Files
rancher-docs/zh/pages-for-subheaders/rancher-security.html
T

24 lines
30 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="zh" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-pages-for-subheaders/rancher-security">
<head>
<meta charset="UTF-8">
<meta name="generator" content="Docusaurus v2.2.0">
<title data-rh="true">安全 | Rancher Manager</title><meta data-rh="true" name="viewport" content="width=device-width,initial-scale=1"><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/rancher-security"><meta data-rh="true" name="docusaurus_locale" content="zh"><meta data-rh="true" name="docsearch:language" content="zh"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="安全 | Rancher Manager"><meta data-rh="true" name="description" content="安全策略"><meta data-rh="true" property="og:description" content="安全策略"><link data-rh="true" rel="icon" href="/zh/img/favicon.png"><link data-rh="true" rel="canonical" href="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/rancher-security"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-security" hreflang="en"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/zh/pages-for-subheaders/rancher-security" hreflang="zh"><link data-rh="true" rel="alternate" href="http://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-security" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/zh/opensearch.xml">
<!-- Google Tag Manager -->
<script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
<!-- End Google Tag Manager -->
<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/zh/assets/css/styles.19303192.css">
<link rel="preload" href="/zh/assets/js/runtime~main.ee5c32f6.js" as="script">
<link rel="preload" href="/zh/assets/js/main.bc269412.js" as="script">
</head>
<body class="navigation-with-keyboard">
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region" aria-label="跳到主要内容"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">跳到主要内容</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/zh/"><div class="navbar__logo"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/zh/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/zh/">v2.7</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/zh/pages-for-subheaders/rancher-security">v2.7</a></li><li><a class="dropdown__link" href="/zh/v2.6/pages-for-subheaders/rancher-security">v2.6</a></li><li><a class="dropdown__link" href="/zh/v2.5/pages-for-subheaders/rancher-security">v2.5</a></li><li><a class="dropdown__link" href="/zh/v2.0-v2.4/pages-for-subheaders/rancher-security">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/zh/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>简体中文</a><ul class="dropdown__menu"><li><a href="/pages-for-subheaders/rancher-security" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="en">English</a></li><li><a href="/zh/pages-for-subheaders/rancher-security" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="搜索"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">搜索</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="回到顶部" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/">什么是 Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/getting-started/overview">开始使用</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/pages-for-subheaders/new-user-guides">操作指南</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/zh/pages-for-subheaders/best-practices">参考指南</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/best-practices">最佳实践</a><button aria-label="打开/收起侧边栏菜单「最佳实践」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-manager-architecture">Rancher Manager 架构</a><button aria-label="打开/收起侧边栏菜单「Rancher Manager 架构」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cluster-configuration">集群配置</a><button aria-label="打开/收起侧边栏菜单「集群配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/single-node-rancher-in-docker">Docker 中的单节点 Rancher</a><button aria-label="打开/收起侧边栏菜单「Docker 中的单节点 Rancher」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/backup-restore-configuration">备份和恢复配置</a><button aria-label="打开/收起侧边栏菜单「备份和恢复配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/kubernetes-concepts">Kubernetes 概念</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/monitoring-v2-configuration">Monitoring V2 配置</a><button aria-label="打开/收起侧边栏菜单「Monitoring V2 配置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/prometheus-federator">Prometheus Federator</a><button aria-label="打开/收起侧边栏菜单「Prometheus Federator」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/user-settings">用户设置</a><button aria-label="打开/收起侧边栏菜单「用户设置」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/cli-with-rancher">Rancher CLI</a><button aria-label="打开/收起侧边栏菜单「Rancher CLI」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/about-the-api">关于 API</a><button aria-label="打开/收起侧边栏菜单「关于 