避免qemu-guest-agent的exec在商家被黑时让你的VPS“飞起来”

今日不少VPS服务商都被爆出了宿主机或管理面板被入侵导致其中VPS也被连带入侵，尽管宿主机被入侵后能对VPS做任何事，作为用户没有万全的防御手段，但目前hostdzire、greencloud等商家的事件来看，利用qemu-guest-agent的guest-exec通道直接在VPS内执行木马部署命令是最常见且低成本的，其他写盘之类的途径对于攻击者而言也比较繁琐，对于低价值目标不常见。因此先断掉这条路径是既低成本又没什么副作用的。（另外也记得要改掉初始root密码）

然而直接完全禁用qemu-guest-agent可能会带来副作用，包括可能会影响安全关机和备份功能（依赖guest-fsfreeze相关调用，否则有可能产生文件系统损坏的备份）

因此更合理的方式是设置qemu-guest-agent白名单，允许安全关机、fsfreeze、占用量读取等安全的调用，禁止其他不安全的调用。修改/etc/qemu/qemu-ga.conf如下：

[general]
allow-rpcs=guest-sync-delimited,guest-sync,guest-ping,guest-info,guest-get-osinfo,guest-get-host-name,guest-network-get-interfaces,guest-get-time,guest-shutdown,guest-fsfreeze-status,guest-fsfreeze-freeze,guest-fsfreeze-freeze-list,guest-fsfreeze-thaw,guest-get-fsinfo,guest-get-disks,guest-get-vcpus,guest-get-timezone,guest-get-memory-block-info,guest-get-memory-blocks,guest-get-diskstats,guest-get-cpustats,guest-get-load,guest-network-get-route,guest-fstrim

注意：旧版系统的配置项名称不同，可能无效，建议使用下面的一键脚本，如果不兼容会报错：

sudo bash <<'SH'
set -euo pipefail

CONF=/etc/qemu/qemu-ga.conf
SERVICE=qemu-guest-agent.service

command -v qemu-ga >/dev/null || {
    echo "ERROR: qemu-ga not installed"
    exit 1
}

[[ "$(qemu-ga --help 2>&1)" == *"--allow-rpcs"* ]] || {
    echo "ERROR: This QGA version does not support allow-rpcs"
    exit 1
}

mkdir -p /etc/qemu

BACKUP=""
if [ -f "$CONF" ]; then
    BACKUP="${CONF}.bak.$(date +%Y%m%d-%H%M%S)"
    cp -a "$CONF" "$BACKUP"
fi

cat > "$CONF" <<'EOF'
[general]
allow-rpcs=guest-sync-delimited,guest-sync,guest-ping,guest-info,guest-get-osinfo,guest-get-host-name,guest-network-get-interfaces,guest-get-time,guest-shutdown,guest-fsfreeze-status,guest-fsfreeze-freeze,guest-fsfreeze-freeze-list,guest-fsfreeze-thaw,guest-get-fsinfo,guest-get-disks,guest-get-vcpus,guest-get-timezone,guest-get-memory-block-info,guest-get-memory-blocks,guest-get-diskstats,guest-get-cpustats,guest-get-load,guest-network-get-route,guest-fstrim
EOF

chmod 644 "$CONF"

if ! qemu-ga --dump-conf >/dev/null ||
   ! systemctl restart "$SERVICE" ||
   ! systemctl is-active --quiet "$SERVICE"; then
    echo "ERROR: Configuration failed, rolling back"
    if [ -n "$BACKUP" ]; then
        cp -a "$BACKUP" "$CONF"
    else
        rm -f "$CONF"
    fi
    systemctl restart "$SERVICE" || true
    exit 1
fi

echo "SUCCESS: QGA whitelist configured"
echo "Allowed RPCs: $(grep '^allow-rpcs=' "$CONF" | tr ',' '\n' | wc -l)"
echo "Backup: ${BACKUP:-none (new configuration)}"
qemu-ga --dump-conf | grep '^allow-rpcs='
SH