Samba Apache SSH Apache SSH Internet Internet

Transcription

1 LAN Internet Unix Microsoft SSH SSH Internet Internet Internet Internet Internet Nmap 231

2 DHCP DNS Fedora Core DHCP server DHCP server PC DHCP server root root root 11.1 DNS ISP DNS server DNS /etc/hosts DNS /etc/hosts nano /etc/hosts 11-1 / 11-2

3 localhost localhost /

4 234 /etc/hosts hosts 95/98/Me hosts c:\windows\etc\ NT/2000/XP c:\winnt\system32\drivers\etc\hosts C:\ c:\winnt hosts localhost.localdomain localhost rox.oreilly.com.tw rox sun.oreilly.com.tw sun /etc/hosts Ctrl-S 11.2 SMB Server Message Block CIFS Common Internet File System NetBIOS LanManager SMB Andrew Tridgell SMB SMB OS/2 Netware Unix PC

5 235 America 15,000 Hewlett-Packard 7,000 Bank of nmbd smbd /etc/samba/smbusers /etc/samba/smb.conf /etc/samba/lmhosts smbusers administrator admin root lmhosts /etc/hosts smb.conf smbusers lmhosts smb.conf / server configuration tool 11-3 Fedora CD/DVD system-config-samba server /etc/samba/smb.conf smb.conf RedHat GUI 11-4

6 236

7 237 smb.conf man mygroup

8 238 ADS ADS server ADS Active Directory Services Kerberos Kerberos Kerberos ADS ADS controller NetBIOS domain

9 239 NetBIOS server... Guest Unix Unix Unix

10 240 Unix Unix

11 241 Unix Unix 11-8 / 11-9

12 Ctrl-3 runlevel 3 smb Ctrl-5 runlevel 5 smb server runlevel smb smb runlevel server

13 server share \\server\share

14 244 Internet /usr/share/doc/samba-*/docs/htmldocs diagnosis.html diagnosis.html server comp.protocols.smb Using Robert Eckstein David Collier-Brown Peter Kelly Open Publication License OPL /etc/samba/smb.conf # cp /etc/samba/smb.conf /etc/samba/smb.conf.bak /etc/samba/smb.conf # cp /etc/samba/smb.conf.bak /etc/samba/smb.conf smb # service smb restart

15 245 OS/2 Mac OS Mac OS X SMB SMB IBM Microsoft 3.11/9x/Me/NT/2000/XP/2003 SMB 2000/XP server server workgroup server server server server 2000/XP \\server\sharename server sharename SERVER pub \\SERVER\pub \\SERVER\lp \\SERVER\pub

16 246 SMB smbclient SMB server $ smbclient -L localhost server SMB server localhost NetBIOS $ smbclient -L server server server -U server $ smbclient -L server -U userid SMB $ smbclient 'service' -U userid service SMB userid SMB // / $ smbclient //server/myshare -U billmccarty \ / \\server\myshare smbclient \\server\myshare //server/myshare SMB smb: dir smbclient dir SMB dir ls smb: \> dir

17 247 smb: \> ls cd smb: \> cd dir dir dir.. smb: \> cd.. smb: \> get lename get SMB smb: \> put local_lename put smbclint help smb: \> help? altname archive blocksize cancel case_sensitive cd chmod chown del dir du exit get hardlink help history lcd link lowercase ls mask md mget mkdir more mput newer open print printmode prompt put pwd q queue quit rd recurse reget rename reput rm rmdir setmode symlink tar tarmode translate vuid logon! help command smb: \> help lcd HELP lcd: [directory] change/report the local current working directory exit quit smbclient shell smbprint script smbprint smbprint Using

18 248 smbclient smbclient smbclient NetBIOS winhost work bill ~]$ smbclient '//winhost/work' -U bill Password: Domain=[WINHOST] OS=[ 5.0] Server=[ 2000 LAN Manager] smb: \> SMB cd tar smb: \> cd data smb: \data\> tar c backup.tar SMB tar shell tar c create backup.tar backup.tar.tar... cd smb: \> cd data smb: \data\> tar x backup.tar tar c x extract backup.tar SMB server 11.3 Internet Internet

19 / httpd mod_ssl system-confighttpd Fedora Core 3 /etc/httpd/conf access.conf httpd.conf srm.conf httpd.conf HTTP HTTP 11-11

20 250 HTTP domain.com Webmaster DNS Webmaster port virtual hosting HTTP 1.1 HTTP 1.0 HTTP server

21 251

22 runlevel runlevel httpd FireFox DNS /etc/hosts 2000 C:\WINNT\system32\drivers\etc\hosts DNS

23 HTML document root /var/www/html root root URL request domain.com index.html public_html /home/joe/public_html joe joe ~

24 254 /etc/httpd/conf/httpd.conf UserDir disable UserDir enable all HTTP HTTP httpd.conf httpd.conf HTTP all UserDir enable bill joe andyoram httpd.conf httpd server apache apache /home/joe/public_html apache apache /home /home/joe /home/joe/public_html /home/joepublic/public_html /home 755 /home/joe 711 /home/joe/public_html 755 /home/joe/public_html 755 /home/joe/public_html

25 SSH SSH Secure Shell TCP/ shell SSH Telnet SSH SSH SSH runlevel 3 5 sshd sshd runlevel sshd SSH sshd SSH /etc/ssh SSH SSH [bill@linux ~]$ ssh localhost The authenticity of host 'localhost ( )' can't be established. RSA key ngerprint is c0:e2:fe:8d:09:d8:e8:62:6b:36:60:b8:98:de:3f:e2. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'localhost' (RSA) to the list of known hosts. bill@localhost's password: [bill@linux ~]$ exit Connection to localhost closed.

