Debian 漏洞修复与 Exploit 处置流程
一、快速处置流程
sudo apt update && sudo apt upgradesudo apt autoremovesudo systemctl restart nginxsudo rebootsudo journalctl -xe、cat /var/log/apt/history.log二、确保能获取安全更新
/etc/apt/sources.list 或 /etc/apt/sources.list.d/ 中包含 security.debian.org 的安全源,例如:
deb http://security.debian.org/debian-security bullseye-security maindeb http://security.debian.org/debian-security bookworm-security mainsudo apt update && sudo apt upgradesudo apt install unattended-upgradessudo dpkg-reconfigure unattended-upgrades(选择自动安装安全更新)sudo unattended-upgrade --dry-run -d(检查将要执行的更新)三、按场景修复与验证
sudo apt install --only-upgrade nginx openssh-server postfixsudo systemctl restart nginx(或 ssh、postfix)apt list --installed | grep <包名>zless /usr/share/doc/<包名>/changelog.Debian.gz | grep -i CVE-sudo apt upgrade(含 linux-image、linux-headers 等)sudo update-grubsudo rebootuname -r,并比对内核包的 changelog 是否包含目标 CVE 修复说明四、事件响应与加固
sudo ss -tulpen | grep ESTAB、sudo lsof -isudo journalctl -xe、sudo tail -n 200 /var/log/auth.logsudo ufw enable,仅开放必要端口(如 22/80/443)