Native VPS reinforcement protection method and device in public network environment

Abstract

The invention provides a native VPS reinforcement and protection method in a public network environment, and the method comprises the steps: obtaining a target host to be reinforced and protected, constructing a preposed bastion network for the target host, carrying out the deep safety baseline inspection of the target host, guaranteeing that the target host is a high-safety machine initially, carrying out the reinforcement and protection of the target host, and carrying out the protection of the target host. Comprising the steps of secondary login verification configuration, real log hiding, detection and closing / unloading of dangerous services which cannot be used in the system, and detection of the reinforcement protection effect of the target host.

Description

Technical Field

[0001] The present invention relates to the field of Linux host security defense, and in particular to a native VPS reinforcement protection method and device exposed to a public network environment. Background Art

[0002] With the increasing development of Internet technology, the flexibility and scalability of VPS cloud hosts have made them widely used in various aspects, not limited to personal life, work and corporate operations. VPS can meet different needs and provide higher performance and control. In the public network, while we enjoy the convenience brought by VPS, our VPS may also be used by cybercrime organizations to carry out network attacks with the help of the compromised VPS. In order to protect the security of VPS on the public network and prevent cybercrime organizations from network attacks, security experts will conduct security compliance baseline checks on VPS or deploy HIDS.

[0003] Baseline inspection refers to the minimum security standards that server equipment configuration must meet in order to meet network security specifications, so as to verify whether the server is vulnerable to access and exploitation by cybercrime organizations. Traditional baseline inspections include accounts, passwords, logs, authentication and authorization compliance configurations on the server, but traditional baseline inspections have little effect on protecting VPSs exposed to the public Internet. Under the multiple attack methods of cybercrime organizations, it is impossible to effectively counter and protect, and the inspection strategy may also be modified.

[0004] HIDS (Host Intrusion Detection System) is a security technology that focuses on monitoring and analyzing activities on a computer host or server to detect suspicious malicious activities. HIDS is not suitable for all VPS usage scenarios, such as personal VPS, small businesses, etc., which will cause a waste of resources, and HIDS is biased towards monitoring and cannot block malicious behavior.

[0005] However, traditional baseline checks are too weak in their ability to perceive the behaviors of cybercrime organizations, such as deleting logs, stealing data, hiding Trojans, inserting backdoors, etc., and cannot improve the efficiency of security experts' emergency response after a server compromise.

[0006] Therefore, with the increasing demand for VPS use, we need a security protection technology that can not only maximize the security of native VPS, but also improve the response efficiency and countermeasures of emergency personnel in the face of the endless attacks and hidden means of cybercrime organizations. Summary of the invention

[0007] The main purpose of this invention is to propose a technical method for avoiding resource abuse and maximizing the security reinforcement of native VPS, so as to solve the problems of inapplicability and insufficient security of traditional baseline checks, HIDS and other solutions.

[0008] To achieve the above object, the present invention provides a native VPS reinforcement protection method in a public network environment, comprising: S1. Obtain the target host to be reinforced and protected, and build a front-end bastion network for the target host; The step of obtaining a target host to be reinforced and protected, and setting a front bastion network for the target host, specifically includes: S11. Based on the OpenVPN suite, a communication tunnel that needs to be authenticated is constructed as a front-end bastion network. The front-end bastion network is composed of one or more VPSs. After the construction is successful, the account and certificate information of the front-end bastion network will be returned. S12. Obtain the target host to be reinforced and protected, block all connections and exit networks of the target host through the IPTABLES component, and introduce all network connection requests for the target host into the communication tunnel of the front bastion network.

[0009] S2. Performing a deep security baseline check on the target host to ensure that the target host is initially a high-security machine; The security policy configuration of the target host to ensure that the target host is initially a high-security machine specifically includes: S21, performing a security check on the target host, and setting the password standard of the target host to a random 20-digit number containing special characters, letters, and numbers; S22, setting a kernel vulnerability check update policy, a security source replacement policy, and a network exit blocking policy for the target host to ensure that the target host is a high-security machine initially.

[0010] The kernel vulnerability check and update policy refers to a series of measures and processes used to ensure that the kernel of the operating system is kept up to date to fix known vulnerabilities and defects. The security source replacement policy is used to regularly replace or update the source used to obtain security information and updates in network security management. The network exit blocking policy is a set of measures used to prevent malicious traffic from being transmitted from the internal network to the external network and limit unnecessary network traffic.

[0011] S3, strengthening the protection of the target host, including secondary login verification configuration, hiding the real log, detecting and closing / uninstalling the dangerous services that come with the system and will not be used; The secondary login verification configuration includes installing the Google-Authenticator suite, automatically configuring the / home / user / .google_authenticator, / etc / pam.d / sshd and / etc / ssh / sshd_conf files, and returning a dynamic verification code binding code. After the system administrator installs the Google-Authenticator program on the mobile phone, he or she can enter the binding code to complete the deployment.

[0012] The real log hiding includes hiding the history, rsyslogd and auditd logs in the target host to avoid being deleted by the cybercrime organization, thereby ensuring that the behavior of the cybercrime organization is recorded.

[0013] The detecting and closing / uninstalling the dangerous services that come with the system and will not be used includes detecting and closing / uninstalling cups and telnet services.

[0014] S4. Detect the reinforcement protection effect of the target host.

[0015] The detecting of the reinforcement protection effect of the target host includes: S41, verify whether the target host can be connected without passing the front bastion network, whether the secondary login verification is successfully set, whether the history, rsyslogd and auditd logs are hidden, and whether the cups and telnet services are closed / uninstalled.

[0016] S42: After the verification is passed, it indicates that the target host has been successfully hardened.

[0017] The present invention also proposes a native VPS reinforcement protection device in a public network environment, including a processor and a memory, wherein the memory stores computer program code, and is characterized in that when the computer program code is executed by the processor, the steps of the native VPS reinforcement protection method in the public network environment are implemented.

[0018] The present invention also proposes a computer-readable storage medium having computer program code stored thereon, characterized in that when the computer program code is executed by a processor, the steps of a native VPS reinforcement protection method in a public network environment are implemented.

[0019] The beneficial effects of the present invention include: (1) introducing the front-end bastion network technology to introduce all network connection requests for the target host into the communication tunnel of the front-end bastion network, thereby improving the overall security of the VPS exposed to the public network. (2) By configuring the target host for secondary login verification, hiding the real log, and detecting and shutting down / uninstalling the dangerous services that come with the system and will not be used, native VPS reinforcement protection is achieved, significantly improving the security of the VPS. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0021] The present invention involves technical terms such as native VPS, front-end bastion network, public network, etc. For the convenience of understanding, it is necessary to briefly explain the above terms. The applicant declares that the following description is only a technical explanation and not a limitation on the protection scope of the present invention.

[0022] Among them, VPS (Virtual Private Server) is a server-based virtualization technology. It is achieved by dividing a physical server into multiple independent virtual servers. Each virtual server has its own operating system, resources (such as CPU, memory, storage space and bandwidth) and complete system permissions, providing users with a similar experience to that of an independent server. Native VPS refers to a VPS whose physical geographical location of its server room is consistent with the registration location of the IP address. The characteristics of native VPS include: Geographic consistency: the native IP address matches the physical location of the VPS. Price: Native IPs usually cost more. Application scenarios: Suitable for specific services with strict requirements on geographical location. Network experience: In specific scenarios, such as accessing services restricted by geographical location, native IP may have advantages. Native VPS is particularly suitable for application scenarios with high requirements on network performance and security due to its unique geographical location matching, performance advantages, network control capabilities and higher security.

[0023] Pre-Bastion Host is a concept in network security architecture, which refers to one or more security layers set up in the network as the first line of defense to enter the internal network. Pre-Bastion Host has the following functions: Security isolation: Pre-Bastion Host is located between the internal network and the external network (usually the Internet), which plays an isolation role and prevents the external network from directly accessing internal resources. Access control: It is usually configured with strict access control policies, allowing only authenticated and authorized users or systems to access the internal network. Service restriction: Pre-Bastion Host usually only runs necessary services, and these services are all security-hardened to reduce potential attack surfaces. Logging and monitoring: Pre-Bastion Host will record all connection attempts and activities through it for security monitoring and auditing. Single entry point: As a single point of entry to the internal network, Pre-Bastion Host makes security management more centralized and easy to monitor and control. Defensive measures: Pre-Bastion Host may be configured with firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS) and other security measures to enhance its defense capabilities.

[0024] Public network, full name public network, refers to the network open to the public and accessible to anyone. In Internet technology, public network refers to the part of the network directly connected to the Internet, which allows users to access network resources and services worldwide through Internet service providers (ISPs).

