密码策略与轮换

RabbitMQ账号密码安全通过制定密码规范、启用密码复杂度校验与定期轮换机制，防止密码泄露与暴力破解。

密码策略制定

密码复杂度要求

密码存储安全

# RabbitMQ 默认使用 SHA-256 哈希存储密码
# 查看密码哈希算法
rabbitmqctl eval 'rabbit_password_hash:hash_password("test").'

# 生产环境建议：
# 1. 启用外部认证（LDAP/OAuth）避免本地密码存储
# 2. 定期轮换密码，降低泄露风险

RabbitMQ 本地密码使用单向哈希存储，无法逆向破解，但弱密码仍可被字典攻击。

密码轮换机制

手动轮换流程

# 1. 创建新密码
rabbitmqctl change_password app_user 'N3wP@ssw0rd!2026'

# 2. 验证新密码连接
# rabbitmqctl status  # 检查连接状态

# 3. 更新应用配置中的密码
# 4. 重启应用或热更新配置
# 5. 验证业务正常运行
# 6. 记录变更日志

自动化轮换脚本

import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.time.LocalDateTime;
import java.util.Base64;

/**
 * RabbitMQ 密码自动轮换示例
 */
public class PasswordRotation {

    private static final String MANAGEMENT_URL = "http://localhost:15672";
    private static final String ADMIN_USER = "admin";
    private static final String ADMIN_PASS = "admin123";
    private static final SecureRandom RANDOM = new SecureRandom();

    public static void main(String[] args) throws Exception {
        String username = "app_user";
        String newPassword = generateStrongPassword(16);
        
        System.out.println("开始轮换密码: " + username);
        boolean success = rotatePassword(username, newPassword);
        
        if (success) {
            System.out.println("密码轮换成功");
            System.out.println("新密码: " + newPassword);
            // 生产环境中应将新密码写入安全配置中心（如 Vault）
        } else {
            System.err.println("密码轮换失败");
        }
    }

    private static String generateStrongPassword(int length) {
        String upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        String lower = "abcdefghijklmnopqrstuvwxyz";
        String digits = "0123456789";
        String special = "!@#$%^&*()-_=+";
        String all = upper + lower + digits + special;

        StringBuilder password = new StringBuilder();
        // 确保每种字符至少一个
        password.append(upper.charAt(RANDOM.nextInt(upper.length())));
        password.append(lower.charAt(RANDOM.nextInt(lower.length())));
        password.append(digits.charAt(RANDOM.nextInt(digits.length())));
        password.append(special.charAt(RANDOM.nextInt(special.length())));

        for (int i = 4; i < length; i++) {
            password.append(all.charAt(RANDOM.nextInt(all.length())));
        }

        // 打乱顺序
        char[] chars = password.toString().toCharArray();
        for (int i = chars.length - 1; i > 0; i--) {
            int j = RANDOM.nextInt(i + 1);
            char temp = chars[i];
            chars[i] = chars[j];
            chars[j] = temp;
        }

        return new String(chars);
    }

    private static boolean rotatePassword(String username, String newPassword) throws IOException {
        String endpoint = MANAGEMENT_URL + "/api/users/" + username;
        URL url = new URL(endpoint);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setRequestMethod("PUT");
        conn.setRequestProperty("Content-Type", "application/json");

        String auth = ADMIN_USER + ":" + ADMIN_PASS;
        String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
        conn.setRequestProperty("Authorization", "Basic " + encodedAuth);
        conn.setDoOutput(true);

        String payload = "{\"password\":\"" + newPassword + "\"}";
        try (OutputStream os = conn.getOutputStream()) {
            os.write(payload.getBytes(StandardCharsets.UTF_8));
        }

        return conn.getResponseCode() == 204 || conn.getResponseCode() == 200;
    }
}

轮换周期与告警

轮换策略

过期告警检查

import java.time.LocalDate;
import java.time.temporal.ChronoUnit;
import java.util.HashMap;
import java.util.Map;

/**
 * 密码过期检查示例
 */
public class PasswordExpiryChecker {

    private final Map<String, LocalDate> passwordExpiryDates = new HashMap<>();

    public PasswordExpiryChecker() {
        // 初始化密码过期日期（实际应从配置中心或数据库读取）
        passwordExpiryDates.put("admin", LocalDate.of(2026, 6, 21));
        passwordExpiryDates.put("app_user", LocalDate.of(2026, 8, 20));
        passwordExpiryDates.put("monitor_svc", LocalDate.of(2026, 11, 18));
    }

    public void checkExpiry() {
        LocalDate today = LocalDate.now();

        for (Map.Entry<String, LocalDate> entry : passwordExpiryDates.entrySet()) {
            String username = entry.getKey();
            LocalDate expiryDate = entry.getValue();
            long daysLeft = ChronoUnit.DAYS.between(today, expiryDate);

            if (daysLeft < 0) {
                System.err.println("[ALERT] " + username + " 密码已过期 " + Math.abs(daysLeft) + " 天，立即轮换");
            } else if (daysLeft <= 7) {
                System.err.println("[WARN] " + username + " 密码将在 " + daysLeft + " 天后过期，安排轮换");
            } else {
                System.out.println("[OK] " + username + " 密码剩余 " + daysLeft + " 天");
            }
        }
    }

    public static void main(String[] args) {
        new PasswordExpiryChecker().checkExpiry();
    }
}

密码轮换必须配合配置中心（如 HashiCorp Vault）实现无缝更新，避免业务中断。

注意事项

• 弱密码检测：定期使用字典攻击工具检测弱密码账号
• 轮换窗口：选择业务低峰期执行轮换，减少影响
• 配置同步：新密码必须同步更新到应用配置，避免连接失败
• 回滚预案：保留旧密码24小时作为回滚窗口
• 审计日志：所有密码变更必须记录审计日志，包含操作人与时间

要点总结

• 密码复杂度：≥12位，大小写+数字+特殊字符，禁止弱密码
• 定期轮换：管理员30天、应用90天、监控180天
• 自动化轮换：结合 Management API 与配置中心实现自动化
• 告警机制：提前检查过期时间，避免突发中断
• 审计与回滚：记录所有变更，保留回滚窗口