注释： 阅读完本指南后如果感觉意犹未尽，请移架到强化Gentoo计划

注释： 建立的政策应该易懂、切题。

代码 3.1: /boot/grub/grub.conf

timeout 5
password changeme

代码 3.2: md5crypt in grub shell

#/sbin/grub

    GRUB  version 0.92  (640K lower / 3072K upper memory)

   [ Minimal BASH-like line editing is supported.  For the first word, TAB
     lists possible command completions.  Anywhere else TAB lists the possible
     completions of a device/filename. ]

grub> md5crypt

Password: ********// Typed changeme
Encrypted: $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.

grub> quit

代码 3.3: /boot/grub/grub.conf

timeout 5
password --md5 $1$T7/dgdIJ$dJM.n2wZ8RG.oEiIOwJUs.

代码 3.4: /etc/lilo.conf

password=changeme
restricted
delay=3

代码 3.5: /etc/lilo.conf

image=/boot/bzImage
      read-only
      password=changeme
      restricted

注释： wheel组中用户还是可以在其他TTY上 su - 为root。

代码 3.6: /etc/securetty

vc/1

代码 4.1: /etc/syslog.conf

#  /etc/syslog.conf     syslogd配置文件.
#
#                       参考syslog.conf(5) man手册页以获取更多的信息
#                       取自Debian, 目前我们使用这个
#                       Daniel Robbins, 5/15/99

#
# 首先，一些标准的日志文件。由工具记录
#

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          /var/log/mail.log
user.*                          -/var/log/user.log
uucp.*                          -/var/log/uucp.log
local6.debug                    /var/log/imapd.log

#
# 邮件系统日志。将其分开以便编写脚本分析这些文件
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

# INN新闻系统日志
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

#
# 一些 `照单全收' 的日志文件。
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# 紧急情况和提醒发送给已登录的所有用户
#
*.emerg                         *
*.=alert                        *

#
# 我喜欢把消息显示在终端上，不过只在一个我通常不用的虚终端上
#
daemon,mail.*;\
       news.=crit;news.=err;news.=notice;\
       *.=debug;*.=info;\
       *.=notice;*.=warn       /dev/tty8

# 设置远端日志服务器
*.*                        @logserver

# /dev/xconsole命名管道用于`xconsole'工具。要使用它，
# 必须以`-file'选项调用`xconsole':
#
#    $ xconsole -file /dev/xconsole [...]
#
# 备注: 调整下面的列表，否则网站够忙时, 你就麻烦缠身了
#
# daemon.*,mail.*;\
#       news.crit;news.err;news.notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       |/dev/xconsole

local2.*                -/var/log/ppp.log

代码 4.2: postfix的/usr/local/sbin/mail_pwd_failures.sh

#! /bin/sh
echo "$3" | mail -s "Warning (program : $2)" root

代码 4.3: qmail的/usr/local/sbin/mail_pwd_failures.sh

#!/bin/sh
echo "To: root
Subject:Failure (Warning: $2)
$3
" | /var/qmail/bin/qmail-inject -f root

代码 4.4: /etc/metalog/metalog.conf

command  = "/usr/local/sbin/mail_pwd_failures.sh"

代码 4.5: /etc/syslog-ng/syslog-ng.conf

options { long_hostnames(off); sync(0); };

# 读取日志的源
source src { unix-stream("/dev/log"); internal(); };
source kernsrc { file("/proc/kmsg"); };

# 定义目的地
destination authlog { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };

destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };

destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
destination xconsole { pipe("/dev/xconsole"); };

# 创建过滤器
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(authpriv, mail); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_user { facility(user); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn)
	and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };

filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };

# 把过滤器和目的地连接起来
log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };

log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };

# 默认日志
log { source(src); destination(console_all); };

代码 5.1: /etc/fstab

/dev/sda1 /boot ext2 noauto,noatime 1 1
/dev/sda2 none swap sw 0 0
/dev/sda3 / reiserfs notail,noatime 0 0
/dev/sda4 /tmp reiserfs notail,noatime,nodev,nosuid,noexec 0 0
/dev/sda5 /var reiserfs notail,noatime,nodev 0 0
/dev/sda6 /home reiserfs notail,noatime,nodev,nosuid 0 0
/dev/sda7 /usr reiserfs notail,noatime,nodev,ro 0 0
/dev/cdroms /cdrom0 /mnt/cdrom iso9660 noauto,ro 0 0
proc /proc proc defaults 0 0

警告： 把 /tmp 设为 noexec 模式可能会妨碍某些脚本正常执行。

注释： 磁盘配额参配额部分.

