Operatsion tizim xavfsizligi

# Nima o'rnatilgan?
dpkg -l | wc -l

# Qaysi xizmatlar ishga tushadi?
systemctl list-unit-files --state=enabled --type=service

# Keraksizlarni o'chirish
sudo systemctl disable --now bluetooth cups avahi-daemon
sudo apt purge telnet rsh-client rsh-server xinetd
sudo apt autoremove --purge

# Barcha foydalanuvchilar
cat /etc/passwd | cut -d: -f1,3,7

# Parolsiz hisoblar - xavfli
sudo awk -F: '($2 == "") {print $1}' /etc/shadow

# UID 0 bo'lgan hisoblar (root ekvivalenti)
sudo awk -F: '($3 == 0) {print $1}' /etc/passwd

# Yangi foydalanuvchi - login qilmaydigan xizmat uchun
sudo useradd -r -s /usr/sbin/nologin -M dokon

# sudo huquqi - aniq buyruqlar bilan
sudo visudo -f /etc/sudoers.d/dokon

# /etc/sudoers.d/dokon
husanboy ALL=(ALL) NOPASSWD: /bin/systemctl reload nginx, /bin/systemctl reload php8.3-fpm
%deploy ALL=(dokon) NOPASSWD: /var/www/dokon/deploy.sh

# sudo amallarini kuzatish
sudo grep sudo /var/log/auth.log | tail -20

ls -la /var/www/dokon

# To'g'ri huquqlar
sudo chown -R dokon:dokon /var/www/dokon
sudo find /var/www/dokon -type d -exec chmod 755 {} \;
sudo find /var/www/dokon -type f -exec chmod 644 {} \;

# Sirlar
sudo chmod 600 /var/www/dokon/.env

# Yozish kerak bo'lgan papkalar
sudo chmod 775 /var/www/dokon/storage
sudo chown -R dokon:www-data /var/www/dokon/storage

# Xavfli fayllarni topish
sudo find / -type f -perm -002 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null

# SUID fayllar - ular egasi huquqi bilan bajariladi
sudo find / -type f -perm -4000 2>/dev/null

# Mavjud yangilanishlar
sudo apt update
apt list --upgradable

# Faqat xavfsizlik yangilanishlari
sudo unattended-upgrade --dry-run -d

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure --priority=low unattended-upgrades

# /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
};

Unattended-Upgrade::Mail "[email protected]";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

# Qayta ishga tushirish kerakmi?
[ -f /var/run/reboot-required ] && cat /var/run/reboot-required.pkgs

# Yadro yangilanishlarini qayta ishga tushirmasdan qo'llash
sudo apt install libcanberra-gtk-module   # yoki kexec, livepatch
sudo canonical-livepatch status

# /etc/systemd/system/dokon.service
[Unit]
Description=Dokon ilovasi
After=network.target mysql.service

[Service]
Type=notify
User=dokon
Group=dokon
WorkingDirectory=/var/www/dokon

# Huquqlarni oshirishni taqiqlash
NoNewPrivileges=true

# Fayl tizimi
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/www/dokon/storage /var/log/dokon

# Yadro
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true

# Tarmoq
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
IPAddressDeny=any
IPAddressAllow=10.0.0.0/8 127.0.0.1

# Xotira
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true

# Tizim chaqiruvlari
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native

# Resurs cheklovlari
MemoryMax=2G
CPUQuota=200%
TasksMax=512

[Install]
WantedBy=multi-user.target

# Xavfsizlik bahosini tekshirish
systemd-analyze security dokon.service

# /etc/sysctl.d/99-xavfsizlik.conf

# IP soxtalashtirishga qarshi
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# ICMP yo'naltirishlarini rad etish
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Manba marshrutlashni o'chirish
net.ipv4.conf.all.accept_source_route = 0

# SYN flood himoyasi
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# Shubhali paketlarni jurnalga yozish
net.ipv4.conf.all.log_martians = 1

# ASLR - xotira manzillarini tasodifiylashtirish
kernel.randomize_va_space = 2

# Yadro ko'rsatkichlarini yashirish
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1

# Core dump larni o'chirish (parollar tushishi mumkin)
fs.suid_dumpable = 0

# Qattiq va ramziy havola himoyasi
fs.protected_hardlinks = 1
fs.protected_symlinks = 1

sudo sysctl --system
sudo sysctl -a | grep tcp_syncookies

# AppArmor holati
sudo aa-status

# /etc/apparmor.d/usr.sbin.dokon
#include <tunables/global>

/usr/local/bin/dokon {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # Faqat shu fayllarni o'qish
  /var/www/dokon/** r,
  /var/www/dokon/storage/** rw,
  /etc/dokon/config.php r,

  # Tarmoq
  network inet stream,
  network inet6 stream,

  # Boshqa hamma narsa taqiqlangan
  deny /etc/shadow r,
  deny /root/** rwx,
  deny /home/** rwx,
}

FROM php:8.3-fpm-alpine

# Root sifatida ishlamang
RUN addgroup -g 1000 ilova && adduser -u 1000 -G ilova -D ilova

# Faqat kerakli paketlar
RUN apk add --no-cache libzip \
    && docker-php-ext-install pdo_mysql opcache \
    && rm -rf /var/cache/apk/*

