NIST SP 800-53 ????????????????????????????????/title> </head> <body> <header> <div class="mg-header container"> <a href="/"><div class="mg-logo"><img src="/images/logo.webp" width="108" height="57" alt="昆仑邮件系统"></div></a> <div class="mg-nav"> <ul class="nav-list"> <li class="nav-li"><a href="/">首页</a></li> <li class="nav-li"><a href="#">产品和服务</a> <ul class="sub-nav-list"> <li class="sub-nav-li"><a href="/depth-understand.html">国产邮件系统</a></li> <li class="sub-nav-li"><a href="/xinchuang_mail.html">信创邮件系统</a></li> <li class="sub-nav-li"><a href="/mailgate.html">邮件安全网关</a></li> </ul> </li> <li class="nav-li"><a href="/solution.html">解决方案</a></li> <li class="nav-li"><a href="/support.html">支持</a></li> <li class="nav-li"><a href="/kb/">知识库</a></li> <li class="nav-li"><a href="/bulletin/faq.html">FAQ问答</a></li> <li class="nav-li"><a href="/bulletin/industryInfo.html">行业资讯</a></li> <li class="nav-li"><a href="/search.html" class="nav-search-btn" aria-label="搜索"><svg viewBox="0 0 20 20"><circle cx="8.5" cy="8.5" r="6"/><line x1="13.5" y1="13.5" x2="18" y2="18"/></svg></a></li> </ul> </div> </div> </header> <div class="container"> <div class="kb-breadcrumb"> <a href="https://ztpop.net/">🏠 ???</a><span>›</span><a href="https://ztpop.net/kb/">?????/a><span>›</span>NIST SP 800-53 ???????????? </div> <article> <div class="article-header"> <h1>NIST SP 800-53 ????????????????????????????????/h1> <div class="article-meta"> <span>📅 2026-07-24</span> <span>📂 ????????/span> <span>⏱ ??35 ???</span> </div> </div> <div class="article-body"> <div class="toc"> <h4>📑 ???</h4> <ol> <li><a href="#s1">NIST SP 800-53 ??????</a></li> <li><a href="#s2">????????C??/a></li> <li><a href="#s3">?????????AU??/a></li> <li><a href="#s4">????????M??/a></li> <li><a href="#s5">?????????IA??/a></li> <li><a href="#s6">?????????????C??/a></li> <li><a href="#s7">?????????????????/a></li> </ol> </div> <h2 id="s1">????IST SP 800-53 ??????</h2> <p>NIST SP 800-53????????Rev. 5??020 ?????????????????????????????????????????? FISMA??ederal Information Security Modernization Act of 2014?????????????????????????????????????????????/p> <p>SP 800-53 Rev. 5 ??? 20 ????????? 400 ??????????????????????????????5 ????????/p> <table> <caption>??1????????????????NIST SP 800-53 ?????/caption> <thead> <tr><th>??ID</th><th>????????/th><th>??????</th><th>????????????</th></tr> </thead> <tbody> <tr><td>AC</td><td>Access Control?????????</td><td>25</td><td>IMAP/POP3 ????????MTP ?????P ?????/td></tr> <tr><td>AU</td><td>Audit and Accountability???????????/td><td>16</td><td>syslog ??????????????????????/td></tr> <tr><td>CM</td><td>Configuration Management?????????</td><td>14</td><td>Postfix ?????????????????????</td></tr> <tr><td>IA</td><td>Identification and Authentication???????????/td><td>14</td><td>SMTP AUTH??ovecot SASL?????????</td></tr> <tr><td>SC</td><td>System and Communications Protection??????????????/td><td>57</td><td>STARTTLS??TA-STS??KIM ???????????/td></tr> </tbody> </table> <p>????????IST SP 800-177 Rev. 1??rustworthy Email, NIST SP 800-177r1??? 800-53 ????????????????P 800-177 ??800-53 ???????????????????????????????/p> <h2 id="s2">???????????AC??/h2> <h3>2.1 AC-2: Account Management?????????</h3> <p><strong>??????</strong>????????????????????????????????????????????/p> <p><strong>?????????</strong>??/p> <pre class="language-bash"><code># Dovecot ?????????????????? # /etc/dovecot/conf.d/auth-passwd.conf passdb { driver = pam # ?????SQL ????????? # driver = sql # args = /etc/dovecot/dovecot-sql.conf.ext } # ???????????useradd -m -s /sbin/nologin -G mail user@example.com passwd user@example.com # ???????????????????????? passwd -l user@example.com # ??????????????cat > /usr/local/bin/audit-inactive-mail-accounts.sh << 'SH' #!/bin/bash # ??? 90 ??????????????INACTIVE_DAYS=${1:-90} echo "=== ??? ${INACTIVE_DAYS} ??????????????===" lastlog -b "${INACTIVE_DAYS}" | grep -v "Never logged in" | awk '{print $1}' echo "" echo "=== ??????????????? ===" lastlog | grep "Never logged in" | awk '{print $1}' SH chmod 755 /usr/local/bin/audit-inactive-mail-accounts.sh # AC-2(3) - ????????? cat > /usr/local/bin/check-disabled-accounts.sh << 'SH' #!/bin/bash echo "=== ??????????????? passwd ?????? ===" passwd -S -a 2>/dev/null | grep " L " | awk '{print $1}' SH</code></pre> <h3>2.2 AC-3: Access Enforcement?????????</h3> <p><strong>??????</strong>???????????????????/p> <p><strong>?????????</strong>??/p> <ul> <li><strong>SMTP ??????</strong>?????????????? 587/465 ??????</li> <li><strong>IMAP ??????</strong>????????IP ??? IMAP ???</li> <li><strong>??????</strong>??ostfix <code>smtpd_relay_restrictions</code></li> </ul> <pre class="language-cfg"><code># /etc/postfix/main.cf ??????????? # ??????????????smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination # ????????? SMTP ?????587 ??? # /etc/postfix/master.cf submission inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_reject_unlisted_recipient=no -o smtpd_client_restrictions=permit_sasl_authenticated,reject # Dovecot ?????? # /etc/dovecot/conf.d/10-auth.conf auth_username_format = %Lu auth_username_translation = %Lu # IMAP ??? IP ???????? iptables??iptables -A INPUT -p tcp --dport 993 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 993 -s 172.16.0.0/12 -j ACCEPT iptables -A INPUT -p tcp --dport 993 -j DROP</code></pre> <h3>2.3 AC-6: Least Privilege?????????</h3> <p><strong>??????</strong>?????????????????????????????????????????/p> <p><strong>?????????</strong>??/p> <pre class="language-bash"><code># Postfix ?????root ??? # /etc/postfix/main.cf mail_owner = postfix setgid_group = postdrop # Dovecot ?????? # Dovecot ??auth ?????dovecot ?????? # ????????vmail ??????????????????????????userdb { driver = static args = uid=vmail gid=vmail home=/var/mail/%d/%u } # Postfix ??smtpd ??? chroot # /etc/postfix/main.cf # ??smtpd ??? chroot ?????????????????? smtpd_chroot = yes</code></pre> <h3>2.4 AC-7: Unsuccessful Logon Attempts????????????</h3> <p><strong>??????</strong>???????????????????/p> <p><strong>?????????</strong>??/p> <pre class="language-bash"><code># Dovecot ??auth_failure_delay # /etc/dovecot/conf.d/10-auth.conf auth_failure_delay = 2 secs # Postfix SMTP AUTH ????????? fail2ban # /etc/fail2ban/jail.d/postfix-auth.conf [postfix-auth] enabled = true port = smtp,submission,submissions,smtps filter = postfix-auth logpath = /var/log/mail.log maxretry = 5 bantime = 3600</code></pre> <h2 id="s3">?????????????U??/h3> <h3>3.1 AU-2: Event Logging????????????</h3> <p><strong>??????</strong>???????????????????????/p> <p><strong>????????????????????</strong>??/p> <table> <caption>??2?????????????????/caption> <thead><tr><th>??????</th><th>Postfix ??????</th><th>Dovecot ??????</th></tr></thead> <tbody> <tr><td>SMTP ???/???</td><td><code>/var/log/mail.log</code></td><td>??/td></tr> <tr><td>?????????????</td><td><code>/var/log/mail.log</code></td><td>??/td></tr> <tr><td>SMTP ??????/???</td><td><code>/var/log/mail.log</code></td><td>??/td></tr> <tr><td>IMAP/POP3 ??????/???</td><td>??/td><td><code>/var/log/dovecot.log</code> ??mail.log</td></tr> <tr><td>TLS ??????