Kuisa zvese zviitiko nema iptables

ZvinyorwaNekuda kwayo ine iyo firita mutemo mu "Gamuchira zvese" maitiro, ndokuti, inopinda nekubuda kwese kubatana kubva kana kuPC yedu, asi ko kana tichida kunyora ruzivo rwese nezvekubatana kunoitwa kumaseva edu kana maPC?

Ongorora: Maitiro andichaita zvino anoshanda 100% mukugovera Debian/Debian-yakavakirwa, saka kana iwe ukashandisa Slackware, Fedora, CentOS, OpenSuSe, maitiro acho anogona kunge asina kufanana, tinokurudzira kuverenga nekunzwisisa yako yekugovana login system usati waisa izvo zvinotsanangurwa pazasi. Iko kune zvakare mukana wekuisa rsyslog mukugovera kwako, kana ichiwanikwa mune zvinyorwa, kunyangwe mune ino dzidziso, syslog inotsanangurwa zvakare kumagumo.

Zvese zvakanaka kusvika parizvino, asi chiiNdekupi kwatinoenda kunyoresa? Nyore, mune iyo faira «/var/log/firewall/iptables.log", chii haapo, kusvikira tazvitenda pachedu ...

1- Isu tinofanirwa kugadzira iyo faira «iptables.log»Mukati mefaira«/ var / log / firewall»Kuti isu tinofanirwa kuigadzira, nekuti hainawo.

mkdir -p / var / danda / firewall /
bata /var/log/firewall/iptables.log

2- Mvumo, yakakosha ...

chmod 600 /var/log/firewall/iptables.log
chown mudzi: adm /var/log/firewall/iptables.log

3- rsyslog, iyo Debian login daemon, inoverenga iyo gadziriso kubva ku «/etc/rsyslog.d«, Saka isu tinofanirwa kugadzira faira randinodaidza«firewall.conf»Kubva pane iyo rsyslog inogona kududzira zvatiri kuda kuita.

bata /etc/rsyslog.d/firewall.conf

Uye mukati tinomusiya kudonha zvinyoro nyoro zvirimo:

: msg, ine, "iptables:" - / var / log / firewall / iptables.log
& ~

Handina kana zano,aya mitsara miviri ari kuitei?

Mutsara wekutanga unotarisa iyo yakatemwa data yeiyo tambo «iptables: »Uye inozviwedzera kune iyo faira«/var/log/firewall/iptables.log«

Yechipiri, inomisa kugadziriswa kwemashoko akapinda nepateni yepamberi kuti isaramba ichitumirwa ku «/ var / log / mameseji".

4- Kutenderera iyo log faira, iine kubudirira.

Tinofanira kugadzira mukati me «/etc/logrotate.d/"iyo faira"firewall»Iyo ichave iine zvinotevera zvirimo:

/var/log/firewall/iptables.log
{
tenderera 7
mazuva ose
saizi 10M
chinyorwa chezuva
missok
gadzira mazana matanhatu emidzi adm
notfempty
compress
kunonoka
postrotate
kukumbira-rc.d rsyslog kurodha zvakare> / dev / null
endcript
}

Kuti utenderedze matanda kanomwe usati wabvisa iwo, ka7 pazuva, saizi yepamusoro yegumi 1MB, yakamanikidzwa, yakanyorwa, isina kupa kukanganisa kana danda risipo, rakagadzirwa semudzi.

5- Tangazve, senge ese anofara kupera xD, iyo rsyslog daemon:

/etc/init.d/rsyslog restart

Ungaratidza sei kuti zvese zviri kushanda?

Ngatiedzei SSH.

Isa OpenSSH (kana vasina iyo yakaiswa ...):

apt-tora kuisa kuvhura-server

Tisati taenderera mberi, isu tinofanirwa kumhanya semidzi mukoni:

iptables -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables: " --log-level 4

Kuita iyi chirevo che iptables kuchanyora info yakakwana kuratidza kuti zvatakaita hazvisi pasina. Mumutsara uyu tinotaurira iptables kunyora zvese zvinouya kwazviri kuburikidza nechiteshi chengarava 22. Kuti uedze nemamwe masevhisi, ingochinja nhamba yechiteshi, kunge 3306 yeMySQL, kungo taura muenzaniso, kana uchida rumwe ruzivo, verenga izvi zvakanyatsonyorwa zvakadzidziswa uye yakavakirwa pane chaiwo mienzaniso yekushandisirwa kwakawanda kushandiswa.

SSH inoshandisa chiteshi 22 nekusarudzika, saka isu tichaedza nayo. Kumisikidza kuvhura, tinozvibatanidza.

ssh pepe @ bvunzo-server

Kuti uone matanda, nemuswe iwe unogadzirisa dambudziko iri:

muswe -f /var/log/firewall/iptables.log

Iptable, mune uyu muenzaniso, danda zvese, zuva, nguva, ip, mac, nezvimwe, izvo zvinoita kuti zvive zvakanaka pakuongorora maseva edu. Rubatsiro rudiki rwusingambokuvadza.

Zvino, tichitarisa kuti tinoshandisa imwe distro, sezvandambotaura pakutanga, inowanzo shandiswa rsyslog, kana chimwe chinhu chakafanana. Kana yako distro inoshandisa syslog, kuti tiite chiitiko chimwe chete isu tinofanirwa kugadzirisa / kugadzirisa zvishoma syslog.conf

nano /etc/syslog.conf

Wedzera uye chengeta unotevera mutsara:

kern.wambiro /var/log/firewall/iptables.log

Uye ipapo, iwe unoziva, iwo magumo anofadza:

/etc/init.d/sysklogd kutangazve

Mhedzisiro: zvakafanana.

Izvo ndezve izvozvi, mune ramangwana zvinyorwa, isu ticharamba tichitamba nemapeti.

Refer:

Kumanikidza iptables kuti upinde kune rakasiyana faira

Pinda iptables kune yakasarudzika faira ine rsyslog

Iptables yekumisikidza dzidziso pane Fedora / RHEL masisitimu