注释： 我没有设 /var 为 noexec 或 nosuid 尽管通常从不从这个挂载点执行。理由是qmail安装在 /var/qmail，它必须执行及访问一个SUID文件。我把/usr设为只读，因为除更新Gentoo外我从不往那里写入任何东西。这样我把文件系统重挂为读写模式，更新，再重挂。

注释： 就算你不用qmail, Gentoo还是需要你设置 /var/tmp 的执行位，因为ebuilds在那里完成。如果你坚持要把 /var 设为 noexec 模式，可以设置一个替代的路径。

代码 6.1: /etc/security/limits.conf

*    soft core      0
*    hard core      0
*    hard nproc     15
*    hard rss       10000
*    -    maxlogins 2
@dev hard core      100000
@dev soft nproc     20
@dev hard nproc     35
@dev -    maxlogins 10

注释：/etc/security/limits.conf 是PAM包的一部分，仅适用于使用了PAM的包。

代码 6.2: /etc/limits

*   L2 C0 U15 R10000
kn L10 C100000 U35

警告： 确保你采用文件系统支持配额。ReiserFS就不支持。

代码 6.3: /etc/fstab

/dev/sda1 /boot ext2 noauto,noatime 1 1
/dev/sda2 none swap sw 0 0
/dev/sda3 / reiserfs notail,noatime 0 0
/dev/sda4 /tmp ext3 notail,noatime,nodev,nosuid,noexec,usrquota,grpquota 0 0
/dev/sda5 /var ext3 notail,noatime,nodev,usrquota,grpquota 0 0
/dev/sda6 /home ext3 notail,noatime,nodev,nosuid,usrquota,grpquota 0 0
/dev/sda7 /usr reiserfs notail,noatime,nodev,ro	0 0
/dev/cdroms/cdrom0 /mnt/cdrom iso9660 noauto,ro 0 0
proc /proc proc defaults 0 0

代码 6.4: Creating the quota files

# touch /tmp/quota.user
# touch /tmp/quota.group
# chmod 600 /tmp/quota.user
# chmod 600 /tmp/quota.group

代码 6.5: Adding quota to the boot runlevel

# rc-update add quota boot

代码 6.6: Adding quota check to crontab

0 3 * * 0 /sbin/quotacheck -avug.

代码 6.7: Setting up quota's for user kn

Quotas for user kn:
/dev/sda4: blocks in use: 2594, limits (soft = 5000, hard = 6500)
         inodes in use: 356, limits (soft = 1000, hard = 1500)

注释： 这个设置不适用于root。

代码 6.8: /etc/login.access

-:ALL EXCEPT wheel sync:console
-:wheel:ALL EXCEPT LOCAL .gentoo.org

重要： 配置这些选项时要小心，如果你没有root访问权限，一旦出错你将无法访问机器。

注释： 这些设置不适用于SSH，因为默认SSH并不执行/bin/login。可以在 /etc/ssh/sshd_config 中使用 UseLogin yes 来打开。这样SSH就会使用login，设置对其就生效了。

代码 7.1: Finding world-writable files and directories

# /usr/bin/find / -type f \( -perm -2 -o -perm -20 \) \
   -exec ls -lg {} \; 2>/dev/null >writable.txt
# /usr/bin/find / -type d \( -perm -2 -o -perm -20 \) \
   -exec ls -ldg {} \; 2>/dev/null >>writable.txt

代码 7.2: Finding setuid files

# /usr/bin/find / -type f \( -perm -004000 -o -perm -002000 \) \
  -exec ls -lg {} \; 2>/dev/null >suidfiles.txt

代码 7.3: List of setuid binaries

/bin/su
/bin/ping
/bin/mount
/bin/umount
/var/qmail/bin/qmail-queue
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/crontab
/usr/bin/chage
/usr/bin/expiry
/usr/bin/sperl5.6.1
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/procmail
/usr/bin/suidperl
/usr/lib/misc/pt_chown
/usr/sbin/unix_chkpwd
/usr/sbin/traceroute
/usr/sbin/pwdb_chkpwd

代码 8.1: Installing cracklib

# emerge cracklib

代码 8.2: /etc/pam.d/passwd

auth	 required pam_unix.so shadow nullok
account	 required pam_unix.so
password required pam_cracklib.so difok=3 retry=3 minlen=8 dcredit=2 ocredit=2 
password required pam_unix.so md5 use_authtok
session	 required pam_unix.so

代码 8.3: /etc/pam.d/sshd

auth	 required pam_unix.so nullok 
auth     required pam_shells.so
auth	 required pam_nologin.so
auth	 required pam_env.so
account	 required pam_unix.so
password required pam_cracklib.so difok=3 retry=3 minlen=8 dcredit=2 ocredit=2 use_authtok
password required pam_unix.so shadow md5
session	 required pam_unix.so
session	 required pam_limits.so