/???</td><td><code>/var/log/mail.log</code></td><td><code>/var/log/dovecot.log</code></td></tr> <tr><td>??????</td><td>??? <code>auditd</code> ???</td><td>??? <code>auditd</code> ???</td></tr> <tr><td>????????/td><td><code>/var/log/auth.log</code></td><td><code>/var/log/auth.log</code></td></tr> </tbody> </table> <pre class="language-cfg"><code># Postfix ?????? ?????????????? # /etc/postfix/main.cf # ??? TLS ?????? smtpd_tls_loglevel = 1 # 1=???, 2=???????????smtp_tls_loglevel = 1 # ????????? smtpd_log_access_permit_actions = all notify_classes = resource,software,bounce,2bounce,delay,policy,protocol # Dovecot ?????? # /etc/dovecot/conf.d/10-logging.conf log_path = /var/log/dovecot.log info_log_path = /var/log/dovecot-info.log debug_log_path = /var/log/dovecot-debug.log auth_verbose = yes auth_debug = no mail_debug = no # ??? IMAP ???????????mail_log_prefix = "%s(%u): " plugin { mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mail_log_fields = uid box msgid size }</code></pre> <h3>3.2 AU-3: Content of Audit Records????????????</h3> <p><strong>??????</strong>????????????????????????????/p> <p><strong>SP 800-53 Rev.5 ???????????????</strong>??/p> <ol> <li>??????</li> <li>??????</li> <li>?????????/???/IP??/li> <li>?????????????/li> <li>???????????????</li> </ol> <pre class="language-bash"><code># Postfix ??????????????AU-3 ?????# ?????? (RFC 3164 syslog): # Jul 20 14:23:45 mx postfix/smtpd[12345]: connect from unknown[203.0.113.5] # - ???: SMTP ??? # - ???: Jul 20 14:23:45 # - ????? 203.0.113.5 # - ???: success (connect) # - ???: postfix/smtpd # ??? rsyslog ?????????RFC 5424 ?????# /etc/rsyslog.d/22-mail-structured.conf $template MailStructured,"<%pri%>1 %timegenerated:::date-rfc3339% %HOSTNAME% %app-name% %procid% %msgid% [mail@28301 source=\"%syslogtag%\" facility=\"%syslogfacility-text%\"] %msg%\n" if $programname startswith 'postfix' or $programname startswith 'dovecot' then /var/log/structured-mail.log;MailStructured # ??????????????# ??? syslog ??????????????????????????? # /etc/rsyslog.conf *.* @@logserver.example.com:514 # TCP ??? (RFC 5425 TLS)</code></pre> <h3>3.3 AU-6: Audit Record Review, Analysis, and Reporting????????????</h3> <p><strong>??????</strong>????????????????????/p> <pre class="language-bash"><code># ??????????????? cat > /usr/local/bin/daily-auth-audit.sh << 'SH' #!/bin/bash # ?????? 24 ???????????? YESTERDAY=$(date -d "yesterday" +%Y-%m-%d) REPORT="/var/reports/auth-failures-${YESTERDAY}.txt" echo "=== SMTP ?????? ($YESTERDAY) ===" > "$REPORT" grep "$YESTERDAY" /var/log/mail.log | \ grep "SASL LOGIN authentication failed" | \ sed 's/.*client=\(.*\)\]$/\1/' | \ sort | uniq -c | sort -rn | head -20 >> "$REPORT" echo "" >> "$REPORT" echo "=== IMAP ?????? ($YESTERDAY) ===" >> "$REPORT" grep "$YESTERDAY" /var/log/dovecot.log | \ grep "auth failed" | \ sed 's/.*rip=\([^,]*\).*/\1/' | \ sort | uniq -c | sort -rn | head -20 >> "$REPORT" # ??????????????ABNORMAL_COUNT=$(wc -l < "$REPORT") if [ "$ABNORMAL_COUNT" -gt 50 ]; then mail -s "[SECURITY] ????????? - ${YESTERDAY} (${ABNORMAL_COUNT}??" \ security@example.com < "$REPORT" fi SH chmod 755 /usr/local/bin/daily-auth-audit.sh # crontab: ??? 08:00 ??? echo "0 8 * * * /usr/local/bin/daily-auth-audit.sh" > /etc/cron.d/mail-auth-audit</code></pre> <h3>3.4 AU-9: Protection of Audit Information????????????</h3> <p><strong>??????</strong>????????????????????????????????/p> <pre class="language-bash"><code># ?????????????