno: event.colno
|
||||
}
|
||||
})
|
||||
})
|
||||
|
||||
// 监控未处理的 Promise 拒绝
|
||||
window.addEventListener('unhandledrejection', (event) => {
|
||||
securityMonitor.logSecurityEvent({
|
||||
type: 'unhandled_promise_rejection',
|
||||
severity: 'error',
|
||||
details: {
|
||||
reason: event.reason
|
||||
}
|
||||
})
|
||||
})
|
||||
```
|
||||
|
||||
## 应急响应
|
||||
|
||||
### 1. 安全事件分类
|
||||
|
||||
#### 事件严重等级
|
||||
|
||||
| 等级 | 描述 | 响应时间 | 处理流程 |
|
||||
|------|------|----------|----------|
|
||||
| 紧急 | 系统被入侵，数据泄露 | 立即响应 | 隔离系统，通知管理层 |
|
||||
| 高危 | 发现严重漏洞 | 2小时内响应 | 修复漏洞，安全审计 |
|
||||
| 中危 | 发现中等风险漏洞 | 24小时内响应 | 制定修复计划 |
|
||||
| 低危 | 发现低风险问题 | 72小时内响应 | 定期修复 |
|
||||
|
||||
### 2. 应急响应流程
|
||||
|
||||
#### 安全事件响应脚本
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# security-incident-response.sh
|
||||
|
||||
set -e
|
||||
|
||||
INCIDENT_TYPE="$1"
|
||||
SEVERITY="$2"
|
||||
|
||||
echo "开始安全事件应急响应..."
|
||||
echo "事件类型: $INCIDENT_TYPE"
|
||||
echo "严重等级: $SEVERITY"
|
||||
|
||||
# 记录事件
|
||||
timestamp=$(date +%Y%m%d_%H%M%S)
|
||||
echo "[$timestamp] 安全事件: $INCIDENT_TYPE ($SEVERITY)" >> /var/log/security/incidents.log
|
||||
|
||||
case $SEVERITY in
|
||||
"critical")
|
||||
echo "执行紧急响应流程..."
|
||||
|
||||
# 1. 隔离受影响系统
|
||||
echo "隔离系统..."
|
||||
sudo systemctl stop nginx
|
||||
sudo ufw deny http
|
||||
sudo ufw deny https
|
||||
|
||||
# 2. 备份当前状态
|
||||
echo "备份系统状态..."
|
||||
tar -czf "/opt/aiotagro/forensics/incident_$timestamp.tar.gz" \
|
||||
/var/log/nginx \
|
||||
/var/log/auth.log \
|
||||
/etc/nginx
|
||||
|
||||
# 3. 通知相关人员
|
||||
echo "通知安全团队..."
|
||||
# send_email "security@aiotagro.com" "安全事件告警" "发现紧急安全事件"
|
||||
|
||||
# 4. 启动取证调查
|
||||
echo "启动取证调查..."
|
||||
;;
|
||||
|
||||
"high")
|
||||
echo "执行高危响应流程..."
|
||||
|
||||
# 1. 限制访问
|
||||
echo "限制访问..."
|
||||
sudo nginx -t && sudo systemctl reload nginx
|
||||
|
||||
# 2. 安全审计
|
||||
echo "执行安全审计..."
|
||||
npm audit
|
||||
# 运行安全扫描工具
|
||||
|
||||
# 3. 修复漏洞
|
||||
echo "修复安全漏洞..."
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "执行标准响应流程..."
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "安全事件响应完成"
|
||||
```
|
||||
|
||||
### 3. 恢复流程
|
||||
|
||||
#### 系统恢复检查清单
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# security-recovery-checklist.sh
|
||||
|
||||
echo "=== 安全恢复检查清单 ==="
|
||||
|
||||
# 1. 验证系统完整性
|
||||
echo "1. 验证系统完整性..."
|
||||
checksum_original="$(sha256sum /opt/aiotagro/frontend/package.json | cut -d' ' -f1)"
|
||||
checksum_current="$(sha256sum /opt/aiotagro/frontend/package.json | cut -d' ' -f1)"
|
||||
|
||||
if [ "$checksum_original" = "$checksum_current" ]; then
|
||||
echo "✓ 系统文件完整性验证通过"
|
||||
else
|
||||
echo "✗ 系统文件可能被篡改"
|
||||
fi
|
||||
|
||||
# 2. 检查安全配置
|
||||
echo "2. 检查安全配置..."
|
||||
nginx_test=$(sudo nginx -t 2>&1)
|
||||
if echo "$nginx_test" | grep -q "test is successful"; then
|
||||
echo "✓ Nginx 配置验证通过"
|
||||
else
|
||||
echo "✗ Nginx 配置存在错误"
|
||||
fi
|
||||
|
||||
# 3. 验证证书状态
|
||||
echo "3. 验证证书状态..."
|
||||
if openssl x509 -checkend 86400 -noout -in /etc/ssl/certs/aiotagro.crt; then
|
||||
echo "✓ SSL 证书有效"
|
||||
else
|
||||
echo "✗ SSL 证书即将过期或无效"
|
||||
fi
|
||||
|
||||
# 4. 检查服务状态
|
||||
echo "4. 检查服务状态..."
|
||||
services=("nginx" "node-exporter")
|
||||
for service in "${services[@]}"; do
|
||||
if systemctl is-active --quiet "$service"; then
|
||||
echo "✓ $service 服务运行正常"
|
||||
else
|
||||
echo "✗ $service 服务异常"
|
||||
fi
|
||||
done
|
||||
|
||||
# 5. 安全扫描
|
||||
echo "5. 执行安全扫描..."
|
||||
# 运行安全扫描工具
|
||||
|
||||
echo "安全恢复检查完成"
|
||||
```
|
||||
|
||||
## 安全培训
|
||||
|
||||
### 1. 开发安全规范
|
||||
|
||||
#### 代码安全规范
|
||||
|
||||
```markdown
|
||||
# AIOTAGRO 开发安全规范
|
||||
|
||||
## 1. 输入验证
|
||||
- 所有用户输入必须验证
|
||||
- 使用白名单验证策略
|
||||
- 防范 XSS、SQL 注入等攻击
|
||||
|
||||
## 2. 身份认证
|
||||
- 使用强密码策略
|
||||
- 实现多因素认证
|
||||
- 会话超时机制
|
||||
|
||||
## 3. 数据保护
|
||||
- 敏感数据加密存储
|
||||
- 传输层使用 TLS
|
||||
- 最小化数据收集
|
||||
|
||||
## 4. 错误处理
|
||||
- 不暴露系统信息
|
||||
- 记录安全相关错误
|
||||
- 统一的错误处理机制
|
||||
|
||||
## 5. 依赖管理
|
||||
- 定期更新依赖
|
||||
- 使用可信的包源
|
||||
- 扫描依赖的安全漏洞
|
||||
```
|
||||
|
||||
### 2. 运维安全规范
|
||||
|
||||
#### 运维安全清单
|
||||
|
||||
```markdown
|
||||
# AIOTAGRO 运维安全清单
|
||||
|
||||
## 系统安全
|
||||
- [ ] 定期系统更新
|
||||
- [ ] 防火墙配置检查
|
||||
- [ ] 用户权限审核
|
||||
- [ ] 日志审计启用
|
||||
|
||||
## 应用安全
|
||||
- [ ] 安全头配置检查
|
||||
- [ ] SSL/TLS 配置验证
|
||||
- [ ] 应用漏洞扫描
|
||||
- [ ] 备份恢复测试
|
||||
|
||||
## 网络安全
|
||||
- [ ] 网络隔离检查
|
||||
- [ ] 访问控制验证
|
||||
- [ ] 入侵检测配置
|
||||
- [ ] DDoS 防护启用
|
||||
|
||||
## 数据安全
|
||||
- [ ] 数据加密验证
|
||||
- [ ] 访问日志审计
|
||||
- [ ] 数据备份验证
|
||||
- [ ] 隐私保护检查
|
||||
```
|
||||
|
||||
通过以上安全配置和流程，AIOTAGRO 管理系统可以实现全面的安全防护，确保系统稳定可靠运行。
|
||||
Reference in New Issue
Block a user