LAN Internet Unix Microsoft SSH SSH Internet Internet Internet Internet Internet Nmap 231
232 11.5 DHCP DNS Fedora Core DHCP server DHCP server PC DHCP server root root root 11.1 DNS ISP DNS server DNS /etc/hosts DNS /etc/hosts nano /etc/hosts 11-1 / 11-2
233 127.0.0.1 localhost localhost /
234 /etc/hosts hosts 95/98/Me hosts c:\windows\etc\ NT/2000/XP c:\winnt\system32\drivers\etc\hosts C:\ c:\winnt hosts 127.0.0.1 localhost.localdomain localhost 192.168.0.10 rox.oreilly.com.tw rox 192.168.0.9 sun.oreilly.com.tw sun /etc/hosts Ctrl-S 11.2 SMB Server Message Block CIFS Common Internet File System NetBIOS LanManager SMB Andrew Tridgell SMB SMB OS/2 Netware Unix PC
235 http://www.samba.org/pub/samba/survey/ssstats.html America 15,000 Hewlett-Packard 7,000 Bank of 11.2.1 nmbd smbd /etc/samba/smbusers /etc/samba/smb.conf /etc/samba/lmhosts smbusers administrator admin root lmhosts /etc/hosts smb.conf smbusers lmhosts smb.conf / server configuration tool 11-3 Fedora CD/DVD system-config-samba - 11.2.2 server /etc/samba/smb.conf smb.conf RedHat GUI 11-4
236
237 smb.conf man mygroup 11-5 11-6
238 ADS ADS server ADS Active Directory Services Kerberos Kerberos Kerberos ADS ADS controller NetBIOS domain
239 NetBIOS 98 98 3.1 95 server... Guest 11-7 11-7 Unix Unix Unix
240 Unix Unix
241 Unix Unix 11-8 / 11-9
242 11.2.3 Ctrl-3 runlevel 3 smb Ctrl-5 runlevel 5 smb server runlevel smb smb runlevel server
243 11.2.4 server share \\server\share
244 Internet /usr/share/doc/samba-*/docs/htmldocs diagnosis.html diagnosis.html server comp.protocols.smb Using Robert Eckstein David Collier-Brown Peter Kelly Open Publication License OPL http://www.oreilly.com/catalog/samba /etc/samba/smb.conf # cp /etc/samba/smb.conf /etc/samba/smb.conf.bak /etc/samba/smb.conf # cp /etc/samba/smb.conf.bak /etc/samba/smb.conf smb # service smb restart 11.2.5
245 OS/2 Mac OS Mac OS X SMB 11.2.4 SMB IBM Microsoft 3.11/9x/Me/NT/2000/XP/2003 SMB 2000/XP server server workgroup server server server server 2000/XP \\server\sharename server sharename SERVER pub \\SERVER\pub \\SERVER\lp \\SERVER\pub 11.2.4
246 SMB smbclient SMB server $ smbclient -L localhost server SMB server localhost NetBIOS $ smbclient -L server server server -U server $ smbclient -L server -U userid SMB $ smbclient 'service' -U userid service SMB userid SMB // / $ smbclient //server/myshare -U billmccarty \ / \\server\myshare smbclient \\server\myshare //server/myshare SMB smb: dir smbclient dir SMB dir ls smb: \> dir
247 smb: \> ls cd smb: \> cd dir dir dir.. smb: \> cd.. smb: \> get lename get SMB smb: \> put local_lename put smbclint help smb: \> help? altname archive blocksize cancel case_sensitive cd chmod chown del dir du exit get hardlink help history lcd link lowercase ls mask md mget mkdir more mput newer open print printmode prompt put pwd q queue quit rd recurse reget rename reput rm rmdir setmode symlink tar tarmode translate vuid logon! help command smb: \> help lcd HELP lcd: [directory] change/report the local current working directory exit quit smbclient shell smbprint script smbprint smbprint Using
248 smbclient smbclient smbclient NetBIOS winhost work bill [bill@linux ~]$ smbclient '//winhost/work' -U bill Password: Domain=[WINHOST] OS=[ 5.0] Server=[ 2000 LAN Manager] smb: \> SMB cd tar smb: \> cd data smb: \data\> tar c backup.tar SMB tar shell tar c create backup.tar backup.tar.tar... cd smb: \> cd data smb: \data\> tar x backup.tar tar c x extract backup.tar SMB server 11.3 Internet Internet
249 11.3.1 / httpd mod_ssl system-confighttpd 11.3.2 Fedora Core 3 /etc/httpd/conf access.conf httpd.conf srm.conf httpd.conf HTTP HTTP 11-11
250 HTTP domain.com Webmaster www.domain.com DNS Webmaster port 80 11-12 virtual hosting http://www.myfirstsite.com http://www.myothersite.com HTTP 1.1 HTTP 1.0 HTTP 1.0 11-13 server 11-14 150 15
251
252 http://httpd.apache.org/docs-2.0 11.3.3 runlevel runlevel httpd FireFox http://localhost/ 11-15 http://myweb.mydomain http://192.168.102.33 DNS /etc/hosts 2000 C:\WINNT\system32\drivers\etc\hosts DNS