# 1. ??? append-only ????????hattr??chattr +a /var/log/mail.log chattr +a /var/log/dovecot.log chattr +a /var/log/structured-mail.log # 2. ??????????????????????????# ??????????????? # $template RemoteMail, "/var/log/remote/%HOSTNAME%/mail.log" # if $syslogfacility-text == 'mail' then -?RemoteMail # & stop # 3. ??? syslog-ng + HSM ??? # /etc/syslog-ng/conf.d/mail-hash.conf # ???? syslog-ng PE ??Linux Audit ???</code></pre> <h2 id="s4">???????????CM??/h2> <h3>4.1 CM-2: Baseline Configuration?????????</h3> <p><strong>??????</strong>????????????????????/p> <pre class="language-bash"><code># ???????????? ????????????cat > /etc/mail-baseline.conf << 'CONF' # ===== Postfix ?????? (SP 800-177 Rev. 1 ???) ===== SMTPD_TLS_SECURITY_LEVEL = may SMTPD_TLS_MANDATORY_PROTOCOLS = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 SMTPD_TLS_PROTOCOLS = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 SMTP_TLS_SECURITY_LEVEL = may SMTP_TLS_MANDATORY_PROTOCOLS = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 # ===== Dovecot ?????? ===== SSL = required SSL_MIN_PROTOCOL = TLSv1.2 AUTH_FAILURE_DELAY = 2 # ===== ?????? ===== SMTPD_TLS_LOGLEVEL >= 1 SMTP_TLS_LOGLEVEL >= 1 AUTH_VERBOSE = yes CONF # ??????????cat > /usr/local/bin/check-mail-baseline.sh << 'SH' #!/bin/bash # ???????Postfix ???????????? echo "=== Postfix ???????===" BASELINE="/etc/mail-baseline.conf" CURRENT_POSTFIX=$(postconf -n) while IFS='=' read -r param value; do param=$(echo "$param" | xargs) value=$(echo "$value" | xargs) [ -z "$param" ] && continue current=$(postconf -n "$param" 2>/dev/null | cut -d= -f2 | xargs) if [ "$current" != "$value" ]; then echo "??$param = $current (???: $value)" FAIL=1 else echo "??$param = $current" fi done < <(grep -E '^[A-Z_]+\s*=' "$BASELINE" | grep -v '^#') echo "" echo "=== Dovecot ???????===" doveconf -n 2>/dev/null | grep -E "ssl|auth_failure" | while read line; do echo " $line" done SH chmod 755 /usr/local/bin/check-mail-baseline.sh</code></pre> <h3>4.2 CM-6: Configuration Settings?????????</h3> <p><strong>??????</strong>???????????????checklist?????CIS Benchmarks ??DISA STIG??/p> <pre class="language-bash"><code># Postfix ?????? checklist (??? CIS Postfix Benchmark v2.0) # 1. banner ??? ?????????????smtpd_banner = $myhostname ESMTP # /etc/postfix/main.cf # 2. ??? VRFY ??EXPN ??? disable_vrfy_command = yes # 3. ??????????????DoS??message_size_limit = 25600000 # 4. ?????????????????? smtpd_recipient_limit = 100 # 5. ????????? ???????smtpd_soft_error_limit = 10 smtpd_hard_error_limit = 20 # 6. ???????????? # /etc/postfix/master.cf ????????????????#127.0.0.1:10025 inet n - n - - smtpd #pickup fifo n - n 60 1 pickup</code></pre> <h3>4.3 CM-8: Information System Component Inventory?????????</h3> <p><strong>??????</strong>???????????????????????/p> <pre class="language-bash"><code># ??????????????? cat > /usr/local/bin/mail-component-inventory.sh << 'SH' #!/bin/bash # ??? JSON ?????????????????VERSION=$(date +%Y%m%d) cat << JSON { "inventory_version": "$VERSION", "system_name": "ztpop-email", "components": [ { "name": "postfix", "version": "$(postconf -d mail_version 2>/dev/null | cut -d= -f2 | xargs || echo 'unknown')", "role": "MTA (SMTP daemon)", "config_files": ["/etc/postfix/main.cf", "/etc/postfix/master.cf"] }, { "name": "dovecot", "version": "$(dovecot --version 2>/dev/null || echo 'unknown')", "role": "MDA/IMAP/POP3", "config_files": ["/etc/dovecot/dovecot.conf", "/etc/dovecot/conf.d/*.conf"] }, { "name": "opendkim", "version": "$(opendkim -V 2>&1 | head -1 || echo 'unknown')", "role": "DKIM signing and verification", "config_files": ["/etc/opendkim.conf"] } ], "listening_ports": [ $(ss -tlnp | grep -E 'master|dovecot' | awk '{printf "{\"port\":%s,\"process\":\"%s\"},", $4, $7}') ] } JSON SH chmod 755 /usr/local/bin/mail-component-inventory.sh</code></pre> <h2 id="s5">?????????????A??