Download as PDF, PPTX
![• iptables-‐service
# systemctl enable iptables
• / / iptables
# systemctl [stop|start|restart] iptables
• iptable
# service iptables save
• iptables
# iptables -‐L
• ssh](https://image.slidesharecdn.com/3-150517174216-lva1-app6891/85/Linux-40-320.jpg)
![•
•
# chcon [-‐R] [-‐t type] [-‐u user] [-‐r role]
•
# restorecon [-‐Rv]
root:~/ # ls -‐Z
-‐rw-‐-‐-‐-‐-‐-‐-‐. root root system_u:object_r:admin_home_t:s0 anaconda-‐ks.cfg
-‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 latest.zip
-‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 number
-‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 phpmyadmin_4.4.0.zip
Identify : Role : Type
: :](https://image.slidesharecdn.com/3-150517174216-lva1-app6891/85/Linux-50-320.jpg)
Uploaded by維泰 蔡
Linux 系統管理與安全：系統防駭與資訊安全
This document provides instructions on configuring Linux security features such as SSH key-based authentication, firewall rules using iptables, SELinux concepts, and the Fail2ban utility. It discusses generating SSH keys, editing SSH configuration files, setting default firewall policies and rules for input, output, and forwarding, as well as network address translation rules. It also covers SELinux file and process context types and restoring default contexts. Lastly, it explains how to install, configure, and check the status of Fail2ban to automatically ban IPs with too many failed login attempts.
More Related Content
Linux 系統管理與安全：系統防駭與資訊安全
- 2.
- 3.
- 5.
- 6.
- 8.
- 9.
- 10.
- 11. • • authorized_keys • id_rsa •id_rsa.pub • known_hosts • $ ssh-‐keygen -‐t rsa -‐b 2048 • 600 .ssh 700
- 12.
- 13. • ~/.ssh/authorized_keys • ssh-‐copy-‐id • •/etc/ssh/sshd_config • PasswordAuthentication no
- 14. • $ last • $ who • $ lastlog
- 16.
- 17.
- 18.
- 19.
- 20.
- 22.
- 23.
- 24.
- 25. • • <Directory /var/www> Options –Indexes </Directory> • /etc/apache2/httpd-‐conf • ServerTokens Prod • ServerSignature Off • /etc/php5/php.ini • expose_php = Off
- 27.
- 28. • • SQL $SQL = "SELECT * FROM users WHERE (name = '" + $user + "') and (pw = '"+ $pass +"');" $user $pass 1' OR '1'='1 SQL $SQL = "SELECT * FROM users WHERE (name = '1' OR '1'='1') and (pw = '1' OR '1'='1');" $SQL = "SELECT * FROM users;"
- 29.
- 30.
- 32.
- 33.
- 34.
- 35.
- 36.
- 37.
- 39. • • • • • firewalld iptables-‐service •# systemctl stop firewalld • # systemctl mask firewalld • # yum install iptables-‐services
- 40. • iptables-‐service # systemctlenable iptables • / / iptables # systemctl [stop|start|restart] iptables • iptable # service iptables save • iptables # iptables -‐L • ssh
- 41. • • INPUT -‐ •OUTPUT -‐ • FORWARD -‐ • (first match) • vs.
- 42. • # vim my_firewall.sh #!/bin/bash # iptables iptables -‐F # SSH tcp 22 iptables -‐A INPUT -‐p tcp -‐-‐dport 22 -‐j ACCEPT # INPUT FORWARD OUTPUT iptables -‐P INPUT DROP iptables -‐P FORWARD DROP iptables -‐P OUTPUT ACCEPT # localhost iptables -‐A INPUT -‐i lo -‐j ACCEPT # iptables -‐A INPUT -‐m state -‐-‐state ESTABLISHED,RELATED -‐j ACCEPT -‐i < > -‐p < > -‐-‐dport < > -‐-‐sport < > -‐m < >-‐A ( ) -‐I ( ) -‐D ( ) -‐-‐state INVALID -‐-‐state ESTABLISHED -‐-‐state NEW -‐-‐state RELATED
- 43. # IP iptables -‐A INPUT -‐s 192.168.0.100 -‐j ACCEPT iptables -‐A INPUT -‐s 140.115.0.0/16 -‐j ACCEPT # 6881-‐6890 bittorrent tcp iptables -‐A INPUT -‐p tcp -‐-‐dport 6881:6890 -‐j ACCEPT # IP 21 tcp iptables -‐A INPUT -‐s 192.168.0.20 -‐p tcp -‐-‐dport 21 -‐j ACCEPT # /sbin/service iptables save # iptables -‐L -‐v -‐s < IP> -‐d < IP> Q REJECT DROP -‐j ACCEPT ( ) -‐j REJECT ( ) -‐j DROP ( )
- 44. • • • # echo 1 > /proc/sys/net/ipv4/ip_forward # port 80 172.31.0.23 port 80 iptables -‐t nat -‐A PREROUTING -‐i eth0 -‐p tcp -‐-‐dport 80 -‐j DNAT -‐-‐to 172.31.0.23:80 # IP 192.168.1.0/24 eth0 IP 1.2.3.0/24 iptables -‐t nat -‐A POSTROUTING -‐s 192.168.1.0/24 -‐o eth1 -‐j SNAT -‐-‐to 1.2.3.0/24 # IP 192.168.1.0/24 eth0 IP eth1 IP iptables -‐t nat -‐A POSTROUTING -‐s 192.168.1.0/24 -‐o eth1 -‐j MASQUERADE Q SNAT DNAT MASQUERADE A SNAT IP DNAT IP MASQUERADE IP
- 46. 1. # iptables-‐A INPUT -‐s 140.115.1.1 -‐j REJECT 2. # iptables -‐A INPUT -‐s 140.115.1.31 -‐p UDP -‐-‐ dport 5566 -‐j ACCEPT
- 49.
- 50. • • # chcon [-‐R] [-‐t type] [-‐u user] [-‐r role] • # restorecon [-‐Rv] root:~/ # ls -‐Z -‐rw-‐-‐-‐-‐-‐-‐-‐. root root system_u:object_r:admin_home_t:s0 anaconda-‐ks.cfg -‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 latest.zip -‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 number -‐rw-‐r-‐-‐r-‐-‐. root root unconfined_u:object_r:admin_home_t:s0 phpmyadmin_4.4.0.zip Identify : Role : Type : :
- 52. • • • • • Fail2ban # yum install fail2ban • # vim /etc/fail2ban/jail.local • # systemctl enable fail2ban && systemctl start fail2ban
- 53. • # fail2ban-‐client status • # fail2ban-‐client status sshd # fail2ban-‐client status sshd Status for the jail: sshd |-‐ Filter | |-‐ Currently failed: 1 | |-‐ Total failed: 1 | `-‐ File list: /var/log/secure `-‐ Actions |-‐ Currently banned: 0 |-‐ Total banned: 0 `-‐ Banned IP list: