Linux firewall example simple rule set protection network

Firewall configuration requirements are as follows: 1. denial of all outside incoming, outgoing and forwarded packets.

2. allow all outgoing TCP connection: we allow such as Web/telnet/ssh/FTP outgoing. 3. allow outgoing TCP connection returns the packets through the firewall, you will need to check the status of the package. 4. allow to send a UDP connection on port 53 on the specified domain name server, but only allow Wei into DNS packets to your internal domain name server chivas. 5. create allows kernel interface from one network to another network interface appropriate to forward packets for the rule: from the network to the Internet delivery of packets from the internal interface eth0 to eth1 forwarded the external interface. Returns the number of packets sent back in the opposite direction. 6. in the kernel to enable IP forwarding. Build a basic firewall root @ linux-tysroot] # sysctl-p-setting IP forwarding root @ linux-tysroot] # cat/proc/sys/net/ipv4/ip_forward-----confirm IP forwarding, you can see results as 1root root @ lg] # iptables-F-clear preset table filter all rules in a chain of rule root @ lg root] # iptables-X-clear preset table filter in a custom rule chain rule root @ lg root] # iptables-F – tmangle-clear all rules in the mangle table chain rule root @ lg root] # iptables-tmangle-X-----clear table mangle any custom rules in the chain rule root @ lg root] # iptables-F-tnat-clear all rules in the nat table chain rule root @ lg root] # iptables-tnat-X-----clear table nat all custom rule in a chain of rule root @ linux-tys root] # iptables-AINPUT-ptcp--dport22-jACCEPTroot @ lg root] # iptables-AOUTPUT-ptcp--sport22-mstate--stateESTABLISHED-jACCEPTroot @ linux-tys root] # iptables-PINPUTDROProot @ linux-tys root] # iptables-POUTPUTDROProot @ linux-tys root] # iptables-PFORWARDDROProot @ linux-tys root] # iptables-AOUTPUT-jACCEPT-olo--the two acts in loopback interface allows internal network traffic root @ linux-tys root] # iptables-AINPUT-jACCEPT-iloroot @ linux-tys root] # iptables-AOUTPUT-jACCEPT-oeth1-ptcp-mstate--stateESTABLISHED, NEW-----this rule set new and established TCP connection packets will be forwarded to the outside through eth1, without indicating the source and destination addresses represent any address root @ linux-tys root] # iptables-AINPUT-ieth0-s192.168.1.0/24-jACCEPT--this allows you to arrive from the private network interface of all traffic networks, the following rule is the check arrives on the outside of the network interface, each packet is connected through belonging to root @ linux-tys root] # iptables-AINPUT-ieth1-mstate--stateESTABLISHED, RELATED-jACCEPT following configuration rules from a network interface forwarding to another: the first rule receives all packets from the network, and is forwarded to the external network card eth1; the second rule reach the external network interface eth1 on packets, such as belonging to the existing connection is forwarded to the intranet. Root @ linux-tys root] # iptables-AFORWARD-ieth0-jACCEPT-root @ linux-tys root] # iptables-AFORWARD-ieth1-mstate--stateESTABLISHED, establish NAT rules RELATED-jACCEPT Finally, POSTROUTING table packets sent out for translation, the rule set to convection from the external network interface eth1 packets, and the source address the address becomes eth1. Root @ linux-tys root] # modprobeiptable_nat--load the NAT module root @ linux-tys root] # iptables-APOSTROUTING-tnat-oeth1-jSNAT--to192.168.32.254 backup and recovery 1, backup, firewall settings: root @ lg root] # iptables-save > iptablesrules.txt this set as iptablesdefault.txt2, remove the firewall settings: root @ lg root] # iptables-F remove all chain。 3. Restore Firewall settings: root @ lg root] # iptables-restoreiptablesrules.txt enable Firewall Automation root @ linux-tys root] # iptables-save >/etc/sysconfig/iptables---saved rules to/etc/syscofig/iptables, and self-starting root @ linux-tys root] #/etc/init.d/iptablesstart/stop/restart----saved you can use this command to control its status by using custom chain consolidation firewall basic rule does not check in addition to the TCP connection state matters other than that available through custom chain to extend basic firewall to help handle the increased complexity, more complex rule sets to specify which of the TCP port you can use the source address of the connection. At the same time create specific rules for processing a single connection can reduce the chance of hackers use port. The firewall configuration is as follows: 1. first of all it is enable forwarding, clearing all rules, set the default for DROP in loopback interfaces allow all internal network traffic. And then we will create two custom chain to handle network and external network interfaces packet arrived. The following is SSH access to reservations. 2. create a PRIV chain to handle traffic from a private network. This chain delivery has returned packets, enters the firewall SSH packets, as well as destinations for Internet FTP, SSH and http packets, then the INPUT chain rule-oriented to a chain. Root @ linux-tys root] # iptables-NPRIVroot @ linux-tys root] # iptables-APRIV-mstate--stateESTABLISHED, RELATED-jACCEPTroot @ linux-tys root] # iptables-APRIV-ptcp – s192.168.1.0/24 – d192.168.1.254--dport22-jACCEPTroot @ linux-tys root] # iptables-APRIV-pudp-d0/0--dport53-jACCEPTroot @ linux-tys root] # iptables-APRIV-ptcp-d0/0--dport21-jACCEPTroot @ linux-tys root] # iptables-APRIV-ptcp-d0/0--dport80-jACCEPTroot @ linux-tys root] # iptables-AINPUT-ieth0-jPRIVroot @ linux-tys root] # iptables-AOUTPUT – oeth0-jPRIV3, creating a chain to handle from the DMZ (if used), as well as external network traffic. This chain discarded from a private network and the DMZ network source address all packets, this is because, first, the former is spoofing addresses, secondly, according to the policy, do not allow traffic from DMZ to enter into the network. The link from existing connections, and addressing to the Internet Pack. Root @ linux-tys root] # iptables-NEXTroot @ linux-tys root] # iptables-AEXT-s192.168.32.0/24-jDROProot @ linux-tys root] # iptables-AEXT-s192.168.1.0/24-jDROProot @ linux-tys root] # iptables-AEXT-s0/0-ptcp--dport1024: 65535-jACCEPTroot @ linux-tys root] # iptables-AEXT-sany/0-d192.168.32.254-jACCEPTroot @ linux-tys root] # iptables-AINPUT-ieth1-jEXT--configure the INPUT chain which will flow oriented to EXTroot @ linux-tys root] # iptables-AOUTPUT – oeth1-jEXT4, modify, FORWARD chain to create a gateway feature. Since the intranet interfaces to new or existing connection is forwarded to the external interface. Root @ linux-tys root] # iptables-AFORWARD-ieth0-mstate--stateNEW, ESTABLISHED, RELATED-jACCEPTroot @ linux-tys root] # iptables-AFORWARD-ieth1-mstate--stateESTABLISHED, SNAT rules RELATED-jACCEPT5, build. On the source address of the function convert to 192.168.32.254. This step to achieving gateway firewall features. Root @ linux-tys root] # modprobeiptable_natroot @ linux-tys root] # iptables-APOSTROUTING-tnat-oeth1-jSNAT--to192.168.32.2546, configure OUTPUT chain. To allow messages from the firewall service of packet transmission to a private network and Internet. root@linux-tys rooT] # iptables-AOUTPUT-oeth0-d192.168.1.0/24-jACCEPTroot @ linux-tys root] # iptables-AOUTPUT-oeth1-mstate--stateNEW, ESTABLISHED, RELATED-jACCEPT7, check your firewall rules and add a rule and then save the rule root @ linux-tys root] # iptables-L – v-----v displays additional information about network interfaces root @ linux-tys root] # iptables-APRIV-ptcp-dany/0--dport23-jACCEPTroot @ linux-tys root] # iptables-save > custom.txt or following command saves the root @ linux-tys root] # iptables-save >/etc/sysconfig/iptables---saved rules to/etc/syscofig/iptables, and since the start.

