26 网安卫士平台搭建 (a1ctf)

1
export INFRA_PUBLIC_IP=
2
export INFRA_PRIVATE_IP=
3
export WORKER1_PUBLIC_IP=
4
export WORKER1_PRIVATE_IP=
5
export WORKER2_PUBLIC_IP=
6
export WORKER2_PRIVATE_IP=
7

8
export REG_DOMAIN=
9
export A1_DOMAIN=
10
export WORKER1_DOMAIN=
11
export WORKER2_DOMAIN=

1
useradd -m -s /bin/bash ctf
2
passwd ctf

1
ssh-keygen -t ed25519 -C "adctf-admin"

1
sudo sshd -t

1
sudo systemctl restart ssh

1
sudo apt update && sudo apt full-upgrade -y
2
sudo apt install -y curl wget unar rsync

1
sudo apt install -y chrony
2
sudo systemctl enable --now chrony
3
chronyc tracking

1
sudo apt install unattended-upgrades apt-listchanges
2
sudo dpkg-reconfigure unattended-upgrades

1
sudo apt autoremove --purge -y
2
sudo apt clean
3
sudo rm -rf /var/lib/apt/lists/*
4
sudo rm -rf /tmp/*
5
sudo rm -rf /var/tmp/*
6

7
sudo journalctl --rotate
8
sudo journalctl --vacuum-time=1s

1
sudo useradd registry -d /var/lib/registry -m -s /bin/bash
2
sudo loginctl enable-linger registry

1
sudo apt-get install -y apache2-utils
2
REG_PASS=$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)
3
htpasswd -cBb /tmp/registry-passwd admin "$REG_PASS"
4
sudo mkdir -p /var/lib/registry/auth /var/lib/registry/data
5
sudo cp /tmp/registry-passwd /var/lib/registry/auth/passwd
6
sudo chmod 600 /var/lib/registry/auth/passwd
7
sudo chown registry:registry /var/lib/registry/auth/passwd
8
sudo chown -R registry:registry /var/lib/registry/data

1
sudo -u registry tee /var/lib/registry/registry-pod.yaml << 'EOF'
2
apiVersion: v1
3
kind: Pod
4
metadata:
5
  name: registry-pod
6
spec:
7
  hostname: registry
8
  restartPolicy: Never
9
  containers:
10
    - name: registry-container
11
      image: registry:3
12
      ports:
13
        - protocol: TCP
14
          containerPort: 5000
15
          hostIP: "::1"
16
          hostPort: 5000
17
      env:
18
        - name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
19
          value: /var/lib/registry
20
        - name: REGISTRY_AUTH
21
          value: htpasswd
22
        - name: REGISTRY_AUTH_HTPASSWD_REALM
23
          value: Registry Realm
24
        - name: REGISTRY_AUTH_HTPASSWD_PATH
25
          value: /auth/passwd
26
      volumeMounts:
27
        - name: registry-data
28
          mountPath: /var/lib/registry
29
        - name: registry-auth
30
          mountPath: /auth
31
          readOnly: true
32
  volumes:
33
    - name: registry-data
34
      hostPath:
35
        type: Directory
36
        path: /var/lib/registry/data
37
    - name: registry-auth
38
      hostPath:
39
        type: Directory
40
        path: /var/lib/registry/auth
41
EOF
42

43
sudo chmod 0600 /var/lib/registry/registry-pod.yaml

1
sudo chown -R registry:registry /var/lib/registry/data /var/lib/registry/auth

1
sudo -u registry bash

1
podman unshare chown -R 0:0 /var/lib/registry/data /var/lib/registry/auth
2
podman kube play /var/lib/registry/registry-pod.yaml

1
mkdir -p ~/.config/systemd/user && cd ~/.config/systemd/user
2
podman generate systemd --files --name registry-pod
3
podman pod stop registry-pod
4

5
export XDG_RUNTIME_DIR=/run/user/$(id -u)
6
systemctl --user daemon-reload
7
systemctl --user enable --now pod-registry-pod.service

