📄 00000012.htm
字号:
# <BR> <BR># Authentication server and client rules <BR> <BR>authsrv: database /usr/local/etc/fw-authdb <BR> <BR>authsrv: permit-hosts * <BR> <BR>authsrv: badsleep 1200 <BR> <BR>authsrv: nobogus true <BR> <BR># Client Applications using the Authentication server <BR> <BR>*: authserver 127.0.0.1 114 <BR> <BR> <BR> <BR>初始化数据库时,要先su到root,在/var/local/etc下运行./authsrv创建用户的记录, <BR> <BR>如下所示: <BR> <BR> <BR> <BR>可以在FWTK的文档中找到创建用户及组的信息. <BR> <BR> <BR> <BR># <BR> <BR># authsrv <BR> <BR>authsrv# list <BR> <BR>authsrv# adduser admin “Auth DB admin” <BR> <BR>ok - user added initially disabled <BR> <BR>authsrv# ena admin <BR> <BR>enabled <BR> <BR>authsrv# proto admin pass <BR> <BR>changed <BR> <BR>authsrv# pass admin “plugh” <BR> <BR>Password changed. <BR> <BR>authsrv# superwiz admin <BR> <BR>set wizard <BR> <BR>authsrv# list <BR> <BR>Report for users in database <BR> <BR>user group longname ok? proto last <BR> <BR>------ ------ ------------------ ----- ------ ----- <BR> <BR>admin Auth DB admin ena passw never <BR> <BR>authsrv# display admin <BR> <BR>Report for user admin (Auth DB admin) <BR> <BR>Authentication protocol: password <BR> <BR>Flags: WIZARD <BR> <BR>authsrv# ^D <BR> <BR>EOT <BR> <BR># <BR> <BR> <BR> <BR> <BR> <BR>telnet网关是最直截了当的并且是你第一个需要设置的. <BR> <BR> <BR> <BR>在我的例子中,所有内部的用户无须认证(permit-hosts 196.1.2.* -passok-xok),而其余 <BR>用户必须经过ID和密码的验证.(permit-hosts *-auth)我还特别允许 196.1.2.202的用户 <BR>不经过防火墙直接访问代理服务器.有关inetacl-in.telnetd的两行表现了这一点,接下去 <BR>我就会解释调用的过程. <BR> <BR> <BR> <BR>Telnet的timeout应尽量设小. <BR> <BR> <BR> <BR> <BR> <BR># telnet gateway rules: <BR> <BR>tn-gw: denial-msg /usr/local/etc/tn-deny.txt <BR> <BR>tn-gw: welcome-msg /usr/local/etc/tn-welcome.txt <BR> <BR>tn-gw: help-msg /usr/local/etc/tn-help.txt <BR> <BR>tn-gw: timeout 90 <BR> <BR>tn-gw: permit-hosts 196.1.2.* -passok -xok <BR> <BR>tn-gw: permit-hosts * -auth <BR> <BR># Only the Administrator can telnet directly to the Firewall via Port 24 <BR> <BR>netacl-in.telnetd: permit-hosts 196.1.2.202 -exec /usr/sbin/in.telnetd <BR> <BR> <BR> <BR> <BR> <BR>rlogin的命令与telnet相仿. <BR> <BR> <BR> <BR> <BR> <BR># rlogin gateway rules: <BR> <BR>rlogin-gw: denial-msg /usr/local/etc/rlogin-deny.txt <BR> <BR>rlogin-gw: welcome-msg /usr/local/etc/rlogin-welcome.txt <BR> <BR>rlogin-gw: help-msg /usr/local/etc/rlogin-help.txt <BR> <BR>rlogin-gw: timeout 90 <BR> <BR>rlogin-gw: permit-hosts 196.1.2.* -passok -xok <BR> <BR>rlogin-gw: permit-hosts * -auth -xok <BR> <BR># Only the Administrator can telnet directly to the Firewall via Port <BR> <BR>netacl-rlogind: permit-hosts 196.1.2.202 -exec /usr/libexec/rlogind -a <BR> <BR> <BR> <BR> <BR> <BR>不要允许任何人直接访问你的防火墙，即使FTP访问也不行.因此要避免在防火墙机器上安 <BR>装FTP服务. <BR> <BR> <BR> <BR>值得重申的是,这里允许所有内部用户自由访问Internet,而其他用户则必须通过验证. 我 <BR>还启用了文件收发的记录. <BR> <BR> <BR>(-log { retr stor }) <BR> <BR> <BR>ftp timeout指定防火墙对一个失效FTP连接的最长等待时间. <BR> <BR> <BR> <BR> <BR># ftp gateway rules: <BR> <BR>ftp-gw: denial-msg /usr/local/etc/ftp-deny.txt <BR> <BR>ftp-gw: welcome-msg /usr/local/etc/ftp-welcome.txt <BR> <BR>ftp-gw: help-msg /usr/local/etc/ftp-help.txt <BR> <BR>ftp-gw: timeout 300 <BR> <BR>ftp-gw: permit-hosts 196.1.2.* -log { retr stor } <BR> <BR>ftp-gw: permit-hosts * -authall -log { retr stor } <BR> <BR> <BR> <BR> <BR> <BR> <BR> <BR>Web,gopher, 和基于浏览器的FTP由http-gw来完成. 