my-vault/01_Projects/Work/Government-Projects/Virtual-Data-Center/Issue-Handling.md at cffe45dc72b2d96289506e37add3857092495a19

Files

T

windyboy 40f3fe3eb8 vault backup: 2026-01-05 14:26:17

2026-01-05 14:26:17 +08:00

24 KiB

Raw Blame History

一、任务一：等保测评，涉及项目9月份验收【腾讯文档】2024_门户_虚拟数据中心等保问题处理跟进 https://docs.qq.com/sheet/DY1pUR0xSWXVxS2hJ?tab=rjqe69 1.政务数据门户（开发彭福临、张小青、运维苏海鹏） 2.虚拟数据中心（开发张成博、运维待定） --消息总线部分请广剑协助

二、任务二：每月安全漏洞扫描【腾讯文档】(内部)应用系统项目漏洞与渗透测试问题处理跟进（8月） https://docs.qq.com/sheet/DY1JEaU10Q0xuSm5V?tab=x7uzon 1.数据开放（开发龙跃云、张小青、运维XXX） 2.政务数据门户（开发彭福临、张小青、运维苏海鹏） 3.虚拟数据中心（开发张成博、运维待定） --消息总线部分请广剑协助

三、计划 1.整改评估（8月16号完成）所有问题过一遍，评估需要的时间，在群内汇报。在线文档的责任人栏标记上人员。对没有解决条件/需要协助/有争议的问题，在备注栏描述。 2.等保测评整改（8月23号完成）整改开发、在线文档填报整改情况、上线、测试。 3.漏洞扫描整改（8月30号完成）整改开发、在线文档填报整改情况、上线、测试。如果各位时间有冲突，在8月16号前在本群@张迪@胡畅提出，我们协调 3.复测和验收支持（9月）测评单位复测期间提供技术支持

mysql 配置修改数据库系统针设定有效的终端接入策略，对通过网络进行管理的终端进行限制。 ■数据库系统对账号进行IP限制，host ≠ %，限制固定IP段登录
数据库系统对登录用户数量进行限制，如配置max_connections为50（具体数值需根据实际业务需求调整）

（1）建议对被测系统内应实施相应措施对重要信息资源设置敏感标记，如设备级别不支持敏感标记的，应在系统级生成敏感标记，使系统整体支持强制访问控制机制； 
（2）依据安全策略严格控制用户对有敏感标记重要信息资源的操作； 
（3）强制访问控制机制通过策略将访问控制规则“强加”给访问主体，即系统强制主体服从访问控制策略。对主体及其所操作的客体（如：进程、文件等）进行安全标记，这些标记是实施强制访问控制的依据。当用户进行访问时，系统通过比较主体和客体的安全标记来判断一个主体是否能够访问其要操作的客体。主体通常指用户，或由用户发起运行的进程或用户正在使用的设备，客体通常是指信息的载体或从其他主体或客体接收信息的实体。

根据您的描述以及参考《环境信息系统安全技术规范》，以下是具体的实施建议：

1. 敏感标记的设置

设备级别支持：如果设备支持敏感标记，如某些高级存储设备，直接在设备上进行标记。
系统级生成：如果设备不支持，则在操作系统层面生成敏感标记，使用工具如SELinux进行标记管理。

2. 严格控制访问

安全策略实施：配置基于角色的访问控制（RBAC），限制用户对敏感资源的操作。
权限审核：定期审核用户权限，确保只有授权用户能访问敏感资源。

3. 强制访问控制机制

标记管理：为所有主体（用户、进程）和客体（文件、数据）设置安全标记。
策略比较：当用户请求访问某一资源时，系统通过比较主体和客体的安全标记，决定是否允许访问。

4. 系统配置与监控

配置管理：确保系统中的强制访问控制策略通过配置管理工具实施，并定期检查策略执行情况。
日志监控：记录并监控所有与敏感标记相关的访问操作，确保违规行为能够被及时发现和处理。

5. 培训与测试

用户培训：对用户进行相关安全策略和标记使用的培训，确保理解和遵守规定。
定期测试：通过模拟攻击和访问尝试测试系统的强制访问控制机制，确保其有效性。

这些措施可以确保在系统内正确实施敏感标记，并通过严格的策略控制访问，从而实现强制访问控制的目标。

（1）数据库系统根据安全策略要求对特权用户进行分离。如设置：系统管理员用户组、安全管理员用户组、安全审计员用户组、系统操作用户组等；
（2）按最小授权原则分配，不赋予一般用户管理员权限，不赋予用户不必要的操作权限。

（1）MySQL数据库系统启用“connection_control”； 

（2）建议数据库系统配置合规的锁定策略，可参考： 

Connection_control_failed_connections_threshold 30；Connection_control_min_connection_delay 600000； 

（3）建议数据库系统配置合规的操作超时锁定，可参考：interactive_timeout 1800。

The Connection Control Plugin in MySQL allows you to manage and limit client connections more precisely by setting thresholds for connection attempts and intervals between them. This plugin helps in mitigating brute-force attacks or controlling resource usage.

Steps to Configure the Connection Control Plugin

1. Install the Plugin

The Connection Control Plugin might not be enabled by default, so you need to install it.

Install the plugin:

INSTALL PLUGIN connection_control SONAME 'connection_control.so';
INSTALL PLUGIN connection_control_failed_login_attempts SONAME 'connection_control.so';

On Windows, the .so file extension may be .dll, so the commands would be:

INSTALL PLUGIN connection_control SONAME 'connection_control.dll';
INSTALL PLUGIN connection_control_failed_login_attempts SONAME 'connection_control.dll';

Verify the plugin installation:
```
SHOW PLUGINS;
```
This command will list all installed plugins, and you should see connection_control and connection_control_failed_login_attempts listed.

2. Configure the Plugin

Once installed, you can configure the plugin using various system variables.

Set the connection delay for failed login attempts:

This parameter defines how long MySQL should wait before accepting a new connection after a failed login attempt.
```
SET GLOBAL connection_control_failed_connections_threshold = 5;
```
This example sets the threshold to 5 failed login attempts.
Set the delay time:

This parameter defines the delay time (in milliseconds) between connections after the threshold is reached.
```
SET GLOBAL connection_control_min_connection_delay = 100;
SET GLOBAL connection_control_max_connection_delay = 10000;
```
Here, the minimum delay is set to 100 milliseconds, and the maximum delay is set to 10,000 milliseconds (10 seconds).
Make the settings persistent:

To make these changes permanent, add them to your MySQL configuration file (my.cnf or my.ini):
```
[mysqld]
connection_control_failed_connections_threshold = 5
connection_control_min_connection_delay = 100
connection_control_max_connection_delay = 10000
```
Then, restart the MySQL server for the changes to take effect.

3. Monitor and Adjust Settings

You can monitor the behavior of the plugin by querying relevant status variables:

Check the number of delayed connections:

SHOW STATUS LIKE 'Connection_control_delay_connections';

Check the number of failed login attempts:

SHOW STATUS LIKE 'Connection_control_failed_login_attempts_total';

Based on the results, you can fine-tune the settings to suit your environment's security and performance needs.

Summary

Install the Connection Control Plugin if it’s not already enabled.
Configure thresholds and delays using system variables.
Persist settings by adding them to the MySQL configuration file.
Monitor and adjust the plugin’s settings based on real-time data.

This setup allows you to control and limit connections, enhancing security and resource management in your MySQL environment.

ubuntu 18 upgrade to 22






10.196.76.79 
Apache HTTP/2 资源管理错误漏洞（CVE-2023-44487） 端口 8899
echo -e "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n" | nc localhost 8899
HTTP/1.1 200 OK
Content-Length: 2
Content-Type: application/vnd.schemaregistry.v1+json
Server: Jetty(8.1.16.v20140903)


openssh

zlib

./configure --prefix=/usr/local/zlib


openssl

export CC="gcc -std=gnu99" export CFLAGS="-O2 -fPIC" export LDFLAGS="-L/usr/local/zlib/lib" export CPPFLAGS="-I/usr/local/zlib/include"

./config
--prefix=/usr/local/openssl
--openssldir=/usr/local/openssl
shared zlib-dynamic

make clean make -j$(nproc) sudo make install sudo ldconfig



**OpenSSH 9.9p1**

cd /home/suops/soft/openssh-9.9p1 export CPPFLAGS="-I/usr/local/openssl/include -I/usr/local/zlib/include" export LDFLAGS="-L/usr/local/openssl/lib -L/usr/local/zlib/lib" export CC=/usr/local/gcc-10/bin/gcc