Getting started with linux Security Foundation SMIT

Using an example of SMIT script now, let's SMIT is applied to a practical example of AIX.

Suppose that you need 10 or 100 AIX system respectively add a 4 GB file system. You can manually to complete this operation, but in the end might feel very tired, and input repeatedly increases the possibility of error. You can fit together, and using various parameters and flags, and then in each system running them. Alternatively, you can let you writing SMIT. The following example uses the SMIT creates a 4 GB enhanced JFS (JFS2) file system, the file system when the system restarts automatically mount to mount point/fs01 and use inline JFS log. Then, the script will write SMIT are copied to the other system, and run the script to create the file system. Start the SMIT's first step is to use the command: smit-s/tmp/mknewfs.kshcrjfs2std. -S flag to tell the script to output SMIT are written to the file/tmp/mknewfs.ksh, instead of the default file/smit.script. Specific action is logged to the/smit.log. By specifying the shortcut paths crjfs2std, you can go directly to AddanEnhancedJournaledFileSystem dialog screen. To display the screen (as shown in Listing 6), you need to select a volume group to create a new file system. Manifest 6.AddanEnhancedJournaledFileSystemSMIT dialog screen AddanEnhancedJournaledFileSystemTypeorselectvaluesinentryfields.PressEnterAFTERmakingalldesiredchanges. [EntryFields] VolumegroupnamedatavgSIZEoffilesystemUnitSizeGigabytes + * Numberofunits [4] # * MOUNTPOINT [/s01] MountAUTOMATICALLYatsystemrestart? yes + PERMISSIONSread/write + MountOPTIONS [] + BlockSize (bytes) 4096 + InlineLog? yes + InlineLogsize (MBytes) [] # F1 = HelpF2 = RefreshF3 = CancelF4 = ListF5 = ResetF6 = CommandF7 = EditF8 = ImageF9 = ShellF10 = ExitEnter = Do is press the Enter key allows SMIT perform the commands in Listing 6, the script in Listing 7 will be written to the file list/tmp/mknewfs.ks? nbsp; 7./tmp/mknewfs.ks ## [Sep062006, 17: 46: 28] # x () {LIST = FLAG = 0foriin "@" docase "$ I" inMegabytes) FLAG = 1;; Gigabytes)FLAG=2;; 512bytes);; size=*)case"$FLAG"in1)LIST="$LIST\"$i\"M"FLAG=0;; 2)LIST="$LIST\"$i\"G"FLAG=0;;0) LIST="$LIST\"$i\"";; esac;; *)LIST="$LIST\"$i\"";; Esacdoneevalcrfs-vjfs2 $ LIST} x-g'datavg''Gigabytes'-asize = ' 4 '-m '/fs01 '-A ' ' would localeyesstr | awk-F: ' {print $ 1} ' would ', '-p'rw'-aagblksize = ' 4096 ' '-alogname = INLINE ' remaining work is to put the above script is copied to another AIX system, and run it. You can pass a number of ways to accomplish this task. The easiest (though not very safe) is, according to the system cycle, the script performs the rcp operations, and then using rsh to execute it (see Listing 8). 8. the script performs the rcp operations and using rsh to execute it Forhostinhost1host2...hostN; do\rcp/tmp/mknewfs.ksh $ host:/tmp/mknewfs.ks; \rsh $ hostksh/tmp/mknewfs.ks; \done this just an example, but it illustrates the use of SMIT as AIX administrators can gain many advantages and saves a lot of time. The next step for any AIX administrator, SMIT is a powerful tool. As with most tools, familiar with the steps of the best method is to use it. Although SMIT can active system performs the appropriate action, but did not provide an undo function, understanding this point is very important. For some operations (but not all operations), SMIT will issue a warning to permanently delete a message, and you need to confirm to continue. Safer use SMIT applications is to use the-x flag calls it. When specified on the command line when the-x flag, SMIT works properly on the surface, but in fact did not perform any commands. On the contrary, itIn normal operation will be executed command written to smit.script file. SMIT menu and dialog screen of the many options and input fields are available with built-in Help features, you can use the arrow keys to highlight or select the item to be visited, and then press F1 (or Esc + 1). This will display a pop-up window for the selected item for a detailed explanation.

Physical isolation Linux how to run through a safe channel

With the Internet in the popularization and application of the world, as well as the deepening of China's Informatization, LAN users on the Internet needs more and more, with the attendant network security issues have become increasingly prominent.