代码 8.4: /etc/pam.d/other

auth     required pam_deny.so
auth     required pam_warn.so
account  required pam_deny.so
account  required pam_warn.so
password required pam_deny.so
password required pam_warn.so
session  required pam_deny.so
session  required pam_warn.so

注释： 此服务在其服务器参数(xinetd中)应执行tcpd。参关于xinetd的章节以获取更多信息。

代码 9.1: /etc/hosts.deny

ALL:PARANOID

代码 9.2: /etc/hosts.allow

ALL: LOCAL @wheel
time: LOCAL, .gentoo.org

代码 10.1: Drop ping packets

# /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

代码 10.2: Ignore broadcast pings

# /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

代码 10.3: Disable source routed packets

# /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route

代码 10.4: Disable redirect acceptance

# /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

代码 10.5: Protect against bad error messages

# /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

代码 10.6: Enable reverse path filtering

# for i in /proc/sys/net/ipv4/conf/*; do
        /bin/echo "1" > $i/rp_filter
done

注释： 如果打开IP转发，也会得到这个结果。

警告： 但是如果使用不对称路由(从你到你某个主机的包与从该主机到你的包采用不同的路径) 或者你使用不同接口上有几个IP地址的无路由主机，启用逆向路径过滤会有问题。

代码 10.7: Log all spoofed, source routed and redirect packets

# /bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

代码 10.8: Deactivate IP forwarding

# /bin/echo "0" > /proc/sys/net/ipv4/ip_forward

代码 10.9: Translating to sysctl.conf

(Manual using echo):
/bin/echo "0" > /proc/sys/net/ipv4/ip_forward

(Automatic in sysctl.conf:)
net.ipv4.ip_forward = 0

警告： 对最新的内核该补丁目前尚为不稳定版本，使用时多家加小心。

代码 11.1: /etc/conf.d/apache

HTTPD_OPTS="-D SSL"

代码 11.2: /etc/apache/conf/apache.conf

#Make it listen on your ip
Listen 127.0.0.1
BindAddress 127.0.0.1
#It is not a good idea to use nobody or nogroup - 
#for every service not running as root 
#(just add the user apache with group apache)
User apache
Group apache
#Will keep apache from telling about the version
ServerSignature Off
ServerTokens Prod

代码 11.3: 改换BIND根目录

ebuild /var/db/pkg/net-dns/bind-9.2.2-r2/bind-9.2.2-r2.ebuild config\`"
// 执行以上命令前可能要改变/etc/conf.d/named中的chroot目录，
否则会使用/chroot/dns。// 可能需要用当前版本号替换上面的版本号

代码 11.4: 禁止网络访问

skip-networking

代码 11.5: 在[mysqld]区禁止 LOAD DATA LOCAL INFILE 命令的使用

set-variable=local-infile=0

代码 11.6: 设定 root 密码

/usr/local/mysql/bin/mysql -u root 
mysql> SET PASSWORD FOR root@localhost=PASSWORD('new_password');

注释： 不从命令行［如使用mysqladmin password命令］改变密码是好的做法。服务器上还有其他用户使用时这点尤为重要。那样密码很容易通过用如 ps aux 命令和查看历史文件(~/.history，~/.bash_history etc)而暴露。

代码 11.7: 删除示例数据库和非必需用户

mysql> drop database test;
mysql> use mysql;
mysql> delete from db;
mysql> delete from user where not (host="localhost" and user="root");
mysql> flush privileges;

警告： 如果已配置好用户帐户，进行上步时要多加小心。

代码 11.8: /etc/proftpd/proftpd.conf

ServerName "My ftp daemon"
#不显示服务器身份
ServerIdent on "Go away"

#便于创建虚用户
RequireValidShell off

#使用替代的密码和组文件(passwd采用加密格式)
AuthUserFile "/etc/proftpd/passwd"
AuthGroupFile "/etc/proftpd/group"

# 权限
Umask 077

# 超时和限制
MaxInstances 30
MaxClients 10 "Only 10 connections allowed"
MaxClientsPerHost 1 "You have already logged on once"
MaxClientsPerUser 1 "You have already logged on once"
TimeoutStalled 10

TimeoutNoTransfer 20
TimeoutLogin 20

# Chroot 每个人
DefaultRoot ~

# 不要以root运行
User  nobody
Group nogroup

# 记录每次传输
TransferLog /var/log/transferlog

# 使用通配符的问题
DenyFilter \*.*/

代码 11.9: /etc/conf.d/pure-ftpd

AUTH="-lpuredb:/etc/pureftpd.pdb"

## Misc. Others ##
MISC_OTHER="-A -E -X -U 177:077 -d -4 -L100:5 -I 15"

警告：不要 使用 -w 或 -W 选项! 如果想建 warez 网站，您还是别往下看了！

代码 11.10: /etc/samba/smb.conf

[global]
  # 绑定到接口
  interfaces = eth0 10.0.0.1/32

  # 确保使用加密口令
  encrypt passwords = yes
  directory security mask = 0700

  #允许来自 10.0.0.* 的通信
  hosts allow = 10.0.0.