/h2> <h3>5.1 IA-2: Identification and Authentication (Organizational Users)?????????????????/h3> <p><strong>??????</strong>??????????????????????/p> <pre class="language-cfg"><code># Dovecot ????????? # /etc/dovecot/conf.d/10-auth.conf auth_mechanisms = plain login # ??? CRAM-MD5 ???????????????IA-2(1) ????????? # auth_mechanisms = cram-md5 plain login # ???????????A-5 ????????? # /etc/dovecot/conf.d/auth-sql.conf.ext password_query = SELECT username AS user, password AS password, \ 'maildir:/var/mail/%d/%n' AS userdb_mail \ FROM mailbox WHERE username = '%u' AND active = '1' # ???????????SHA512-CRYPT ??BLF-CRYPT # Dovecot ?????doveadm pw ????????doveadm pw -s SHA512-CRYPT # ??????????? {SHA512-CRYPT}$6$rounds=5000$...</code></pre> <h3>5.2 IA-5: Authenticator Management?????????</h3> <p><strong>??????</strong>???????????????????????????????????????/p> <pre class="language-bash"><code># ???????????# PAM ??? /etc/pam.d/dovecot ??/etc/pam.d/passwd password requisite pam_pwquality.so \ minlen=12 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 \ enforce_for_root # Dovecot ????????????????????????????cat > /usr/local/bin/password-expiry-check.sh << 'SH' #!/bin/bash # ????Dovecot ????????? # ?????passwd-file ?????? PASSWD_FILE="/etc/dovecot/users" if [ ! -f "$PASSWD_FILE" ]; then echo "password-file ?????????" exit 0 fi while IFS=':' read -r user passwd_info; do # ????????????????????????????????????????? # ??????????? shadow ??? shadow_entry=$(grep "^${user}:" /etc/shadow) if [ -n "$shadow_entry" ]; then last_change=$(echo "$shadow_entry" | cut -d: -f3) max_days=$(echo "$shadow_entry" | cut -d: -f5) if [ -n "$max_days" ] && [ "$max_days" -gt 0 ]; then days_left=$(( last_change + max_days - $(date +%s) / 86400 )) if [ "$days_left" -lt 30 ]; then echo "WARNING: Password for $user expires in $days_left days" fi fi fi done < /etc/passwd | grep -E '^/{0,1}home' 2>/dev/null || true SH</code></pre> <h3>5.3 IA-2(1): Multi-factor Authentication???????????/h3> <p><strong>??????</strong>??????????????????????/p> <pre class="language-bash"><code># Dovecot ?????????????????# 1. ??? (something you know) # 2. TOTP (something you have) ????? PAM oath ??auth SQL ????? # PAM + oathtool TOTP ??? # ?????? apt install oathtool libpam-oath # ????????TOTP ??? cat > /usr/local/bin/setup-totp-for-user.sh << 'SH' #!/bin/bash USER=$1 if [ -z "$USER" ]; then echo "???: $0 <email_user>" exit 1 fi SECRET=$(head -c 1024 /dev/urandom | base32 | head -1 | tr -d '=' | cut -c1-32) echo "${USER}:${SECRET}" >> /etc/oath/users.oath echo "TOTP ???: $SECRET" echo "URI: otpauth://totp/${USER}?secret=${SECRET}&issuer=email.example.com" echo "????????Authenticator App ???" SH # /etc/pam.d/dovecot ??? # auth required pam_oath.so usersfile=/etc/oath/users.oath # @include common-auth # ?????????</code></pre> <h2 id="s6">????????????????C??/h2> <h3>6.1 SC-8: Transmission Confidentiality and Integrity?????????????????</h3> <p><strong>??????</strong>?????????????????????????/p> <p><strong>????????SC-8 ?????????</strong>??P 800-177 Rev. 1 ????????/p> <ul> <li>SMTP ?????? STARTTLS??FC 3207??/li> <li>MTA-STS??FC 8461????????TLS</li> <li>IMAP/POP3 ????????? TLS??FC 8314 ?????? TLS??/li> <li>HTTPS ????????? TLS 1.2+</li> </ul> <pre class="language-cfg"><code># Postfix ????????? # /etc/postfix/main.cf # ??? TLS smtpd_tls_security_level = may smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtpd_tls_mandatory_ciphers = high smtpd_tls_eecdh_grade = strong # ??? TLS ????? STARTTLS??C-8 ?????smtp_tls_security_level = may smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 smtp_tls_mandatory_ciphers = high smtp_tls_eecdh_grade = strong # ??? MTA-STS ?????? smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix</code></pre> <h3>6.2 SC-12: Cryptographic Key Establishment and Management?????????????????/h3> <p><strong>??????</strong>?????????????????/p> <pre class="language-bash"><code># DKIM ???????????# ??? DKIM ???????????2048 ??RSA??opendkim-genkey -D /etc/opendkim/keys/ -d example.com -s 20260701 # /etc/opendkim.conf Domain example.com Selector 20260701 KeyFile /etc/opendkim/keys/20260701.private Socket inet:8891@localhost Canonicalization relaxed/simple Mode sv SubDomains no AutoRestart yes AutoRestartRate 5/1M Background yes DNSTimeout 5 SignatureAlgorithm rsa-sha256 # ???????????P 800-57 Part 1 Rev. 5 ?????# - RSA 2048 ?????1-2 ?????# - ECDSA P-256??? 2-3 ?????# - ??????????????????????30 ??cat > /usr/local/bin/dkim-key-rotation.sh << 'SH' #!/bin/bash # DKIM ???????????? DOMAIN="$1" NEW_SELECTOR=$(date +%Y%m%d) KEY_DIR="/etc/opendkim/keys" # ????????opendkim-genkey -D "$KEY_DIR" -d "$DOMAIN" -s "$NEW_SELECTOR" chown opendkim:opendkim "$KEY_DIR/${NEW_SELECTOR}.private" chmod 600 "$KEY_DIR/${NEW_SELECTOR}.private" echo "??????? $NEW_SELECTOR" echo "DNS TXT ???:" cat "$KEY_DIR/${NEW_SELECTOR}.txt" echo "" echo "???:" echo "1. ?????? DNS TXT ?????${NEW_SELECTOR}._domainkey.${DOMAIN}" echo "2. ??? 48 ??????????? echo "3. ??? opendkim.conf ??? Selector ??$NEW_SELECTOR" echo "4. ??? opendkim" echo "5. ??? 30 ????????DNS ???" SH</code></pre> <h3>6.3 SC-13: Cryptographic Protection?????????</h3> <p><strong>??????</strong>?????FIPS 140-3 ?????????????/p> <pre class="language-bash"><code># OpenSSL FIPS ?????? OpenSSL 3.x + FIPS ?????# /etc/ssl/openssl.cnf # .include /etc/ssl/fipsmodule.cnf # [openssl_init] # fips = fips_sect # ??? OpenSSL ?????? FIPS openssl list -providers | grep fips # Postfix TLS ?????? ????FIPS 140-3 ??? # NIST SP 800-52 Rev. 2 ??? smtpd_tls_mandatory_ciphers = high smtpd_tls_eecdh_grade = strong # ????????????????? smtpd_tls_ciphers = high tls_high_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 # Dovecot TLS ?????? # /etc/dovecot/conf.d/10-ssl.conf ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\ ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384</code></pre> <h3>6.4 SC-28: Protection of Information at Rest????????????</h3> <p><strong>??????</strong>?????????????/p> <pre class="language-bash"><code># ????????? ??dm-crypt/LUKS ?????? # ??????????????? cryptsetup luksFormat /dev/sdb1 cryptsetup luksOpen /dev/sdb1 mailstore_vault mkfs.ext4 /dev/mapper/mailstore_vault mount /dev/mapper/mailstore_vault /var/mail # /etc/crypttab mailstore_vault /dev/sdb1 none luks,discard,keyscript=/usr/local/bin/open-mail-keyscript.sh # ??? eCryptfs ???????????? # ?????????????????? ecryptfs-setup-private # Dovecot ???????????/MIME ??PGP ????????# mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_save_version = 2 mail_crypt_global_private_key = </etc/dovecot/private/dovecot-ecdsa-key.pem mail_crypt_global_public_key = </etc/dovecot/public/dovecot-ecdsa-key.pub }</code></pre> <h2 id="s7">????????????????????</h2> <h3>7.1 ??????????????/h3> <p>???????????????????????????????????????</p> <table> <caption>??3????????????????????