Author: Zhao Peng cite LILO (Linuxloader): this is a system boot applications and boot for configuration, one or more operating system.
Bash (BourneAgainshell): four Linux commonly used shell (PDKSH, TCSH-shell, Z-shell, Bash) for the upgrade version, Brounshell consolidated the Kornshell, C-shell and all the advanced features of TCSHshell. It is also the default shell of RedHat. X-windows: X refers to the X protocol, UNIX system development in the mid-1980s by providing the network graphic user interface. And PC-based Windows, GUI, GUI it into X-windows, window manager and program/file manager in three sections. Gnome and KDE: Linux two very common desktop. Gnome (GUNNetworkObjectModelEnvironment) i.e. the network object model environment, including Panel, desktop and one for organizations program interface GUI (graphical user interface) tools; KDE (KDesktopEnvironment) i.e. K desktop environment, a transparent desktop based network, a user can perform in this environment the vast majority of Linux applications. G/KDM (Gnome/KDisplayManager): means the Gnome or KDE environment display manager. RPM (RedHatPackageManager): RedHat package manager. It will be organized into Linux software can install and remove packages.Monday, February 7, 2011
LINUX2.2.x State detection of realization
1. Introduction to firewall stateful inspection is currently one of the prerequisites.
It work at the IP layer, check the firewall forwarding packages, and create the corresponding structure records the State of the connection. It checks that include link layer, network layer, transport layer, application layer in a variety of information, and in accordance with the rules of the table or the state table to decide whether to allow forwarding packets to pass through. Open source project SIFI (http://www.ifi.unizh.ch/ikm/sinus/) implements a firewall stateful inspection feature. The Firewall kernel section of code is to establish in the framework of LINUX2.2.x network security, is a very good analysis, learning State detection technology instance. The following is from the data structure, status checks, serial number check, timeout, application protocol data checking and other aspects of its State testing is how to achieve. 2. Overview of the first look at SIFI several important data structures. 2.1.sf_fw_ops SIFI kernel code is LINUX2.2.x network security framework, so it should define in the check point on the reference architecture, as follows: structfirewall_opssf_fw_ops = {NULL, sf_forward_ck, sf_input_ck, sf_output_ck, PF_INET, 2} struct sf_forward_chk, sf_input_chk, sf_out_chk three functions in checkpoint call_fw_firewall, call_in_firewall, call_out_firewall on being called. All three functions to call the function sf_check_packet real action. This structure is of priority 2, higher than LINUX2.2.x kernel-defined priority of ipfw_ops, check point, first call the function defined in the structure. Only in it for the function's return value is FW_SKIP circumstances will call the functions defined in ipfw_ops. 2.2. rule table rule sheet is a one-way list, is used to match the packages need to be addressed, and decided to match the action. As shown in Figure 2.1. 2.3. connection table connection table is a hash table, the same hash value of the structure is linked in a doubly linked list. All fabric and is linked in a doubly linked list, the pointer points to the conns head and tail pointing to the linked list of lastc. As shown in Figure 2.1. 2.4. State defined connection tables in every structure in a moment, there is a certain State. In SIFI, only for TCP and UDP protocols to create the connection structure. Other protocol checks by matching rules table implementation, without creating the connection structure. State is defined as follows: [table 2.1] table with grey logo status in status check is not used. SF_TCP_ESTABLISHEDFTP status for the FTP protocol defined for the control connection, define this State's purpose is to check the FTP protocol, and find out the address and port, and create a new connection structure, so that the FTP data connection in the absence of appropriate rules can also be set up. Other State defines TCP connection in the process of change of legal status and the status of the conversion process as mentioned below. 3. the basic process now look SIFI on different protocol packet processing. On the ICMP protocol or IGMP Protocol of the packet, it checks the length of the package, and in the rules table lookup, if a match is found, perform the action required by the rules; if you do not find a matching rule, the default ban the bag. It did not record the ICMP or IGMP protocols. The UDP protocol of the packet flow check as follows: [figure 3.1] first look at the attached table, if found, this direction of UDP traffic is allowed by the rules; if not found, then the rule table lookup, if there is a matching rule, perform the action required by the rules, if you do not find a matching rule, the default ban the bag. Rule check, if the matched rules allow this package will add the connection table a new structure, the status value is SF_UDP_STATE, subsequent packets will no longer be rule checks until the structure to be deleted. It is worth noting that the UDP packet to check the connection table using a single match, this to handle different on TCP. On the TCP protocol of the packet flow check as follows: [figure 3.2] first connection table to see if there is a corresponding connection structure. Here find using two-way matching (the destination address, destination port and source address, source port swap), so a TCP connection for each connection structure. If you find an appropriate connection structure, status changes (status change will be described later); if not found, check whether the package is syn reset bit, but there is no reset bit ack packet (TCP connecting packages), and if so, use the source port is zero, the calculated hash value in the join table to find the appropriate structure (this structure is in processing application protocol data in dynamic address and create a dynamic port, and address translation of similar), if found, delete the original source port is zero, and this bag's address and port to recompute the hash value, create a new structure; if not syn reset position while the ack packet is not set, the prohibition of the package. 