前两行建立目录来缓存通过防火墙的 <BR>web页面和ftp文件,我把这些文件的所有者设为root,并保存在只有root才能访问的目录中. <BR> <BR> <BR> <BR>Web connection应保持在一个较小的值,它控制用户等待一个失效连接的时间. <BR> <BR> <BR> <BR># www and gopher gateway rules: <BR> <BR>http-gw: userid root <BR> <BR>http-gw: directory /jail <BR> <BR>http-gw: timeout 90 <BR> <BR>http-gw: default-httpd www.afs.net <BR> <BR>http-gw: hosts 196.1.2.* -log { read write ftp } <BR> <BR>http-gw: deny-hosts * <BR> <BR> <BR> <BR> <BR>ssl-gw只有一个传递作用, 要小心设置. 在这里, 我允许内部用户访问除 127.0.0.* 和 <BR>192.1.1.*以外的所有外部地址.且只能访问443到563端口,这些是通用的SSL端口. <BR> <BR> <BR> <BR># ssl gateway rules: <BR> <BR>ssl-gw: timeout 300 <BR> <BR>ssl-gw: hosts 196.1.2.* -dest { !127.0.0.* !192.1.1.* *:443:563 } <BR> <BR>ssl-gw: deny-hosts * <BR> <BR> <BR> <BR>下例说明怎样使用plug-gw代理news server,只允许内部用户访问一个外部server,且只能 <BR>访问一个端口。 <BR> <BR> <BR>第二行设置允许news server将数据送入内部网. <BR> <BR> <BR> <BR>几乎所有的news client在用户阅读news时保持连接状态,因此这里给news server规定了 <BR>一个较长的等待时间(time out). <BR> <BR> <BR> <BR># NetNews Pluged gateway <BR> <BR>plug-gw: timeout 3600 <BR> <BR>plug-gw: port nntp 196.1.2.* -plug-to 199.5.175.22 -port nntp <BR> <BR>plug-gw: port nntp 199.5.175.22 -plug-to 196.1.2.* -port nntp <BR> <BR> <BR> <BR>finger-gw比较简单,任何内部用户只能先登录到防火墙,再运行finger,其他访问者将得到 <BR> <BR>一个信息(finger.txt). <BR> <BR> <BR> <BR> <BR> <BR># Enable finger service <BR> <BR>netacl-fingerd: permit-hosts 196.1.2.* -exec /usr/libexec/fingerd <BR> <BR>netacl-fingerd: permit-hosts * -exec /bin/cat /usr/local/etc/finger.txt <BR> <BR> <BR> <BR>我没有作过Mail和X-windows服务的代理,无法提供相应的例子,欢迎来信补充. <BR> <BR> <BR> <BR>关于inetd.conf <BR> <BR> <BR> <BR>下面是一例inetd.conf文件,所有不必要的服务都被注释掉了. 但我还是包括了整个文件, <BR>以阐明怎样关闭服务及为防火墙开启新服务. <BR> <BR> <BR> <BR> <BR> <BR>#echo stream tcp nowait root internal <BR> <BR>#echo dgram udp wait root internal <BR> <BR>#discard stream tcp nowait root internal <BR> <BR>#discard dgram udp wait root internal <BR> <BR>#daytime stream tcp nowait root internal <BR> <BR>#daytime dgram udp wait root internal <BR> <BR>#chargen stream tcp nowait root internal <BR> <BR>#chargen dgram udp wait root internal <BR> <BR># FTP firewall gateway <BR> <BR>ftp-gw stream tcp nowait.400 root /usr/local/etc/ftp-gw ftp-gw <BR> <BR># Telnet firewall gateway <BR> <BR>telnet stream tcp nowait root /usr/local/etc/tn-gw /usr/local/etc/tn-gw <BR> <BR># local telnet services <BR> <BR>telnet-a stream tcp nowait root /usr/local/etc/netacl in.telnetd <BR> <BR># Gopher firewall gateway <BR> <BR>gopher stream tcp nowait.400 root /usr/local/etc/http-gw /usr/local/etc/http-gw <BR> <BR># WWW firewall gateway <BR> <BR>http stream tcp nowait.400 root /usr/local/etc/http-gw /usr/local/etc/http-gw <BR> <BR># SSL firewall gateway <BR> <BR>ssl-gw stream tcp nowait root /usr/local/etc/ssl-gw ssl-gw <BR> <BR># NetNews firewall proxy (using plug-gw) <BR> <BR>nntp stream tcp nowait root /usr/local/etc/plug-gw plug-gw nntp <BR> <BR>#nntp stream tcp nowait root /usr/sbin/tcpd in.nntpd <BR> <BR># SMTP (email) firewall gateway <BR> <BR>#smtp stream tcp nowait root /usr/local/etc/smap smap <BR> <BR># <BR> <BR># Shell, login, exec and talk are BSD protocols. <BR> <BR># <BR> <BR>#shell stream tcp nowait root /usr/sbin/tcpd in.rshd <BR> <BR>#login stream tcp nowait root /usr/sbin/tcpd in.rlogind <BR> <BR>#exec stream tcp nowait root /usr/sbin/tcpd in.rexecd <BR> <BR>#talk dgram udp wait root /usr/sbin/tcpd in.talkd <BR> <BR>#ntalk dgram udp wait root /usr/sbin/tcpd in.ntalkd <BR> <BR>#dtalk stream tcp waut nobody /usr/sbin/tcpd in.dtalkd <BR> <BR>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -