132 lines
2.8 KiB
Markdown
132 lines
2.8 KiB
Markdown
---
|
||
sidebar_position: 8
|
||
title: 安全最佳实践
|
||
description: ZHub 安全配置和最佳实践指南
|
||
---
|
||
|
||
# 安全最佳实践
|
||
|
||
ZHub 安全配置和最佳实践指南，帮助您构建安全的分布式系统。
|
||
|
||
## 认证和授权
|
||
|
||
### 启用权限验证
|
||
|
||
**服务端配置**：
|
||
```ini
|
||
# app.ini - 生产环境配置
|
||
[service]
|
||
auth=1 # 生产环境必须开启连接授权
|
||
```
|
||
|
||
:::warning 重要安全提醒
|
||
**生产环境强烈建议开启权限验证**：
|
||
- 关闭权限验证 (`auth=0`) 意味着任何客户端都可以无限制访问所有主题
|
||
- 即使在内网环境，也存在内部威胁、误操作、配置错误等风险
|
||
- 仅在完全隔离的开发测试环境可考虑关闭权限验证
|
||
:::
|
||
|
||
**客户端配置**：
|
||
```java
|
||
// 使用认证令牌连接
|
||
ZHubClient zhub = new ZHubClient(
|
||
"127.0.0.1:1216",
|
||
"group1",
|
||
"app1",
|
||
"your-secure-token"
|
||
);
|
||
```
|
||
|
||
### 权限配置
|
||
|
||
**最小权限原则**：
|
||
```yaml
|
||
# auth.yml
|
||
users:
|
||
- id: 1
|
||
username: "user-service"
|
||
password: "secure-password"
|
||
status: "active"
|
||
groups: ["user-service"]
|
||
reads: ["user.*"] # 只读用户相关主题
|
||
writes: ["user.*"] # 只写用户相关主题
|
||
|
||
- id: 2
|
||
username: "order-service"
|
||
password: "secure-password"
|
||
status: "active"
|
||
groups: ["order-service"]
|
||
reads: ["order.*", "user.basic.*"] # 只读订单和用户基础信息
|
||
writes: ["order.*"] # 只写订单相关主题
|
||
```
|
||
|
||
**权限隔离**：
|
||
```yaml
|
||
# 不同团队权限隔离
|
||
groups:
|
||
- name: "user-team"
|
||
description: "用户服务团队"
|
||
reads: ["user.*"]
|
||
writes: ["user.*"]
|
||
|
||
- name: "order-team"
|
||
description: "订单服务团队"
|
||
reads: ["order.*", "user.basic.*"]
|
||
writes: ["order.*"]
|
||
|
||
- name: "admin-team"
|
||
description: "管理员团队"
|
||
reads: ["*"]
|
||
writes: ["*"]
|
||
```
|
||
|
||
## 网络安全
|
||
|
||
### 网络隔离
|
||
|
||
**内网部署**：
|
||
```ini
|
||
# app.ini - 只监听内网地址
|
||
[service]
|
||
watch=192.168.1.100:711 # 管理端口只监听内网
|
||
addr=192.168.1.100:1216 # 服务端口只监听内网
|
||
```
|
||
|
||
**防火墙配置**：
|
||
```bash
|
||
# 只允许内网访问
|
||
iptables -A INPUT -p tcp --dport 1216 -s 192.168.1.0/24 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 711 -s 192.168.1.0/24 -j ACCEPT
|
||
iptables -A INPUT -p tcp --dport 1216 -j DROP
|
||
iptables -A INPUT -p tcp --dport 711 -j DROP
|
||
```
|
||
|
||
|
||
## 监控
|
||
|
||
### 基础监控
|
||
|
||
**服务状态监控**：
|
||
```bash
|
||
# 检查服务状态
|
||
curl http://127.0.0.1:711/_/info
|
||
|
||
# 检查权限配置
|
||
curl http://127.0.0.1:711/auth/reload
|
||
```
|
||
|
||
## 最佳实践
|
||
|
||
### 安全配置检查清单
|
||
|
||
- [ ] 启用认证和授权 (`auth=1`)
|
||
- [ ] 配置最小权限原则
|
||
- [ ] 实施网络隔离
|
||
- [ ] 启用访问日志
|
||
- [ ] 定期安全审计
|
||
|
||
### 定期维护
|
||
|
||
- 定期检查权限配置
|
||
- 定期更新认证令牌
|
||
- 监控服务状态和连接情况 |