security

Documentation

Index

• Variables
• type BindAddrChecker
  • func (c *BindAddrChecker) Check(ctx context.Context) Result
  • func (c *BindAddrChecker) Name() string
• type Checker
• type ConfigChecker
  • func (c *ConfigChecker) Check(ctx context.Context) Result
  • func (c *ConfigChecker) Name() string
• type FilePermChecker
  • func (c *FilePermChecker) Check(ctx context.Context) Result
  • func (c *FilePermChecker) Name() string
• type Manager
  • func New(logger *zerolog.Logger) *Manager
  • func (m *Manager) Register(c ...Checker)
  • func (m *Manager) Run(ctx context.Context) error
• type Result
• type RootUserChecker
  • func (c *RootUserChecker) Check(ctx context.Context) Result
  • func (c *RootUserChecker) Name() string
• type SecretStrengthChecker
  • func (c *SecretStrengthChecker) Check(ctx context.Context) Result
  • func (c *SecretStrengthChecker) Name() string
• type Severity
  • func (s Severity) String() string
• type SwapChecker
  • func (c *SwapChecker) Check(ctx context.Context) Result
  • func (c *SwapChecker) Name() string
• type SysctlChecker
  • func (c *SysctlChecker) Check(ctx context.Context) Result
  • func (c *SysctlChecker) Name() string
• type UlimitChecker
  • func (c *UlimitChecker) Check(ctx context.Context) Result
  • func (c *UlimitChecker) Name() string

Variables

var WeakList = []string{
	"123456", "12345678", "123456789", "password", "secret", "admin", "root",
	"changeme", "default", "actuator", "manager", "111111", "qwerty",
	"1234567890", "system", "service", "auth", "token", "key",
}

这些是开发环境中极其常见的弱密码

Types

type BindAddrChecker

type BindAddrChecker struct {
	Addr        string
	AllowPublic bool // 是否允许公网暴露
}

BindAddrChecker 检查监听地址是否过于宽泛

func (*BindAddrChecker) Check

func (c *BindAddrChecker) Check(ctx context.Context) Result

func (*BindAddrChecker) Name

func (c *BindAddrChecker) Name() string

type Checker

type Checker interface {
	Name() string
	Check(ctx context.Context) Result
}

Checker 检查器接口

type ConfigChecker

type ConfigChecker struct {
	ID       string
	Severity Severity
	CheckFn  func() (bool, string)
}

ConfigChecker 这是一个通用的配置检查器，传入一个闭包

func (*ConfigChecker) Check

func (c *ConfigChecker) Check(ctx context.Context) Result

func (*ConfigChecker) Name

func (c *ConfigChecker) Name() string

type FilePermChecker

type FilePermChecker struct {
	Path     string
	MaxPerm  os.FileMode // 例如 0600
	Severity Severity
}

FilePermChecker 检查关键文件权限 (如 0600)

func (*FilePermChecker) Check

func (c *FilePermChecker) Check(ctx context.Context) Result

func (*FilePermChecker) Name

func (c *FilePermChecker) Name() string

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager 管理安全自检流程

func New

func New(logger *zerolog.Logger) *Manager

func (*Manager) Register

func (m *Manager) Register(c ...Checker)

Register 注册检查项

func (*Manager) Run

func (m *Manager) Run(ctx context.Context) error

Run 执行所有检查。 如果有 SeverityFatal 级别的检查失败，返回 error。

type Result

type Result struct {
	Name     string
	Passed   bool
	Severity Severity
	Message  string
	Error    error
}

Result 封装检查结果

type RootUserChecker

type RootUserChecker struct {
	Severity Severity
}

RootUserChecker 检查是否以 Root 身份运行

func (*RootUserChecker) Check

func (c *RootUserChecker) Check(ctx context.Context) Result

func (*RootUserChecker) Name

func (c *RootUserChecker) Name() string

type SecretStrengthChecker

type SecretStrengthChecker struct {
	NameID    string
	Secret    string
	MinLength int
	// MinEntropy 最小熵值（建议值：3.0 左右）
	MinEntropy float64
}

SecretStrengthChecker 检查敏感字符串的强度

func (*SecretStrengthChecker) Check

func (c *SecretStrengthChecker) Check(ctx context.Context) Result

func (*SecretStrengthChecker) Name

func (c *SecretStrengthChecker) Name() string

type Severity

type Severity int

const (
	SeverityInfo Severity = iota
	SeverityWarn
	SeverityFatal
)

func (Severity) String

func (s Severity) String() string

type SwapChecker

type SwapChecker struct {
	Severity Severity
}

SwapChecker 检查系统是否开启了 Swap 对于 Go GC 来说，Swap 是性能杀手。生产环境建议关闭。

func (*SwapChecker) Check

func (c *SwapChecker) Check(ctx context.Context) Result

func (*SwapChecker) Name

func (c *SwapChecker) Name() string

type SysctlChecker

type SysctlChecker struct {
	Key      string // e.g., "net.core.somaxconn"
	MinValue int64
	Severity Severity
}

SysctlChecker 检查内核参数 (/proc/sys)

func (*SysctlChecker) Check

func (c *SysctlChecker) Check(ctx context.Context) Result

func (*SysctlChecker) Name

func (c *SysctlChecker) Name() string

type UlimitChecker

type UlimitChecker struct {
	MinLimit uint64
	Severity Severity
}

UlimitChecker 检查文件描述符限制 (FD Limit)

func (*UlimitChecker) Check

func (c *UlimitChecker) Check(ctx context.Context) Result

func (*UlimitChecker) Name

func (c *UlimitChecker) Name() string