4. status check 4.1. status check status check defines TCP connection changes in the process of legal status, as well as in a particular State allows the package type. Stateful inspection at the same time to allow the adoption of the package do check the legality, such as their serial numbers are consistent with the TCP protocolDiscussion of provisions, etc. All state changes between as shown in the figure: [figure 4.1] connection structure of the initial state is SF_TCP_ACCEPT_SYN, ack syn reset bit but did not reset bit TCP packet in rules check the return value is created when FW_ACCEPT. Structure after it is created, access to create a connection's status check. Steps: (1) If a CLIENT (the connection initiator) ack syn reset bit but did not reset bit package, the connection state changes to SF_TCP_CLIENT_SYN. (2) in SF_TCP_CLIENT_SYN State, when SERVER (connect the recipient) to respond to the syn reset bit or syn/ack packet, setting the connection state changes to SF_TCP_SYN_ACK. In this State also allows CLIENT's syn reset bit or syn/ack packet, setting the connection status remains unchanged. (3) in SF_TCP_SYN_ACK State, when a CLIENT response ack setting or syn/ack packet, setting the connection state changes to SF_TCP_ESTABLISHED3. In this State, also allows the SERVER's syn/ack packet, setting the connection status remains unchanged, but does not allow the SERVER's syn reset bit and CLIENT of syn packets through setting. These are the SF_TCP_ACCEPT_SYN, SF_TCP_CLIENT_SYN, SF_TCP_SYN_ACK three State on ack syn or setting package check. This check support TCP connections open simultaneously, provided that the rules you want to allow. Close the connection status to check the steps as follows: (4) If a CLIENT of fin set bits in the package, the connection state changes to SF_TCP_CLIENT_FIN. (5) if the SERVER's fin reset bit package changes the connection to the SF_TCP_SERVER_FIN. (6) the above two steps of change if you have completed, the status of the connection is either greater than SF_TCP_TERMINATED SF_TCP_TERMINATED (if the FTP control connection is to create a structure). (7) in the State is greater than or equal to, if you receive SF_TCP_TERMINATED syn reset bit package, will remove the connection, and check the rules. In any State if you receive an rst reset bit package, delete the connection. And, if received syn, fin set bits or rst set bits syn, fin, rst, or set of packages (Christmas packet), will prevent the packet through. 4.2. timeout in each State of the non-ESTABLISHED are set on an appropriate timeout value, as follows: [table 4.1] timeout by kernel Timer implementation, timed-out connection is deleted. SF_TCP_ESTABLISHED3, SF_TCP_ESTABLISHEDFTP two status on the default timeout value is not defined, but you can define SF_TCP_IDLE compilation options, make the two State timeout value is 8 * 36 * HZ is 8 hours. 4.3. serial number check the serial number is the TCP protocol is used to ensure data reliability of an important means. TCP connection in the delivery of every byte of data is used to identify a serial number. Connection of the initial sequence number when a connection is established. Receive a package of a party will issue the ack setting response packet, tell someone their acceptance of the next sequence number is a number that identifies the next serial number before the data received. TCP protocol using serial number window to limit each other can send packets of length, to control traffic. Window size is a 16 bit positive integer, you can extend the scale options TCP window size. Use the scale option, in calculating the window will change the window value left to increase the value of the window. TCP initial sequence number in the negotiation of syn reset bit package occupies one serial number disconnected fin set bits in occupies one serial number for the package. SIFI by checking the serial number for forwarding packets to determine the legality of this package. The realization of the SIFI, you can configure the parameter checking each TCP connection of the serial number, the steps are as follows: (1) no syn reset bit package (fin or ack setting package), first determine the sender's maximum sequence number in the other side of the window, and then if you are setting the ack packet, which confirm the serial number should be in each other's serial number. (2) a State record in SF_TCP_CLIENT_SYN CLIENT's serial number, window size and scaling factor. In a State record SERVER SF_TCP_SYN_ACK sequence numbers, window size and zoom factor, and the CLIENT's sequence number increases by one. (3) in the State, if SF_TCP_TERMINATED received syn reset bit package, its serial number in the serial number of the party. (4) in the SERVER SF_TCP_SYN_ACK of duplicate syn/ack packet, setting it to confirm the serial number should be used with the connection record the serial number of the CLIENT. 4.4. application protocol data check application protocol data check does is check the control connection agreement on the application of the address and port, and create a corresponding connection structure, so that subsequent data connections can be established. In General, unless the rule to allow all ports, otherwise these agreements in passing dynamic ports by default in the rule is prohibited. If you are able to dynamically create a fabric, to avoid checking rules, transparent to the user. Of course, this can create a dynamic rule to achieve, but the rule is aGNOME File Manager will join the tabbed browsing
Linux desktop GNOME's file manager, Nautilus, allegedly will add similar browser tabbed browsing feature.
Nautilus many areas need to be updated, in which the user maximum requirements is tabbed browsing, so developers will be the first time to join this feature. Basic allegedly has now joined this feature, just some small fixes and testing needs to be done, but also join the Alt + number key shortcuts. The new Nautilus will together with GNOME2.24 in September. And friends can first try to support the functionality of the Windows PCManFileManager also can use QTTabBar. Download source code: http://svn.gnome.org/viewvc/nautilus/branches/multiview/dependent libbackground download: http://svn.gnome.org/svn/gnome-control-center/tags/gnome_control_center_2_22_0/libbackground/Non-fixed IP in Ubuntu shelves NAT + DHCP
Then don't forget 「introduction # sudogedit/etc/default/dhcp3-server 」, and modify 「introduction INTERFACES = "" 」 into 「introduction INTERFACES = "eth1" 」.
Finally a difficult step is to modify 「introduction/etc/dhcp3/dhcpd.conf 」, however when I labored, open Firestarter and DHCP and NAT setting (I selected 「introduction CreatnewDHCPconfiguration 」), then back to 「introduction/etc/dhcp3/dhcpd.conf 」, inside of the content is not what I refer to the birds of Costa hard to break into, but the set, Firestarter dexterity than I even less, province of several B capacity. # DHCPconfigurationgeneratedbyFirestarterddns-update-styleinterim; ignoreclient-updates; subnet192.168.1.0netmask255.255.255.0 {optionrouters192.168.1.2; optionsubnet-mask255.255.255.0; optiondomain-name-servers168.95.1.1; # Chunghwa Telecom's DNS address optionip-forwardingof; rangedynamic-bootp192.168.1.30192.168.1.50; # automatically assign IP range default-lease-time21600; max-lease-time43200;} Don't forget to perform 「introduction # sudo/etc/init.d/dhcp3-serverrestart 」 if you share with me too lazy to own set iptables, the next super easy. Please install Firestarter, remember to suite the Universe in the library. The following settings if you want to reference pictures, see below URL. Firestarter-> Preferences – > NetWorkSettings, connect Ethernet of 「introduction Internetconnectednetworkdevice 」 select ppp0, connect internal computer 「introduction Localnetworkconnecteddevice 」 select eth1, the middle two tick Enable all, underneath you can select 「introduction KeepexistingDHCPconfiguration 」, he would use you just created, if you choose to enter 「introduction CreatnewDHCPconfiguration 」 good distribution coverage of IP, Firestarter will own set 「introduction/etc/dhcp3/dhcpd.conf 」. Forgot to remind everyone that you want to remember that the cable is connected properly, otherwise there is no logging to Firestarter two connected network card, it will not start NAT. Things here is not over yet, my computer still does not have access to the Internet, and so I put the original regional network established 192.168.1.3 into 「introduction automatically obtain IP address 」, below the select 「introduction automatically obtain DNS server address 」, everything is done. Watch with me for a long time of cFos display 「introduction interrupted line 」, got a strange sadness, don't, cFos, and from now on, I want to talk to my brother shared IP.Apache logs: access log (2)
3. process statistics UNIX can track each user runs each command, if you want to know what last night mess of important documents, process statistics subsystem can tell you.
It also tracks a trespasser. And connection time log, process statistics subsystem default not activated, it must be started. On Linux systems start process statistics using the accton command, you must use root to run. Accton commands acctonfile, file must exist. Use the touch command to create the pacct file: touch/var/log/pacct and then run the accton: accton/var/log/pacct. Once the accton is activated, you can use the lastcomm command monitoring system commands at any time. To turn off statistics that can be used without any arguments accton command. Lastcomm command reports the file before execution. Without parameters, lastcomm command displays the current statistics file lifetime record of all information about the command. Including the command name, user, tty, command takes CPU time and a time stamp. If the system has many users, enter you can get quite long. The following example: crondFroot?? 0.00secsSunAug2000:16 promisc_check.sSroot?? 0.04secsSunAug2000:16 promisc_checkroot?? 0.01secsSunAug2000:16 greproot?? 0.02secsSunAug2000:16 tailroot?? 0.01secsSunAug2000:16 shroot?? 0.01secsSunAug2000:15 pingSroot?? 0.01secsSunAug2000:15 ping6.plFroot?? 0.01secsSunAug2000:15 shroot?? 0.01secsSunAug2000:15 pingSroot?? 0.02secsSunAug2000:15 ping6.plFroot?? 0.02secsSunAug2000:15 shroot?? 0.02secsSunAug2000:15 pingSroot?? 0.00secsSunAug2000:15 ping6.plFroot?? 0.01secsSunAug2000:15 shroot?? 0.01secsSunAug2000:15 pingSroot?? 0.01secsSunAug2000:15 shroot?? 0.02secsSunAug2000:15 pingSroot?? 1.34secsSunAug2000: acctonSrootttyp00.00secsSunAug2000 locaterootttyp01.34secsSunAug2000: 15 15: 15 process statistics are the pacct file may grow very fast. You need interactive or through cron mechanism keeps running sa command log data in the system control. Sa command report, cleaning and maintenance process statistics file. It can put the information in the compresses/var/log/pacct to summary file/var/log/savacct and/var/log/usracct. This summary contains the command name and user name of the classification system statistics. Sa default to read them, and then read the pacct file so that the report would contain all of the available information. Sa's output has the following tags: avio--each execution of the average number of I/O operations--user cp and total system time, in minutes, the cpu--and like k-cp-kernel used by average CPU time, in units of k * 1k sec--CPU storage integrity to 1k-core sec re--real time, in minutes, the s-system time, in minutes, tio--I/O operation of total u-user time, in minutes, for example: 842173.26re4.30cp0avio358k 210.98re4.06cp0avio299kind 924.80re0.05cp0avio291k *** oter 10530.44re0.03cp0avio302kping 10430.55re0.03cp0avio394ks 1620.11re0.03cp0avio413ksecurity.s * 1540.03re0.02cp0avio273kls 5631.61re0.02cp0avio823kping6.pl * 23.23re0.02cp0avio822kping6.pl 350.02re0.01cp0avio257kmd5sum 970.02re0.01cp0avio263kinitlog 120.19re0.01cp0avio399kpromisc_check.s 150.09re0.00cp0avio288kgrep 110.08re0.00cp0avio332kawK users can user instead of the command to provide a summary report. For example sa-m appears as follows: 885173.28re4.31cp0avk root879173.23re4.31cp0avk alias30.05re0.00cp0avk qmailp30.01re0.00cp0avk 4.Syslog device Syslog has been adopted by many log function, it is used in many protection measures--any program are available through syslog records events. Syslog to record system events, you can write to a file or device, or send a message to the user. It can record local events or through network record another host events. Syslog devices based on two important documents:/etc/syslogd (daemon) and the/etc/syslog.conf configuration file, it is customary that most information is written to the syslog/var/adm or/var/log directory information files (messages. *). A typical syslog records including generating program name and a text message. It also includes a range of equipment and a priority (but do not appear in the day). Each syslog message is assigned one of the following major equipment: LOG_AUTH--certification system: login, su, getty et LOG_AUTH LOG_AUTHPRIV--the same, but only to log on to choose single user-readable file LOG_CRON--cron daemon LOG_DAEMON--other system daemons, such as routed LOG_FTP--file transfer protocols: ftpd, ttpd LOG_KERN--kernel resulting message LOG_LPR--system printer buffer pool: lpr and lpd LOG_MAIL--e-mail system LOG_NEWS--network news system LOG_SYSLOG--by syslogd (8) the internal message LOG_USER--random user process message LOG_UUCP--UUCP subsystem LOG_LOCAL0 ~ LOG_LOCAL7--Syslog for local use reserved for each event gives several different priorities: LOG_EMERG LOG_ALERT--emergencies--should be immediately corrected issues, such as the system database corruption LOG_CRIT--important information, such as a hard disk error LOG_ERR LOG_WARNING-error--warning information LOG_NOTICE--is not an error, but may need to handle LOG_INFO LOG_DEBUG--information--contains intelligence information, usually to debug a program using the syslog.conf file specified in the record a log of syslogd, the program at startup query configuration file. This file consists of different program or message classification of individual entries, each on a separate line. For each type of information to offer a choice of domain and one domain. These fields are separated by tab: select the domain specified in the message type and priority; action field indicates syslogd receives a selection criteria that matches the message's action to be performed. Each option is composed by a device and priority. When specifying a priority, a syslogd records have the same or higher priority messages. So if you specify "crit", that all marked as crit, alert and emerg message will be recorded. Each row in the action field indicates when the select a field to select a given message after he ought to be sent. For example, if you want to record all messages to a file, as follows: # Logallthemailmessagesinoneplace mail. */var/log/maillog other devices also have their own logs. UUCP and news equipment can produce many external messages. It put the message into its own journal (/var/log/spooler) and the level limit for "err" or higher. For example: # Savemailandnewserrorsoflevelerrandhigherinaspecialfile. Uucp, news.crit/var/log/spooler when an emergency message arrives, you may want to let all users. Might also want to make your own log received and saved. # Everybodygetsemergencymessages, pluslogthemonanthermacine * .emerg ** .emerg @ linuxaid.com.cn alert message should be written to the root and tiger's personal account number: # RootandTigergetalertandhighermessages * .alertroot, tiger sometimes syslogd will produce a lot of messages. Such as the kernel ("kern" devices) can be very lengthy. The user may want to put the kernel message records to/dev/console. The following example shows the kernel log records are commented out: # Logallkernelmessagestotheconsole # Loggingmuchelsecluttersupthescreen # kern. */dev/console users can specify all on one line. The following examples get info or a higher level of messages sent to/var/Log/messages, apart from the mail. Level "none" no one device: # Loganything (exceptmail) oflevelinfoorhiger # Don'tlogprivateauthenticationmessages! * .Info: mail.none; authpriv.none/var/log/messages in some cases, you can put the log sent to the printer, so network intruders do modify the log is not used. Often extensive records log. Syslog devices are a significant target for attackers. An other host maintenance log of the system for preventing server attacks particularly vulnerable, and therefore pay particular attention. There is a small command logger for syslog (3) the system log files provide a shell command interface that allows users to create entries in the log file. Usage: logger for example: loggerThisisatest! it produces a following syslog records: Aug1922: 22: 34tiger: Thisisatest! Note do not fully trust the log, because the attacker can easily modify it. 5. the program log number of programs by maintaining a log to reflect the system's security status. The su command allows the user to access another user's permissions, so its security is important, it's file for sulog. The same also sudolog. In addition, Apache has two logs: access_log and error_log.Migration from Windows to Linux device control applications
Linux function ioctlLinux you can use the ioctl — intioctl (intfildes, intrequest,/* arg */...);
— To specify the device to send control information. The first parameter fildes is open () function returns the file descriptor for alleged specific devices. And the corresponding system call DeviceIOControl ioctl, the input parameters list is not fixed. It depends on what ioctl request, as well as the instructions request parameters, just as Windows function DeviceIOControl dwIoControlCode parameter. However, the migration period need to be aware of when choosing the correct request parameters, because the DeviceIOControl ioctl request of dwIoControlCode and have different values. But there is no dwIoControlCode and request explicit mapping list. Usually you can find the associated header file request parameter values defined for the selected parameter value. All control codes defined in/usr/include/{asm, linux}/* .h file. Parameter arg as specific equipment operation provides detailed command information. The data type of the arg depends on the specific control requests. This parameter can be used to send detailed commands and receive returned data. Migration example we see a from Windows to Linux migration example. This example involves from PC main IDE hard drive read SMART log. Step 1-identification device types as mentioned earlier, Linux devices are used as file. It is first necessary to describe the device's file on Linux. Only use this file to get the device control requires a handle to the device. In this example, the object is an IDE hard disk drive. Linux be described as/dev/hdb/dev/hda, etc. This example will be the migration of hard disk device pathname is \\\\.\\PhysicalDrive0. /Dev/hda is the device corresponding to the Linux name of the file. 2. the changes include the header file must # include header files for Linux (see table 3): table 3. # include header files
Subscribe to:
Posts (Atom)