2821 ¹ø ±ÛÀÇ ´äÀå±Û: Re: ftp, ssh µî |
±Û¾´ÀÌ: »êÀÌ
[ȨÆäÀÌÁö]
|
±Û¾´³¯: 2009³â 03¿ù 23ÀÏ 23:15:26 ¿ù(Àú³á) |
Á¶È¸: 2310 |
[±è¼º¹Î]´ÔÀÌ ³²±â½Å ±Û:
>¾È³çÇϼ¼¿ä?
>
>¸®´ª½º¿¡ proftpd ¿Í ssh °¡ ¼³Ä¡µÇ¾î ÀÖ°í, pc¿¡¼ ¸®´ª½ºÂÊÀ¸·Î Á¢¼ÓÇÒ¶§
¸»ÀÔ´Ï´Ù.
>iptables ¸¦ »ç¿ëÇÏ°í ÀÖÀ»¶§ TCP 20, 21, 22 ¸¦ Çã¿ëÇÑ »óÅÂÀÔ´Ï´Ù.
>pc¿¡¼ ftp Á¢¼Ó½Ã ´Ù¸¥ »ç¹«½Ç¿¡¼ Á¢¼ÓÇÏ¸é ¿¬°áÀº µÇ´Âµ¥ ¸®½ºÆ®°¡ ¾Èº¸Àδٰí Çؾß
Çϳª¿ä? ³»¿ë¹°ÀÌ ¾Èº¸ÀÌ°í, sshµµ ¸¶Âù°¡Áö·Î ¿¬°áÀº µÇ´Âµ¥ ·Î±äÇÏ¸é ¾Æ¹« ³»¿ëÀÌ
¾Èº¸ÀÌ´Â °æ¿ì°¡ ÀÖ½À´Ï´Ù.
>
>¿¹Àü¿¡ ¾îµð¼ º¸´Ï±î, /etc/sysconfig/iptables ¿¡ ¾Æ·¡¿Í °°ÀÌ
>-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 32768:60000 -j
ACCEPT
>32768~60000 ¹ø´ë¸¦ Çã¿ëÇØ¾ß ÇÑ´Ù´Â °ÍÀ» º»ÀûÀÌ Àִµ¥, ½ÇÁ¦·Î À§¿Í °°Àº Çã¿ëÀ» Çϸé
¾Æ¹«°÷¿¡ °¡¼µµ ftp, ssh Á¢¼ÓÇϴµ¥ ¹®Á¦°¡ ¾ø´Âµ¥ 20.21.22 ¸¸ ¿¾î³õÀ¸¸é
¾î¶²°÷¿¡¼´Â ÀÌ»ó¾ø°í ¾î¶²°÷¿¡¼´Â Á¤»óÀÌ ¾Æ´Ï°í ÇÕ´Ï´Ù..
>
>À§¿Í °°ÀÌ Æ÷Æ®¹üÀ§ ¿ÀÇ¿©ºÎ°¡ ½ÇÁ¦·Î ¿µÇâÀ» ¹Þ´Â°ÇÁö ¹®Àǵ帳´Ï´Ù...
========================================
Ä¿³Î 2.4 ¿¡¼´Â
/sbin/modprobe ip_conntrack_ftp ports=21,2121,8021,9921
ÀÌ·±½ÄÀ¸·Î ftp Æ÷Æ®¸¦ ¸ðµÎ ¿©±â¿¡ ±âÀÔÇØ¾ß ÇÕ´Ï´Ù.
21¹ø Æ÷Æ®¿Ü¿¡ ¾È¾´´Ù¸é 2121,8021,9921 ´Â ÇÊ¿ä¾ø½À´Ï´Ù.
±×¸®°í ¾Æ·¡¿Í °°ÀÌ inbound ¿Ü¿¡µµ outbound µµ ¼³Á¤ÇØ¾ß ÇÕ´Ï´Ù.
## system LISTEN for incoming packets TCP/UDP 1:65535
##
${IPTABLES} -A INPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p udp --dport 53 -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j
ACCEPT
${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j
ACCEPT
...
## system allow inbound(if established) TCP/UDP 0:65535
##
${IPTABLES} -A INPUT -p udp --sport 53 -j ACCEPT
${IPTABLES} -A INPUT -p udp --sport 161 -j ACCEPT
${IPTABLES} -A INPUT -m state --state ESTABLISHED -j ACCEPT
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
## system allow OUTPUT and outbound packets(if state related)
##
${IPTABLES} -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
±×¸®°í ftp client ´Â active ¸ðµå·Î ÇؾßÇÕ´Ï´Ù.
http://linuxchannel.net/board/read.php?table=alpha&no=213
¿©±â º¸°í ÂüÁ¶Çϼ¼¿ä.
|
ÀÌÀü±Û : ftp, ssh µî
´ÙÀ½±Û : openvpn Áú¹®2
|
from 211.212.239.50
JS(Redhands)Board 0.4 +@
|
|