1
podman login $REG_DOMAIN -u admin

1
curl -sfL https://get.k3s.io | \
2
  INSTALL_K3S_EXEC="server \
3
    --node-name infra-1 \
4
    --node-taint CriticalAddonsOnly=true:NoSchedule \
5
    --write-kubeconfig-mode 0600" sh -s -

1
systemctl is-active k3s          # active
2
sudo k3s kubectl get nodes       # infra-1 Ready

1
sudo tee /etc/rancher/k3s/config.yaml << 'EOF'
2
write-kubeconfig-mode: "0600"
3
tls-san:
4
  - host.containers.internal    # Podman 容器内访问 k3s API 需要此 SAN
5
disable:
6
  - traefik           # 用 Caddy 做反代，不需要 k3s 内置 ingress。留着会占 80/443 并在 iptables 加 REJECT 规则拦截流量
7
  - servicelb         # 题目用 NodePort 暴露，不用 LoadBalancer Service
8
  - helm-controller
9
EOF
10

11
sudo systemctl restart k3s

1
sudo cat /var/lib/rancher/k3s/server/node-token

1
export NODE_TOKEN=

1
curl -sfL https://get.k3s.io | \
2
  K3S_URL=https://$INFRA_PRIVATE_IP:6443 \
3
  K3S_TOKEN="$NODE_TOKEN" \
4
  INSTALL_K3S_EXEC="agent --node-name worker-1" \
5
  sh -s -

1
export NODE_TOKEN=

1
curl -sfL https://get.k3s.io | \
2
  K3S_URL=https://$INFRA_PRIVATE_IP:6443 \
3
  K3S_TOKEN="$NODE_TOKEN" \
4
  INSTALL_K3S_EXEC="agent --node-name worker-2" \
5
  sh -s -

1
sudo k3s kubectl get nodes -o wide
2
# 应显示 infra-1, worker-1, worker-2 三个节点，状态均为 Ready

1
export REG_PASS=

1
sudo mkdir -p /etc/rancher/k3s
2
sudo tee /etc/rancher/k3s/registries.yaml << EOF
3
mirrors:
4
  "$REG_DOMAIN":
5
    endpoint:
6
      - "https://$REG_DOMAIN"
7
configs:
8
  "$REG_DOMAIN":
9
    auth:
10
      username: admin
11
      password: $REG_PASS
12
EOF
13

14
sudo systemctl restart k3s-agent

1
sudo tee -a /etc/rancher/k3s/config.yaml << 'EOF'
2
kube-apiserver-arg:
3
  - "anonymous-auth=false"
4
EOF
5

6
sudo systemctl restart k3s

1
sudo apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl
2
curl -1sLf "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" | \
3
  sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
4
curl -1sLf "https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt" | \
5
  sudo tee /etc/apt/sources.list.d/caddy-stable.list > /dev/null
6
sudo apt-get update
7
sudo apt-get install -y caddy

1
sudo tee /etc/caddy/Caddyfile << EOF
2
$A1_DOMAIN {
3
 reverse_proxy localhost:7777
4

5
 header {
6
  X-Content-Type-Options nosniff
7
  X-Frame-Options DENY
8
  Referrer-Policy strict-origin-when-cross-origin
9
 }
10
}
11

12
$REG_DOMAIN {
13
 reverse_proxy localhost:5000
14

15
 header {
16
  X-Content-Type-Options nosniff
17
 }
18
}
19
EOF
20

21
sudo systemctl restart caddy

1
sudo useradd a1ctf -d /var/lib/a1ctf -m -s /bin/bash
2
sudo loginctl enable-linger a1ctf

1
sudo -u a1ctf podman info --format {{.Host.Security.Rootless}}
2
# 应输出 true

1
sudo tee /etc/containers/registries.conf << 'EOF'
2
unqualified-search-registries = ["docker.io"]
3
EOF

1
sudo mkdir -p /var/lib/a1ctf/data /var/lib/a1ctf/postgres /var/lib/a1ctf/redis
2
sudo chown -R a1ctf:a1ctf /var/lib/a1ctf
3

4

5
PG_PASS=$(openssl rand -base64 24 | tr -d '/+=' | head -c 32)
6
REDIS_PASS=$(openssl rand -base64 24 | tr -d '/+=' | head -c 32)
7
echo "PostgreSQL password: $PG_PASS"
8
echo "Redis password: $REDIS_PASS"

1
secret-tool store --label="PG pass" a1 pg
2
secret-tool store --label="Redis pass" a1 redis

1
# 0. 创建 namespace（必须先于 RBAC，否则资源无法绑定到该 namespace）
2
sudo k3s kubectl apply -f - <<'NS'
3
apiVersion: v1
4
kind: Namespace
5
metadata:
6
  name: a1ctf-challenges
7
NS
8

9
# 1. 创建 ServiceAccount 和 RBAC
10
sudo k3s kubectl apply -f - <<'RBAC'
11
---
12
apiVersion: v1
13
kind: ServiceAccount
14
metadata:
15
  name: a1ctf
16
  namespace: a1ctf-challenges
17
---
18
apiVersion: rbac.authorization.k8s.io/v1
19
kind: Role
20
metadata:
21
  name: a1ctf-manager
22
  namespace: a1ctf-challenges
23
rules:
24
  - apiGroups: [""]
25
    resources: ["pods", "services"]
26
    verbs: ["get", "list", "create", "delete"]
27
  - apiGroups: ["networking.k8s.io"]
28
    resources: ["networkpolicies"]
29
    verbs: ["get", "list", "create", "delete"]
30
---
31
apiVersion: rbac.authorization.k8s.io/v1
32
kind: RoleBinding
33
metadata:
34
  name: a1ctf-manager
35
  namespace: a1ctf-challenges
36
subjects:
37
  - kind: ServiceAccount
38
    name: a1ctf
39
    namespace: a1ctf-challenges
40
roleRef:
41
  kind: Role
42
  name: a1ctf-manager
43
  apiGroup: rbac.authorization.k8s.io
44
---
45
apiVersion: rbac.authorization.k8s.io/v1
46
kind: ClusterRole
47
metadata:
48
  name: a1ctf-namespace-manager
49
rules:
50
  - apiGroups: [""]
51
    resources: ["namespaces"]
52
    resourceNames: ["a1ctf-challenges"]
53
    verbs: ["get", "create"]
54
---
55
apiVersion: rbac.authorization.k8s.io/v1
56
kind: ClusterRoleBinding
57
metadata:
58
  name: a1ctf-namespace-manager
59
subjects:
60
  - kind: ServiceAccount
61
    name: a1ctf
62
    namespace: a1ctf-challenges
63
roleRef:
64
  kind: ClusterRole
65
  name: a1ctf-namespace-manager
66
  apiGroup: rbac.authorization.k8s.io
67
RBAC
68

69
# 2. 生成 SA token (10 年有效期)
70
TOKEN=$(k3s kubectl create token a1ctf -n a1ctf-challenges --duration=87600h)
71

72
# 3. 从原始 kubeconfig 提取 CA 证书
73
CA=$(grep certificate-authority-data /etc/rancher/k3s/k3s.yaml | awk '{print $2}')
74

75
# 4. 验证变量非空（如果为空说明前面的步骤有问题，不要继续）
76
echo "CA length: ${#CA}"
77
echo "Token length: ${#TOKEN}"
78
[ -z "$CA" ] && echo "ERROR: CA is empty" && exit 1
79
[ -z "$TOKEN" ] && echo "ERROR: Token is empty" && exit 1
80

81
# 5. 写入 SA kubeconfig（用 envsubst 避免变量展开问题）
82
sudo tee /var/lib/a1ctf/kubeconfig.yaml > /dev/null << EOF
83
apiVersion: v1
84
kind: Config
85
clusters:
86
- cluster:
87
    certificate-authority-data: ${CA}
88
    server: https://host.containers.internal:6443
89
  name: local
90
contexts:
91
- context:
92
    cluster: local
93
    user: a1ctf
94
  name: a1ctf
95
current-context: a1ctf
96
preferences: {}
97
users:
98
- name: a1ctf
99
  user:
100
    token: ${TOKEN}
101
EOF
102

103
sudo chmod 600 /var/lib/a1ctf/kubeconfig.yaml
104
sudo chown a1ctf:a1ctf /var/lib/a1ctf/kubeconfig.yaml