[0025] The OpenVPN suite is an open source virtual private network (VPN) solution that allows users to securely connect to a remote server or network through an encrypted channel.

[0026] IPTABLES is a very important component in the Linux operating system. It provides a command-line tool for configuring network layer packet filtering and NAT (Network Address Translation). IPTABLES is part of the netfilter project, which is a framework in the Linux kernel that manages the processing and forwarding of network packets.

[0027] The present invention provides a native VPS reinforcement protection method in a public network environment, wherein the native VPS is installed with a Linux operating system, comprising: S1. Obtain the target host to be reinforced and protected, and build a front-end bastion network for the target host; The step of obtaining a target host to be reinforced and protected, and setting a front bastion network for the target host, specifically includes: S11. Based on the OpenVPN suite, a communication tunnel that needs to be authenticated is constructed as a front-end bastion network. The front-end bastion network is composed of one or more VPSs. After the construction is successful, the account and certificate information of the front-end bastion network will be returned. S12. Obtain the target host to be reinforced and protected, block all connections and exit networks of the target host through the IPTABLES component, and introduce all network connection requests for the target host into the communication tunnel of the front bastion network.

[0028] S2. Performing a deep security baseline check on the target host to ensure that the target host is initially a high-security machine; The security policy configuration of the target host to ensure that the target host is initially a high-security machine specifically includes: S21, performing a security check on the target host, and setting the password standard of the target host to a random 20-digit number containing special characters, letters, and numbers; S22, setting a kernel vulnerability check update policy, a security source replacement policy, and a network exit blocking policy for the target host to ensure that the target host is a high-security machine initially.

[0029] The kernel vulnerability check and update policy refers to a series of measures and processes used to ensure that the kernel of the operating system is kept up to date to fix known vulnerabilities and defects. The security source replacement policy is used to regularly replace or update the source used to obtain security information and updates in network security management. The network exit blocking policy is a set of measures used to prevent malicious traffic from being transmitted from the internal network to the external network and limit unnecessary network traffic.

[0030] S3, strengthening the protection of the target host, including secondary login verification configuration, hiding the real log, detecting and closing / uninstalling the dangerous services that come with the system and will not be used; The secondary login verification configuration includes installing the Google-Authenticator suite, automatically configuring the / home / user / .google_authenticator, / etc / pam.d / sshd and / etc / ssh / sshd_conf files, and returning a dynamic verification code binding code. After the system administrator installs the Google-Authenticator program on the mobile phone, he or she can enter the binding code to complete the deployment.

[0031] Google Authenticator is a two-factor authentication (2FA) tool based on the time-based one-time password (TOTP) algorithm. It enhances account security by generating a six-digit code that changes every 30 seconds. When users log in to a service, in addition to entering their username and password, they also need to enter a dynamic verification code generated by Google Authenticator, so that even if the password is leaked, attackers cannot access the user's account without this dynamic code. Google Authenticator can be installed on smartphones as a mobile application or used on hardware tokens that support this function.

[0032] The real log hiding includes hiding the history, rsyslogd and auditd logs in the target host to avoid being deleted by the cybercrime organization, thereby ensuring that the behavior of the cybercrime organization is recorded.

[0033] The history log is used in the Linux system to record the history of commands executed by users in the terminal. It can help users review previous work steps or find used commands; rsyslogd is a powerful logging system that is responsible for collecting, storing and forwarding system logs, including kernel messages, service logs and custom application logs, for monitoring and troubleshooting; auditd is an audit daemon that records various security-related events that occur in the system, such as user authentication, file access and network connection, etc. It aims to provide a means to detect and track abnormal activities in the system to ensure system security and compliance.

[0034] The detecting and closing / uninstalling the dangerous services that come with the system and will not be used includes detecting and closing / uninstalling cups and telnet services.

[0035] CUPS (Common Unix Printing System) is a common printing system in Unix-like operating systems. It provides a cross-platform printing solution that allows users to manage print tasks and printer configurations through the standard Internet Printing Protocol (IPP). It supports the management of multiple printers and print queues and is the default printing service in modern Linux systems. Telnet service is an earlier Internet protocol used to provide two-way interactive text communication sessions on the network. It allows users to connect to remote servers through Telnet clients and perform command line interface operations. However, due to its clear text data transmission characteristics, Telnet service has security flaws. Therefore, in modern network environments, it is usually recommended to use the more secure SSH (Secure Shell) protocol instead.

[0036] S4. Detect the reinforcement protection effect of the target host.

[0037] The detecting of the reinforcement protection effect of the target host includes: S41, verify whether the target host can be connected without passing the front bastion network, whether the secondary login verification is successfully set, whether the history, rsyslogd and auditd logs are hidden, and whether the cups and telnet services are closed / uninstalled.

[0038] S42: After the verification is passed, it indicates that the target host has been successfully hardened.

[0039] The present invention also proposes a native VPS reinforcement protection device in a public network environment, including a processor and a memory, wherein the memory stores computer program code, and is characterized in that when the computer program code is executed by the processor, the steps of the native VPS reinforcement protection method in the public network environment are implemented.

[0040] The present invention also proposes a computer-readable storage medium having computer program code stored thereon, characterized in that when the computer program code is executed by a processor, the steps of a native VPS reinforcement protection method in a public network environment are implemented.

[0041] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A native VPS reinforcement protection method in a public network environment, comprising: S1. Obtain the target host to be reinforced and protected, and build a front-end bastion network for the target host; S2. Performing a deep security baseline check on the target host to ensure that the target host is initially a high-security machine; S3, strengthening the protection of the target host, including secondary login verification configuration, hiding the real log, detecting and closing / uninstalling the dangerous services that come with the system and will not be used; S4. Detect the reinforcement protection effect of the target host.

2. The method according to claim 1, characterized in that The step of obtaining a target host to be reinforced and protected, and setting a front bastion network for the target host, specifically includes: S11. Based on the OpenVPN suite, a communication tunnel that needs to be authenticated is constructed as a front-end bastion network. The front-end bastion network is composed of one or more VPSs. After the construction is successful, the account and certificate information of the front-end bastion network will be returned. S12. Obtain the target host to be reinforced and protected, block all connections and exit networks of the target host through the IPTABLES component, and introduce all network connection requests for the target host into the communication tunnel of the front bastion network.

3. The method according to claim 1, characterized in that The security policy configuration of the target host to ensure that the target host is initially a high-security machine specifically includes: S21, performing a security check on the target host, and setting the password standard of the target host to a random 20-digit number containing special characters, letters, and numbers; S22, setting a kernel vulnerability check update policy, a security source replacement policy, and a network exit blocking policy for the target host to ensure that the target host is a high-security machine initially.

4. The method according to claim 3, characterized in that in, The kernel vulnerability check and update strategy refers to a series of measures and processes used to ensure that the kernel of the operating system is kept up to date to fix known vulnerabilities and defects; The security source replacement strategy is used to regularly replace or update the source used to obtain security information and updates in network security management; The network exit blocking policy is a set of measures used to prevent malicious traffic from being transmitted from the internal network to the external network and to limit unnecessary network traffic.

5. The method according to claim 1, characterized in that The secondary login verification configuration includes installing the Google-Authenticator suite, automatically configuring the / home / user / .google_authenticator, / etc / pam.d / sshd and / etc / ssh / sshd_conf files, and returning a dynamic verification code binding code. After the system administrator installs the Google-Authenticator program on the mobile phone, he or she can enter the binding code to complete the deployment.

6. The method according to claim 5, characterized in that The real log hiding includes hiding the history, rsyslogd and auditd logs in the target host to avoid being deleted by the cybercrime organization, thereby ensuring that the behavior of the cybercrime organization is recorded; the detection and closing / uninstalling of dangerous services that are not used by the system includes detecting and closing / uninstalling cups and telnet services.

7. The method according to claim 1, characterized in that Also includes: The detecting of the reinforcement protection effect of the target host includes: S41, verify whether the target host can be connected without passing the front bastion network, whether the secondary login verification is successfully set, whether the history, rsyslogd and auditd logs are hidden, and whether the cups and telnet services are closed / uninstalled; S42: After the verification is passed, it indicates that the target host has been successfully hardened.

8. A native VPS reinforcement protection device in a public network environment, comprising a processor and a memory, wherein the memory stores a computer program code, characterized in that: When the computer program code is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program code stored thereon, characterized in that: When the computer program code is executed, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product, comprising computer program code, characterized in that: When the computer program code is executed, the steps of the method according to any one of claims 1 to 7 are implemented.

Images