  # 启用用户认证 
  #( 不要使用共享模式 )
  security = user
  
  # 不允许特权帐户
  invalid users = root @wheel

  # smb显示给共享的最大值 (不是限制)
  max disk size = 102400

  # 捍卫密码政策
  min password length = 8
  null passwords = no

  # 使用( 如果加入了支持 )
  obey pam restrictions = yes
  pam password change = yes

代码 11.11: /etc/ssh/sshd_config

# 只启用版本 2
Protocol 2

# 禁止 root 登录。用户必须su为root
PermitRootLogin no

# 打开公密钥鉴证
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

# 禁止 .rhost 和常规密码鉴证
RhostsAuthentication no
PasswordAuthentication no
PermitEmptyPasswords no

AllowHosts *.gentoo.org

# 只允许 wheel 或 admin 组的用户登录
AllowGroups wheel admin

# 只允许那些组中的如下用户
AllowUsers kn bs

# 日志 
SyslogFacility AUTH
LogLevel INFO

ListenAddress 127.0.0.1

代码 11.12: 创建 DSA 密钥对

# /usr/bin/ssh-keygen -t dsa

代码 11.13: ssh-keygen的输出

Generating public/private dsa key pair.
Enter file in which to save the key (/home/kn/.ssh/id_dsa):[Press enter]
Created directory '/home/kn/.ssh'.
Enter passphrase (empty for no passphrase): [Enter passphrase]
Enter same passphrase again: [Enter passphrase again]
Your identification has been saved in /home/kn/.ssh/id_dsa.
Your public key has been saved in /home/kn/.ssh/id_dsa.pub.
The key fingerprint is:
07:24:a9:12:7f:83:7e:af:b8:1f:89:a3:48:29:e2:a4 kn@knielsen

代码 11.14: 安装l xinetd

# emerge xinetd tcp-wrappers

代码 11.15: /etc/xinetd.conf

defaults
{
 only_from      = localhost
 instances      = 10
 log_type       = SYSLOG authpriv info
 log_on_success = HOST PID
 log_on_failure = HOST
 cps            = 25 30
}

# 将以如下设定经由xinetd设置 pserver (cvs):
# 最多 10 个实例 (一次 10 个连接)
# 限制 pserver 只用 tcp 
# 使用用户 cvs 运行本服务
# 把接口只绑定到一个ip上
# 允许来自 10.0.0.* 的连接
# 现在开发人员使用cvs的时间从早8点到晚5点
# 使用 tpcd 包装 ( 访问控制在
# /etc/hosts.allow和/etc/hosts.deny中)
# 该机 max_load 设为 1.0
# disable 标志默认设为no, 但我还是加上了 
# 以策安全
service cvspserver
{
 socket_type    = stream
 protocol       = tcp
 instances      = 10
 protocol       = tcp
 wait           = no
 user           = cvs
 bind           = 10.0.0.2
 only_from      = 10.0.0.0
 access_times   = 8:00-17:00
 server         = /usr/sbin/tcpd
 server_args    = /usr/bin/cvs --allow-root=/mnt/cvsdisk/cvsroot pserver
 max_load       = 1.0
 log_on_failure += RECORD
 disable        = no
}

代码 11.16: /etc/vsftpd

anonymous_enable=NO
local_enable=YES

#read only
write_enable=NO

#enable logging of transfers
xferlog_std_format=YES

idle_session_timeout=20
data_connection_timeout=20
nopriv_user=nobody

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chrootlist

ls_recurse_enable=NO

重要： 如果不需要这个服务，禁用之！

警告： 绝对不要使用 xhost + 功能! 这会允许任何客户连入并控制你的X。如果攻击者能访问X，他就可以记录下你的键盘动作并控制你的桌面。如果不能不用，一定记得指定主机。

代码 11.17: /usr/X11R6/bin/startx

defaultserverargs="-nolisten tcp"

代码 11.18: /etc/make.conf

CONFIG_PROTECT_MASK="/usr/X11R6/bin/startx"