1
sudo -u a1ctf tee /var/lib/a1ctf/config.yaml << EOF
2
configVersion: v1
3

4
system:
5
  gin-port: 7777
6
  gin-host: 0.0.0.0
7
  prometheus-port: 8081
8
  prometheus-host: 0.0.0.0
9
  favicon: ./data/favicon.ico
10
  baseURL: https://$A1_DOMAIN
11
  forwarded-by-client-ip: true
12
  remote-ip-headers:
13
    - X-Forwarded-For
14
    - X-Real-IP
15
  trusted-proxies:
16
    - 10.0.0.0/8
17
    - 172.21.0.0/16
18
    - 127.0.0.0/8
19
    - ::1/128
20
  pprof-enable: false
21

22
redis:
23
  address: localhost:6379
24
  password: "$REDIS_PASS"
25
  db: 0
26

27
k8s:
28
  k8s-config-file: "k8sconfig.yaml"
29
  node-ip-map:
30
    - { name: "worker-1", "address": "$WORKER1_DOMAIN" }
31
    - { name: "worker-2", "address": "$WORKER2_DOMAIN" }
32
  manual-port-assignments:
33
    enabled: false
34
    port-range-map: []
35
  pull-secret-names: []
36
  custom-dns-server:
37
    enabled: false
38
    nameservers:
39
      - 8.8.8.8
40

41
postgres:
42
  host: localhost
43
  port: 5432
44
  user: postgres
45
  password: "$PG_PASS"
46
  dbname: a1ctf
47
  sslmode: disable
48

49
cache-time:
50
  user-list: 500ms
51
  upload-list: 500ms
52
  solved-challenges-for-game: 500ms
53
  game-info: 500ms
54
  all-teams-for-game: 500ms
55
  game-scoreboard: 500ms
56
  challenges-for-game: 1s
57
  challenge-detail: 500ms
58
  container-status: 100ms
59
  team-flag: 100ms
60
  team-solve-status: 100ms
61
  judge-result: 100ms
62

63
redis-cache-time:
64
  user-list: 500ms
65
  upload-list: 500ms
66
  solved-challenges-for-game: 500ms
67
  game-info: 500ms
68
  all-teams-for-game: 500ms
69

70
monitoring:
71
  enabled: true
72
  system-monitor-interval: 1s
73
  gorm-slow-query-threshold: 100ms
74

75
job-intervals:
76
  update-activate-game-score: 500ms
77
  update-active-game-score-board: 5s
78
  flag-judge: 1s
79
  update-game-scoreboard-cache: 1s
80
  container-updating: 1s
81
  compress-and-delete-old-logs: 2h
82

83
cap-settings:
84
  defaultChallengeTokenSize: 25
85
  defaultChallengeCount: 80
86
  defaultChallengeSize: 32
87
  defaultChallengeDifficulty: 4
88
  defaultChallengeExpires: 10m
89
  defaultTokenSize: 64
90
  defaultTokenIdSize: 16
91
  defaultTokenExpires: 20m
92
  defaultTokenVerifyOnce: true
93
  defaultHttpHandleLimitRPS: 10
94
  defaultHttpHandleLimitBurst: 50
95

