Как понять, что сервер безопасный

Ответ

Как понять, что сервер безопасный

Безопасность сервера — комплексное понятие, включающее различные аспекты от конфигурации до кода приложения. Рассмотрим ключевые показатели и методы проверки.

1. Проверка SSL/TLS сертификата

openssl s_client -connect example.com:443 -showcerts

import javax.net.ssl.HttpsURLConnection;
import java.net.URL;
import java.security.cert.X509Certificate;

public class CertificateValidator {
    public static void validateServerCertificate(String urlString) throws Exception {
        URL url = new URL(urlString);
        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
        java.security.cert.Certificate[] certificates = connection.getServerCertificates();
        
        for (java.security.cert.Certificate cert : certificates) {
            if (cert instanceof X509Certificate) {
                X509Certificate x509 = (X509Certificate) cert;
                System.out.println("Subject: " + x509.getSubjectDN());
                System.out.println("Valid Until: " + x509.getNotAfter());
            }
        }
        connection.disconnect();
    }
}

2. SQL Injection Protection

public class SQLSecurityCheck {
    public static void unsafeQuery(String userId) throws Exception {
        String query = "SELECT * FROM users WHERE id = " + userId;
    }
    
    public static void safeQuery(String userId, java.sql.Connection conn) throws Exception {
        String query = "SELECT * FROM users WHERE id = ?";
        java.sql.PreparedStatement stmt = conn.prepareStatement(query);
        stmt.setString(1, userId);
        java.sql.ResultSet rs = stmt.executeQuery();
    }
}

3. XSS Prevention

public class XSSSecurityCheck {
    public static String escapeHtml(String input) {
        if (input == null) return "";
        return input
            .replace("&", "&")
            .replace("<", "&lt;")
            .replace(">", "&gt;")
            .replace("\"", "&quot;")
            .replace("'", "&#39;");
    }
}

4. Password Security

public class AuthSecurityCheck {
    public static boolean isWeakPassword(String password) {
        if (password == null || password.length() < 12) {
            return true;
        }
        boolean hasLower = password.matches(".*[a-z].*");
        boolean hasUpper = password.matches(".*[A-Z].*");
        boolean hasDigit = password.matches(".*\\d.*");
        boolean hasSpecial = password.matches(".*[!@#$%^&*].*");
        return !(hasLower && hasUpper && hasDigit && hasSpecial);
    }
}

5. Security Headers Check

public class SecurityHeadersChecker {
    private static final String[] SECURITY_HEADERS = {
        "Strict-Transport-Security",
        "X-Content-Type-Options",
        "X-Frame-Options",
        "X-XSS-Protection",
        "Content-Security-Policy"
    };
    
    public static void checkHeaders(String urlString) throws Exception {
        URL url = new URL(urlString);
        java.net.HttpURLConnection conn = (java.net.HttpURLConnection) url.openConnection();
        
        java.util.Map<String, java.util.List<String>> headers = conn.getHeaderFields();
        for (String header : SECURITY_HEADERS) {
            java.util.List<String> values = headers.get(header);
            if (values != null && !values.isEmpty()) {
                System.out.println("OK: " + header);
            } else {
                System.out.println("MISSING: " + header);
            }
        }
        conn.disconnect();
    }
}

6. CSRF Token Generation

public class CSRFSecurityCheck {
    public static String generateCSRFToken() throws Exception {
        byte[] randomBytes = new byte[32];
        new java.security.SecureRandom().nextBytes(randomBytes);
        java.security.MessageDigest digest = java.security.MessageDigest.getInstance("SHA-256");
        byte[] hash = digest.digest(randomBytes);
        return java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(hash);
    }
}

7. Rate Limiting

static class RateLimiter {
    private final java.util.Map<String, java.util.Deque<Long>> attempts = 
        new java.util.concurrent.ConcurrentHashMap<>();
    
    public boolean isAllowed(String userId) {
        long now = System.currentTimeMillis();
        long timeWindow = 15 * 60 * 1000;
        java.util.Deque<Long> userAttempts = attempts.computeIfAbsent(
            userId, k -> new java.util.concurrent.ConcurrentLinkedDeque<>()
        );
        
        while (!userAttempts.isEmpty() && userAttempts.peek() < now - timeWindow) {
            userAttempts.poll();
        }
        
        if (userAttempts.size() >= 5) {
            return false;
        }
        userAttempts.add(now);
        return true;
    }
}

8. Dependency Vulnerability Scan

mvn org.owasp:dependency-check-maven:check
gradle dependencyCheckAnalyze

9. Security Logging

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class SecurityLogging {
    private static final Logger logger = LoggerFactory.getLogger(SecurityLogging.class);
    
    public static void logSecurityEvent(String userId, String event, boolean success) {
        if (success) {
            logger.info("Security: User {} {}", userId, event);
        } else {
            logger.warn("Security FAILED: User {} {}", userId, event);
        }
    }
}

10. Encryption Support

public class EncryptionCheck {
    public static void checkEncryption() throws Exception {
        javax.crypto.KeyGenerator kg = javax.crypto.KeyGenerator.getInstance("AES");
        kg.init(256);
        System.out.println("AES-256 supported");
    }
}

Чеклист безопасности

Лучшие практики

1. HTTPS с валидным сертификатом
2. Все системы обновлены
3. Используй prepared statements
4. Санитизируй входные данные
5. Strong passwords с bcrypt
6. Security headers правильно настроены
7. Логируй security события
8. Проверяй зависимости на CVE
9. Используй rate limiting
10. Проводи регулярные security audits

Безопасность — это процесс, а не одноразовое действие. Требуется постоянное мониторирование и обновление.