代码 11.19: /etc/X11/gdm/gdm.conf

[server-Standard]
command=/usr/X11R6/bin/X -nolisten tcp

代码 11.20: /etc/X11/xdm/Xservers

:0 local /usr/bin/X11/X -nolisten tcp 

代码 12.1: 取得使用库的列表

# ldd /bin/bash
  libncurses.so.5 => /lib/libncurses.so.5 (0x4001b000)
  libdl.so.2 => /lib/libdl.so.2 (0x40060000)
  libc.so.6 => /lib/libc.so.6 (0x40063000)
  /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

代码 12.2: 为bash建立 chroot 环境

# mkdir /chroot/bash
# mkdir /chroot/bash/bin
# mkdir /chroot/bash/lib

代码 13.1: 阻止所有 ICMP 包

# iptables -A INPUT -p icmp -j DROP

代码 13.2: 刷新所有规则

# iptables -F

代码 13.3: 接受产生自已经建立的连接的包

# iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

代码 13.4: 创建用户定义链

// 创建一个只有一条规则的新链
# iptables -X mychain
# iptables -N mychain
# iptables -A mychain -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT// 默认政策是允许所有流出的通讯，丢弃进入的。
# iptables -P OUTPUT ACCEPT
# iptables -P INPUT DROP// 将其加入 INPUT 链
# iptables -A INPUT -j mychain

代码 13.5: /etc/init.d/firewall

#!/sbin/runscript
IPTABLES=/sbin/iptables
IPTABLESSAVE=/sbin/iptables-save
IPTABLESRESTORE=/sbin/iptables-restore
FIREWALL=/etc/firewall.rules
DNS1=212.242.40.3
DNS2=212.242.40.51
#内部
IIP=10.0.0.2
IINTERFACE=eth0
LOCAL_NETWORK=10.0.0.0/24
#外部
OIP=217.157.156.144
OINTERFACE=eth1

opts="${opts} showstatus panic save restore showoptions rules"

depend() {
  need net
}

rules() {
  stop
  ebegin "Setting internal rules"

  einfo "Setting default rule to drop"
  $IPTABLES -P FORWARD DROP
  $IPTABLES -P INPUT   DROP
  $IPTABLES -P OUTPUT  DROP

  #默认规则
  einfo "Creating states chain"
  $IPTABLES -N allowed-connection
  $IPTABLES -F allowed-connection
  $IPTABLES -A allowed-connection -m state --state ESTABLISHED,RELATED -j ACCEPT
  $IPTABLES -A allowed-connection -i $IINTERFACE -m limit -j LOG --log-prefix \ 
      "Bad packet from ${IINTERFACE}:"
  $IPTABLES -A allowed-connection -j DROP

  #ICMP通迅
  einfo "Creating icmp chain"
  $IPTABLES -N icmp_allowed
  $IPTABLES -F icmp_allowed
  $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ 
      time-exceeded -j ACCEPT
  $IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type \ 
      destination-unreachable -j ACCEPT
  $IPTABLES -A icmp_allowed -p icmp -j LOG --log-prefix "Bad ICMP traffic:"
  $IPTABLES -A icmp_allowed -p icmp -j DROP

  #进入通讯
  einfo "Creating incoming ssh traffic chain"
  $IPTABLES -N allow-ssh-traffic-in
  $IPTABLES -F allow-ssh-traffic-in
  #Flood protection
  $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ 
      ALL RST --dport ssh -j ACCEPT
  $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ 
      ALL FIN --dport ssh -j ACCEPT
  $IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags \ 
      ALL SYN --dport ssh -j ACCEPT
  $IPTABLES -A allow-ssh-traffic-in -m state --state RELATED,ESTABLISHED -p tcp --dport ssh -j ACCEPT

  #外出通讯
  einfo "Creating outgoing ssh traffic chain"
  $IPTABLES -N allow-ssh-traffic-out
  $IPTABLES -F allow-ssh-traffic-out
  $IPTABLES -A allow-ssh-traffic-out -p tcp --dport ssh -j ACCEPT

  einfo "Creating outgoing dns traffic chain"
  $IPTABLES -N allow-dns-traffic-out
  $IPTABLES -F allow-dns-traffic-out
  $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS1 --dport domain \ 
      -j ACCEPT
  $IPTABLES -A allow-dns-traffic-out -p udp -d $DNS2 --dport domain \ 
     -j ACCEPT

  einfo "Creating outgoing http/https traffic chain"
  $IPTABLES -N allow-www-traffic-out
  $IPTABLES -F allow-www-traffic-out
  $IPTABLES -A allow-www-traffic-out -p tcp --dport www -j ACCEPT
  $IPTABLES -A allow-www-traffic-out -p tcp --dport https -j ACCEPT

