Github<\/a><\/p>\n \u53d7\u63a7\u6587\u4ef6\u4ea4\u6362\u7cfb\u7edf<\/p>\n \u672c\u7248\u672c\u53ef\u76f4\u63a5\u90e8\u7f72\u5230 Rocky Linux \uff0c\u56fa\u5b9a\u76d1\u542c\u540c\u4e00 IP \u7684\u4e24\u4e2a\u5165\u53e3\uff1a<\/p>\n \u4e24\u4e2a\u7aef\u53e3\u662f\u903b\u8f91\u5165\u53e3\u533a\u5206<\/strong>\uff0c\u4e0d\u662f\u7f51\u95f8\u6216\u7269\u7406\u9694\u79bb\u3002\u5fc5\u987b\u5728 firewalld\u3001VLAN \u6216\u4e0a\u6e38 ACL \u4e2d\u9650\u5236\uff1a\u529e\u516c\u7f51\u53ea\u80fd\u8bbf\u95ee 8080\uff0c\u7814\u53d1\u7f51\u53ea\u80fd\u8bbf\u95ee 8081\u3002<\/p>\n <\/p>\n \u5728 Rocky \u4e0a\u5c06\u9879\u76ee\u62f7\u8d1d\u5230\u00a0 \u5df2\u90e8\u7f72\u7684 Rocky \u670d\u52a1\u5668\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\uff0c\u53ef\u81ea\u52a8\u5907\u4efd\u3001\u62c9\u53d6\u6700\u65b0\u4ee3\u7801\u3001\u66f4\u65b0\u4f9d\u8d56\u5e76\u91cd\u542f\u670d\u52a1\uff1a<\/p>\n \u811a\u672c\u9ed8\u8ba4\u5347\u7ea7\u00a0 \u5148\u5728\u00a0 \u9996\u6b21\u670d\u52a1\u542f\u52a8\u4f1a\u521b\u5efa\u7ba1\u7406\u5458\uff1b\u968f\u540e\u4ece\u73af\u5883\u6587\u4ef6\u5220\u9664\u00a0 \u4f7f\u7528\u53ea\u8bfb\u670d\u52a1\u8d26\u53f7\u4e0e\u4f01\u4e1a CA \u8bc1\u4e66\uff0c\u7981\u6b62\u00a0 AD \u7528\u6237\u9996\u6b21\u6210\u529f\u8ba4\u8bc1\u624d\u521b\u5efa\u672c\u5730\u8eab\u4efd\u8bb0\u5f55\uff1b\u975e\u6620\u5c04\u7ec4\u9ed8\u8ba4\u666e\u901a\u7528\u6237\u3002\u4e0d\u8981\u521b\u5efa\u4e0e AD \u7528\u6237\u540c\u540d\u7684\u672c\u5730\u8d26\u6237\u3002<\/p>\n \u672c\u7cfb\u7edf\u4ecd\u4e0d\u5305\u542b\u7f51\u95f8\u3001\u591a\u5f15\u64ce\u6740\u6bd2\u3001\u6c99\u7bb1\u3001CDR\u3001\u771f\u5b9e DLP\u3001HA \u6216\u4e0d\u53ef\u7be1\u6539\u5ba1\u8ba1\uff0c\u6d89\u5bc6\/\u9ad8\u4fdd\u5bc6\u573a\u666f\u5fc5\u987b\u5728\u8fd9\u4e9b\u80fd\u529b\u4e4b\u4e0a\u5efa\u8bbe\u3002<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" \u9879\u76ee\u5730\u5740\uff1a Gitee Github \u53d7\u63a7\u6587\u4ef6\u4ea4\u6362\u7cfb\u7edf \u672c\u7248\u672c\u53ef\u76f4\u63a5\u90e8\u7f72\u5230 Rocky Linux \uff0c\u56fa\u5b9a\u76d1\u542c […]<\/p>\n","protected":false},"author":1,"featured_media":1177,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[128,69],"tags":[179,91],"class_list":["post-2059","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-128","category-69","tag-179","tag-91"],"_links":{"self":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/2059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2059"}],"version-history":[{"count":3,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/2059\/revisions"}],"predecessor-version":[{"id":2070,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/posts\/2059\/revisions\/2070"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=\/wp\/v2\/media\/1177"}],"wp:attachment":[{"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rchen.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
https:\/\/IP:8080<\/code><\/li>\nhttps:\/\/IP:8081<\/code><\/li>\n<\/ul>\n<\/a>\u529f\u80fd<\/h2>\n
\n