./configure
--prefix=/usr/local/openssh
--sysconfdir=/etc/ssh
--with-ssl-dir=/usr/local/openssl
--with-zlib=/usr/local/zlib
--with-pam
--with-privsep-path=/var/lib/sshd

make -j$(nproc) sudo make install

sudo /usr/local/openssh/sbin/sshd -t -f /etc/ssh/sshd_config

/usr/local/openssh/sbin/sshd -D -f /etc/ssh/sshd_config -p 2222 -E /tmp/sshd-test.log



backup old ssh

mkdir -p /usr/local/openssh-backup cp -a /usr/sbin/sshd /usr/local/openssh-backup/ cp -a /usr/bin/ssh /usr/bin/scp /usr/bin/sftp /usr/bin/ssh-keygen /usr/local/openssh-backup/



replace

mv /usr/sbin/sshd /usr/sbin/sshd.old ln -s /usr/local/openssh/sbin/sshd /usr/sbin/sshd

for bin in ssh scp sftp ssh-keygen ssh-add ssh-agent; do if [ -f /usr/local/openssh/bin/$bin ]; then mv /usr/bin/$bin /usr/bin/$bin.old 2>/dev/null || true ln -sf /usr/local/openssh/bin/$bin /usr/bin/$bin fi done

echo "/usr/local/openssl/lib" | sudo tee /etc/ld.so.conf.d/openssl.conf sudo ldconfig sudo systemctl restart sshd



10.196.76.89

默认编译器：

export PATH=/usr/local/gcc-10/bin:$PATH export LD_LIBRARY_PATH=/usr/local/gcc-10/lib64:$LD_LIBRARY_PATH


zlib:

./configure --prefix=/usr/local/zlib make -j$(nproc) sudo make install



openssl 3.0.18

安装perl 模块

sudo yum install -y perl perl-core perl-IPC-Cmd perl-Text-Template

export CC=/usr/local/gcc-10/bin/gcc export CFLAGS="-O2 -fPIC" export CPPFLAGS="-I/usr/local/zlib/include" export LDFLAGS="-L/usr/local/zlib/lib"

./Configure linux-x86_64
--prefix=/usr/local/openssl
--openssldir=/usr/local/openssl
shared zlib-dynamic

make -j$(nproc) sudo make install_sw

sudo chmod 755 /usr/local/openssl

sudo chmod 755 /usr/local/openssl/lib64

sudo chmod -R a+X /usr/local/openssl




openssh-portable-V_10_2 :

安装 pam

sudo yum install -y pam-devel

export CC=/usr/local/gcc-10/bin/gcc export CPPFLAGS="-I/usr/local/openssl/include -I/usr/local/zlib/include" export LDFLAGS="-Wl,-rpath=/usr/local/openssl/lib64 -L/usr/local/openssl/lib64 -L/usr/local/zlib/lib" export LD_LIBRARY_PATH=/usr/local/openssl/lib64:/usr/local/zlib/lib




注册openssl3

echo "/usr/local/openssl/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf echo "/usr/local/openssl/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf export LD_LIBRARY_PATH=/usr/local/openssl/lib64:/usr/local/openssl/lib:$LD_LIBRARY_PATH sudo ldconfig

./configure
--prefix=/usr/local/openssh
--sysconfdir=/etc/ssh
--with-ssl-dir=/usr/local/openssl
--with-zlib=/usr/local/zlib
--with-ssl-engine
--with-pam
--with-privsep-path=/var/lib/sshd

make -j$(nproc) sudo make install

/usr/local/openssh/bin/ssh -V


备份旧版

sudo mkdir -p /usr/local/openssh-backup/{bin,etc_ssh_$(date +%F),system}

sudo cp /usr/sbin/sshd /usr/local/openssh-backup/bin/ 2>/dev/null || true sudo cp /usr/bin/ssh* /usr/local/openssh-backup/bin/ 2>/dev/null || true sudo cp /usr/bin/scp /usr/local/openssh-backup/bin/ 2>/dev/null || true sudo cp /usr/bin/sftp* /usr/local/openssh-backup/bin/ 2>/dev/null || true

sudo cp -a /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)

sudo cp /etc/rc.d/init.d/sshd /usr/local/openssh-backup/system/ 2>/dev/null || true sudo cp /lib/systemd/system/sshd.service /usr/local/openssh-backup/system/ 2>/dev/null || true sudo cp /etc/pam.d/sshd /usr/local/openssh-backup/system/ 2>/dev/null || true

sudo ls -R /usr/local/openssh-backup


安装新版：
配置文件：

sudo sed -i 's/^:space:*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config sudo sed -i 's/^:space:*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config sudo sed -i 's/^:space:*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config

