Linux Administrator (Advance)

Transcription

1 Linux Administrator (Advance) Mr.Kriangsak Namkot Trainer & Director Jodoi IT&Service Co.,Ltd. Linux Administrator I Day Samba Server ( File Server ) Coffee Break Samba Server ( File Server ) Lunch Iptables Coffee Break Iptables & Internet Gateway 1

2 Samba Server samba - A Windows SMB/CIFS fileserver for UNIX The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS). For a more thorough description, see Samba also implements the NetBIOS protocol in nmbd. smbd - server to provide SMB/CIFS services to clients # rpm -q samba samba el5_5.1 # yum install samba Or How to Compile Samba Collection/compiling.html # vi /etc/samba/smb.conf Samba Server 2

3 Samba Server named]# vi /etc/samba/smb.conf ~ workgroup = MYGROUP server string = Samba Server # Standalone Server Options # security = user # passdb backend = tdbsam security = share ; hosts allow = hosts allow = ; interfaces = / /24 interfaces = /24 Samba Server [public] comment = Public Stuff path = /samba public = yes writable = yes printable = no write list :wq! [root@jodoi-server ~]# /etc/init.d/smb restart [root@jodoi-server ~]# service smb restart 3

4 Samba Server ~]# netstat -anp grep smb tcp : :* LISTEN 2719/smbd tcp : :* LISTEN 2719/smbd [root@jodoi-server ~]# netstat -anp grep nmb udp : :* 2723/nmbd udp : :* 2723/nmbd udp : :* 2723/nmbd udp : :* 2723/nmbd [root@jodoi-server ~]# ps -ef grep smb root :29? 00:00:00 smbd -D root :29? 00:00:00 smbd -D Samba Server [root@jodoi-server /]# cd / [root@jodoi-server /] # mkdir samba [root@jodoi-server /]# chmod -fr samba/ [root@jodoi-server /]# chmod -fr 777 samba/ Test on PC 4

5 Samba Server Test on PC # vi /etc/samba/smb.conf [...] security = user passdb backend = tdbsam [...] #smbpasswd -a user Samba Server # /etc/init.d/smb restart Shutting down SMB services: [ OK ] Shutting down NMB services: [ OK ] Starting SMB services: [ OK ] Starting NMB services: [ OK ] 5

6 In GUI Samba Server In GUI Samba Server 6

7 Samba Server iptables - administration tool for IPv4 packet filtering and NAT Option -t, --table table -L, --list [chain] -n, --numeric -A, --append chain rule-specification -D, --delete chain rule-specification -I, --insert chain [rulenum] rule-specification -F, --flush [chain] deleting all the rules one by one -P, --policy chain target 7

8 Option -p, --protocol [!] protocol -s, --source [!] address[/mask] -d, --destination [!] address[/mask] -j, --jump target -i, --in-interface [!] name -o, --out-interface [!] name Reading iptables rules # iptables -L n # iptables-save # vi /etc/sysconfig/iptables [root@jodoi-server ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain RH-Firewall-1-INPUT (2 references) 8

9 ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination 9

10 TABLES in IPTABLES [1] filter [2] nat # iptables -t filter -L n # iptables -t nat -L n ERASE existing ruleset # iptables -F INPUT # iptables -F OUTPUT set defaut policy # iptables -P INPUT DROP # iptables -P OUTPUT ACCEPT set stateful connection tracking (allow REPLY to come back) # iptables -P INPUT DROP # iptables -P OUTPUT ACCEPT # ping # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # ping

11 Ex.1 SELECTIVELY PERMIT some connection e.g. TCP/22 from /24 LIST the following information [0] FROM WHAT INTERFACE? ( eth0 ) [1] FROM WHAT IP? ( /24 ) [2] TO WHICH PROTOCOL? ( TCP ) [3] TO WHICH PORT? ( 22 ) # iptables -A INPUT -i eth0 -s /24 -p tcp --dport 22 -j ACCEPT Ex. 2 SELECTIVELY PERMIT some connection e.g. TCP/80 from /24 LIST the following information [0] FROM WHAT INTERFACE? ( eth0 ) [1] FROM WHAT IP? ( any ) [2] TO WHICH PROTOCOL? ( TCP ) [3] TO WHICH PORT? ( 80,443 ) # iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT # iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT 11

12 Ex. 3 Block web hi5 # iptables -A FORWARD -i eth0 -d j DROP # iptables -A FORWARD -i eth0 -d j DROP # iptables -A FORWARD -i eth0 -d j DROP Internet Gateway Server 1. enable IP Forward [root@jodoi-server ~]# vi /etc/sysctl.conf ~ # Controls IP packet forwarding net.ipv4.ip_forward = 1 ( 0 is disabled, 1 is enabled) ~ :wq! [root@doiserver root]# service network restart [root@doiserver root]# cat /proc/sys/net/ipv4/ip_forward 1 12

13 Internet Gateway Server 2. Disable Firewall root]# setup Internet Gateway Server 3. Set group IP can Forward Packet root]# iptables -A FORWARD -s /24 -j ACCEPT root]# iptables -A FORWARD -d /24 -j ACCEPT root]# iptables -A FORWARD -j DROP root]# service iptables save root]# service iptables restart or # vi /etc/sysconfig/iptables Ex Config NAT # iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to

14 Internet Gateway Server Lab Test IP tabless 1. Client can not open and and can not ping to any IP 2. Outside can ping, use web, samba, ssh and webmin 14