Peijun Zhao
b271eda8d5
新增6个Minecraft安全模块: - GeoBlockService: 地理IP封锁（国家黑白名单/高风险MC攻击来源拦截） - PlayerSessionValidationService: 玩家会话验证（UUID/正版/离线检测/会话重放） - PluginVerificationService: 插件完整性校验（SHA-256/恶意插件名/25个已知恶意插件） - ConnectionThrottleService: 连接速率限制（多窗口追踪/递增延迟2s-30s） - BackupIntegrityService: 备份完整性验证（SHA-256/文件存在性/6h自动扫描） - AntiSkinSpoofService: 皮肤伪造检测（25个冒充目标/可疑URL/变更频率） 配置独立开关（31个模块全部可单独控制）: - ServerGuardConfig新增SuperEvolutionConfig包含全部31个模块的enabled开关 - application.yml新增完整super-evolution配置段（含中文说明） - 每个Service注入ServerGuardConfig并在入口检查开关，关闭时跳过检测 DashboardController新增6个API端点 + 全部25个服务重构注入config 测试: V33SecurityTest 29项测试（含23项v3.3 + 6项更正），全部114测试通过 文档: README/README_EN 30+→85+模块，USER_MANUAL新增完整开关配置文档
229 lines
7.8 KiB
YAML
229 lines
7.8 KiB
YAML
serverguard:
|
||
minecraft:
|
||
service-name: minecraft
|
||
process-name: paper-1.21.11.jar
|
||
jar-file: paper-1.21.11.jar
|
||
working-dir: /opt/minecraft
|
||
java-opts: -Xms4G -Xmx4G
|
||
check-interval-seconds: 5
|
||
rcon:
|
||
enabled: true
|
||
host: localhost
|
||
port: 25575
|
||
password: ${RCON_PASSWORD:}
|
||
|
||
monitor:
|
||
tps-threshold: 15
|
||
cpu-threshold: 80.0
|
||
memory-threshold: 85.0
|
||
connection-threshold: 50
|
||
log-watch-lines: 100
|
||
log-path: /opt/minecraft/logs/latest.log
|
||
|
||
alert:
|
||
enabled: true
|
||
email:
|
||
smtp-host: smtp.qq.com
|
||
smtp-port: 587
|
||
username: ${ALUER_ALERT_SMTP_USERNAME:}
|
||
password: ${ALUER_ALERT_SMTP_PASSWORD:}
|
||
to:
|
||
- ${ALUER_ALERT_EMAIL_PRIMARY:}
|
||
- ${ALUER_ALERT_EMAIL_SECONDARY:}
|
||
rate-limit:
|
||
per-type-seconds: 300
|
||
max-emails-per-minute: 10
|
||
|
||
ai:
|
||
enabled: true
|
||
use-isolation-forest: true
|
||
use-prediction: true
|
||
sliding-window-size: 100
|
||
anomaly-threshold: 0.7
|
||
prediction-horizon-minutes: 60
|
||
deepseek:
|
||
enabled: true
|
||
api-key: ${DEEPSEEK_API_KEY:}
|
||
base-url: ${DEEPSEEK_BASE_URL:https://api.deepseek.com}
|
||
model: ${DEEPSEEK_MODEL:deepseek-chat}
|
||
max-tokens: 1000
|
||
temperature: 0.35
|
||
auto-analyze-alerts: true
|
||
analysis-interval-seconds: 45
|
||
auto-execute:
|
||
enabled: true
|
||
ban-ip: true
|
||
kill-entity: true
|
||
clear-lag: true
|
||
set-spawn-rate: true
|
||
kick-player: true
|
||
whitelist: true
|
||
min-confidence: 88
|
||
|
||
security:
|
||
enabled: true
|
||
auto-ban-vpn: true
|
||
check-on-login: true
|
||
max-connections-per-ip: 3
|
||
block-common-exploits: true
|
||
log-all-commands: true
|
||
anti-intrusion:
|
||
enabled: true
|
||
monitor-commands: true
|
||
monitor-processes: true
|
||
monitor-files: true
|
||
monitor-plugins: true
|
||
monitor-systemd: true
|
||
monitor-rcon: true
|
||
file-integrity:
|
||
enabled: true
|
||
max-depth: 5
|
||
host-enforcement:
|
||
enabled: true
|
||
dry-run: true
|
||
preferred-backend: auto
|
||
default-block-minutes: 60
|
||
default-rate-limit-per-minute: 120
|
||
mirror-to-cloud-edge: true
|
||
cloud-edge:
|
||
enabled: false
|
||
dry-run: true
|
||
provider: cloudflare
|
||
zone-id: ${ALUER_CLOUDFLARE_ZONE_ID:}
|
||
api-key: ${ALUER_CLOUDFLARE_API_KEY:}
|
||
api-email: ${ALUER_CLOUDFLARE_EMAIL:}
|
||
default-block-mode: block
|
||
default-challenge-mode: challenge
|
||
enable-under-attack-on-critical: true
|
||
orchestration:
|
||
enabled: true
|
||
allow-local-block: true
|
||
allow-edge-challenge: true
|
||
allow-minecraft-defense: true
|
||
notify-on-critical: true
|
||
autonomy:
|
||
enabled: true
|
||
deepseek-dominant: true
|
||
quiet-console: true
|
||
loop-interval-seconds: 45
|
||
min-risk-score-for-action: 70
|
||
critical-risk-score: 90
|
||
workflow-cooldown-seconds: 180
|
||
max-actions-per-hour: 12
|
||
require-second-signal-for-containment: true
|
||
shield:
|
||
enabled: true
|
||
auto-mode: true
|
||
auto-enable-under-attack: true
|
||
heat-trigger: 78
|
||
resonance-trigger: 72
|
||
threat-score-trigger: 85
|
||
edge-challenge-offender-limit: 6
|
||
shelter-rate-limit-per-minute: 45
|
||
attacker-notice-enabled: true
|
||
deterrence-message: Your source has been identified, recorded, and isolated by Aluer.
|
||
kernel:
|
||
enabled: true
|
||
pulse-interval-seconds: 30
|
||
pulse-history-size: 180
|
||
journal-size: 300
|
||
echo-retention-minutes: 180
|
||
adaptive-weights: true
|
||
directive-heat-threshold: 60
|
||
lockdown-heat-threshold: 82
|
||
task-bus:
|
||
enabled: true
|
||
auto-dispatch: true
|
||
dispatch-interval-seconds: 10
|
||
queue-limit: 200
|
||
history-limit: 300
|
||
self-healing:
|
||
enabled: true
|
||
dry-run: true
|
||
loop-interval-seconds: 45
|
||
auto-backup-before-recovery: true
|
||
auto-whitelist-on-swarm: true
|
||
allow-soft-restart: true
|
||
tps-emergency-threshold: 12
|
||
cpu-emergency-threshold: 92.0
|
||
memory-emergency-threshold: 95.0
|
||
max-recovery-actions-per-hour: 8
|
||
|
||
super-evolution:
|
||
# === v3.1 超进化安全模块开关 ===
|
||
jwt-auth: true # JWT身份认证与令牌管理
|
||
brute-force: true # 暴力破解防护（多时间窗口检测）
|
||
anti-bot: true # 反机器人检测（Bot名称/加入速率/IP关联）
|
||
reverse-shell: true # 反向Shell检测（50+ shell模式匹配）
|
||
arp-spoof: true # ARP欺骗检测（MAC变更/网关伪造）
|
||
dns-tunnel: true # DNS隧道检测（熵值/Base32编码/可疑TLD）
|
||
exploit-signature: true # 漏洞签名检测（Log4Shell/SQLi/RCE等15种）
|
||
ssrf: true # SSRF防护（内网IP/云元数据/协议限制）
|
||
xxe: true # XXE防护（实体注入/Billion Laughs检测）
|
||
csp: true # CSP安全头强制执行（8种响应头）
|
||
database-firewall: true # 数据库防火墙（SQL注入/联合查询/时间盲注）
|
||
dlp: true # 数据防泄漏（12种敏感信息规则+自动脱敏）
|
||
memory-protection: true # JVM内存保护（堆/GC/内存泄漏检测）
|
||
process-injection: true # 进程注入检测（/proc扫描/线程异常）
|
||
secure-delete: true # 安全文件删除（多道覆写DoD标准）
|
||
forensics: true # 取证收集（进程/网络/日志快照）
|
||
incident-response: true # 事件响应（5种预定义响应剧本）
|
||
threat-hunting: true # 威胁狩猎（10种狩猎定义/5个类别）
|
||
compliance: true # 合规扫描（7类20+检查项）
|
||
anti-grief: true # 反破坏检测（方块破坏率/TNT/纵火/偷箱）
|
||
# === v3.2 Minecraft专属模块开关 ===
|
||
anti-xray: true # X-ray透视检测（钻石比/直线挖掘/暗处精准）
|
||
anti-fly: true # 飞行外挂检测（垂直/水平速度/悬空时间）
|
||
anti-dupe: true # 物品复制检测（堆叠异常/高价值暴涨/9种复制法）
|
||
crash-exploit: true # 崩溃漏洞防护（超大包/NBT炸弹/书与笔攻击）
|
||
lag-machine: true # 卡服机检测（Observer链/TNT堆/红石密度）
|
||
# === v3.3 新模块开关 ===
|
||
geo-block: true # 地理IP封锁（按国家/地区拦截）
|
||
session-validation: true # 玩家会话验证（UUID伪造/正版/离线检测）
|
||
plugin-verification: true # 插件完整性校验（Hash对比/未授权修改）
|
||
connection-throttle: true # 连接速率限制（IP/时间窗口/递增延迟）
|
||
backup-integrity: true # 备份完整性校验（SHA-256/文件计数/大小对比）
|
||
anti-skin-spoof: true # 皮肤伪造检测（模型数据异常/皮肤URL检测）
|
||
|
||
dashboard:
|
||
enabled: true
|
||
title: Aluer Nebula Console
|
||
subtitle: PaperMC defense, recovery, and remote operations fabric
|
||
refresh-interval-seconds: 6
|
||
compact-terminal: true
|
||
ssh-gateway:
|
||
enabled: true
|
||
session-timeout-minutes: 30
|
||
max-sessions: 6
|
||
command-timeout-seconds: 25
|
||
strict-host-key-checking: false
|
||
allow-private-key-paste: true
|
||
require-engine-handshake: true
|
||
handshake-ttl-seconds: 30
|
||
|
||
webhook:
|
||
enabled: false
|
||
discord-url: ${ALUER_WEBHOOK_DISCORD:}
|
||
slack-url: ${ALUER_WEBHOOK_SLACK:}
|
||
|
||
report:
|
||
dir: ./reports
|
||
|
||
server:
|
||
port: 8080
|
||
|
||
spring:
|
||
shell:
|
||
interactive:
|
||
enabled: true
|
||
command:
|
||
init:
|
||
delay: 0
|
||
|
||
logging:
|
||
level:
|
||
root: INFO
|
||
com.aluer: INFO
|
||
file:
|
||
name: /var/log/serverguard.log
|