sudo /usr/local/openssh/sbin/sshd -t

测试启动：

sudo /usr/local/openssh/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D



替换文件：

sudo ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd sudo ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh sudo ln -sf /usr/local/openssh/bin/scp /usr/bin/scp sudo ln -sf /usr/local/openssh/bin/sftp /usr/bin/sftp sudo ln -sf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen sudo ln -sf /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan sudo ln -sf /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add sudo ln -sf /usr/local/openssh/bin/ssh-agent /usr/bin/ssh-agent

sudo systemctl daemon-reexec sudo systemctl daemon-reload

sudo systemctl restart sshd sudo systemctl status sshd

/usr/sbin/sshd -V

cd /usr/local sudo tar czf /home/suops/soft/openssh10p1_full.tar.gz openssh openssl zlib gcc-10





10.196.76.88

sudo tar xvzf openssh10p1_full.tar.gz -C /usr/local


权限：

sudo chmod -R a+X /usr/local/openssl /usr/local/zlib /usr/local/openssh



链接库

echo "/usr/local/openssl/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf echo "/usr/local/openssl/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf echo "/usr/local/zlib/lib" | sudo tee /etc/ld.so.conf.d/zlib.conf sudo ldconfig

ldconfig -p | grep libssl.so.3 ldconfig -p | grep libz.so



验证：

/usr/local/openssl/bin/openssl version -a /usr/local/openssh/bin/ssh -V


备份：

sudo mkdir -p /usr/local/openssh-backup sudo cp /usr/sbin/sshd /usr/local/openssh-backup/ sudo cp /usr/bin/ssh* /usr/local/openssh-backup/ sudo cp -r /etc/ssh /usr/local/openssh-backup/etc_ssh_$(date +%F)



测试启动：

sudo chmod 600 /etc/ssh/ssh_host_key sudo chmod 644 /etc/ssh/ssh_host_key.pub

sudo mkdir -p /var/lib/sshd sudo chmod 700 /var/lib/sshd sudo chown root:sys /var/lib/sshd 2>/dev/null || sudo chown root:root /var/lib/sshd

sudo /usr/local/openssh/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D



替换：

sudo ln -sf /usr/local/openssh/sbin/sshd /usr/sbin/sshd sudo ln -sf /usr/local/openssh/bin/ssh /usr/bin/ssh sudo ln -sf /usr/local/openssh/bin/scp /usr/bin/scp sudo ln -sf /usr/local/openssh/bin/sftp /usr/bin/sftp sudo ln -sf /usr/local/openssh/bin/ssh-keygen /usr/bin/ssh-keygen sudo ln -sf /usr/local/openssh/bin/ssh-keyscan /usr/bin/ssh-keyscan sudo ln -sf /usr/local/openssh/bin/ssh-agent /usr/bin/ssh-agent sudo ln -sf /usr/local/openssh/bin/ssh-add /usr/bin/ssh-add

sudo systemctl daemon-reexec sudo systemctl daemon-reload

sudo systemctl restart sshd sudo systemctl status sshd





10.194.67.122:

wget https://ftp.gnu.org/gnu/gmp/gmp-6.2.1.tar.xz wget https://ftp.gnu.org/gnu/mpfr/mpfr-4.2.1.tar.xz wget https://ftp.gnu.org/gnu/mpc/mpc-1.3.1.tar.gz



gcc:

../configure --prefix=/usr/local/gcc-10
--enable-languages=c,c++
--disable-multilib
--enable-bootstrap

make -j$(nproc) sudo make install

sudo chmod -R a+rx /usr/local/gcc-10

export CC=/usr/local/gcc-10/bin/gcc export CXX=/usr/local/gcc-10/bin/g++


编译zlib

./configure --prefix=/usr/local/zlib make -j$(nproc) sudo make install

sudo chmod -R a+rx /usr/local/zlib



编译openssl

./Configure
--prefix=/usr/local/openssl-3
--openssldir=/usr/local/openssl-3
shared zlib
-I/usr/local/zlib/include
-L/usr/local/zlib/lib

sudo chmod -R a+rx /usr/local/openssl-3


编译openssh

export CC=/usr/local/gcc-10/bin/gcc export CXX=/usr/local/gcc-10/bin/g++ export CPPFLAGS="-I/usr/local/openssl-3/include" export LDFLAGS="-L/usr/local/openssl-3/lib64"

echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl-3.conf

./configure
--prefix=/usr/local/openssh-9
--sysconfdir=/usr/local/openssh-9/etc
--with-ssl-dir=/usr/local/openssl-3
--with-zlib=/usr/local/zlib
--with-pam
--with-md5-passwords

