零基础搭建涉密文书档案信息化系统全流程实操

一、环境准备与基础依赖安装

涉密系统的基础环境必须严格控制，推荐使用Ubuntu 20.04 LTS作为服务器基础环境。首先更新系统源并安装必要的开发工具与依赖库。

执行以下命令完成基础环境初始化：

```bash sudo apt-get update sudo apt-get install -y python3.9 python3-pip python3-venv nginx postgresql postgresql-contrib redis-server gcc g++ make ```

为了防止数据泄露，必须配置防火墙策略，仅开放SSH和必要的应用端口，关闭其他所有端口。执行以下命令配置UFW防火墙：

```bash sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow ssh sudo ufw allow 8000 sudo ufw --force enable ```

二、数据库加密存储配置

涉密文书档案的核心在于数据库的加密存储。我们将使用PostgreSQL作为主数据库，并配置透明数据加密（TDE）及SSL连接。首先修改PostgreSQL配置监听地址。

编辑配置文件 /etc/postgresql/12/main/postgresql.conf：

```bash sudo nano /etc/postgresql/12/main/postgresql.conf ```

将以下配置项粘贴到文件末尾，强制要求SSL连接并开启审计日志：

```ini listen_addresses = 'localhost' ssl = on ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem' ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key' log_connections = on log_disconnections = on log_statement = 'all' ```

接下来，配置 pg_hba.conf 文件，拒绝所有非SSL连接：

```bash sudo nano /etc/postgresql/12/main/pg_hba.conf ```

将文件末尾的IPv4连接配置修改为：

```ini hostssl all all 127.0.0.1/32 scram-sha-256 ```

重启数据库服务使配置生效：

```bash sudo systemctl restart postgresql ```

三、后端核心服务开发与部署

我们使用Python的FastAPI框架构建后端服务，实现档案的加密上传、下载及权限控制。首先创建项目目录并初始化虚拟环境：

```bash mkdir -p /opt/secret_archive_system cd /opt/secret_archive_system python3 -m venv venv source venv/bin/activate pip install fastapi uvicorn python-multipart python-jose[cryptography] passlib[bcrypt] sqlalchemy psycopg2-binary cryptography ```

创建 main.py 文件，编写核心业务逻辑。该代码包含用户认证、文件加密存储及三员管理（系统管理员、安全保密员、安全审计员）的基础逻辑。

```python from fastapi import FastAPI, Depends, HTTPException, status, UploadFile, File from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm from passlib.context import CryptContext from jose import JWTError, jwt from datetime import datetime, timedelta from sqlalchemy import create_engine, Column, Integer, String, LargeBinary, DateTime from sqlalchemy.ext.declarative import declarative_base from sqlalchemy.orm import sessionmaker, Session import os from cryptography.fernet import Fernet 配置部分 SECRET_KEY = "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7" ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 30 生成加密密钥（实际生产中请从安全配置文件读取） KEY = Fernet.generate_key() cipher_suite = Fernet(KEY) 数据库连接 SQLALCHEMY_DATABASE_URL = "postgresql://postgres:yourpassword@localhost/secret_db" engine = create_engine(SQLALCHEMY_DATABASE_URL) SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine) Base = declarative_base() 数据模型 class User(Base): __tablename__ = "users" id = Column(Integer, primary_key=True, index=True) username = Column(String, unique=True, index=True) hashed_password = Column(String) role = Column(String) admin, security, auditor class Document(Base): __tablename__ = "documents" id = Column(Integer, primary_key=True, index=True) filename = Column(String) encrypted_content = Column(LargeBinary) uploader = Column(String) upload_time = Column(DateTime) Base.metadata.create_all(bind=engine) app = FastAPI() pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token") 辅助函数 def get_db(): db = SessionLocal() try: yield db finally: db.close() def verify_password(plain_password, hashed_password): return pwd_context.verify(plain_password, hashed_password) def get_password_hash(password): return pwd_context.hash(password) def create_access_token(data: dict): to_encode = data.copy() expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) to_encode.update({"exp": expire}) encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) return encoded_jwt async def get_current_user(token: str = Depends(oauth2_scheme), db: Session = Depends(get_db)): credentials_exception = HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"}, ) try: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) username: str = payload.get("sub") if username is None: raise credentials_exception except JWTError: raise credentials_exception user = db.query(User).filter(User.username == username).first() if user is None: raise credentials_exception return user 接口实现 @app.post("/token") async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: Session = Depends(get_db)): user = db.query(User).filter(User.username == form_data.username).first() if not user or not verify_password(form_data.password, user.hashed_password): raise HTTPException(status_code=400, detail="Incorrect username or password") access_token = create_access_token(data={"sub": user.username}) return {"access_token": access_token, "token_type": "bearer"} @app.post("/upload/") async def upload_document(file: UploadFile = File(...), current_user: User = Depends(get_current_user), db: Session = Depends(get_db)): if current_user.role not in ["admin", "security"]: raise HTTPException(status_code=403, detail="Permission denied") content = await file.read() 加密文件内容 encrypted_content = cipher_suite.encrypt(content) doc = Document(filename=file.filename, encrypted_content=encrypted_content, uploader=current_user.username, upload_time=datetime.utcnow()) db.add(doc) db.commit() return {"status": "success", "message": "Document encrypted and saved"} @app.get("/documents/") async def list_documents(current_user: User = Depends(get_current_user), db: Session = Depends(get_db)): docs = db.query(Document).all() return [{"id": d.id, "filename": d.filename, "uploader": d.uploader, "upload_time": d.upload_time} for d in docs] 初始化管理员用户（仅在首次运行时需要） def init_admin(): db = SessionLocal() if not db.query(User).filter(User.username == "admin").first(): admin = User(username="admin", hashed_password=get_password_hash("admin123"), role="admin") db.add(admin) db.commit() db.close() init_admin() ```

启动后端服务：

```bash nohup uvicorn main:app --host 0.0.0.0 --port 8000 > server.log 2>&1 & ```

四、前端安全展示与水印技术

前端界面需实现屏幕水印功能，防止通过截屏泄密。创建 /var/www/html/index.html 文件：

```html ```

五、Nginx反向代理与HTTPS配置

为了保证传输层安全，必须配置HTTPS。首先生成自签名证书（生产环境请申请正规CA证书）：

```bash sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/cert.key -out /etc/nginx/cert.crt ```

配置Nginx反向代理，编辑 /etc/nginx/sites-available/default：

```nginx server { listen 80; server_name _; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name _; ssl_certificate /etc/nginx/cert.crt; ssl_certificate_key /etc/nginx/cert.key; location / { root /var/www/html; index index.html; } location /api/ { proxy_pass http://127.0.0.1:8000/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ```

重启Nginx服务：

```bash sudo systemctl restart nginx ```

六、系统安全加固与审计

对系统内核参数进行加固，禁用不必要的USB存储等。编辑 /etc/sysctl.conf，添加以下内容：

```ini 禁用核心转储 kernel.core_pattern = /dev/null 禁用包转发 net.ipv4.ip_forward = 0 启用源地址验证 net.ipv4.conf.all.rp_filter = 1 ```

执行命令应用配置：

```bash sudo sysctl -p ```

配置SSH服务，禁止Root远程登录并强制使用密钥认证。编辑 /etc/ssh/sshd_config：

```ini PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes ```

重启SSH服务：

```bash sudo systemctl restart sshd ```

至此，一套具备基础涉密防护能力的文书档案信息化系统已搭建完成。系统包含了传输层加密、存储层加密、三员权限分离、前端防截屏水印以及系统层面的安全加固。