/caption> <thead><tr><th>???</th><th>????????/th><th>???</th></tr></thead> <tbody> <tr><td>SMTP ?????ovecot SASL??/td><td>IA + AC + AU</td><td>IA-2 ?????? ??AC-3 ?????? ??AU-2 ??????</td></tr> <tr><td>TLS ??????</td><td>SC + CM + AU</td><td>SC-8 ?????? ??CM-2 ?????? ??AU-2 ??????</td></tr> <tr><td>DKIM ??????</td><td>SC + CM + IA</td><td>SC-12 ?????? ??CM-3 ?????? ??IA-5 ??????</td></tr> <tr><td>?????????</td><td>IA + AC + AU</td><td>IA-5 ?????? ??AC-7 ?????? ??AU-6 ??????</td></tr> </tbody> </table> <h3>7.2 ??? OpenSCAP ???????????/h3> <pre class="language-bash"><code># ??? OpenSCAP apt install libopenscap8 scap-security-guide # ??? NIST SP 800-53 Rev. 5 ?????? Profile????????# ?????? DISA STIG for Postfix oscap info /usr/share/scap-security-guide/ssg-rhel9-ds.xml | grep -i postfix # ??? CIS ?????? Postfix ??? oscap oval eval \ --results /tmp/postfix-oval-results.xml \ /usr/share/scap-security-guide/ssg-rhel9-ds.xml \ --profile xccdf_org.ssgproject.content_profile_cis # ??????????????cat > /usr/local/bin/scap-mail-scan.sh << 'SH' #!/bin/bash # NIST SP 800-53 ?????????????????REPORT_DIR="/var/reports/scap" mkdir -p "$REPORT_DIR" DATE=$(date +%Y%m%d) REPORT="${REPORT_DIR}/mail-scap-${DATE}.html" cat > /tmp/mail-check-probes.sh << 'CHK' #!/bin/bash SCORE=0 TOTAL=0 # AC-2: ???????? passwd ??????????????? TOTAL=$((TOTAL + 1)) INACTIVE=$(lastlog -b 90 | grep -v "Never logged in" | grep -v "^Username" | wc -l) if [ "$INACTIVE" -le 5 ]; then SCORE=$((SCORE + 1)); fi # AC-7: ????fail2ban ?????? TOTAL=$((TOTAL + 1)) if systemctl is-active --quiet fail2ban; then SCORE=$((SCORE + 1)); fi # SC-8: ??????????TLS TOTAL=$((TOTAL + 1)) if postconf -n smtpd_tls_security_level 2>/dev/null | grep -q "may\|encrypt"; then SCORE=$((SCORE + 1)) fi # SC-12: ????DKIM ????????? TOTAL=$((TOTAL + 1)) if dig TXT 20260701._domainkey.example.com +short | grep -q 'v=DKIM1'; then SCORE=$((SCORE + 1)) fi # AU-2: ???????????????????TOTAL=$((TOTAL + 1)) if [ -f /var/log/mail.log.1 ]; then SCORE=$((SCORE + 1)); fi echo "Compliance Score: ${SCORE}/${TOTAL}" CHK bash /tmp/mail-check-probes.sh > "$REPORT" 2>&1 # ??????????mail -s "[COMPLIANCE] ?????? NIST SP 800-53 ??????" \ security-team@example.com < "$REPORT" SH chmod 755 /usr/local/bin/scap-mail-scan.sh</code></pre> <div class="ref-block"> <h3>???????/h3> <ol> <li>NIST SP 800-53 Rev. 5 ??Security and Privacy Controls for Information Systems and Organizations. NIST, September 2020.</li> <li>NIST SP 800-177 Rev. 1 ??Trustworthy Email. NIST, June 2021 (Updated 2026 Draft).</li> <li>NIST SP 800-45 Version 2 ??Guidelines on Electronic Mail Security. NIST, February 2007.</li> <li>NIST SP 800-52 Rev. 2 ??Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. NIST, August 2019.</li> <li>NIST SP 800-57 Part 1 Rev. 5 ??Recommendation for Key Management, Part 1: General. NIST, May 2020.</li> <li>FIPS 140-3 ??Security Requirements for Cryptographic Modules. NIST, March 2019.</li> <li>RFC 8314 ??Cleartext Considered Obsolete: Use of TLS for Email Submission and Access. IETF, February 2018.</li> <li>CIS Benchmark for Postfix ??Center for Internet Security, Version 2.0 (2025).</li> <li>DISA Application Security and Development STIG V5R1 ??Postfix SRG Requirements.</li> <li>M3AAWG ??Email Security Controls Mapping to NIST SP 800-53 (2025 Technical Reference).</li> </ol> </div> <div class="citation-block"> <h3>引用本文</h3> <p class="citation-format">ztpop.net 知识库编辑. "本文标题" <em>ztpop.net 知识库</em>.</p> <p class="citation-license">本站技术文章采用 CC-BY 4.0 许可，可自由引用，仅需标注来源 ztpop.net。