make -j2 sudo make install

sudo chmod -R a+X /usr/local/openssh-9

/usr/local/openssl-3/bin/openssl version -a /usr/local/openssh-9/bin/ssh -V

sudo chmod 600 /etc/ssh/ssh_host_key sudo chmod 644 /etc/ssh/ssh_host_key.pub

sudo /usr/local/openssh-9/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D

sudo ln -sf /usr/local/openssh-9/sbin/sshd /usr/sbin/sshd sudo ln -sf /usr/local/openssh-9/bin/ssh /usr/bin/ssh sudo ln -sf /usr/local/openssh-9/bin/scp /usr/bin/scp sudo ln -sf /usr/local/openssh-9/bin/sftp /usr/bin/sftp sudo ln -sf /usr/local/openssh-9/bin/ssh-keygen /usr/bin/ssh-keygen sudo ln -sf /usr/local/openssh-9/bin/ssh-keyscan /usr/bin/ssh-keyscan sudo ln -sf /usr/local/openssh-9/bin/ssh-agent /usr/bin/ssh-agent sudo ln -sf /usr/local/openssh-9/bin/ssh-add /usr/bin/ssh-add

sudo systemctl daemon-reexec sudo systemctl daemon-reload

sudo systemctl restart sshd sudo systemctl status sshd



123，125 , 126,127,128,130:

echo "/usr/local/openssl-3/lib64" | sudo tee /etc/ld.so.conf.d/openssl3.conf echo "/usr/local/openssl-3/lib" | sudo tee -a /etc/ld.so.conf.d/openssl3.conf echo "/usr/local/zlib/lib" | sudo tee /etc/ld.so.conf.d/zlib.conf sudo ldconfig

/usr/local/openssl-3/bin/openssl version -a /usr/local/openssh-9/bin/ssh -V

sudo sed -i 's/^:space:*GSSAPIAuthentication/#&/' /etc/ssh/sshd_config

sudo sed -i 's/^:space:*GSSAPICleanupCredentials/#&/' /etc/ssh/sshd_config

sudo sed -i 's/^:space:*UsePrivilegeSeparation/#&/' /etc/ssh/sshd_config



生成新服务器key:

sudo /usr/local/openssh-9/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-9/etc/ssh_host_rsa_key -N "" -q sudo /usr/local/openssh-9/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-9/etc/ssh_host_ecdsa_key -N "" -q sudo /usr/local/openssh-9/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-9/etc/ssh_host_ed25519_key -N "" -q

sudo chmod 600 /etc/ssh/ssh_host_key sudo chmod 644 /etc/ssh/ssh_host_key.pub

sudo mkdir -p /var/empty sudo chown root:root /var/empty sudo chmod 755 /var/empty

sudo /usr/local/openssh-9/sbin/sshd -p 2222 -f /etc/ssh/sshd_config -D

sudo ln -sf /usr/local/openssh-9/sbin/sshd /usr/sbin/sshd

sudo ln -sf /usr/local/openssh-9/bin/ssh /usr/bin/ssh

sudo ln -sf /usr/local/openssh-9/bin/scp /usr/bin/scp

sudo ln -sf /usr/local/openssh-9/bin/sftp /usr/bin/sftp

sudo ln -sf /usr/local/openssh-9/bin/ssh-keygen /usr/bin/ssh-keygen

sudo ln -sf /usr/local/openssh-9/bin/ssh-keyscan /usr/bin/ssh-keyscan

sudo ln -sf /usr/local/openssh-9/bin/ssh-agent /usr/bin/ssh-agent

sudo ln -sf /usr/local/openssh-9/bin/ssh-add /usr/bin/ssh-add

sudo systemctl daemon-reexec

sudo systemctl daemon-reload

sudo systemctl restart sshd

sudo systemctl status sshd



debug ssh 断开错误

sudo /usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/test/sshd_debug -E /usr/local/openssh-9/test/sshd_debug.log


