杜绝＂人因＂漏洞:Linux 账号管理,如何让系统容忍人的错误?

账号分类与核心管理框架

四大场景的深度管理策略

groupadd -r auditors

useradd -r -g auditors -d /var/log/audit -s /sbin/nologin audit_reader

# /etc/sudoers.d/audit

Cmnd_Alias AUDIT_CMDS = /usr/bin/journalctl, /usr/bin/ausearch, /usr/bin/aureport

%auditors ALL=(root) NOPASSWD: AUDIT_CMDS

create_regular_user() {

useradd -g ${DEPT}_staff -G users,ssh_login \

-c "${DEPT} Employee" -m -s /bin/bash ${USERNAME}

passwd -e ${USERNAME} # 强制首次修改密码

chage -m 7 -M 90 -W 14 -I 30 ${USERNAME}

}

# /etc/security/pwquality.conf

minlen = 12 # 最小长度 12

dcredit = -1 # 至少 1 数字

ucredit = -1 # 至少 1 大写

lcredit = -1 # 至少 1 小写

ocredit = -1 # 至少 1 特殊字符

maxrepeat = 3 # 连续重复 ≤ 3

difok = 5 # 新旧密码差 ≥ 5

# 系统管理员 — 不可操作审计日志

%sysadmins ALL=(ALL) !/bin/su, !/bin/systemctl stop auditd

# 数据库管理员 — 仅限于数据库相关

%dbadmins ALL=(root) /usr/bin/systemctl start mysql*

# 安全管理员 — 仅审计命令

%secadmins ALL=(root) /usr/bin/ausearch, /usr/bin/aureport

useradd --system --no-create-home --shell /sbin/nologin --gid ${APP_GROUP} ${SERVICE}

[Service]

ProtectSystem=full

ProtectHome=true

PrivateTmp=true

NoNewPrivileges=true

CapabilityBoundingSet=CAP_NET_BIND_SERVICE

SystemCallFilter=@system-service

杜绝人因：从制度到技术的五层闭环防御

echo 'export PROMPT_COMMAND="history -a; logger -p authpriv.info \

[USER=\$USER] [PWD=\$PWD] CMD=\$(history 1 | cut -c8-)"' >> /etc/bashrc

# /etc/sudoers

Defaults logfile=/var/log/sudo.log

Defaults log_year, loglinelen=80

auditctl -a exit,always -S execve -k command_log

auditctl -w /etc/shadow -p wa -k identity

- name: Create dev users

ansible.builtin.user:

name: "{{ item.name }}"

group: "{{ item.dept }}_staff"

shell: /bin/bash

with_items: "{{ users }}"

notify: audit_user_creation

resource "local_file" "sudoers_d" {

content = templatefile("sudoers.tpl", { admins = var.admins })

filename = "/etc/sudoers.d/team_admins"

provisioner "local-exec" {

command = "visudo -c -f /etc/sudoers.d/team_admins || exit 1"

}

}

# 每 30 分钟检查僵尸账号

*/30 * * * * root /usr/local/bin/account_audit.sh && \

[ -s /tmp/account_alert.txt ] && \

mail -s "Account Alert" security@company.com < /tmp/account_alert.txt

account_spec:

naming: "{dept}_{role}_{seq}"

uid_policy: "auto"

primary_group: "{dept}_staff"

supplementary_groups: ["users", "ssh_login"]

password_policy:

min_days: 7, max_days: 90

warn_days: 14, inactive_days: 30

history: 5

shell_whitelist: ["/bin/bash", "/sbin/nologin"]

# 随机禁用工具账号，测试告警响应

random_user=$(awk -F: '($3>=1000){print $1}' /etc/passwd | shuf -n1)

usermod -L "$random_user"

# 1. systemd 沙箱防止越界

ProtectSystem=full

ProtectHome=true

# 2. SELinux 强制访问控制

semanage login -a -s user_u $SERVICE_USER

# 3. Webhook 实时告警

tail -1 /var/log/sudo.log | grep -q FAILED && \

curl -X POST -H "Content-Type: application/json" \

-d '{"msg_type":"interactive","card":{"header":{"title":"sudo 失败告警"}}}' \

https://open.feishu.cn/open-apis/bot/v2/hook/xxx

四类账号的防御纵深对比

结语：信任管理的终极命题