99 lines
4.8 KiB
JSON
99 lines
4.8 KiB
JSON
|
{
|
|||
|
|
"id": "ZY-PROJ-003",
|
|||
|
|
"name": "SSH 安全加固 · ZY-SVR-002 面孔服务器",
|
|||
|
|
"guardian": "铸渊 · ICE-GL-ZY001",
|
|||
|
|
"copyright": "国作登字-2026-A-00037559",
|
|||
|
|
"background": {
|
|||
|
|
"bingshuo_requirement": "ZY-SVR-002的SSH 22端口一直被扫描·要加固·禁密码登录改端口加fail2ban·但我不直接SSH登服务器·只用腾讯云在线终端",
|
|||
|
|
"zhuyuan_understanding": "冰朔唯一操作服务器方式=腾讯云在线终端(腾讯内网·不受SSH端口和安全组约束)·GitHub Actions是唯一外部SSH来源·所以安全组可以只开放GitHub Actions IP段·改端口和限安全组完全不影响冰朔操作"
|
|||
|
|
},
|
|||
|
|
"architecture": {
|
|||
|
|
"constraint": "冰朔不直接SSH·只用腾讯云在线终端·GitHub Actions = 唯一外部SSH",
|
|||
|
|
"hardening_layers": [
|
|||
|
|
"Layer1 协议层: PasswordAuthentication no（只允许公钥）",
|
|||
|
|
"Layer2 端口层: 22 → ZY_SERVER_SSH_PORT（自定义·降低被扫描概率）",
|
|||
|
|
"Layer3 封禁层: fail2ban zy-svr-002-sshd jail（失败3次→ban 72小时）",
|
|||
|
|
"Layer4 网络层: 腾讯云安全组·SSH入站仅允许GitHub Actions IP段"
|
|||
|
|
],
|
|||
|
|
"github_actions_ip_ranges": [
|
|||
|
|
"185.199.108.0/22",
|
|||
|
|
"140.82.112.0/20",
|
|||
|
|
"143.55.64.0/20",
|
|||
|
|
"参考: curl https://api.github.com/meta | jq .actions"
|
|||
|
|
],
|
|||
|
|
"workflow_ssh_pattern": "所有连接ZY-SVR-002的workflow通过ZY_SERVER_SSH_PORT Secret指定端口·默认fallback 22向后兼容"
|
|||
|
|
},
|
|||
|
|
"phases": [
|
|||
|
|
{
|
|||
|
|
"id": "ZY-PROJ-003-PHASE-1",
|
|||
|
|
"name": "配置文件准备 + workflow改造",
|
|||
|
|
"status": "in_progress",
|
|||
|
|
"started_at": "2026-04-16",
|
|||
|
|
"content": [
|
|||
|
|
"server/security/ssh-hardening/fail2ban-sshd.conf: SSH专用fail2ban jail",
|
|||
|
|
".github/workflows/harden-ssh-zy-svr-002.yml: 加固执行workflow（手动触发）",
|
|||
|
|
"更新所有连接ZY-SVR-002的workflow支持ZY_SERVER_SSH_PORT Secret",
|
|||
|
|
"受影响workflow: deploy-to-zhuyuan-server/deploy-awen-domain-proxy/deploy-proxy-service/staging-auto-deploy/proxy-dashboard-update/zhuyuan-deploy-observer/deploy-brain-proxy/deploy-cn-landing/deploy-to-cn-server/deploy-cn-llm-relay"
|
|||
|
|
],
|
|||
|
|
"next_step": "完成配置文件·提醒冰朔在GitHub Secrets中配置ZY_SERVER_SSH_PORT并在腾讯云控制台配置安全组"
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ZY-PROJ-003-PHASE-2",
|
|||
|
|
"name": "服务器实际执行",
|
|||
|
|
"status": "pending",
|
|||
|
|
"content": [
|
|||
|
|
"触发harden-ssh-zy-svr-002.yml",
|
|||
|
|
"服务器: 修改/etc/ssh/sshd_config端口和PasswordAuthentication",
|
|||
|
|
"服务器: 安装并启动fail2ban SSH jail",
|
|||
|
|
"验证: GitHub Actions仍能正常SSH连接"
|
|||
|
|
],
|
|||
|
|
"prerequisite": "冰朔需要先在GitHub Secrets中添加ZY_SERVER_SSH_PORT·然后在腾讯云控制台安全组配置SSH白名单"
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ZY-PROJ-003-PHASE-3",
|
|||
|
|
"name": "全链路验证",
|
|||
|
|
"status": "pending",
|
|||
|
|
"content": [
|
|||
|
|
"触发deploy-to-zhuyuan-server.yml验证新端口SSH连接正常",
|
|||
|
|
"确认fail2ban zy-svr-002-sshd jail在运行",
|
|||
|
|
"确认端口22上的扫描流量消失",
|
|||
|
|
"确认腾讯云在线终端仍然可用"
|
|||
|
|
]
|
|||
|
|
}
|
|||
|
|
],
|
|||
|
|
"fixes": [],
|
|||
|
|
"modules_used": [
|
|||
|
|
"server/setup/zhuyuan-server-init.sh",
|
|||
|
|
"server/proxy/config/server-registry.json",
|
|||
|
|
".github/workflows/deploy-to-zhuyuan-server.yml",
|
|||
|
|
".github/workflows/deploy-awen-domain-proxy.yml",
|
|||
|
|
".github/workflows/deploy-proxy-service.yml",
|
|||
|
|
".github/workflows/staging-auto-deploy.yml",
|
|||
|
|
".github/workflows/proxy-dashboard-update.yml",
|
|||
|
|
".github/workflows/zhuyuan-deploy-observer.yml",
|
|||
|
|
".github/workflows/deploy-brain-proxy.yml",
|
|||
|
|
".github/workflows/deploy-cn-landing.yml",
|
|||
|
|
".github/workflows/deploy-to-cn-server.yml",
|
|||
|
|
".github/workflows/deploy-cn-llm-relay.yml"
|
|||
|
|
],
|
|||
|
|
"required_secrets": [
|
|||
|
|
{
|
|||
|
|
"name": "ZY_SERVER_SSH_PORT",
|
|||
|
|
"description": "ZY-SVR-002自定义SSH端口·默认22向后兼容·建议设置为非标准端口如2222或其他",
|
|||
|
|
"status": "not_yet_configured",
|
|||
|
|
"action_required": "冰朔在GitHub → Settings → Secrets → Actions → New repository secret"
|
|||
|
|
}
|
|||
|
|
],
|
|||
|
|
"manual_steps_for_bingshuo": [
|
|||
|
|
"1. 在GitHub Secrets中添加 ZY_SERVER_SSH_PORT（值：你选择的自定义端口号）",
|
|||
|
|
"2. 在腾讯云控制台 → 轻量应用服务器 → ZY-SVR-002 → 防火墙",
|
|||
|
|
"3. 删除22端口的全局SSH规则",
|
|||
|
|
"4. 添加新端口的SSH规则·来源IP填GitHub Actions的IP段",
|
|||
|
|
"5. 添加新端口的SSH规则·来源IP填100.64.0.0/10（腾讯内网·保证在线终端可用）",
|
|||
|
|
"6. 触发 harden-ssh-zy-svr-002.yml workflow执行服务器端加固"
|
|||
|
|
],
|
|||
|
|
"next_step": "完成fail2ban-sshd.conf和harden-ssh-zy-svr-002.yml配置文件·更新所有相关workflow支持ZY_SERVER_SSH_PORT·然后提醒冰朔配置Secret和安全组",
|
|||
|
|
"status": "in_progress",
|
|||
|
|
"current_phase": "ZY-PROJ-003-PHASE-1"
|
|||
|
|
}
|