备份

sudo mkdir -p /etc/ssh/backup-$(date +%F) sudo cp -a /etc/ssh/sshd_config /etc/ssh/backup-$(date +%F)/ sudo cp -a /etc/ssh/ssh_host_* /etc/ssh/backup-$(date +%F)/

sudo /usr/local/openssh-9/bin/ssh-keygen -t rsa -b 4096 -f /usr/local/openssh-9/etc/ssh_host_rsa_key -N "" sudo /usr/local/openssh-9/bin/ssh-keygen -t ecdsa -b 521 -f /usr/local/openssh-9/etc/ssh_host_ecdsa_key -N "" sudo /usr/local/openssh-9/bin/ssh-keygen -t ed25519 -f /usr/local/openssh-9/etc/ssh_host_ed25519_key -N ""

sudo chmod 600 /usr/local/openssh-9/etc/ssh/ssh_host_key sudo chmod 644 /usr/local/openssh-9/etc/ssh/ssh_host_key.pub



sshd_config

#Port 22 Port 2222 ListenAddress 0.0.0.0 Protocol 2 HostKey /usr/local/openssh-9/etc/ssh_host_rsa_key HostKey /usr/local/openssh-9/etc/ssh_host_ecdsa_key HostKey /usr/local/openssh-9/etc/ssh_host_ed25519_key PermitRootLogin prohibit-password PasswordAuthentication yes PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PermitEmptyPasswords no ChallengeResponseAuthentication no UsePAM yes LoginGraceTime 30 MaxAuthTries 3 ClientAliveInterval 60 ClientAliveCountMax 3 LogLevel INFO PidFile /usr/local/openssh-9/etc/sshd.pid Subsystem sftp /usr/local/openssh-9/libexec/sftp-server




测试语法

sudo /usr/local/openssh-9/sbin/sshd -t -f /usr/local/openssh-9/etc/sshd_config




测试运行

sudo /usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/etc/sshd_config -E /usr/local/openssh-9/etc/sshd_debug.log

sudo nano /etc/systemd/system/sshd.service

[Unit] Description=OpenSSH Daemon (custom build) After=network.target auditd.service Wants=network.target

[Service] Type=simple ExecStart=/usr/local/openssh-9/sbin/sshd -D -f /usr/local/openssh-9/etc/sshd_config ExecReload=/bin/kill -HUP $MAINPID Restart=on-failure PIDFile=/usr/local/openssh-9/etc/sshd.pid

[Install] WantedBy=multi-user.target

sudo /usr/local/openssh-9/sbin/sshd -t -f /usr/local/openssh-9/etc/sshd_config

sudo systemctl stop ssh

sudo systemctl disable ssh

sudo systemctl daemon-reexec

sudo systemctl daemon-reload

sudo systemctl enable sshd.service

sudo systemctl start sshd.service

sudo /usr/local/openssh-9/sbin/sshd -D -e -f /usr/local/openssh-9/etc/sshd_config



10.194.67.222:
centos 6.8

编译gcc 6.5.0

# GMP

tar -xf gmp-6.1.2.tar.xz cd gmp-6.1.2 ./configure --prefix=/usr/local/gmp make -j$(nproc) make install



# MPFR

tar xf mpfr-4.1.0.tar.xz cd mpfr-4.1.0 ./configure
--prefix=/usr/local/mpfr
--with-gmp=/usr/local/gmp
CPPFLAGS="-I/usr/local/gmp/include"
LDFLAGS="-L/usr/local/gmp/lib"

make -j4 make install



# MPC

tar xf mpc-1.2.1.tar.gz cd mpc-1.2.1 ./configure --prefix=/usr/local/mpc
--with-gmp=/usr/local/gmp
--with-mpfr=/usr/local/mpfr
CPPFLAGS="-I/usr/local/gmp/include -I/usr/local/mpfr/include"
LDFLAGS="-L/usr/local/gmp/lib -L/usr/local/mpfr/lib"

make -j4 make install



# gcc

../configure --prefix=/opt/gcc-6.5
--enable-languages=c,c++
--disable-multilib
--disable-bootstrap
--disable-nls
--enable-checking=release
--enable-shared
--enable-threads=posix
--enable-lto
--enable-__cxa_atexit
--with-system-zlib
--with-gmp=/usr/local/gmp
--with-mpfr=/usr/local/mpfr
--with-mpc=/usr/local/mpc
CPPFLAGS="-I/usr/local/gmp/include -I/usr/local/mpfr/include -I/usr/local/mpc/include"
LDFLAGS="-L/usr/local/gmp/lib -L/usr/local/mpfr/lib -L/usr/local/mpc/lib"

24 KiB Raw Blame History Unescape Escape

1. 敏感标记的设置

2. 严格控制访问

3. 强制访问控制机制

4. 系统配置与监控

5. 培训与测试

Steps to Configure the Connection Control Plugin

1. Install the Plugin

2. Configure the Plugin

3. Monitor and Adjust Settings

Summary

24 KiB

Raw Blame History