96
game-settings:
97
  container-cooldown-time: 60s
98
EOF
99

100
sudo chmod 600 /var/lib/a1ctf/config.yaml

1
sudo chmod 600 /etc/rancher/k3s/k3s.yaml

1
sudo -u a1ctf tee /var/lib/a1ctf/a1ctf-pod.yaml << EOF
2
apiVersion: v1
3
kind: Pod
4
metadata:
5
  name: a1ctf-pod
6
spec:
7
  hostname: a1ctf
8
  restartPolicy: OnFailure
9
  containers:
10
    - name: a1ctf-container
11
      image: ghcr.io/carbofish/a1ctf/a1ctf:latest
12
      env:
13
        - name: GIN_MODE
14
          value: release
15
      ports:
16
        - containerPort: 7777
17
          hostIP: ::1
18
          hostPort: 7777
19
        - containerPort: 8081
20
          hostIP: ::1
21
          hostPort: 8081
22
      volumeMounts:
23
        - name: a1ctf-data
24
          mountPath: /app/data
25
        - name: a1ctf-config
26
          mountPath: /app/config.yaml
27
          readOnly: true
28
        - name: k8sconfig
29
          mountPath: /app/k8sconfig.yaml
30
          readOnly: true
31
    - name: postgres-container
32
      image: postgres:17-alpine
33
      env:
34
        - name: POSTGRES_DB
35
          value: a1ctf
36
        - name: POSTGRES_USER
37
          value: postgres
38
        - name: POSTGRES_PASSWORD
39
          value: "$PG_PASS"
40
      ports:
41
        - containerPort: 5432
42
          hostIP: ::1
43
          hostPort: 5432
44
      volumeMounts:
45
        - name: postgres-data
46
          mountPath: /var/lib/postgresql/data
47
    - name: redis-container
48
      image: bitnami/redis:latest
49
      env:
50
        - name: REDIS_PASSWORD
51
          value: "$REDIS_PASS"
52
        - name: REDIS_AOF_ENABLED
53
          value: "yes"
54
      volumeMounts:
55
        - name: redis-data
56
          mountPath: /bitnami/redis/data
57
  volumes:
58
    - name: a1ctf-data
59
      hostPath:
60
        type: Directory
61
        path: /var/lib/a1ctf/data
62
    - name: a1ctf-config
63
      hostPath:
64
        type: File
65
        path: /var/lib/a1ctf/config.yaml
66
    - name: k8sconfig
67
      hostPath:
68
        type: File
69
        path: /var/lib/a1ctf/kubeconfig.yaml
70
    - name: postgres-data
71
      hostPath:
72
        type: Directory
73
        path: /var/lib/a1ctf/postgres
74
    - name: redis-data
75
      hostPath:
76
        type: Directory
77
        path: /var/lib/a1ctf/redis
78
EOF

1
# A1CTF 数据目录 — 容器内 appuser (UID 1001)
2
sudo -u a1ctf podman unshare chown -R 1001:1001 /var/lib/a1ctf/data
3

4
# A1CTF 配置文件 — 容器内 appuser (UID 1001) 需要读取
5
sudo -u a1ctf podman unshare chown 1001:1001 /var/lib/a1ctf/config.yaml /var/lib/a1ctf/kubeconfig.yaml
6

7
# PostgreSQL 数据目录 — 容器内 postgres 用户 (UID 70)
8
sudo -u a1ctf podman unshare chown -R 70:70 /var/lib/a1ctf/postgres
9

10
# Redis 数据目录 — 容器内 redis 用户 (UID 1001)
11
sudo -u a1ctf podman unshare chown -R 1001:1001 /var/lib/a1ctf/redis

1
sudo -u a1ctf podman kube play /var/lib/a1ctf/a1ctf-pod.yaml

1
sudo -u a1ctf podman ps --pod

1
# 切换到 a1ctf 用户
2
sudo -u a1ctf bash
3

4
# 生成 unit 文件
5
mkdir -p ~/.config/systemd/user && cd ~/.config/systemd/user
6
podman generate systemd --files --name a1ctf-pod
7

8
# 停止 pod（接下来由 systemd 管理）
9
podman pod stop a1ctf-pod
10

11
# 启用并启动
12
export XDG_RUNTIME_DIR=/run/user/$(id -u)
13
systemctl --user daemon-reload
14
systemctl --user enable --now pod-a1ctf-pod.service

1
sudo -u a1ctf podman ps --pod

1
podman build -t my-challenge .
2
podman tag my-challenge $REG_DOMAIN/my-challenge:latest
3
podman push $REG_DOMAIN/my-challenge:latest

1
sudo kubectl get pods -n a1ctf-challenges -o wide  # 状态和所在节点
2
sudo kubectl get svc -n a1ctf-challenges            # NodePort 映射
3
sudo kubectl logs <pod-name> -n a1ctf-challenges    # 容器日志
4
sudo kubectl describe pod <pod-name> -n a1ctf-challenges  # Events 段看调度/启动事件