1. 双 NIC 安全模型NIC准入对象防护机制Management NIC部署/排障的有限命令客户提供的证书bootstrap 阶段External/Ingress NIC网络中的普通用户/服务走身份提供方 RBACManagement vNIC 与 Ingress vNIC 分别承担管理面和用户访问面两者通过 Appliance 内部安全边界隔离外部访问策略也不同。2. 默认启用项传输加密TLS 1.2 / TLS 1.3 / DTLS 1.2、SMB 3.x signed encryption全部传输中数据存储加密BitLocker AES-XTS 256Appliance VM 数据卷反恶意软件Microsoft Defender启动完整性Secure Boot应用白名单Windows Application ControlWDAC仅允许受信代码在 Appliance VM 内运行3. BitLocker 恢复密钥必须留存3.1 为什么必须管官方原文Disconnected operations for Azure Local manages BitLocker recovery passwords for data at rest encryption. You dont need to provide these passwords for regular operations or during system startup.However, support scenarios might require these passwords to bring the system online. Without these passwords, some support scenarios can cause data loss and require system redeployment.一旦丢失 BitLocker 恢复密钥 → 部分支持场景会数据丢失 必须重部署。恢复密钥对应 Appliance VM 数据卷而不是 Azure Local 宿主机 BitLocker。3.2 获取命令# 1. 导入 OperationsModule Import-Module C:\azurelocal\OperationsModule\Azure.Local.DisconnectedOperations.psd1 -Force # 2. 建立 client context $password ConvertTo-SecureString RETRACTED -AsPlainText -Force $context Set-DisconnectedOperationsClientContext -ManagementEndpointClientCertificatePath ${env:localappdata}\AzureLocalOpModuleDev\certs\ManagementEndpoint\ManagementEndpointClientAuth.pfx -ManagementEndpointClientCertificatePassword $password -ManagementEndpointIpAddress 169.254.53.25 # 3. 拉取恢复密钥 $recoveryKeys Get-ApplianceBitLockerRecoveryKeys $context $recoveryKeys.recoverykeyset输出形如protectorid recoverypassword ----------- ---------------- {DCA51B1F-...} 1141015-055275-382305-1911114-363957-150975-55 {264FB985-...} 186516-209792-097229-117040-638286-147048-26 ...3.3 储存要求官方建议Get your BitLocker recovery passwords and store them in a secure locationoutside Azure Local or the Azure Local host.❌ 不要存在 Azure Local 本机✅ 建议存在 HSM/离线介质/企业密码保险箱/双人保管推荐立刻备份、立刻验证一次解密可行性4. Host Guardian ServiceHGS证书导出新增工作负载集群时每个 workload 节点都需要这两个 .pfxC:\Users\Administrator\AppData\Roaming\AzureLocal\AzsVmHostGuardian-IRVM01-encryption.pfx C:\Users\Administrator\AppData\Roaming\AzureLocal\AzsVmHostGuardian-IRVM01-signing.pfx这正是 known-issues 里Other cluster deployments fail - Host Guardian certificates arent available这条 issue 的根因。每新增一个 Workload Cluster都需要 Appliance 提供 HGS Signing 与 Encryption 证书否则受保护 VM 无法完成信任建立。导出命令$password ConvertTo-SecureString RETRACTED -AsPlainText -Force $context Set-DisconnectedOperationsClientContext -ManagementEndpointClientCertificatePath ${env:localappdata}\AzureLocalOpModuleDev\certs\ManagementEndpoint\ManagementEndpointClientAuth.pfx -ManagementEndpointClientCertificatePassword $password -ManagementEndpointIpAddress 169.254.53.25 Export-ApplianceHGSCertificates -Path C:\AzureLocalDisconnectedOperations\HGSBackup5. Syslog 转发推到 SIEMAppliance VM 内置 syslog agent可转发安全事件到外部 SIEM。5.1 REST 参数表参数类型必填说明ClientCertificateThumbprintString否与 syslog server 通信用的客户端证书EnabledFlag是启用/禁用 syslog agent禁用 删除配置并停止 forwarderNoEncryptionFlag否明文发送生产禁用OutputSeverityString否Defaultwarn/crit/error或Verbose全部ServerNameString否syslog server FQDN 或 IPServerPortUInt16否syslog 端口SkipServerCertificateCheckFlag否跳过 TLS server 证书校验生产禁用SkipServerCNCheckFlag否跳过证书 CN 校验生产禁用UseUDPFlag否用 UDP 而非 TCP5.2 默认推荐配置官方原文By default, TCP with authentication and encryption is used, which is the minimum level of security recommended for production.Dont use the-SkipServerCertificateCheckflag in production environments.生产最小配置TCP TLS 服务端证书验证。6. 我额外注意到的官方没明说的事项文档没说BitLocker 恢复密钥多久轮换一次——官方未说明恢复密钥轮换策略建议按照企业密钥管理制度进行管理。Syslog 输出遵循标准 Syslog 协议具体事件格式以微软后续版本为准。HGS 证书必须在新增工作负载集群前存在如缺失只能 redownload无法跨 appliance 重建文档没写管理端 Management NIC 的客户证书轮换流程微软官方未说明 Air-gapped 模式下 Microsoft Defender 特征库的更新机制。企业应根据自身离线运维流程制定病毒定义更新策略并参考 Windows Defender 离线更新最佳实践。7.安全基线Best Practice建议推荐TLS 1.3✅LDAPS✅企业 CA✅HGS 证书离线备份✅BitLocker Recovery 离线备份✅Syslog → SIEM✅WDAC 保持默认✅Secure Boot不关闭8.安全架构图如下所示9.部署流程如下图所示