TWM597904U - Servo host configuration setting management system - Google Patents

Abstract

The present invention relates to a server host configuration setting management system. More than one managed server host is connected to a configuration management server host, the managed server host stores more than one configuration setting information and installs a configuration agent, and the managed server The configuration agent of the host obtains more than one configuration setting update information from the configuration management server host, and when the managed server host determines that the configuration setting information does not match the configuration setting update information, it will update in time according to the configuration setting update information Set the configuration setting information; update the configuration setting information in the managed server host in an automated manner to prevent the managed server host from being threatened by information, thereby improving the management, protection, and setting efficiency of information security settings. The purpose of correctness.

Description

Server host configuration setting management system

This model relates to a management system, especially a server host configuration setting management system.

The server host that provides application system services usually stores some sensitive information of the organization and users. To avoid service interruption due to malicious access or loss of sensitive information to the organization, management and maintenance personnel must install the latest information on the server host. In addition to the version operating system security update and anti-virus software, the configuration setting policy defined by the organization for the server host should be implemented to meet the current requirements for information security control and protection.

The configuration setting policy items for the server host include the password policy of the user account, the timeout lock of the operation idle, the upper limit of the log file capacity, and the disabling of non-essential system services. In the past, the maintenance and update of the configuration policy of the server host were usually handled by the management and maintenance personnel of the server host one by one. However, each management and maintenance personnel has different familiarity with the operating system or application software of the server host they are dealing with, and there may be setting errors due to incorrect understanding of the configuration setting policy or negligence in the setting method. In addition, as the organization side increases the number of server hosts year by year in response to business expansion, and in response to mainstream information security threats and organizational side management unit requirements, configuration settings policies need to be updated and new items added. However, a large number of server hosts The work time and manpower required to maintain, update, or set make it difficult for the organization to load. Therefore, how to effectively and timely manage the configuration settings of the server host has become a problem that the organization has to face.

In view of the above problems, the main purpose of the present invention is to provide a server host configuration setting management system, which stores the configuration settings that other server hosts defined by the organization should follow in a centralized control manner in the configuration management server host. Information (including the configuration and implementation details of each configuration item), and then the configuration agent installed in the server host is connected to the configuration management server host for regular and automatic updates to improve the efficiency of the configuration settings of the server host and confirm the settings In addition to implementing the situation and avoiding personnel errors due to negligence or misunderstanding, it can also ensure that the entire life cycle of the server host meets the security protection requirements, thereby improving the management, protection and configuration of information security settings through the update of the master-slave architecture The purpose of efficiency and correctness.

The main technical means adopted to achieve the above-mentioned purpose is to make the aforementioned server host configuration setting management system connect more than one managed server host to a configuration management server host, and the configuration management server host stores more than one group Status setting update information, the managed server host includes: A storage module to store more than one set of first configuration information; A connection module, connected to the configuration management server host to exchange information; A processing module, connecting the storage module and the connection module, and the processing module installs and executes a setting agent; Wherein, the configuration agent of the processing module sends an update request information to the configuration management server host, and the connection module obtains the configuration setting update information returned by the configuration management server host. The setting agent compares the first configuration setting information with the configuration setting update information. If it does not match, the setting agent of the processing module updates and sets the first configuration setting update information according to the configuration setting update information. A piece of configuration setting information is stored as a corresponding piece of second configuration setting information in the storage module instead.

According to the above system, by centrally managing the configuration setting update information provided to the managed server host for configuration settings in the configuration management server host, and the configuration agent in the managed server host will start from the The configuration setting update information obtained by the configuration management server host matches the first configuration setting information. When there is no match, the setting agent of the managed server host will set the configuration according to the configuration in time Update information Update the first configuration setting information, and replace the updated first configuration setting information with the corresponding second configuration setting information, which can effectively reduce the need to update the management one by one. In addition to the time and manpower spent on the configuration settings in the server host; and through centralized management to update the configuration settings update information; it can also avoid the configuration settings that update the settings in the same server host and cause configuration conflicts; Furthermore, by obtaining the configuration setting update information used to update the settings from the configuration management server host by the managed server host, it can also avoid the different operation methods of different information personnel, resulting in inconsistent update settings, errors or omissions. The problem of updating the settings is to improve the efficiency of the configuration settings of the server, confirm the implementation of the settings, and avoid personnel errors due to negligence or misunderstanding. It can also ensure that the complete life cycle of the server meets the security protection requirements. From the framework of the update method to achieve the purpose of improving the management and protection of information security settings, as well as the efficiency and accuracy of settings.