COPY --chown=ilova:ilova . /var/www

USER ilova

HEALTHCHECK --interval=30s CMD php /var/www/tools/salomatlik.php

services:
  ilova:
    build: .
    read_only: true                    # fayl tizimi faqat o'qish
    tmpfs:
      - /tmp
    cap_drop:
      - ALL                            # barcha imkoniyatlarni olib tashlash
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    user: "1000:1000"
    mem_limit: 1g
    pids_limit: 256

# Obrazni zaifliklarga tekshirish
docker scout cves dokon:1.0.0
trivy image dokon:1.0.0

# AIDE - fayl yaxlitligini kuzatish
sudo apt install aide
sudo aideinit
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Tekshirish
sudo aide --check

# Kunlik tekshiruv
echo "0 4 * * * root /usr/bin/aide --check | mail -s 'AIDE hisoboti' [email protected]" \
    | sudo tee /etc/cron.d/aide

# auditd - tizim chaqiruvlarini kuzatish
sudo apt install auditd

# Muhim fayllarni kuzatish
sudo auditctl -w /etc/passwd -p wa -k parol_fayli
sudo auditctl -w /etc/shadow -p wa -k parol_fayli
sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_sozlama
sudo auditctl -w /var/www/dokon/.env -p wa -k ilova_sirlari

# Doimiy qoidalar

# /etc/audit/rules.d/xavfsizlik.rules
-w /etc/passwd -p wa -k parol_fayli
-w /etc/shadow -p wa -k parol_fayli
-w /etc/sudoers -p wa -k sudo_sozlama
-w /etc/sudoers.d/ -p wa -k sudo_sozlama

# Huquq oshirish urinishlari
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=4294967295 -k huquq_oshirish

# Foydalanuvchi o'zgarishlari
-w /usr/sbin/useradd -p x -k foydalanuvchi_ozgarishi
-w /usr/sbin/userdel -p x -k foydalanuvchi_ozgarishi

# Hisobot
sudo ausearch -k parol_fayli --start today
sudo aureport --summary

#!/bin/bash
# zaxira.sh
set -euo pipefail

SANA=$(date +%F_%H%M)
ZAXIRA=/zaxira
SAQLASH_KUN=30

# Ma'lumotlar bazasi
mysqldump --single-transaction --routines --triggers dokon \
    | gzip > "$ZAXIRA/db_${SANA}.sql.gz"

# Fayllar
tar -czf "$ZAXIRA/fayllar_${SANA}.tar.gz" \
    /var/www/dokon/storage/yuklamalar

# Sozlamalar
tar -czf "$ZAXIRA/sozlama_${SANA}.tar.gz" \
    /etc/nginx /etc/php /var/www/dokon/.env

# Shifrlash
for f in "$ZAXIRA"/*_"${SANA}".*; do
    gpg --encrypt --recipient [email protected] "$f"
    rm "$f"
done

# Masofaviy nusxa
rclone copy "$ZAXIRA" bulut:dokon-zaxira/ --include "*_${SANA}.*"

# Eskilarini tozalash
find "$ZAXIRA" -name "*.gpg" -mtime +$SAQLASH_KUN -delete

echo "Zaxira tayyor: $SANA"

# Tiklash mashqi - har oyda
mysql -u root -p sinov_baza < <(gpg --decrypt db_2026-08-15.sql.gz.gpg | gunzip)
mysql sinov_baza -e "SELECT COUNT(*) FROM buyurtmalar;"

# Lynis - avtomatik audit
sudo apt install lynis
sudo lynis audit system

# CIS benchmark tekshiruvi
docker run --rm --net host --pid host --userns host --cap-add audit_control \
    -v /etc:/etc:ro -v /var/lib:/var/lib:ro \
    docker/docker-bench-security

# Yangilanishlar holati
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Ishlaydigan xizmatlar
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName

# Firewall
Get-NetFirewallProfile | Select-Object Name, Enabled

# Administrator guruhidagi foydalanuvchilar
Get-LocalGroupMember -Group "Administrators"

# BitLocker holati
Get-BitLockerVolume

# Xavfsizlik siyosati
# Parol murakkabligi
net accounts /minpwlen:12 /maxpwage:0 /lockoutthreshold:5

# SMBv1 ni o'chirish (WannaCry shu orqali tarqalgan)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

# PowerShell jurnali
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -Name "EnableScriptBlockLogging" -Value 1

#!/bin/bash
# tez-tekshiruv.sh

echo "=== Yangilanishlar ==="
apt list --upgradable 2>/dev/null | grep -c security || echo "0"

echo -e "\n=== Root ekvivalenti hisoblar ==="
awk -F: '($3 == 0) {print $1}' /etc/passwd

echo -e "\n=== Parolsiz hisoblar ==="
sudo awk -F: '($2 == "") {print $1}' /etc/shadow || echo "yo'q"

echo -e "\n=== 777 huquqli fayllar (/var/www) ==="
find /var/www -perm 0777 2>/dev/null | head

echo -e "\n=== SSH sozlamalari ==="
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication)'

echo -e "\n=== Firewall ==="
sudo ufw status | head -3

echo -e "\n=== Ishlaydigan xizmatlar soni ==="
systemctl list-units --type=service --state=running | grep -c '\.service'

echo -e "\n=== Oxirgi qayta ishga tushirish ==="
uptime -s