user<\/code>\u3001approver<\/code>\u3001admin<\/code>\u3002<\/li>\nHttpOnly<\/code>\/SameSite=Strict<\/code>\u00a0Cookie\u3001CSRF \u6821\u9a8c\u548c\u672c\u5730\u5bc6\u7801 scrypt \u54c8\u5e0c\u3002<\/li>\n![\"\"](\"http:\/\/www.rchen.top\/wp-content\/uploads\/2026\/07\/\u5c4f\u5e55\u622a\u56fe-2026-07-21-102214-2.png\")
<\/p>\n![\"\"](\"http:\/\/www.rchen.top\/wp-content\/uploads\/2026\/07\/\u5c4f\u5e55\u622a\u56fe-2026-07-21-102407-2.png\")
<\/p>\n![\"\"](\"http:\/\/www.rchen.top\/wp-content\/uploads\/2026\/07\/\u5c4f\u5e55\u622a\u56fe-2026-07-21-102440-1.png\")
<\/p>\n<\/a>\u90e8\u7f72<\/h2>\n
\/opt\/secure-file-exchange<\/code>\u00a0\u540e\u6267\u884c\uff1a<\/p>\nsudo bash deploy\/rocky-install.sh\r\nsudo install -m 0640 -o root -g sfx deploy\/sfx.env.example \/etc\/secure-file-exchange\/sfx.env\r\nsudo vi \/etc\/secure-file-exchange\/sfx.env\r\nsudo systemctl enable<\/span> --now secure-file-exchange\r\n<\/code><\/pre>\n<\/a>\u4e00\u952e\u5347\u7ea7<\/h2>\n
cd<\/span> \/opt\/secure-file-exchange\r\nsudo .\/deploy\/rocky-upgrade.sh\r\n<\/code><\/pre>\ncodex\/secure-file-exchange-system<\/code>\u00a0\u5206\u652f\uff0c\u5907\u4efd\u4fdd\u5b58\u5230\u00a0\/var\/backups\/secure-file-exchange\/<\u65f6\u95f4\u6233>\/<\/code>\u3002\u68c0\u6d4b\u5230\u672c\u673a\u672a\u63d0\u4ea4\u4ee3\u7801\u65f6\u4f1a\u5b89\u5168\u505c\u6b62\uff0c\u4e0d\u4f1a\u5f3a\u5236\u8986\u76d6\u3002<\/p>\nsfx.env<\/code>\u00a0\u8bbe\u7f6e\u4e00\u6b21\u6027\u521d\u59cb\u7ba1\u7406\u5458\uff08\u81f3\u5c11 8 \u4f4d\u5bc6\u7801\uff09\uff1a<\/p>\nBOOTSTRAP_ADMIN_USERNAME<\/span>=sfxadmin\r\nBOOTSTRAP_ADMIN_PASSWORD<\/span>=replace-with-a-long-random-secret\r\n<\/code><\/pre>\nBOOTSTRAP_ADMIN_PASSWORD<\/code>\u00a0\u5e76\u6267\u884c\u00a0sudo systemctl restart secure-file-exchange<\/code>\u3002<\/p>\n<\/a>AD \/ Microsoft Active Directory<\/h2>\n
ldap:\/\/<\/code>\u00a0\u548c\u8df3\u8fc7\u8bc1\u4e66\u6821\u9a8c\uff1a<\/p>\nLDAP_URL<\/span>=ldaps:\/\/ad.example.local:636<\/span>\r\nLDAP_BIND_DN<\/span>=CN=sfx-reader,OU=Service Accounts,DC=example,DC=local\r\nLDAP_BIND_PASSWORD<\/span>=replace-this-secret\r\nLDAP_BASE_DN<\/span>=DC=example,DC=local\r\nLDAP_TLS_CA_FILE<\/span>=\/etc\/pki\/ca-trust\/source\/anchors\/ad-ca.pem\r\nLDAP_ADMIN_GROUPS<\/span>=CN=SFX-Admins,OU=Groups,DC=example,DC=local\r\nLDAP_APPROVER_GROUPS<\/span>=CN=SFX-Approvers,OU=Groups,DC=example,DC=local\r\n<\/code><\/pre>\n<\/a>\u5fc5\u987b\u5b8c\u6210\u7684\u7f51\u7edc\u4e0e\u5b89\u5168\u9879<\/h2>\n
\n
TLS_CERT_FILE<\/code>\u3001TLS_KEY_FILE<\/code>\u00a0\u548c\u00a0COOKIE_SECURE=true<\/code>\uff0c\u4f7f\u7528 HTTPS\u3002<\/li>\nOFFICE_CIDR<\/code>\u00a0\u548c\u00a0RD_CIDR<\/code>\uff0c\u5206\u522b\u653e\u884c 8080\u30018081\uff1b\u4e0d\u8981\u5728 public zone \u5f00\u653e\u4e24\u4e2a\u7aef\u53e3\u3002<\/li>\n\/var\/lib\/secure-file-exchange<\/code>\u00a0\u4e0e\u00a0\/etc\/secure-file-exchange\/sfx.env<\/code>\uff08\u52a0\u5bc6\u4fdd\u5b58\uff09\u3002<\/li>\n<\/ol>\n<\/a>\u9a8c\u6536<\/h2>\n
\n
systemctl is-active secure-file-exchange<\/code>\u00a0\u663e\u793a\u00a0active<\/code>\u3002<\/li>\n.exe<\/code>\u00a0\u6216\u542b\u00a0SECRET<\/code>\u00a0\u7684 TXT\uff0c\u5fc5\u987b\u62d2\u7edd\u3002<\/li>\n