EMOS1.3安装后的相关安全设置
作者 佚名技术
来源 Linux系统
浏览
发布时间 2012-05-15
| tealth Scans and TCP State Flags # All of the bits are cleared $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # SYN and FIN are both set $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP # SYN and RST are both set $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP # FIN and RST are both set $IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP # FIN is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP # PSH is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP # URG is the only bit set, without the expected accompanying ACK $IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP # Using Connection State to By-pass Rule Checking 拥有帝国一切，皆有可能。欢迎访问phome.net if [ "$CONNECTION_TRACKING" = "1" ]; then $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -m state --state INVALID -j DROP $IPT -A OUTPUT -m state --state INVALID -j DROP fi ################################################################## # Source Address Spoofing and Other Bad Addresses # Refuse spoofed packets pretending to be from # the external interface.s IP address $IPT -A INPUT -i $INTERNET -s $IPADDR -j DROP # Refuse packets claiming to be from a Class A private network $IPT -A INPUT -i $INTERNET -s $CLASS_A -j DROP # Refuse packets claiming to be from a Class B private network $IPT -A INPUT -i $INTERNET -s $CLASS_B -j DROP # Refuse packets claiming to be from a Class C private network $IPT -A INPUT -i $INTERNET -s $CLASS_C -j DROP $IPT -A INPUT -i $INTERNET -s 0.0.0.0/8 -j DROP $IPT -A INPUT -i $INTERNET -s 169.254.0.0/16 -j DROP $IPT -A INPUT -i $INTERNET -s 192.0.2.0/24 -j DROP ################################################################### #setting access rules #enable ssh connect $IPT -A INPUT -i $INTERNET -p tcp --dport 22 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 25 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 80 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 110 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 143 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp -s 127.0.0.1 --dport 3306 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 10024 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 10025 -j ACCEPT $IPT -A INPUT -i $INTERNET -p tcp --dport 443 -j ACCEPT $IPT -A INPUT -i $INTERNET -p icmp -j ACCEPT #*********************************************************************************************************** 拥有帝国一切，皆有可能。欢迎访问phome.net #6、extman后台访问授权 vi /etc/httpd/conf/vhost_extmail.conf Alias /extmail /var/www/extsuite/extmail/html/ <Directory "/var/www/extsuite/extman/html"> AuthType Basic Options None AllowOverride None Order allow,deny Allow from 192.168.1.3 AuthName "Mail Server Manager" AuthUserFile /etc/httpd/conf/htpasswd Require valid-user </Directory&g |
凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢! |
你可能对下面的文章感兴趣
上一篇: linux实用方法下一篇: linux服务之samba
关于EMOS1.3安装后的相关安全设置的所有评论
