在国庆重保正式实施全网“封网Change Freeze”指令前的最后 24 小时任何未闭环的高危配置、测试遗留端口或策略冲突都可能成为红队攻击突破的决胜点。封网意味着除重大应急阻断外生产环境禁止一切常规代码上线与架构变更。因此在封网前组织开展最后一次地毯式的全量安全巡检核验所有安全防护链条的状态是守住安全底线的最后关卡。本文整理涵盖“网络边界、主机容器、中间件存储、安全设备与演练遗留”的终极巡检 Checklist 与自动化巡检核验脚本。封网前终极全量安全巡检 Checklist安全巡检覆盖五大核心域所有检查项必须做到“逐项核实、双人签字、系统核销”---------------------------------------------------------------------------------------- | 域 1网络与外部暴露面收敛 (External Attack Surface) | | [ ] 1.1 公网 DNS 域名全量核对下线所有包含 test/dev/staging/demo 关键字的公网解析 | | [ ] 1.2 边缘资产与外包系统排查确认子公司/外包合作方独立专线是否已加挂 WAF 与访问限制 | | [ ] 1.3 外部高危端口封堵确认 22(SSH)、3389(RDP)、8080/8888(管理后台) 无公网直通 | ---------------------------------------------------------------------------------------- | 域 2主机与容器基础设施 (Host Container Infrastructure) | | [ ] 2.1 EDR 探针全量在线率核验生产集群在线率必须达到 100%无心跳离线节点全量隔离 | | [ ] 2.2 宿主机特权容器清零核查 k8s 集群彻底清除 privileged: true 与 docker.sock 挂载| | [ ] 2.3 SSH 互信与弱口令排查清除所有跨节点的无密码 SSH 互信密钥与空密码影子账户 | ---------------------------------------------------------------------------------------- | 域 3中间件与核心数据存储 (Middleware Data Stores) | | [ ] 3.1 Redis/Elasticsearch/MongoDB 未授权排查强制绑定 127.0.0.1 并开启强密码认证 | | [ ] 3.2 消息队列 Kafka/RabbitMQ 鉴权禁用匿名 Producer/Consumer开启 SASL/PLAIN 认证 | | [ ] 3.3 数据库连接池与明文凭据排查配置文件中的明文账密确认已托管至 KMS/Vault | ---------------------------------------------------------------------------------------- | 域 4安全防御设备与探针 (Security Appliances Defense Sensors) | | [ ] 4.1 WAF 与 API 网关规则重载全量加载最新 0day 虚拟补丁与高频 IP 封禁策略 | | [ ] 4.2 蜜罐与诱饵网络激活确认各网段高仿真诱饵SSH/MySQL/Web引流正常并告警联通 | | [ ] 4.3 威胁情报与阻断列表下发边界防火墙同步最新国家级威胁情报 IOC 恶意 IP 池 | ---------------------------------------------------------------------------------------- | 域 5前期演练遗留清理 (Exercise Residual Cleanup) | | [ ] 5.1 红队测试账户与临时白名单注销彻底清理演练期间开通的临时堡垒机账号与 WAF 放行 | | [ ] 5.2 演练探针与测试脏数据回滚清理测试订单、影子数据库及测试向量索引 | ----------------------------------------------------------------------------------------自动化一键巡检探针脚本实现为了在封网前快速对全网数千台 Linux 服务器进行无死角基线扫描编写了轻量、无外部依赖的 Python 巡检脚本可直接通过 Ansible 批量并发下发执行import os import socket import subprocess import json import sys def check_listening_ports() - list: 检测是否存在违规绑定 0.0.0.0 的高危端口 dangerous_ports {22: SSH, 3389: RDP, 6379: Redis, 9200: Elasticsearch, 27017: MongoDB, 2375: Docker Daemon} findings [] try: netstat subprocess.run([ss, -tuln], capture_outputTrue, textTrue, checkTrue) lines netstat.stdout.splitlines() for line in lines: for port, service in dangerous_ports.items(): pattern f:{port} if pattern in line and (0.0.0.0 in line or [::] in line or *: in line): findings.append({ type: DANGEROUS_OPEN_PORT, service: service, port: port, raw: line.strip() }) except Exception as e: findings.append({type: CHECK_ERROR, msg: str(e)}) return findings def check_ssh_security() - list: 核查 SSH 安全基线与 Agent 转发配置 findings [] sshd_config /etc/ssh/sshd_config if os.path.exists(sshd_config): with open(sshd_config, r) as f: content f.read() if PermitRootLogin yes in content: findings.append({type: SSH_ROOT_PERMITTED, severity: HIGH, file: sshd_config}) if AllowAgentForwarding yes in content: findings.append({type: SSH_AGENT_FORWARDING_ENABLED, severity: MEDIUM, file: sshd_config}) return findings def check_cron_and_startup() - list: 排查异常未授权计划任务与持久化后门 findings [] cron_paths [/etc/crontab, /etc/cron.d, /var/spool/cron/crontabs] for path in cron_paths: if os.path.exists(path): if os.path.isdir(path): for f in os.listdir(path): full_p os.path.join(path, f) findings.extend(_scan_file_for_backdoor(full_p)) else: findings.extend(_scan_file_for_backdoor(path)) return findings def _scan_file_for_backdoor(file_path: str) - list: alerts [] suspicious_keywords [curl, wget, nc , bash -i, sh -i, /dev/tcp, python -c] try: with open(file_path, r, errorsignore) as f: for line_no, line in enumerate(f, 1): if any(kw in line for kw in suspicious_keywords) and not line.strip().startswith(#): alerts.append({ type: SUSPICIOUS_CRON_ENTRY, file: file_path, line_no: line_no, content: line.strip() }) except Exception: pass return alerts def run_pre_freeze_inspection(): report { hostname: socket.gethostname(), timestamp: subprocess.run([date, %Y-%m-%dT%H:%M:%S], capture_outputTrue, textTrue).stdout.strip(), open_port_violations: check_listening_ports(), ssh_violations: check_ssh_security(), cron_anomalies: check_cron_and_startup() } total_violations len(report[open_port_violations]) len(report[ssh_violations]) len(report[cron_anomalies]) report[status] PASSED if total_violations 0 else FAILED report[total_violations] total_violations print(json.dumps(report, indent2)) if total_violations 0: sys.exit(2) if __name__ __main__: run_pre_freeze_inspection()封网指令生效确认与签字机制在巡检通过后安全团队与基础架构团队联合签发封网令并在网络与系统层面开启强制锁止发布系统熔断Pipeline LockGitLab CI/CD、Kubernetes CD 平台将发布权限收敛至仅总指挥官账号可用堡垒机双人复核Four-Eyes Principle所有对生产环境的变更与调试指令必须由第二名资深工程师在堡垒机后台进行实时同屏核对与二次审批授权配置防篡改Immutable Config对/etc/passwd、/etc/hosts、Nginx 与核心网关配置添加chattr i属性锁定确保封网期间整个 IT 资产处于绝对静止的防御稳态。