  #捕获端口扫描
  einfo "Creating portscan detection chain"
  $IPTABLES -N check-flags
  $IPTABLES -F check-flags
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \ 
      --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:" 
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit \ 
      5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \ 
      -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit \ 
      --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
  $IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \ 
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \ 
      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
  $IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

  # 向链中应用并加入无效状态
  einfo "Applying chains to INPUT"
  $IPTABLES -A INPUT -m state --state INVALID -j DROP
  $IPTABLES -A INPUT -j icmp_allowed 
  $IPTABLES -A INPUT -j check-flags
  $IPTABLES -A INPUT -i lo -j ACCEPT
  $IPTABLES -A INPUT -j allow-ssh-traffic-in
  $IPTABLES -A INPUT -j allowed-connection

  einfo "Applying chains to FORWARD"
  $IPTABLES -A FORWARD -m state --state INVALID -j DROP
  $IPTABLES -A FORWARD -j icmp_allowed 
  $IPTABLES -A FORWARD -j check-flags
  $IPTABLES -A FORWARD -o lo -j ACCEPT
  $IPTABLES -A FORWARD -j allow-ssh-traffic-in
  $IPTABLES -A FORWARD -j allow-www-traffic-out
  $IPTABLES -A FORWARD -j allowed-connection

  einfo "Applying chains to OUTPUT"
  $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
  $IPTABLES -A OUTPUT -j icmp_allowed
  $IPTABLES -A OUTPUT -j check-flags
  $IPTABLES -A OUTPUT -o lo -j ACCEPT
  $IPTABLES -A OUTPUT -j allow-ssh-traffic-out
  $IPTABLES -A OUTPUT -j allow-dns-traffic-out
  $IPTABLES -A OUTPUT -j allow-www-traffic-out
  $IPTABLES -A OUTPUT -j allowed-connection

  #允许客户通过NAT(网路地址转换)路由
  $IPTABLES -t nat -A POSTROUTING -o $IINTERFACE -j MASQUERADE 
  eend $?
}

start() {
  ebegin "Starting firewall"
  if [ -e "${FIREWALL}" ]; then
    restore
  else
    einfo "${FIREWALL} does not exists. Using default rules."
    rules
  fi
  eend $?
}

stop() {
  ebegin "Stopping firewall"
  $IPTABLES -F
  $IPTABLES -t nat -F
  $IPTABLES -X
  $IPTABLES -P FORWARD ACCEPT
  $IPTABLES -P INPUT   ACCEPT
  $IPTABLES -P OUTPUT  ACCEPT
  eend $?
}

showstatus() {
  ebegin "Status"
  $IPTABLES -L -n -v --line-numbers
  einfo "NAT status"
  $IPTABLES -L -n -v --line-numbers -t nat
  eend $?
}

panic() {
  ebegin "Setting panic rules"
  $IPTABLES -F
  $IPTABLES -X
  $IPTABLES -t nat -F
  $IPTABLES -P FORWARD DROP
  $IPTABLES -P INPUT   DROP
  $IPTABLES -P OUTPUT  DROP
  $IPTABLES -A INPUT -i lo -j ACCEPT
  $IPTABLES -A OUTPUT -o lo -j ACCEPT
  eend $?
}

save() {
  ebegin "Saving Firewall rules"
  $IPTABLESSAVE > $FIREWALL
  eend $?
}

restore() {
  ebegin "Restoring Firewall rules"
  $IPTABLESRESTORE < $FIREWALL
  eend $?
}

restart() {
  svc_stop; svc_start
}

showoptions() {
  echo "Usage: $0 {start|save|restore|panic|stop|restart|showstatus}"
  echo "start)      will restore setting if exists else force rules"
  echo "stop)       delete all rules and set all to accept"
  echo "rules)      force settings of new rules"
  echo "save)       will store settings in ${FIREWALL}"
  echo "restore)    will restore settings from ${FIREWALL}"
  echo "showstatus) Shows the status" 
}

代码 13.6: /etc/squid/squid.conf

# 保定到一个 IP和端口
http_port 10.0.2.1:3128

# 标准配置
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY

# 加入基本访问控制列表
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255

# 加入可以访问代理服务器的人员
acl localnet src 10.0.0.0/255.255.0.0

# 及端口
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl purge method PURGE

# 加入基于URL内的正则表达式的访问控制列表
acl archives urlpath_regex "/etc/squid/files.acl"
acl url_ads url_regex "/etc/squid/banner-ads.acl"

