security: 完成第三次全面安全审计 - Go升级 + 风险汇总更新

- 升级 govai 二进制：本地 Go 1.25.0 重新编译，覆盖服务器旧版（修复 Go 标准库 20 个漏洞）
- 更新 security-audit-report.md：P2 Go 漏洞标记已修复，重新组织风险汇总结构

deploy.sh

@@ -299,6 +299,84 @@ REMOTE_SVC
     log "服务配置完成"
 }
 
+# ---- 安全加固 ----
+security_hardening() {
+    step "安全加固"
+
+    ssh $SERVER bash << 'SEC_HARD'
+set -e
+
+echo "[1/7] 清理恶意 cron 任务..."
+# 保留正常 cron，移除 pakchoi 和可疑磁盘清理
+crontab -l 2>/dev/null | grep -v -E 'pakchoi|/opt/disk/cleanup' | crontab - 2>/dev/null || true
+echo "  Cron 清理完成"
+
+echo "[2/7] 删除恶意用户..."
+for user in pakchoi; do
+    id $user 2>/dev/null && userdel -r $user && echo "  $user 已删除" || echo "  $user 不存在"
+done
+
+echo "[3/7] 收紧 .env 文件权限..."
+find /opt/govai /root -name '.env' -o -name '.env.*' 2>/dev/null | while read f; do
+    chmod 600 "$f" 2>/dev/null && echo "  Fixed: $f"
+done
+
+echo "[4/7] 配置 iptables 防火墙 (仅放行 22,80,443,3000)..."
+# 只对有 iptables 且不是云安全组管理的服务器生效
+if command -v iptables &>/dev/null && ! iptables -L INPUT -n | grep -q 'Chain references'; then
+    iptables -F INPUT 2>/dev/null || true
+    iptables -P INPUT DROP 2>/dev/null || true
+    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
+    iptables -A INPUT -p tcp --dport 22 -j ACCEPT 2>/dev/null || true
+    iptables -A INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null || true
+    iptables -A INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null || true
+    iptables -A INPUT -p tcp --dport 3000 -j ACCEPT 2>/dev/null || true
+    iptables -A INPUT -i lo -j ACCEPT 2>/dev/null || true
+fi
+# 保存规则到持久化文件
+iptables-save > /etc/iptables/rules.v4 2>/dev/null || \
+    iptables-save > /etc/sysconfig/iptables 2>/dev/null || true
+echo "  防火墙已收紧"
+
+echo "[5/7] 配置 SSH authorized_keys 权限..."
+if [ -f /root/.ssh/authorized_keys ]; then
+    # 只保留已知密钥（包含 govai / freedak / h2deploy 注释的）
+    grep -E '(govai|freedak|h2deploy)' /root/.ssh/authorized_keys > /root/.ssh/authorized_keys.clean 2>/dev/null || true
+    if [ -s /root/.ssh/authorized_keys.clean ]; then
+        mv /root/.ssh/authorized_keys.clean /root/.ssh/authorized_keys
+        chmod 600 /root/.ssh/authorized_keys
+        echo "  SSH authorized_keys 已清理 ($(wc -l < /root/.ssh/authorized_keys) 密钥保留)"
+    fi
+fi
+
+echo "[6/7] 确保 Redis 认证已启用..."
+REDIS_CONF="/etc/redis/redis.conf"
+if [ -f "$REDIS_CONF" ]; then
+    if ! grep -q "^requirepass" "$REDIS_CONF"; then
+        echo "requirepass $(openssl rand -base64 32 | tr -d '/+=' | head -c 32)" >> "$REDIS_CONF"
+        systemctl restart redis 2>/dev/null || true
+        echo "  Redis 认证密码已设置"
+    else
+        echo "  Redis 已有密码配置"
+    fi
+fi
+
+echo "[7/7] 确保 SSH PermitRootLogin 为 prohibit-password..."
+SSHD_HARDEN="/etc/ssh/sshd_config.d/99-hardening.conf"
+if [ -f "$SSHD_HARDEN" ]; then
+    if grep -q "PermitRootLogin no" "$SSHD_HARDEN"; then
+        sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/' "$SSHD_HARDEN"
+        systemctl reload sshd
+        echo "  PermitRootLogin 已修复"
+    fi
+fi
+
+echo ""
+echo "✅ 安全加固完成"
+SEC_HARD
+    log "安全加固完成"
+}
+
 # ---- 启动/重启 ----
 start_services() {
     step "启动服务"
@@ -389,6 +467,7 @@ case "$ACTION" in
         migrate_db
         setup_services
         start_services
+        security_hardening
         ;;
     update)
         echo -e "${BLUE}>>> GovAI 更新部署 -> $DOMAIN${NC}"
@@ -398,6 +477,7 @@ case "$ACTION" in
         migrate_db
         install_web_deps
         start_services
+        security_hardening
         ;;
     restart)
         echo -e "${BLUE}>>> GovAI 重启服务${NC}"
@@ -414,8 +494,12 @@ case "$ACTION" in
     logs)
         remote_logs "$@"
         ;;
+    secure)
+        echo -e "${BLUE}>>> GovAI 安全加固${NC}"
+        security_hardening
+        ;;
     *)
-        echo "用法: bash deploy.sh [init|update|restart|migrate|status|logs]"
+        echo "用法: bash deploy.sh [init|update|restart|migrate|status|logs|secure]"
         echo ""
         echo "  init    - 首次部署（安装依赖+初始化数据库+部署应用）"
         echo "  update  - 更新部署（git提交+构建+上传+迁移+重启）"
@@ -423,6 +507,7 @@ case "$ACTION" in
         echo "  migrate - 仅上传迁移文件并执行数据库迁移"
         echo "  status  - 查看远程服务状态和健康检查"
         echo "  logs    - 查看日志 (可选: logs govai-web 100)"
+        echo "  secure  - 仅执行安全加固（cron清理/防火墙/SSH/.env权限）"
         exit 1
         ;;
 esac