Some of the local area, especially for certain safety requirements extremely high sector LAN, is strictly limited and that is directly connected to the Internet. In 2000, the protection of State secrets has issued the international networking of computer information system security management regulations, the provisions of the "file involves State secrets of the computer information systems, directly or indirectly, and Internet or other public information network connected, it must implement physical isolation". These LAN from the Internet to get information from the traditional way is to use the Teleport, offline browsing software, to collect data from the Internet, and then manually copy to the internal LAN. So while ensuring network security, but to the actual work has brought a lot of inconvenience. First of all, this kind of offline software cannot handle acquisition invalid link in data; second, each acquisition must be completed by the manual start, not depending on your application needs to automatically capture; Moreover, all actions are completed by hand, leading to productivity is very low; but as the information demand increases, the labor intensity. In order to address this growing information needs and information security between, our research and development on RedHatLinux platform based on the physical isolation of the "Internet information security acquisition system". The Internet information security acquisition system is a guarantee that at any one time, in LAN and Internet physical isolation of the safe browsing Internet network resources of the system software. It provides the user with a physical isolation-based secure network environment, and provides information acquisition, load balancing, automatic forwarding, information and control functions. System logical structure of the Internet information security acquisition system consists of the collection server, intermediate server (including physical isolator) and internal server three-part. The main design idea is through an intermediate server on the Internet and LAN connection to the LAN for indirect users online process is actually only browse LAN internal server offerings, and the collection server from the Internet automatically download the content of the specified Web site, the Internet user simulated LAN. Intermediate server can guarantee that no simultaneous connection to the LAN and the Internet, which connects the internal LAN, intermediate server and Internet connection whether physically or software settings are completely disconnected, and vice versa. In this way, the effect of from the Internet or not likely to enter the internal local area network, LAN internal cannot really connected to the Internet, the security of the entire system, mainly by intermediate servers. The logical structure of the system as shown in Figure 1. Figure 1 Internet information security acquisition system logic chart from can be seen in Figure 1, the collection server cluster by RAS or otherwise connected to the Internet, and internal LAN between physical isolator physical isolation. By way of the isolator, middle management server and collection server or internal server establishes a connection, but the moment you can only connect with one of the parties, and not with two-party connection. Specially designed physical isolator ensures that whenever the collection server and the internal server for the circuit breaker. 1. the collection server (groups) of the collection server (groups) used to collect information from the Internet, so it's network interface configuration should be accessible through the firewall on the Internet to browse the Web service. In a collection server (groups), it must be logically and there should be a maximum of one acquisition Manager, collection Manager provides can be collection server (Group) visited network database (MySQLServer) and network shares (NFSServer), and may be the intermediate server to access the FTP directory (FTPServer). Because the acquisition Manager management operations is through Web operation is complete, so acquisition Manager should be able to access Web services (HTTPServer). Similarly, logically it should be at least one collection server, the collection server should be able to access the Internet collecting information, and you can access the collection Manager database (MySQLClient) and network shares (NFSClient). 2. the intermediate server between the capabilities of the server from the collection manager on the acquisition of good information, and then forwarded to a local area network server for publishing, so intermediate servers on the network interface configuration should be able to access the collection manager, can access LAN Server. Intermediate server should be able to access the collection manager and LAN Server FTP directory (FTPClient). 3. LAN Server LAN Server function is used to post information on the internal LAN, so its network interface should be internal LAN computer access. Because the LAN Server is used to publish information that is collected, should provide Web services (HTTPServer), and may be the intermediate server to access the FTP directory (FTPServer). Here, the collection server and LAN internal server can use one or more computers, and can be based on system sizing and demand at any time to expand the new server, the system of collecting ability is dynamically adjustable. System function module system can be divided into a functional network configuration and system security management module, task queue management module, collector queue management module, scheduling, coordinating management module, internal server management module five parts. Function module framework as shown in Figure 2. Figure 2 Internet information security acquisition system function module figure ◆ network configuration and system security management module is a complete system of protection control center, including physical isolator, firewall, user management, is responsible for ensuring the normal circulation of information flow throughout the system. ◆ Task queue management module is responsible for receiving, filing the demand for Internet access, and then define, generate a download task, and submit the schedule coordination management module. ◆ Collector queue management module manages the acquisition server cluster, to scheduling coordination management module provides completeInternet download task of collector. ◆ Scheduling coordination management module is responsible for specific tasks on the rational distribution to each collector, and the task results back from the collector to be sent to the internal server cluster. ◆ Internal server management module is responsible for receiving and processing the download information, last to the internal LAN users with a virtual online environment. The Internet information security collection system network operating system, Web server selected RedHat7.2 selection of Apache, MySQL database platform selection, development tools use PHP and standard C.

Talking about Linux security

Writing this article is for the use of Linux administrators, lovers, on linux security is concerned with colleagues, want to help, nonsense do not more, tacks.