26 256 ssh RSA yes ssh localhost ssh ssh bill shell ssh sshd exit SSH ssh ssh ssh userid@host userid host [bill@moon ~]$ ssh [email protected] lin@carbon's password: lin [lin@carbon ~]$ RSA exit logout moon carbon ssh carbon SSH scp SSH $ scp le userid@host:destination file host destination file userid destination destination $ scp rhbook_rev.txt [email protected]:rhle rhbook_rev.txt example.com /home/bill rhfile destination shell *? scp scp -r Desktop newdesktop $ scp -r Desktop [email protected]:newdesktop newdesktop

27 257 $ scp userid@host:path localle host path localfile userid $ scp [email protected]:/out/ch11.doc myle bill author.example.com /out ch11.doc myfile myfile SSH sftp ftp ftp sftp $ sftp userid@host SSH sftp ftp sftp author.example.com $ sftp bill@dhcp195 Connecting to dhcp bill@dhcp195's password: bill sftp> ls Desktop FC3_Snapshots backup.tar les refox-1.0.installer.tar.gz logs sftp> get backup.tar Fetching /home/bill/backup.tar to backup.tar /home/bill/backup.tar 25% 18MB 1.6MB/s 00:32 ETA FTP help sftp sftp> help Available commands: cd path Change remote directory to 'path' lcd path Change local directory to 'path' chgrp grp path Change group of le 'path' to 'grp' chmod mode path Change permissions of le 'path' to 'mode' chown own path Change owner of le 'path' to 'own' help Display this help text get remote-path [local-path] Download le lls [ls-options [path]] Display local directory listing ln oldpath newpath Symlink remote le lmkdir path Create local directory

28 258 lpwd Print local working directory ls [path] Display remote directory listing lumask umask Set local umask to 'umask' mkdir path Create remote directory progress Toggle display of progress meter put local-path [remote-path] Upload le pwd Display remote working directory exit Quit sftp quit Quit sftp rename oldpath newpath Rename remote le rmdir path Remove remote directory rm path Delete remote le symlink oldpath newpath Symlink remote le version Show SFTP version!command Execute 'command' in local shell! Escape to local shell? Synonym for help SSH ssh SSH Simon Tatham PuTTY SSH Google "putty" PuTTY putty.exe windows putty.exe $PATH putty PuTTY PuTTY Hostname SSH putty.exe PuTTY

29 259 Protocol SSH PuTTY Port 22 SSH SSH port 22 Port Save Saved Sessions Open PuTTY PuTTY SSH WinSCP SCP SFTP GUI WinSCP WinSCP

30 TCP wrapper TCP SSH SSH sshd sshd SSH runlevel SSH TCP wrapper SSH TCP Wrapper TCP SSH /etc/hosts.deny /etc/hosts.allow /etc/hosts.allow TCP /etc/hosts.deny TCP /etc/hosts.allow # # hosts.allow This le describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. #

31 261 TCP /etc/hosts.allow sshd: sshd / /etc/hosts.allow /etc/hosts.deny /etc/hosts.deny # # hosts.deny This le describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! sshd: ALL protmap line /etc/hosts.deny sshd TCP wrapper TCP /etc/services TCP /etc/hosts.allow ftp /24 # /etc/hosts.allow ftp: # /etc/hosts.deny ftp: ALL TCP TCP TCP wrapper UDP

32 Internet firewall TCP wrapper TCP UDP ICMP SE SE NSA policy SE

33 263 SELINUX NSA's Open Source Security Enhanced O'Reilly SE Internet Internet iptables iptables iptables runlevel runlevel iptables 11.6 Nmap Nmap Nmap Nmap Nmap Nmap Nmap scan TCP UDP Nmap Nmap / Nmap nmap nmap-frontend

34 264 GNOME KDE Nmap nmap nmapfe Nmap FE Nmap FE nmap X Nmap FE GUI nmap Nmap FE Nmap FE root Nmap FE Scan Discover Timing File Options Scan Target Scan Scan Type Connect Scan Scanned Ports Range Given Below Range Scan Extensions

35 265 Scan Nmap Nmap FE ssh root Enter ISP ISP 11.7 Internet Internet

36 266 Building Internet Firewalls Elizabeth D. Zwicky Simon Cooper D. Brent Chapman Building Secure Servers with Michael D. Bauer Computer Security Basics Deborah Russell G.T. Gangemi, Sr. Security Cookbook Daniel J. Barrett Richard Silverman Robert G. Byrnes Server Hacks Rob Flickenger Practical Unix & Internet Security Simson Garfinkel Gene Spafford Alan Schwartz Red Hat Firewalls Bill McCarty Red Hat Press mailing list CERT Red Hat Network