一.背景
之前文章maven项目容器化运行之1-基于1Panel软件将docker镜像构建能力分享给局域网_1panel 构建镜像-CSDN博客将1Panel软件的Doocker端口给到了局域网，安全组兄弟扫描认为是高危漏洞，可能导致攻击者获取对Docker主机的完全控制权。
二.修复的建议
安全组的兄弟给了修复建议：
高危2：Docker Engine API is accessible without authentication，可能导致攻击者获取对Docker主机的完全控制权
具体说明：
Docker守护进程配置不当，允许远程访问而没有适当的身份验证。Docker API端口（通常是2375或2376）暴露。防火墙规则不当，允许来自任何IP地址的连接到Docker API端口。可能导致未经授权访问和控制Docker容器。可能导致数据泄露、系统被入侵或被用于恶意目的（如挖矿）。攻击者可能利用此漏洞在主机上执行任意命令。
解决办法：
1.限制API访问：
默认情况下，禁用远程API访问。
如果需要远程访问，使用TLS加密和客户端证书认证。
2.配置Docker守护进程：
编辑Docker配置文件（通常在 /etc/docker/daemon.json）:
{
"tls": true,
"tlscert": "/path/to/server-cert.pem",
"tlskey": "/path/to/server-key.pem",
"tlsverify": true,
"tlscacert": "/path/to/ca.pem"
}
3.生成TLS证书：
使用OpenSSL生成CA、服务器和客户端证书。
4.配置防火墙：
限制只有特定IP地址可以访问Docker API端口。
使用 iptables 或云服务提供商的安全组设置。
5.使用Unix Socket：
如果可能，优先使用Unix socket而不是TCP端口来与Docker通信。
6.更新Docker：
确保使用最新版本的Docker，以获取最新的安全更新。
7实施网络隔离：
使用虚拟私有网络（VPN）来访问Docker API。
三.选择配置防火墙策略来修复
1.查看我的机器是否可以访问Docker端口
在cmd窗口，输入命令 curl -i http://10.1.230.94:2375/version，结果如下：
C:\Users\Dell>curl -i http://10.1.230.94:2375/version
HTTP/1.1 200 OK
Api-Version: 1.45
Content-Type: application/json
Docker-Experimental: false
Ostype: linux
Server: Docker/26.1.3 (linux)
Date: Tue, 08 Oct 2024 09:07:16 GMT
Content-Length: 848
{"Platform":{"Name":"Docker Engine - Community"},"Components":[{"Name":"Engine","Version":"26.1.3","Details":{"ApiVersion":"1.45","Arch":"amd64","BuildTime":"2024-05-16T08:35:20.000000000+00:00","Experimental":"false","GitCommit":"8e96db1","GoVersion":"go1.21.10","KernelVersion":"3.10.0-1160.105.1.el7.x86_64","MinAPIVersion":"1.24","Os":"linux"}},{"Name":"containerd","Version":"1.6.32","Details":{"GitCommit":"8b3b7ca2e5ce38e8f31a34f35b2b68ceb8470d89"}},{"Name":"runc","Version":"1.1.12","Details":{"GitCommit":"v1.1.12-0-g51d5e94"}},{"Name":"docker-init","Version":"0.19.0","Details":{"GitCommit":"de40ad0"}}],"Version":"26.1.3","ApiVersion":"1.45","MinAPIVersion":"1.24","GitCommit":"8e96db1","GoVersion":"go1.21.10","Os":"linux","Arch":"amd64","KernelVersion":"3.10.0-1160.105.1.el7.x86_64","BuildTime":"2024-05-16T08:35:20.000000000+00:00"}我在浏览器输入http://10.1.230.94:2375/version，也有响应如下：
{
"Platform": {
"Name": "Docker Engine - Community"
},
"Components": [{
"Name": "Engine",
"Version": "26.1.3",
"Details": {
"ApiVersion": "1.45",
"Arch": "amd64",
"BuildTime": "2024-05-16T08:35:20.000000000+00:00",
"Experimental": "false",
"GitCommit": "8e96db1",
"GoVersion": "go1.21.10",
"KernelVersion": "3.10.0-1160.105.1.el7.x86_64",
"MinAPIVersion": "1.24",
"Os": "linux"
}
}, {
"Name": "containerd",
"Version": "1.6.32",
"Details": {
"GitCommit": "8b3b7ca2e5ce38e8f31a34f35b2b68ceb8470d89"
}
}, {
"Name": "runc",
"Version": "1.1.12",
"Details": {
"GitCommit": "v1.1.12-0-g51d5e94"
}
}, {
"Name": "docker-init",
"Version": "0.19.0",
"Details": {
"GitCommit": "de40ad0"
}
}],
"Version": "26.1.3",
"ApiVersion": "1.45",
"MinAPIVersion": "1.24",
"GitCommit": "8e96db1",
"GoVersion": "go1.21.10",
"Os": "linux",
"Arch": "amd64",
"KernelVersion": "3.10.0-1160.105.1.el7.x86_64",
"BuildTime": "2024-05-16T08:35:20.000000000+00:00"
}说明我的机器确实可以访问的。我的构建服务器ip是10.1.230.232，我本机10.1.210.197、另一个同事机器10.2.125.55。我准备就允许设置这3个IP可以访问Docker的端口。
2.设置防火墙规则
（1）先明确linux机器用的什么防火墙？
一般是用iptables或者firewalld。先通过查看2个命令分别查看服务的状态，就知道用的是哪个防火墙了。systemctl status iptables 和 systemctl status firewalld。很明显，我机器是firewalld。
[root@localhost ~]# systemctl status iptables
Unit iptables.service could not be found.
[root@localhost ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: active (running) since 二 2024-10-08 17:43:49 CST; 28min ago
Docs: man:firewalld(1)
Main PID: 14565 (firewalld)
Tasks: 2
Memory: 28.3M
CGroup: /system.slice/firewalld.service
└─14565 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid
10月 08 17:43:48 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
10月 08 17:43:49 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.
10月 08 17:43:49 localhost.localdomain firewalld[14565]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
10月 08 17:50:58 localhost.localdomain firewalld[14565]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
10月 08 17:54:06 localhost.localdomain firewalld[14565]: ERROR: INVALID_PROTOCOL: http
10月 08 17:58:15 localhost.localdomain firewalld[14565]: WARNING: ALREADY_ENABLED: rule family="ipv4" source address="10.1.210.197" port port="2375" protocol="tcp" accept
10月 08 17:58:47 localhost.localdomain firewalld[14565]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.
10月 08 18:10:12 localhost.localdomain firewalld[14565]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.（2）firewalld添加允许访问并重启
#添加3个IP访问2375端口
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.1.230.232" port port="2375" protocol="tcp" accept' --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.1.210.197" port port="2375" protocol="tcp" accept' --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.2.125.55" port port="2375" protocol="tcp" accept' --permanent
#重新加载 firewalld 配置
sudo firewall-cmd --reload
如果不重启，不生效哦！
可以输入命令去验证规则：
[root@localhost zones]# sudo firewall-cmd --zone=public --list-rich-rules
rule family="ipv4" source address="10.1.230.232" port port="2375" protocol="tcp" accept
rule family="ipv4" source address="10.1.210.197" port port="2375" protocol="tcp" accept
rule family="ipv4" source address="10.2.125.55" port port="2375" protocol="tcp" accept四.其他问题处理
1.1panel的15021端口访问不了
我的Docker服务器不是自己安装的，是在1Panel中带的，原来没有启用防火墙，我命令输入后，启动了防火墙，导致我1Panel平台的15021端口，里面容器映射的端口都访问不了。所以，我手动先输入命令，把1panel的15021端口允许任何ip访问。
[root@localhost zones]# sudo firewall-cmd --zone=public --add-port=15021/tcp --permanent
success2.1panel中其他容器映射的端口访问不了
在1panel中添加就行了，多个端口可以一次批量添加:
可以在1panel防火墙界面查看，当前的规则。也可以像下面这样输入命令查看：
[root@localhost zones]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: dhcpv6-client ssh
ports: 15021/tcp 22/tcp 80/tcp 443/tcp 14000/tcp 14001/tcp 14002/tcp 14003/tcp 16379/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="10.1.230.232" port port="2375" protocol="tcp" accept
rule family="ipv4" source address="10.1.210.197" port port="2375" protocol="tcp" accept
rule family="ipv4" source address="10.2.125.55" port port="2375" protocol="tcp" accept
![[简单实践]Noisy Print - 自制基于加性噪声模型的简易降噪器](https://img-blog.csdnimg.cn/img_convert/d88be87b200e4dd2c60ebb7031a63b77.png)
