开源零信任本地化部署实战指南：Keycloak + OpenZiti 完整方案

一、方案概述

本方案为中小企业提供完全本地化的开源零信任架构，核心组件包括：

• Keycloak：统一身份认证与访问管理（IAM）
• OpenZiti：零信任网络覆盖与策略执行
• PostgreSQL：高可用数据存储
• Nginx：反向代理与SSL终端

架构优势

• 🔒 数据不出域：所有组件部署在本地基础设施
• 💰 零许可成本：完全基于开源软件
• 🛡️ 强安全性：遵循"永不信任，始终验证"原则
• 📦 易维护：容器化部署，标准化配置

二、环境准备

硬件要求

软件要求

• 操作系统：Ubuntu 22.04 LTS / CentOS 8+ 
• 依赖组件：OpenJDK 17, PostgreSQL 14+, Nginx 1.18+ 
• 网络要求：DNS解析、SSL证书、固定IP地址

三、快速部署脚本

#!/bin/bash

# 零信任一键部署脚本 - ZeroTrust Deployer v2.0

set -e

# 配置区

export DOMAIN="zt.yourcompany.com"

export KEYCLOAK_ADMIN_PWD="$(openssl rand -base64 16)"

export ZITI_ADMIN_PWD="$(openssl rand -base64 16)"

export DB_PASSWORD="$(openssl rand -base64 16)"

export INSTALL_DIR="/opt/zero-trust"

echo "🚀 开始部署零信任平台..."

mkdir -p ${INSTALL_DIR}/{keycloak,ziti}

# 安装依赖

apt update && apt install -y openjdk-17-jdk postgresql nginx certbot python3-certbot-nginx

# 配置数据库

sudo -u postgres psql -c "CREATE DATABASE keycloak;"

sudo -u postgres psql -c "CREATE USER keycloak WITH PASSWORD '${DB_PASSWORD}';"

sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;"

# 部署Keycloak

wget -qP /tmp https://github.com/keycloak/keycloak/releases/download/24.0.1/keycloak-24.0.1.tar.gz

tar -xzf /tmp/keycloak-*.tar.gz -C ${INSTALL_DIR}/keycloak --strip-components=1

cat > ${INSTALL_DIR}/keycloak/conf/keycloak.conf << EOF

db=postgres

db-username=keycloak

db-password=${DB_PASSWORD}

db-url=jdbc:postgresql://localhost:5432/keycloak

hostname=${DOMAIN}

http-enabled=false

https-port=8443

proxy=edge

features=admin-fine-grained-authz

EOF

# 部署OpenZiti

ZITI_VER="0.32.13"

ARCH=$(uname -m | sed 's/x86_64/amd64/')

wget -qO ${INSTALL_DIR}/ziti/controller/ziti-controller \

  https://github.com/openziti/ziti/releases/download/v${ZITI_VER}/ziti-controller-linux-${ARCH}

wget -qO ${INSTALL_DIR}/ziti/router/ziti-router \

  https://github.com/openziti/ziti/releases/download/v${ZITI_VER}/ziti-router-linux-${ARCH}

chmod +x ${INSTALL_DIR}/ziti/*/ziti-*

# 初始化OpenZiti

sudo -u ziti ${INSTALL_DIR}/ziti/controller/ziti-controller edge init \

  --username admin --password "${ZITI_ADMIN_PWD}" \

  --database "postgres://ziti:${DB_PASSWORD}@localhost:5432/ziti" \

  -j ${INSTALL_DIR}/ziti/controller/initial.jwt

# 配置系统服务

cat > /etc/systemd/system/keycloak.service << EOF

[Unit]

Description=Keycloak Identity Server

After=network.target postgresql.service

[Service]

User=keycloak

Group=keycloak

ExecStart=${INSTALL_DIR}/keycloak/bin/kc.sh start --optimized

WorkingDirectory=${INSTALL_DIR}/keycloak

Restart=always

RestartSec=30

Environment="KEYCLOAK_ADMIN=admin"

Environment="KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PWD}"

[Install]

WantedBy=multi-user.target

EOF

# 启动服务

systemctl daemon-reload

systemctl enable --now keycloak ziti-controller ziti-router nginx postgresql

echo "✅ 部署完成！"

echo "📝 访问信息："

echo "   Keycloak控制台: https://${DOMAIN}"

echo "   用户名: admin"

echo "   密码: ${KEYCLOAK_ADMIN_PWD}"

echo "   OpenZiti控制台: https://zt-controller.${DOMAIN}"

echo "   用户名: admin"

echo "   密码: ${ZITI_ADMIN_PWD}"

四、核心配置详解

1. Keycloak 领域配置

# 创建业务领域

ziti edge login ziti-controller.${DOMAIN}:443 -u admin -p ${ZITI_ADMIN_PWD}

ziti edge create identity user employee1 -o employee1.jwt

ziti edge create service-policy web-access Dial --identity-roles '@employees' --service-roles '@web-apps'

2. OpenZiti 服务策略

# configs/zero-trust-policies.yaml

services:

  - name: internal-webapp

    protocol: tcp

    address: internal-webapp.company.local

    port: 8080

    policies:

      - name: webapp-access

        identities: ['@developers', '@qa-team']

        conditions:

          - device-compliance: true

          - time: "9:00-17:00"