Regarding the first preferred embodiment of the new type of server host configuration management system, please refer to Figures 1 and 2. The new type of server host configuration management system is connected to one group by more than one managed server host 10 State management server host 20. The managed server host 10 stores more than one set of first configuration setting information and installs a setting agent, and the configuration management server host 20 stores more than one set of configuration update information. The managed server host 10 obtains configuration setting update information from the configuration management server host 20, and updates the first configuration setting information corresponding to the setting. The specific content will be described in subsequent paragraphs.

In this embodiment, the managed server host 10 can be a server device. The configuration management server host 20 can be a server device.

In this embodiment, the configuration setting update information includes a vulnerability detection report information, a system optimization proposal information, an information security notification information, an organization's self-defined control item information, and a government configuration benchmark ( Government Configuration Baseline (GCB) listed configuration benchmark project information, as well as the information provided by the National Information Communication Security Report Technical Service Center of the Executive Yuan. The actual setting target of the setting item can be a local security policy item, a system registry item, a system configuration file (Configuration File), a directory or file access permission setting, and The capacity or storage period setting of a log or transaction record file, etc. The foregoing is only an example and is not a limitation. It can be adjusted or added according to needs or information requested or shared by relevant governments and organizations.

Please refer to FIGS. 1 and 2, the managed server host 10 includes a connection module 11, a processing module 12, and a storage module 13, and the processing module 12 is connected to the connection module 11 and the storage module 13 respectively. In this embodiment, the connection module 11 has a wired network protocol to connect to the configuration management server host 20 via the wired network protocol and exchange information. The connection module 11 may specifically be a network card. The processing module 12 is used to execute the setting agent program and process the information received by the connection module 11. In this embodiment, the processing module 12 may be a CPU. The storage module 13 is used for storing the first configuration setting information, setting the related data or information of the agent, and other related data or information. In this embodiment, the storage module 13 may be a memory such as but not limited to a non-volatile memory (Dynamic Random Access Memory, DRAM), a hard disk (High Disk Drive, HDD), and a flash memory. Flash memory, or a solid-state drive (Solid-State Drive, Solid-State Disk, SSD), etc.

Regarding the specific operational relationship between the managed server host 10 and the configuration management server host 20, the setting agent executed by the processing module 12 sends an update request information to the connection module 11 according to the first configuration setting information. The configuration management server host 20. The configuration management server host 20 returns the corresponding configuration setting update information to the connection module 11 according to the received update request information, thereby enabling the managed server host 10 to receive the update request information from the configuration The management server host 20 exchanges and obtains corresponding configuration setting update information. In this embodiment, the configuration agent program executed by the processing module 12 periodically sends update request information to the configuration management server host 20 through the connection module 11 according to the first configuration configuration information at a fixed time.

Further, the setting agent executed by the processing module 12 compares the configuration setting update information received by the connection module 11 with the first configuration setting information. If the result of the comparison is a match, there is no need to update the setting The corresponding first configuration setting information; if the result of the comparison is a mismatch, the setting agent executed by the processing module 12 updates the corresponding first configuration setting information according to the configuration setting update information, and the processing module 12 The running configuration agent replaces and saves the updated first configuration configuration information as a corresponding piece of second configuration configuration information in the storage module 13, thereby completing the security protection update settings for the managed server host 10. To improve the management, protection, efficiency and accuracy of information security.

In this embodiment, the setting agent program executed by the processing module 12 can update the vulnerability detection report information, system optimization proposal information, information security notification information, control project information, and configuration information contained in the configuration settings. The first configuration setting information corresponding to the updated settings such as baseline project information and information security technical report information. The updated content includes, but is not limited to, local security policy items, system log file items, system configuration files, directory or file access authority settings, and log or transaction log file capacity or storage period settings.

In this embodiment, before the configuration agent executed by the processing module 12 updates the corresponding first configuration configuration information according to the configuration setting update information, the configuration agent executed by the processing module 12 will correspond to the first configuration The setting information is stored as a corresponding piece of historical configuration setting information in the storage module 13, so that when a problem occurs after updating the setting configuration settings, the corresponding second configuration setting information can be replaced by the corresponding historical configuration setting information Restoring the settings to the first configuration setting information before updating the settings can also improve the management and security of the configuration settings, the traceability of the version of the configuration settings, and the risk of changes to the update settings.

Regarding the second preferred embodiment of the present invention, please refer to Figs. 2 and 3. The second preferred embodiment has roughly the same technology as the previous embodiments, but the second preferred embodiment is further configured by the configuration management server host 20 Connect to more than one administrator electronic device 30, and the corresponding administrator in the organization side creates corresponding configuration setting update information through the administrator electronic device 30, and transmits it to the configuration management server 20 for storage via the network. For the corresponding managed server host 10 to download and obtain, and update the settings, thereby improving the manageability and scalability. In this embodiment, the administrator electronic device 30 can be a desktop computer, a notebook computer, or a tablet computer.

In addition, in this embodiment, if the setting agent executed by the processing module 12 of the managed server host 10 fails to update the first configuration setting information according to the configuration setting update information, it stops updating the setting and sends back An update failure information is sent to the configuration management server host 20 for the administrator to obtain the update failure information through the manager electronic device 30 and perform related update failure analysis. Wherein, when the number of failures to update the first configuration setting information corresponding to the processing module 12 of the managed server host 10 reaches a threshold, the update setting of the first configuration setting information is stopped, and the update failure is returned. Information is sent to the configuration management server host 20, where the number of times set by the threshold value can be but not limited to 2 times.

According to the above content, the configuration management server host 20 centrally manages the configuration setting update information provided to the managed server host 10 for configuration setting, and the setting agent executed by the managed server host 10 will Whether the configuration setting update information obtained by the configuration management server host 20 matches the first configuration setting information, when the result of the comparison is not a match, the setting agent of the managed server host 10 is timely Update and set the first configuration setting information according to the configuration setting update information, and replace the updated first configuration setting information with the corresponding second configuration setting information, so as to improve the server configuration In addition to the execution efficiency of state setting, confirming the setting implementation situation and avoiding personnel errors due to negligence or misunderstanding, it can also ensure that the complete life cycle of the server host meets the security protection requirements, and the update method of the master-slave structure achieves the improvement of information security settings. The purpose of management, protection, and efficiency and accuracy.

10: Managed server host 11: Connection module 12: Processing module 13: Storage module 20: Configuration management server host 30: Manager electronic device

FIG. 1 is a schematic diagram of the first system architecture of the first preferred embodiment of the present invention. Figure 2 is a schematic diagram of the second system architecture of the first preferred embodiment of the present invention. FIG. 3 is a schematic diagram of the first system architecture of the second preferred embodiment of the present invention.

10: Managed server host

11: Connection module

12: Processing module

13: Storage module

20: Configuration management server host

Claims (10)

A server host configuration setting management system. More than one managed server host is connected to a configuration management server host. The configuration management server host stores more than one configuration setting update information. The managed server host includes: A storage module to store more than one set of first configuration information; A connection module, connected to the configuration management server host to exchange information; A processing module, connecting the storage module and the connection module, and the processing module installs and executes a setting agent; Wherein, the configuration agent of the processing module sends an update request information to the configuration management server host, and the connection module obtains the configuration setting update information returned by the configuration management server host. The setting agent compares the first configuration setting information with the configuration setting update information. If it does not match, the setting agent of the processing module updates and sets the first configuration setting information according to the configuration setting update information. A piece of configuration setting information is stored as a corresponding piece of second configuration setting information in the storage module instead. The server host configuration setting management system according to claim 1, wherein the setting agent of the processing module sends the update request information through the connection module at a fixed time according to the first configuration setting information To the configuration management server host. The server host configuration setting management system described in claim 1, wherein the configuration setting update information includes a vulnerability detection report information, a system optimization proposal information, an information security notification information, and a control item information , One configuration benchmark project information, one information communication security technical report information. The server host configuration configuration management system described in claim 3, wherein the configuration agent of the processing module updates the vulnerability detection report information, system optimization proposal information, and information security contained in the configuration configuration update information Notification information, control project information, configuration benchmark project information, and information security technical report information update settings corresponding to the first configuration setting information. The server host configuration setting management system described in claim 1, wherein, when the configuration agent of the processing module updates the corresponding first configuration setting information according to the configuration setting update information, the processing module The setting agent program saves the corresponding first configuration setting information as a corresponding piece of historical configuration setting information and stores it in the storage module. The server host configuration setting management system described in claim 5, wherein the setting agent of the processing module updates and sets the first configuration setting information according to the configuration setting update information, and replaces the storage with the corresponding A piece of second configuration setting information is after the storage module, and the configuration agent of the processing module can further restore and set the piece of second configuration setting information to the corresponding one before updating the setting based on the historical configuration setting information The first configuration setting information. For the server host configuration management system described in claim 1, wherein the configuration agent executed by the processing module fails to update and set the first configuration configuration information according to the configuration configuration update information, and then through The connection module returns an update failure information to the configuration management server host. For example, the server host configuration setting management system according to claim 7, wherein, when the number of times that the processing module fails to update and set the first configuration setting information exceeds a threshold, the first configuration setting is stopped Information update settings. The server host configuration setting management system according to claim 1, wherein the managed server host can be a server device. The server host configuration setting management system according to claim 1, wherein the configuration management server host may be a server device.

Images