Linux文件管理：怎样保护敏感文件安全

<code>chmod 600 critical_file.txt  # 仅文件拥有者可读写
chmod 700 folder_name         # 仅文件夹拥有者可读、写及执行</code>

<code>chown user:critical_group critical_file.txt
chgrp critical_group folder_name</code>

<code>setfacl -m u:user:rwx critical_file.txt
setfacl -m g:critical_group:rwx folder_name</code>

<code>gpg --output encrypted_file.txt.gpg --encrypt --recipient your_email@example.com critical_file.txt</code>

<code>openssl enc -aes-256-cbc -salt -in critical_file.txt -out encrypted_file.txt.enc</code>

<code>cp -a critical_file.txt /backup/directory/</code>

<code>chcon system_u:object_r:critical_file_t:s0 critical_file.txt</code>

<code># /etc/apparmor.d/usr.sbin.myservice
/usr/sbin/myservice {
    /path/to/critical_file.txt r,
    /path/to/critical_folder/ r,
    deny /path/to/critical_folder/** rwk,
}</code>

<code>auditctl -a exit,always -F arch=b32 -S open -F path=/path/to/critical_file.txt -k critical_file_access
auditctl -a exit,always -F arch=b64 -S open -F path=/path/to/critical_file.txt -k critical_file_access</code>

<code>iptables -A INPUT -p tcp --dport 22 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP</code>

<code>sudo apt-get update && sudo apt-get upgrade</code>