# 加入基于时间和日期的访问控制列表
acl restricted_weekdays time MTWHF 8:00-17:00
acl restricted_weekends time A 8:00-13:00

acl CONNECT method CONNECT

#允许manager从localhost访问
http_access allow manager localhost
http_access deny manager

# 只允许来自localhost(本地主机)的purge(清洗）请求
http_access allow purge localhost
http_access deny purge

# 拒绝对位置端口的请求
http_access deny !Safe_ports

# 就觉对SSL以外端口的CONNECT(连接)
http_access deny CONNECT !SSL_ports

# 我自己的规则

# 加入删除广告条幅后要显示的页
deny_info NOTE_ADS_FILTERED url_ads

# 可以拒绝它们了
http_access deny url_ads

# 拒绝所有的 archives（档案)
http_access deny archives

# 仅限于工作时间访问
http_access allow localnet restricted_weekdays
http_access allow localnet restricted_weekends

# 剩下的全部拒绝
http_access deny all

代码 13.7: /etc/squid/files.acl

\.[Zz][Ii][pP]$
\.[Vv][Ii][Vv].*
\.[Ee][Xx][Ee]$
\.[Mm][Pp]3$
\.[Rr][Aa][Rr]$
\.[Aa][Cc][Ee]$
\.[Aa][Ss][Ff]$
\.[Aa][Vv][Ii]$
\.[Mm][Oo][Vv]$
\.[Mm][Pp][Gg]$
\.[Mm][Pp][Ee][Gg]$
\.[Aa][Uu]$
\.[Rr][Aa]$
\.[Aa][Rr][Jj]$
\.[Tt][Aa][Rr]$
\.[GgZz]$
\.[Zz]$

注释： 请注意[]中每个字母的大小写。这样做是为了避免有人骗过它访问AvI而不是avi文件

代码 13.8: /etc/squid/banner-ads.acl

/adv/.*\.gif$
/[Aa]ds/.*\.gif$
/[Aa]d[Pp]ix/
/[Aa]d[Ss]erver
/[Aa][Dd]/.*\.[GgJj][IiPp][FfGg]$
/[Bb]annerads/
/adbanner.*\.[GgJj][IiPp][FfGg]$
/images/ad/
/reklame/
/RealMedia/ads/.*
^http://www\.submit-it.*
^http://www\.eads.*
^http://ads\.
^http://ad\.
^http://ads02\.
^http://adaver.*\.
^http://adforce\.
adbot\.com
/ads/.*\.gif.*
_ad\..*cgi
/Banners/
/SmartBanner/
/Ads/Media/Images/
^http://static\.wired\.com/advertising/
^http://*\.dejanews\.com/ads/
^http://adfu\.blockstackers\.com/
^http://ads2\.zdnet\.com/adverts
^http://www2\.burstnet\.com/gifs/
^http://www.\.valueclick\.com/cgi-bin/cycle
^http://www\.altavista\.com/av/gifs/ie_horiz\.gif

代码 13.9: /etc/squid/errors/NOTE_ADS_FILTERED

<HTML>
<HEAD>
<META HTTP-EQUIV="REFRESH" CONTENT="0; URL=http://localhost/images/4x4.gif">
<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
</HEAD>
<BODY>
<H1>Add filtered!</H1>

注释： 不要关闭 <HTML> <BODY> 标签，交给squid吧。

注释： Mozilla中在Edit->Preferences->Advanced->Proxies设置。

代码 13.10: 启用到我们的代理服务器的端口转发

# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to proxyhost:3128
# iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to proxyhost:3128

代码 14.1: 创建 AIDE 规则集

All=R+a+sha1+rmd160
Norm=s+n+b+md5+sha1+rmd160

代码 14.2: /etc/aide/aide.conf

@@ifndef TOPDIR 
@@define TOPDIR /
@@endif

@@ifndef AIDEDIR 
@@define AIDEDIR /etc/aide
@@endif

@@ifhost smbserv
@@define smbactive
@@endif

# 要读的数据库的位置。
database=file:@@{AIDEDIR}/aide.db

# 要写入的数据库的位置。
database_out=file:aide.db.new

verbose=20
report_url=stdout

# 定义规则
All=R+a+sha1+rmd160
Norm=s+n+b+md5+sha1+rmd160

@@{TOPDIR} Norm
!@@{TOPDIR}etc/aide
!@@{TOPDIR}dev
!@@{TOPDIR}proc
!@@{TOPDIR}root
!@@{TOPDIR}tmp
!@@{TOPDIR}var/log
!@@{TOPDIR}var/run
!@@{TOPDIR}usr/portage
@@ifdef smbactive
!@@{TOPDIR}etc/smb/private/secrets.tdb
@@endif
=@@{TOPDIR}home Norm

注释： 取决于cpu, 磁盘访问(速度)和设定的文件访问标志，这个过程可能要花一些时间。 take some time.

