2006隨手札記

System Service Access Controls *chkconfig控制服務在開機後是否自動啟動 (1) #chkconfig --list #chkconfig name {on|off} #chkconfi vsftpd on #chkconfig --level levels name {on|off} #chkconfig --level 3 vsftpd on (2) xinetd 大總管 %開啟telnet服務 #chkconfig telnet on 或 # vi /etc/xinetd.d/telnet %xinetd access control #白名單 only_from = host_pattern #黑名單 no_access = host_pattern #maximum instances per_source = 2 (同一IP, 只允許2個連線) Ex: only from = 192.168.0.0/24 no access = 192.168.0.1 (3)Access control %tcp_wrappers(libwrap.so) Ex: xinetd configuration: /etc/hosts.allow, /etc/hosts.deny %daemons Ex: httpd, smbd, squid 如何查詢service是使用那種安控 #ldd `which sshd`|grep libwrap libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00dc2000) #ldd `which squid`|grep libwrap (空白, 因為自己的安控daemon) (4)Tcp_wrappers #/etc/hosts.allow vsftpd: 192.168.0. in.telnetd, portmap: all | spawn echo "login attempt from %c to %s" %c: client information (user@host) %s: server information (server@host) #/etc/hosts.deny all: .cracker.org EXCEPT trusted.cracker.org sshd: 192.168.0. EXCEPT 192.168.0.4 (5)SElinux #ps -Z #ls -Z -rw------- root root root:object_r:user_home_t anaconda-ks.cfg drwxr-xr-x root root root:object_r:user_home_t etc -rw-r--r-- root root root:object_r:user_home_t install.log -rw-r--r-- root root root:object_r:user_home_t install.log.syslog *SElinux context A:B:C:D:E A:user : user_u, system_u B:role : object_r, system_r C:type D:sensitivity : security classification E:category : similar to group *show modes #getenfoce *暫時調整為Permissive mode #setenforce 0|1 0:disable(Permissive mode) 1:enable (Enforcing mode) *policy adjustments #semanage #semanage [function] -l function -------------- login : assigns clearances to users at login user : assigns roles transitions for users port : allows confined daemons to bind to non-standard ports interface : assign a security clearance to a network interface fcontext : defines the file contexts user by restorecon translation : translates sensitivity and catefories into names Ex: #semanage fcontext -l |grep ftp #getsebool #setsebool #setsebool -P boolean value