API」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-cluster-tools">集群工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-project-tools">项目工具:Logging,Monitoring 和可视化</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/system-tools">系统工具</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rke1-template-example-yaml">RKE1 示例 YAML</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible menu__list-item-collapsible--active"><a class="menu__link menu__link--sublist menu__link--active" aria-current="page" aria-expanded="true" tabindex="0" href="/zh/pages-for-subheaders/rancher-security">Rancher 安全</a><button aria-label="打开/收起侧边栏菜单「Rancher 安全」" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-v2.6-hardening-guides">Rancher 2.6 强化指南</a><button aria-label="打开/收起侧边栏菜单「Rancher 2.6 强化指南」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/rancher-v2.7-hardening-guides">Rancher v2.7 Hardening Guides</a><button aria-label="打开/收起侧边栏菜单「Rancher v2.7 Hardening Guides」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/zh/pages-for-subheaders/selinux-rpm">SELinux RPM</a><button aria-label="打开/收起侧边栏菜单「SELinux RPM」" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-security/kubernetes-security-best-practices">Kubernetes 安全最佳实践</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link" tabindex="0" href="/zh/reference-guides/rancher-security/security-advisories-and-cves">安全公告和 CVE</a></li></ul></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/pages-for-subheaders/cloud-marketplace">Rancher 中的集成</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/faq/general-faq">常见问题</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/zh/troubleshooting/general-troubleshooting">故障排除</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/zh/contribute-to-rancher">参与 Rancher 社区贡献</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_VOVn"><div class="docItemContainer_Djhp"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="页面路径"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="主页面" class="breadcrumbs__link" href="/zh/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">参考指南</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Rancher 安全</span><meta itemprop="position" content="2"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">版本:v2.7</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">本页总览</button></div><div class="theme-doc-markdown markdown"><header><h1>安全</h1></header><table width="100%"><tr style="vertical-align:top"><td width="30%" style="border:none"><h4>安全策略</h4><p style="padding:8px">Rancher Labs 会负责任地披露问题,并致力于在合理的时间内解决所有问题。 </p></td><td width="30%" style="border:none"><h4>报告过程</h4><p style="padding:8px">请将安全问题发送至 <a href="mailto:security-rancher@suse.com" target="_blank" rel="noopener noreferrer">security-rancher@suse.com</a>。</p></td><td width="30%" style="border:none"><h4>公告</h4><p style="padding:8px">订阅 <a href="https://forums.rancher.com/c/announcements" target="_blank" rel="noopener noreferrer">Rancher 公告论坛</a>以获取版本更新。</p></td></tr></table><p>安全是 Rancher 全部功能的基础。Rancher 集成了全部主流身份验证工具和服务,并提供了企业级的 <a href="/zh/pages-for-subheaders/manage-role-based-access-control-rbac">RBAC 功能</a>,让你的 Kubernetes 集群更加安全。</p><p>本文介绍了安全相关的文档以及资源,让你的 Rancher 安装和下游 Kubernetes 集群更加安全。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="neuvector-与-rancher-的集成">NeuVector 与 Rancher 的集成<a class="hash-link" href="#neuvector-与-rancher-的集成" title="标题的直接链接">​</a></h3><p><em>2.6.5 的新功能</em></p><p>NeuVector 是一个开源的、以容器为中心的安全应用程序,现已集成到 Rancher 中。NeuVector 提供生产安全、DevOps 漏洞保护和容器防火墙等功能。请参阅 <a href="/zh/integrations-in-rancher/neuvector">Rancher 文档</a>和 <a href="https://open-docs.neuvector.com/" target="_blank" rel="noopener noreferrer">NeuVector 文档</a>了解更多信息。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="在-kubernetes-集群上运行-cis-安全扫描">在 Kubernetes 集群上运行 CIS 安全扫描<a class="hash-link" href="#在-kubernetes-集群上运行-cis-安全扫描" title="标题的直接链接">​</a></h3><p>Rancher 使用 <a href="https://github.com/aquasecurity/kube-bench" target="_blank" rel="noopener noreferrer">kube-bench</a> 来运行安全扫描,从而检查 Kubernetes 是否按照 <a href="https://www.cisecurity.org/cis-benchmarks/" target="_blank" rel="noopener noreferrer">CIS</a>(Center for Internet Security,互联网安全中心)Kubernetes Benchmark 中定义的安全最佳实践进行部署。</p><p>CIS Kubernetes Benchmark 是一个参考文档,用于为 Kubernetes 建立安全配置基线。</p><p>CIS 是一个 501(c<!-- -->)<!-- -->(3) 非营利组织,成立于 2000 年 10 月,其使命是识别、开发、验证、促进和维持网络防御的最佳实践方案,并建立和指导社区,以在网络空间中营造信任的环境。</p><p>CIS Benchmark 是目标系统安全配置的最佳实践。CIS Benchmark 是由安全专家、技术供应商、公开和私人社区成员,以及 CIS Benchmark 开发团队共同志愿开发的。</p><p>Benchmark 提供两种类型的建议,分别是自动(Automated)和手动(Manual)。我们只运行 Automated 相关的测试。</p><p>Rancher 在集群上运行 CIS 安全扫描时会生成一份报告,该报告会显示每个测试的结果,包括测试概要以及 <code>passed</code>、<code>skipped</code> 和 <code>failed</code> 的测试数量。报告还包括失败测试的修正步骤。</p><p>有关详细信息,请参阅<a href="/zh/pages-for-subheaders/cis-scan-guides">安全扫描</a>。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="selinux-rpm">SELinux RPM<a class="hash-link" href="#selinux-rpm" title="标题的直接链接">​</a></h3><p><a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux" target="_blank" rel="noopener noreferrer">安全增强型 Linux (SELinux)</a> 是对 Linux 的安全增强。被政府机构使用之后,SELinux 已成为行业标准,并在 CentOS 7 和 8 上默认启用。</p><p>我们提供了 <code>rancher-selinux</code> 和 <code>rke2-selinux</code> 两个 RPM(Red Hat 软件包),让 Rancher 产品能够在 SELinux 主机上正常运行。有关详细信息,请参阅<a href="/zh/pages-for-subheaders/selinux-rpm">此页面</a>。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="rancher-强化指南">Rancher 强化指南<a class="hash-link" href="#rancher-强化指南" title="标题的直接链接">​</a></h3><p>Rancher 强化指南基于 <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank" rel="noopener noreferrer">CIS Kubernetes Benchmark</a>。</p><p>强化指南为强化 Rancher 的生产安装提供了说明性指导。有关安全管控的完整列表,请参阅 Rancher 的 <a href="#cis-benchmark-%E5%92%8C%E8%87%AA%E6%88%91%E8%AF%84%E4%BC%B0">CIS Kubernetes Benchmark自我评估指南</a>。</p><blockquote><p>强化指南描述了如何保护集群中的节点,建议在安装 Kubernetes 之前参考强化指南中的步骤。</p></blockquote><p>每个强化指南版本都针对特定的 CIS Kubernetes Benchmark、Kubernetes 和 Rancher 版本。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="cis-benchmark-和自我评估">CIS Benchmark 和自我评估<a class="hash-link" href="#cis-benchmark-和自我评估" title="标题的直接链接">​</a></h3><p>Benchmark 自我评估是 Rancher 安全强化指南的辅助。强化指南展示了如何强化集群,而 Benchmark 指南旨在帮助你评估强化集群的安全级别。</p><p>由于 Rancher 和 RKE 将 Kubernetes 服务安装为 Docker 容器,因此 CIS Kubernetes Benchmark 中的许多管控验证检查都不适用。本指南将介绍各种管控,并提供更新的示例命令来审核 Rancher 创建的集群的合规性。你可以前往 <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank" rel="noopener noreferrer">CIS 网站</a>下载原始的 Benchmark 文档。</p><p>Rancher 每个版本的自我评估指南都对应特定的强化指南、Rancher、Kubernetes 和 CIS Benchmark 版本。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="第三方渗透测试报告">第三方渗透测试报告<a class="hash-link" href="#第三方渗透测试报告" title="标题的直接链接">​</a></h3><p>Rancher 会定期聘请第三方对 Rancher 2.x 软件栈进行安全审核和渗透测试。测试环境会遵循 Rancher 提供的强化指南。测试结果会在第三方确认我们已经修复了 MEDIUM 或以上的问题后发布。</p><p>结果:</p><ul><li><a href="https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf" target="_blank" rel="noopener noreferrer">Cure53 渗透测试 - 2019 年 7 月</a></li><li><a href="https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf" target="_blank" rel="noopener noreferrer">Untamed Theory 渗透测试 - 2019 年 3 月</a></li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="rancher-安全公告和-cve">Rancher 安全公告和 CVE<a class="hash-link" href="#rancher-安全公告和-cve" title="标题的直接链接">​</a></h3><p>Rancher 致力于向社区披露我们产品的安全问题。有关我们已解决问题的 CVE(Common Vulnerabilities and Exposures,通用漏洞披露)列表,请参阅<a href="/zh/reference-guides/rancher-security/security-advisories-and-cves">此页面</a>。</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="kubernetes-安全最佳实践">Kubernetes 安全最佳实践<a class="hash-link" href="#kubernetes-安全最佳实践" title="标题的直接链接">​</a></h3><p>有关保护 Kubernetes 集群的建议,请参阅 <a href="/zh/reference-guides/rancher-security/kubernetes-security-best-practices">Kubernetes 安全最佳实践指南</a>。</p></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/pages-for-subheaders/rancher-security.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_Z9Sw" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>编辑此页</a></div><div class="col lastUpdated_vwxv"><span class="theme-last-updated">最后<!-- -->于 <b><time datetime="2022-10-25T20:41:06.000Z">2022年10月25日</time></b> <!-- -->更新</span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="文档分页导航"><a class="pagination-nav__link pagination-nav__link--prev" href="/zh/reference-guides/rke1-template-example-yaml"><div class="pagination-nav__sublabel">上一页</div><div class="pagination-nav__label">RKE1 示例 YAML</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/zh/pages-for-subheaders/rancher-v2.6-hardening-guides"><div class="pagination-nav__sublabel">下一页</div><div class="pagination-nav__label">Rancher 2.6 的自我评估和强化指南</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#neuvector-与-rancher-的集成" class="table-of-contents__link toc-highlight">NeuVector 与 Rancher 的集成</a></li><li><a href="#在-kubernetes-集群上运行-cis-安全扫描" class="table-of-contents__link toc-highlight">在 Kubernetes 集群上运行 CIS 安全扫描</a></li><li><a href="#selinux-rpm" class="table-of-contents__link toc-highlight">SELinux RPM</a></li><li><a href="#rancher-强化指南" class="table-of-contents__link toc-highlight">Rancher 强化指南</a></li><li><a href="#cis-benchmark-和自我评估" class="table-of-contents__link toc-highlight">CIS Benchmark 和自我评估</a></li><li><a href="#第三方渗透测试报告" class="table-of-contents__link toc-highlight">第三方渗透测试报告</a></li><li><a href="#rancher-安全公告和-cve" class="table-of-contents__link toc-highlight">Rancher 安全公告和 CVE</a></li><li><a href="#kubernetes-安全最佳实践" class="table-of-contents__link toc-highlight">Kubernetes 安全最佳实践</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/zh/assets/js/runtime~main.ee5c32f6.js"></script>
<script src="/zh/assets/js/main.bc269412.js"></script>
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) --></body>
</html>