代码 14.3: 安排 aide 为 cron 工作

0 3   * * * /usr/bin/aide -u

注释： 记得设好可收到root的邮件，否则就无法知道 aide 报告的内容。

代码 14.4: 向系统中加入用户snort

# useradd snort -d /var/log/snort -s /dev/null
# chown -R snort /var/log/snort

代码 14.5: /etc/conf.d/snort

PIDFILE=/var/run/snort_eth0.pid
MODE="full"
NETWORK="10.0.0.0/24"
LOGDIR="/var/log/snort"
CONF=/etc/snort/snort.conf
SNORT_OPTS="-D -s -u snort -dev -l $LOGDIR -h $NETWORK -c $CONF"

代码 14.6: /etc/snort/snort.conf

// 第一步
var HOME_NET 10.0.0.0/24
var EXTERNAL_NET any
var SMTP $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var DNS_SERVERS [10.0.0.2/32,212.242.40.51/32]
var RULE_PATH ./

// 第二步
preprocessor frag2
preprocessor stream4: detect_scans detect_state_problems detect_scans disable_evasion_alerts
preprocessor stream4_reassemble: ports all
preprocessor http_decode: 80 8080 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
preprocessor rpc_decode: 111 32771
preprocessor bo: -nobrute
preprocessor telnet_decode

// 第三步
include classification.config

// 第四步
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/smtp.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/rservices.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
include $RULE_PATH/tftp.rules
include $RULE_PATH/web-cgi.rules
include $RULE_PATH/web-coldfusion.rules
include $RULE_PATH/web-iis.rules
include $RULE_PATH/web-frontpage.rules
include $RULE_PATH/web-misc.rules
include $RULE_PATH/web-attacks.rules
include $RULE_PATH/sql.rules
include $RULE_PATH/x11.rules
include $RULE_PATH/icmp.rules
include $RULE_PATH/netbios.rules
include $RULE_PATH/misc.rules
include $RULE_PATH/attack-responses.rules
include $RULE_PATH/backdoor.rules
include $RULE_PATH/shellcode.rules
include $RULE_PATH/policy.rules
include $RULE_PATH/porn.rules
include $RULE_PATH/info.rules
include $RULE_PATH/icmp-info.rules
include $RULE_PATH/virus.rules
# include $RULE_PATH/experimental.rules
include $RULE_PATH/local.rules

代码 14.7: /etc/snort/classification.config

config classification: not-suspicious,Not Suspicious Traffic,3
config classification: unknown,Unknown Traffic,3
config classification: bad-unknown,Potentially Bad Traffic, 2
config classification: attempted-recon,Attempted Information Leak,2
config classification: successful-recon-limited,Information Leak,2
config classification: successful-recon-largescale,Large Scale Information Leak,2
config classification: attempted-dos,Attempted Denial of Service,2
config classification: successful-dos,Denial of Service,2
config classification: attempted-user,Attempted User Privilege Gain,1
config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1
config classification: successful-user,Successful User Privilege Gain,1
config classification: attempted-admin,Attempted Administrator Privilege Gain,1
config classification: successful-admin,Successful Administrator Privilege Gain,1

# 新的分类
config classification: rpc-portmap-decode,Decode of an RPC Query,2
config classification: shellcode-detect,Executable code was detected,1
config classification: string-detect,A suspicious string was detected,3
config classification: suspicious-filename-detect,A suspicious filename was detected,2
config classification: suspicious-login,An attempted login using a suspicious username was detected,2
config classification: system-call-detect,A system call was detected,2
config classification: tcp-connection,A TCP connection was detected,4
config classification: trojan-activity,A Network Trojan was detected, 1
config classification: unusual-client-port-connection,A client was using an unusual port,2
config classification: network-scan,Detection of a Network Scan,3
config classification: denial-of-service,Detection of a Denial of Service Attack,2
config classification: non-standard-protocol,Detection of a non-standard protocol or event,2
config classification: protocol-command-decode,Generic Protocol Command Decode,3
config classification: web-application-activity,access to a potentially vulnerable web application,2
config classification: web-application-attack,Web Application Attack,1
config classification: misc-activity,Misc activity,3
config classification: misc-attack,Misc Attack,2
config classification: icmp-event,Generic ICMP event,3
config classification: kickass-porn,SCORE! Get the lotion!,1

代码 15.1: glsa-check -l输出示例

# glsa-check -l

警告：glsa-check 还是试验性质的，如果安全是你的首要问题，明智的做法是将该列表与其他途径核对。