Linux Administrator (Advance) Mr.Kriangsak Namkot Trainer & Director Jodoi IT&Service Co.,Ltd. jodoi@jodoi.com jodoi1819@hotmail.com http://www.jodoi.com Linux Administrator I Day 1 9.00 10.30 - Samba Server ( File Server ) 10.30 10.45 - Coffee Break 10.45 12.00 - Samba Server ( File Server ) 12.00 13.00 - Lunch 13.00 14.30 - Iptables 14.30 14.45 - Coffee Break 14.45 16.00 - Iptables & Internet Gateway 1
Samba Server samba - A Windows SMB/CIFS fileserver for UNIX The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS). For a more thorough description, see http://www.ubiqx.org/cifs/. Samba also implements the NetBIOS protocol in nmbd. smbd - server to provide SMB/CIFS services to clients # rpm -q samba samba-3.0.33-3.29.el5_5.1 # yum install samba Or How to Compile Samba http://www.samba.org/samba/docs/man/samba-howto- Collection/compiling.html # vi /etc/samba/smb.conf Samba Server 2
Samba Server [root@doiserver named]# vi /etc/samba/smb.conf ~ workgroup = MYGROUP server string = Samba Server # ---------------- Standalone Server Options ------------- # security = user # passdb backend = tdbsam security = share ; hosts allow = 192.168.1. 192.168.2. 127. hosts allow = 192.168.1. 127. ; interfaces = 192.168.12.2/24 192.168.13.2/24 interfaces = 192.168.1.212/24 Samba Server [public] comment = Public Stuff path = /samba public = yes writable = yes printable = no write list = @staff :wq! [root@jodoi-server ~]# /etc/init.d/smb restart [root@jodoi-server ~]# service smb restart 3
Samba Server [root@jodoi-server ~]# netstat -anp grep smb tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 2719/smbd tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 2719/smbd [root@jodoi-server ~]# netstat -anp grep nmb udp 0 0 192.168.1.212:137 0.0.0.0:* 2723/nmbd udp 0 0 0.0.0.0:137 0.0.0.0:* 2723/nmbd udp 0 0 192.168.1.212:138 0.0.0.0:* 2723/nmbd udp 0 0 0.0.0.0:138 0.0.0.0:* 2723/nmbd [root@jodoi-server ~]# ps -ef grep smb root 2719 1 0 08:29? 00:00:00 smbd -D root 2720 2719 0 08:29? 00:00:00 smbd -D Samba Server [root@jodoi-server /]# cd / [root@jodoi-server /] # mkdir samba [root@jodoi-server /]# chmod -fr samba/ [root@jodoi-server /]# chmod -fr 777 samba/ Test on PC 4
Samba Server Test on PC # vi /etc/samba/smb.conf [...] security = user passdb backend = tdbsam [...] #smbpasswd -a user Samba Server # /etc/init.d/smb restart Shutting down SMB services: [ OK ] Shutting down NMB services: [ OK ] Starting SMB services: [ OK ] Starting NMB services: [ OK ] 5
In GUI Samba Server In GUI Samba Server 6
Samba Server iptables - administration tool for IPv4 packet filtering and NAT Option -t, --table table -L, --list [chain] -n, --numeric -A, --append chain rule-specification -D, --delete chain rule-specification -I, --insert chain [rulenum] rule-specification -F, --flush [chain] deleting all the rules one by one -P, --policy chain target 7
Option -p, --protocol [!] protocol -s, --source [!] address[/mask] -d, --destination [!] address[/mask] -j, --jump target -i, --in-interface [!] name -o, --out-interface [!] name Reading iptables rules # iptables -L n # iptables-save # vi /etc/sysconfig/iptables [root@jodoi-server ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain RH-Firewall-1-INPUT (2 references) 8
[root@jodoi-server ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination 9
TABLES in IPTABLES [1] filter [2] nat # iptables -t filter -L n # iptables -t nat -L n ERASE existing ruleset # iptables -F INPUT # iptables -F OUTPUT set defaut policy # iptables -P INPUT DROP # iptables -P OUTPUT ACCEPT set stateful connection tracking (allow REPLY to come back) # iptables -P INPUT DROP # iptables -P OUTPUT ACCEPT # ping 192.168.1.254 # iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # ping 192.168.1.254 10
Ex.1 SELECTIVELY PERMIT some connection e.g. TCP/22 from 192.168.1.0/24 LIST the following information [0] FROM WHAT INTERFACE? ( eth0 ) [1] FROM WHAT IP? ( 192.168.1.0/24 ) [2] TO WHICH PROTOCOL? ( TCP ) [3] TO WHICH PORT? ( 22 ) # iptables -A INPUT -i eth0 -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT Ex. 2 SELECTIVELY PERMIT some connection e.g. TCP/80 from 192.168.1.0/24 LIST the following information [0] FROM WHAT INTERFACE? ( eth0 ) [1] FROM WHAT IP? ( any ) [2] TO WHICH PROTOCOL? ( TCP ) [3] TO WHICH PORT? ( 80,443 ) # iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT # iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT 11
Ex. 3 Block web hi5 # iptables -A FORWARD -i eth0 -d 66.218.161.68 -j DROP # iptables -A FORWARD -i eth0 -d 66.218.161.133 -j DROP # iptables -A FORWARD -i eth0 -d 66.218.161.6 -j DROP Internet Gateway Server 1. enable IP Forward [root@jodoi-server ~]# vi /etc/sysctl.conf ~ # Controls IP packet forwarding net.ipv4.ip_forward = 1 ( 0 is disabled, 1 is enabled) ~ :wq! [root@doiserver root]# service network restart [root@doiserver root]# cat /proc/sys/net/ipv4/ip_forward 1 12
Internet Gateway Server 2. Disable Firewall [root@doiserver root]# setup Internet Gateway Server 3. Set group IP can Forward Packet [root@doiserver root]# iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT [root@doiserver root]# iptables -A FORWARD -d 192.168.1.0/24 -j ACCEPT [root@doiserver root]# iptables -A FORWARD -j DROP [root@doiserver root]# service iptables save [root@doiserver root]# service iptables restart or # vi /etc/sysconfig/iptables Ex Config NAT # iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 203.222.222.222 13
Internet Gateway Server Lab Test IP tabless 1. Client can not open www.manager.co.th and www.jodoi.com and can not ping to any IP 2. Outside can ping, use web, samba, ssh and webmin 14