Before the said security settings, I would like to talk about the release and install. For release, I believe most of them know, Linux distributions is too much I more than once in the many sites of the article, many books have seen talked about the release is the best, in fact, I personally think that, in the linux world, not the best of this argument, as long as your own habits, familiar a version, so I can say he is the best. Writing this article, I also try to find a lot of information, attempting to find the one that we all feel that common, familiar, and finally, I think redhatlinux really very good, although it's huge, but the kernel more efficiency does not make all of the release, but its universality, ease of use and software upgrade support, application software support is worth, which is a good Linux distribution needs. This article builds on the above, all redhatlinux7.3 Edition software settings in the version on the test passed. Here, may we ask, why should I use redhat7.3? now not many?, redhat, with redhat8.0, redhat9.0 what redhat advanced Enterprise Edition, and so on. So many new things so why not? "asked this question very well, that's exactly what I want to say that the installation and select the release is to be noted. 1, select the I use a version of redhat has for a long time, personally think that redhat versions of .0 large version upgrade of the first version, this version is often a lot of packages is not very stable, and prone to failure, for the vast majority of linux administrators who is used to serve as a server, then to most servers, the largest primary issue is stable, then the most important is security, so if you are an administrator, but non-fanatical enthusiasts, junkie, I suggest you choose redhat7.3. Redhat version number, followed by a small number of packages has many updates and modifications, although this update may not be up to date, but at least it is the latest stable version is the most stable, I do not know you understand this issue is not, I will detail what version of the upgrade issues, where I will explain this theory. 2. Select the installation method to install the release version, then we begin installation, installation of only a few caveats, one of which is the partition, the second is to install packages. Partition of stress that you need for your application to planning zones, last seen many expositions of linux is the best partition scheme, although many people have made a number of excellent partition scheme, but I think it needs more of their application for partition is the best of all, the following partition, partition scheme, but is recommended, or more to your needs. Personal opinion, standard server, at least-common partition, so it is recommended that the hard disk is divided into the following way:/bootswap//var/usr/home/tmp, size according to your own application to, or cannot be less than/usr 1G, and/var are larger, because most software in it, several other, more need to say to swap I think about the size of the area of dispute is relatively large, I integrated a lot of friends, summed up a rule, if your memory is less than 1G then divided into memory to 2 x, if it is greater than 1G points maximum swap 2 g, which is why? because swap as we all know, is a virtual memory space, small and does not play the role of the best has also waste of space, the size is a specific reason, large memory, then the application uses the virtual space is small, but in order to fully meet the server's memory needs, according to the experience of many friends, and my personal experience, this method can be said to be one of the best option, particularly for the database, and other large-scale application memory needs, but also a lot of server memory is 1G-2G. Installation package is installed, so the fewer concentrate better, but redhat installation begins, as a server, the following package groups need to choose: Networsupport (network support) Messagingandwebtools (you can choose to install, some networking tools such as ncftp) Router/Firewall (firewall software, you need to install, but he is not good to ipchian, iptables, ipwf are install, will explain how to delete) Networkmanagedworkstation (admin tool), Utilities (common tools, backup tools, etc.) while we now install is simple select the package group, in the following security settings will remove some unused package, it will be said later. 3. update the software although redhat7.3 is the updated version, but there are many software packages have vulnerabilities, one of the biggest vulnerability is a flaw 2.4.18, it causes the ext3 file system crashes, I met a few times (according to ext3 development team, this phenomenon is in specific actions and conditions, general user rarely this phenomenon), although many are now close to solve this problem, but if there is no update kernel 7.3 or unstable, there are two ways to update, a current in the update packages manually by using rpm-Uvh to update, another is what I recommend to use the up2date to update, it's a good thing, it is very easy to update your systemBut the more you installed packages to update, he will not update the bind9 bind8, will not update to redhat9.0 redhat7.3, this ensures that you are using the version of the stability and integrity that is specific to this version of the package was amended, the version number is generally become such as iptables, 7.3 RPM version 1.2.5 then updated is 1.2.8 fixed many vulnerabilities error, but does not make a big adjustment, ensure that your use of and and application compatibility. Up2date, before the automatic upgrade, it is recommended that several: * first, because the version with redhat7.3 up2date bug with SSL, therefore, need to be removed in a latest update up2date, download https://rhn.redhat.com/errata/rhsa-2003-267.tml * second, in General, we do not want to automatically update up2date kernel, and then the kernel updates directly address many major vulnerability, especially the newly installed redhat7.3 have ext3 crash vulnerabilities so I suggest that you first upgrade the kernel manually, of course, use the RPM package to upgrade, this saves a lot of time, I said that, although the redhat is the most efficient, but you sure do have the most widespread one system, RPM easy is entirely reflects this point advantage, redhat7.3 kernel download address: http://updates.redhat.com/7.3/en/os/i386/kernel-2.4.20-20.7.i386.rpm http://updates.redhat.com/7.3/en/os/i386/kernel-2.4.20-20.7.i586.rpm http://updates.redhat.com/7.3/en/os/i386/kernel-2.4.20-20.7.i686.rpm for your own system, you can use uname-a look at present is i386 or i686 then based on this to select the downloaded kernel upgrade package. It is recommended that you use rpm-ivh to upgrade, so you can keep the original kernel, make sure there are no problems and the kernel rpm-e, the RPM package is very simple and you don't have to modify your lilo.conf or grub.conf configuration files, it automatically gives you joined, you need to do is restart and then select the new kernel boots. Finished kernel upgrade, restart with the new kernel is up2date after. Feel free to sign up for a run rhn_register numbers (this must be kept secret, Oh, my own research, rhn network upgrade is actually the service fees, but a mailbox an account is free, but an account is only one upgrade system permissions, you can use rhn network to log in to modify the permissions to the other machine, but it's too much trouble and the upgrading basically stable redhat7.3, only need to install first upgrade it, so we just registered account number to upgrade: P) when you are prompted to do so, it is the default selection for your machine all packets as you upgrade, it doesn't matter, all the way to the final finish and then back to the next console, then there is the exciting upgrade, run the command: up2date-u on begin the upgrade, the process depends on your network, about 1 hour. It will automatically download and install for you, although not restart, it is recommended that you restart it, make sure the new kernel and new packages will be able to correctly use this point, the system updates the finished, the following is the more important security settings. 4, security settings, in fact, linux security have better, and we did a preliminary discussion of security, is nothing more than set off the service, certain firewalls, if everyone on the anti-hacker and advanced security settings are interested, then please pay attention to my next article, I will introduce the simple technique of IDS, and so on anti-black, thank you. Turn off unused services, the issue, and many articles are suggested, I personally think that the most effective close method as follows, we all know that Linux control services with chkconfig, ntsysv, etc, in fact, these tools control services are linux has sysV style saved service startup items, are actually/etc/rc.d/following things, for example, have been rc3.d 3 represents init3 need to do the project, there are a number of files, start at the beginning indicates that the S, K, so at the beginning of the said termination rc0.d inside Basic are K at the beginning, so you don't have to fear to think how mysterious Linux service, here are two simple ways to control the service. Run the service using ntsysv ntsysv control shutting down service only crond to define a scheduled task to generate a random number random network network for ssh session symmetric keys of generate sshdssh syslog system log on the server side service xinetd Super processes (here no service to use, can be turned off) in fact xinetd is similar to init the Super process a process, but you can turn it off entirely, because the following are some useless services listener, for general server, basically just above the service ntsysv, others are closed, and, of course, if you want to start httpd web course. Services close out later, that is, remove some unused user, use vipw # adm: x: 3: 4: adm:/var/adm:/sbin/nologin # lp: x:4:7:lp:/var/spool/lpd:/sbin/nologin　　#sync:x:5:0:sync:/sbin:/bin/sync　　#news:x:9:13:news:/var/spool/news:　　#uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin　　#operator:x:11:0:operator:/root:/sbin/nologin　　#games:x:

Protect Linux desktop security of nine tips

Hide files and folders on Linux systems, the files and folders is by using the "."

To be hidden. For example, as shown in the following figure, the original in testfilefolder folder there are two files, we can use the ls command view. But after running the command mvadsl-stop.adsl-stop, ls, you can see only one file. This description can use mv to hide not want other users to see the file. Of course, you can use ls-a command to view all files, regardless of whether they are hidden. Figure 3: Figure 3 has a good password Linux user's password as the key to doing it as important. If the user will be the key to many people, he also locks do? of course, this key is finally being easily produced, that is, the user's password is not easy to guess. If you are using Ubuntu, release version, the passwords might give users more access. Anyway, it is important to protect the user's password is strong. If you really do not trust their own password if appropriate, may wish to use this software, it AutomatedPasswordGenerator can provide you creating a secure random password of the good. Figure 4: diagram 4 do not install the file-sharing applications, many users are sharing some of the files. If you want to run this function, you should know the risks. Especially if you use this feature with workplaces, the share will not only their own files, but also involves the company's other users, and also the entire desktop to hand over to the other users illegally. Therefore, for security reasons, please do not install the file-sharing tool. Periodic upgrades used Windows users on Microsoft periodically releases OS and application patches have left a deep impression of "". But Microsoft releases patches of speed is far less Linux came fast. In the Linux world, a security vulnerability discovered, in a few hours or a few minutes you can publish their patches. KDE and Gnome support Panel of the update. Some people think that regular upgrades too much trouble, it is recommended that you do not deny security updates, these updates will certainly cause of publishing. Install anti-virus mechanisms do not feel that the virus causing system problems unlikely. The author recommends that you use a robust virus defense tools such as ClamAV so that you can protect your machines make mail does not contain harmful code, nor will it affect the company's network of other systems. SELinux worth a try SELinux well lock on the application of access control, although some people think that there is a satisfactory SELinux, as it may affect system performance, but you may find other applications to install. However, according to the author's experience, the SELinux security benefits to far outweigh its negative effects. The Fedora installation, you will have the opportunity of SELinux enabled. Figure

Understanding Linux platform four IDS intrusion detection tools

Simple and convenient: chkrootkit and rootkitRootkit utility chkrootkit and rootkitHunter is old rootkit detection program.

Obviously, in a not writable external device at run time, they are more trusted tools, such as from a CD or write protect USB drive run-time. I like the SD card, it is because the write protection switch. These two programs can search known rooktkit, backdoor and local vulnerability exploits, and can be found in a limited number of suspicious activity. We need to run these tools of reason is that they can view the file system on/proc, ps and other important activities. Although they are not used for network, but it can quickly scan the PC. Versatile: TripwireTripwire is an intrusion detection and data integrity of the product, which allows users to build a performance optimization settings basic server status. It does not preclude a damage incident, but it can be the present state of the State and the ideal, compared to determine whether any accidental or deliberate changes. If any changes have been detected, it will be reduced to the minimum running obstacle. If you need to control on Linux or UNIX server changes, you have three options: open source Tripwire, Tripwire, a server version of Tripwire Enterprise Edition. Although these three products have some things in common, but they have a large number of different aspects, making this product can meet the requirements of the different IT environments. If open source Tripwire for monitoring a small number of servers is appropriate, because it does not require centralized control and reporting; the server version of Tripwire for those only in Linux/UNIX/Windows platform requires the server to monitor and provide detailed reports and optimization centralized server management, IT is an ideal solution; while the Enterprise Edition Tripwire for UNIX/Linux/Windows servers, databases, network devices, desktops, and directory servers securely audit configuration of the IT organization is the best choice.

Use ndiswrapper Linux configure wireless network card

Nowadays, almost every one of his mobile are available with built-in wireless functionality, but many of these cards do not have good Linux drivers.

So unless the mobile settings are double import, Linux users to use the wireless card is not possible. Despite that, unless Windows is not running, or the mobile to connect to a wireless network is also very unlikely. However, many card already has a solution. A program called the ndiswrapper Linux kernel module to allow loaded into some wireless card drivers on Windows. This makes mobile on Linux using the wireless card, even in the absence of the original Linux driver. First of all, to find a copy sourceforge.net ndiswrapper. Download the latest version (0.8), then install, as follows: # tarxvzfndiswrapper-0.8.tar.gz # cdndiswrapper-0.8 # makeinstall this install ndiswrapper tools and different from the currently running kernel kernel module. You must have a valid kernel source code. (For most RPM, you only need to install the "kernel-source" software packages. Next, you need to find the card of the Windows driver copy is already exists in the Windows system (if it is a double import) found in or downloaded driver, are not related. Sourgeforge.net website lists the supported card, and provide a link for you to download Windows drivers. Perform the following operations, install Windows driver: # ndiswrapper-i [inf_file] .inffile (file) is a Windows-driven information file. It put the correct files are installed to/etc/ndiswrapper/[driver]. You can perform the following operation, to verify and ensure consistent with ndiswrapper ndiswrapper. # Ndiswrapper-l this program should list you just installed. Then, load the ndiswrapper kernel module, as follows: # modprobendiswrapper this load the driver and the system that you can use. You need to install Wireless Toolkit, in order to configure the wireless interface. Check to see if the system is in line with each other, simply enter iwconfig, it appears the network interface. (Usually wlan0, if it is the only one on the wireless card. ) Then use iwconfig or using wireless specific extensions, such as WEP key mode, to configure the tool to install wireless card (same as other wireless card is installed).