</p> </div> <div class="article-footer"> ?????ztpop.net ??????????????????????????????????<a href="https://ztpop.net/kb/">?????/a>?? <p class="article-license">本站技术文章采用 CC-BY 4.0 许可，可自由引用，仅需标注来源 <a href="https://www.ztpop.net">ztpop.net</a>。</p> </div> </div> </article> <div class="kb-copyright"> © 2026 ztpop.net · ???????????? ztpop.net ????· ???????????? </div> </div> <script type="application/ld+json"> { "@context": "https://schema.org", "@type": "TechArticle", "headline": "NIST SP 800-53 ????????????????????????????????, "description": "????????C?????????????U???????????CM?????????????A????????????????C?????????????????????????????, "datePublished": "2026-07-24", "dateModified": "2026-07-24", "author": { "@type": "Person", "name": "ztpop.net ???????????" }, "publisher": { "@type": "Organization", "name": "ztpop.net", "logo": { "@type": "ImageObject", "url": "https://ztpop.net/logo.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://ztpop.net/kb/nist-sp80053-email-control-mapping.html" }, "speakable": { "@type": "SpeakableSpecification", "xpath": ["/html/head/title", "/html/body/article/div[1]/h1"] }, "breadcrumb": { "@type": "BreadcrumbList", "itemListElement": [ {"@type": "ListItem","position": 1,"name": "???","item": "https://ztpop.net/"}, {"@type": "ListItem","position": 2,"name": "?????,"item": "https://ztpop.net/kb/"}, {"@type": "ListItem","position": 3,"name": "NIST SP 800-53 ????????????","item": "https://ztpop.net/kb/nist-sp80053-email-control-mapping.html"} ] } } </script> <footer style="background:#f5f5f7;padding:40px 0 24px;margin-top:60px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;"> <div style="max-width:1040px;margin:0 auto;padding:0 20px;"> <div style="display:flex;flex-wrap:wrap;gap:48px;font-size:14px;color:#666;line-height:2.2;"> <div style="flex:1;min-width:200px;"> <p style="font-size:13px;font-weight:600;color:#333;margin:0 0 8px 0;letter-spacing:0.5px;text-transform:uppercase;">联系我们</p> <p style="margin:0;">021-69753778</p> <p style="margin:0;">zhangtao@ztpop.net</p> <p style="margin:0;display:flex;align-items:center;gap:8px;"> 微信咨询 <span style="display:inline-block;width:64px;height:64px;background:#fff;border-radius:6px;padding:3px;border:1px solid #e5e5ea;"> <img src="/images/tech-weixin.webp" alt="微信" width="58" height="58" style="display:block;border-radius:4px;" loading="lazy"> </span> </p> </div> <div style="flex:1;min-width:160px;"> <p style="font-size:13px;font-weight:600;color:#333;margin:0 0 8px 0;letter-spacing:0.5px;text-transform:uppercase;">快速导航</p> <p style="margin:0;"><a href="/" style="color:#515154;text-decoration:none;">首页</a></p> <p style="margin:0;"><a href="/depth-understand.html" style="color:#515154;text-decoration:none;">国产邮件系统</a></p> <p style="margin:0;"><a href="/mailgate.html" style="color:#515154;text-decoration:none;">邮件安全网关</a></p> <p style="margin:0;"><a href="/xinchuang_mail.html" style="color:#515154;text-decoration:none;">信创邮件系统</a></p> <p style="margin:0;"><a href="/kb/" style="color:#515154;text-decoration:none;">知识库</a></p> <p style="margin:0;"><a href="/bulletin/industryInfo.html" style="color:#515154;text-decoration:none;">行业资讯</a></p> <p style="margin:0;"><a href="/contact.html" style="color:#515154;text-decoration:none;">联系我们</a></p> </div> </div> <div style="border-top:1px solid #d2d2d7;margin-top:24px;padding-top:16px;text-align:center;font-size:12px;color:#999;line-height:1.8;"> © 2018-2026 上海辰童科技有限公司 | 沪ICP备2024053450号 | 专注国产邮件系统与邮件安全 </div> </div> </footer> </body> </html>