3. Nginx 安全配置

# /etc/nginx/sites-available/zero-trust

server {

    listen 443 ssl;

    server_name zt.yourcompany.com;

    ssl_certificate /etc/letsencrypt/live/zt.yourcompany.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/zt.yourcompany.com/privkey.pem;

    # 安全头部

    add_header Strict-Transport-Security "max-age=63072000" always;

    add_header X-Frame-Options DENY;

    add_header X-Content-Type-Options nosniff;

    location / {

        proxy_pass https://localhost:8443;

        proxy_ssl_verify off;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

    }

}

五、零信任策略配置

1. 身份认证策略

# 启用多因素认证

keycloak-config-cli.sh --config-file /opt/keycloak/config/mfa-config.json

# 配置设备合规性检查

ziti edge create config device-compliance-checker \

  type="edge-router" \

  data='{"api":"http://wazuh-server:55000","timeout":"10s"}'

2. 网络访问策略

# 创建微分段策略

ziti edge create service-policy database-access Dial \

  --service-roles '@mysql-servers' \

  --identity-roles '@dba-team' \

  --semantic 'AllOf'

# 设置时间限制策略

ziti edge create service-policy business-hours Dial \

  --service-roles '@business-apps' \

  --identity-roles '@employees' \

  --conditions '{"timeRange":{"days":["Mon","Tue","Wed","Thu","Fri"],"startTime":"08:00","endTime":"18:00"}}'

六、集成与扩展

1. 与企业AD集成

# 配置LDAP连接

keycloak-config-cli.sh --config-file /opt/keycloak/config/ldap-integration.json \

  --vars.ldap.url="ldap://ad.company.local:389" \

  --vars.ldap.bindDn="cn=admin,dc=company,dc=local"

2. 安全监控集成

# Prometheus监控配置

scrape_configs:

  - job_name: 'keycloak'

    metrics_path: '/auth/realms/master/metrics'

    static_configs:

      - targets: ['keycloak:8443']

  - job_name: 'ziti-controller'

    static_configs:

      - targets: ['ziti-controller:1280']

七、故障排除指南

常见问题排查

# 1. 服务状态检查

systemctl status keycloak ziti-controller ziti-router

# 2. 日志分析

journalctl -u keycloak -f --since "5 minutes ago"

tail -f /opt/ziti/router/logs/router.log

# 3. 网络连通性

curl -kv https://zt.yourcompany.com/realms/master/.well-known/openid-configuration

ziti edge list edge-routers

# 4. 数据库诊断

sudo -u postgres psql -d keycloak -c "\dt+"

sudo -u postgres psql -d ziti -c "SELECT COUNT(*) FROM identities;"

性能调优参数

# Keycloak JVM调优

JAVA_OPTS="-Xms2G -Xmx4G -XX:MetaspaceSize=256M -XX:MaxMetaspaceSize=512m"

# OpenZiti数据库连接池

db:

  pool:

    maxOpenConns: 100

    maxIdleConns: 20

    connMaxLifetime: "30m"

八、安全加固措施

1. 基础设施安全

# 防火墙规则

ufw allow 443/tcp comment 'Keycloak HTTPS'

ufw allow 8443/tcp comment 'Keycloak Admin'

ufw allow 1280/tcp comment 'Ziti Controller'

ufw enable

# 文件系统权限

chmod 750 /opt/zero-trust

chown -R keycloak:keycloak /opt/zero-trust/keycloak

chown -R ziti:ziti /opt/zero-trust/ziti

2. 审计与监控

# 启用详细审计日志

cat >> /opt/keycloak/conf/keycloak.conf << EOF

log-level=INFO

log-handler=file:DEBUG

spi-events-listener-jboss-logging-success-level=INFO

spi-events-listener-jboss-logging-error-level=WARN

EOF

九、备份与恢复

1. 自动化备份脚本

#!/bin/bash

# 零信任平台备份脚本

BACKUP_DIR="/backup/zero-trust"

TIMESTAMP=$(date +%Y%m%d_%H%M%S)

# 备份数据库

pg_dump -U keycloak -d keycloak > ${BACKUP_DIR}/keycloak_db_${TIMESTAMP}.sql

pg_dump -U ziti -d ziti > ${BACKUP_DIR}/ziti_db_${TIMESTAMP}.sql

# 备份配置文件

tar -czf ${BACKUP_DIR}/configs_${TIMESTAMP}.tar.gz \

  /opt/zero-trust/keycloak/conf \

  /opt/zero-trust/ziti/controller/ctrl.yaml \

  /opt/zero-trust/ziti/router/router.yaml

# 保留最近7天备份

find ${BACKUP_DIR} -name "*.sql" -mtime +7 -delete

find ${BACKUP_DIR} -name "*.tar.gz" -mtime +7 -delete

十、总结与最佳实践

成功关键因素

1. 分阶段实施：从非关键业务开始试点，逐步推广
2. 持续监控：建立完整的监控和告警体系
3. 定期审计：每月审查访问日志和策略有效性
4. 团队培训：确保IT团队掌握零信任理念和工具链

扩展建议

• 🔄 高可用部署：部署多节点Controller和Router集群
• 🌐 混合云支持：将Router部署到公有云实现混合云访问
• 🤖 自动化运维：使用Ansible/Terraform实现基础设施即代码
• 📊 可视化分析：集成ELK Stack进行安全日志分析