253 11.3.4 HTML document root /var/www/html root root http://www.domain.com URL request domain.com index.html public_html /home/joe/public_html http://www.domain.com/~joe joe joe ~
254 /etc/httpd/conf/httpd.conf UserDir disable UserDir enable all HTTP HTTP httpd.conf httpd.conf HTTP all UserDir enable bill joe andyoram httpd.conf httpd server apache apache /home/joe/public_html apache apache /home /home/joe /home/joe/public_html /home/joepublic/public_html 11-1 11-1 /home 755 /home/joe 711 /home/joe/public_html 755 /home/joe/public_html 755 /home/joe/public_html 644 11-1
255 11.4 SSH SSH Secure Shell TCP/ shell SSH Telnet SSH 11.4.1 SSH SSH runlevel 3 5 sshd sshd runlevel sshd SSH sshd SSH /etc/ssh 11.4.2 SSH SSH [bill@linux ~]$ ssh localhost The authenticity of host 'localhost (127.0.0.1)' can't be established. RSA key ngerprint is c0:e2:fe:8d:09:d8:e8:62:6b:36:60:b8:98:de:3f:e2. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'localhost' (RSA) to the list of known hosts. bill@localhost's password: [bill@linux ~]$ exit Connection to localhost closed.
256 ssh RSA yes ssh localhost ssh ssh bill shell ssh sshd exit SSH ssh ssh localhost @ email ssh userid@host userid host [bill@moon ~]$ ssh lin@carbon.oreilly.com.tw lin@carbon's password: lin [lin@carbon ~]$ RSA exit logout moon carbon ssh carbon SSH scp SSH $ scp le userid@host:destination file host destination file userid destination destination $ scp rhbook_rev.txt bill@example.com:rhle rhbook_rev.txt example.com /home/bill rhfile destination shell *? scp scp -r Desktop newdesktop $ scp -r Desktop bill@example.com:newdesktop newdesktop
257 $ scp userid@host:path localle host path localfile userid $ scp bill@author.example.com:/out/ch11.doc myle bill author.example.com /out ch11.doc myfile myfile SSH sftp ftp ftp sftp $ sftp userid@host SSH sftp ftp sftp author.example.com $ sftp bill@dhcp195 Connecting to dhcp195... bill@dhcp195's password: bill sftp> ls Desktop FC3_Snapshots backup.tar les refox-1.0.installer.tar.gz logs sftp> get backup.tar Fetching /home/bill/backup.tar to backup.tar /home/bill/backup.tar 25% 18MB 1.6MB/s 00:32 ETA FTP help sftp sftp> help Available commands: cd path Change remote directory to 'path' lcd path Change local directory to 'path' chgrp grp path Change group of le 'path' to 'grp' chmod mode path Change permissions of le 'path' to 'mode' chown own path Change owner of le 'path' to 'own' help Display this help text get remote-path [local-path] Download le lls [ls-options [path]] Display local directory listing ln oldpath newpath Symlink remote le lmkdir path Create local directory
258 lpwd Print local working directory ls [path] Display remote directory listing lumask umask Set local umask to 'umask' mkdir path Create remote directory progress Toggle display of progress meter put local-path [remote-path] Upload le pwd Display remote working directory exit Quit sftp quit Quit sftp rename oldpath newpath Rename remote le rmdir path Remove remote directory rm path Delete remote le symlink oldpath newpath Symlink remote le version Show SFTP version!command Execute 'command' in local shell! Escape to local shell? Synonym for help 11.4.3 SSH ssh SSH Simon Tatham PuTTY SSH http://www.chiark.greenend.org.uk/~sgtatham/putty/ Google "putty" PuTTY putty.exe windows putty.exe $PATH putty 11-16 PuTTY PuTTY Hostname SSH putty.exe http://www.csie.ntu.edu.tw/~piaip/prjs/pputty/ http://beta.wsl.sinica.edu.tw/~ylchang/putty/ PuTTY
259 Protocol SSH PuTTY Port 22 SSH SSH port 22 Port Save Saved Sessions Open PuTTY PuTTY SSH WinSCP SCP SFTP GUI 11-17 WinSCP WinSCP http://winscp.sourceforge.net/eng
260 11.4.4 TCP wrapper TCP SSH SSH sshd sshd SSH runlevel SSH TCP wrapper SSH TCP Wrapper TCP SSH /etc/hosts.deny /etc/hosts.allow /etc/hosts.allow TCP /etc/hosts.deny TCP /etc/hosts.allow # # hosts.allow This le describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. #
261 TCP /etc/hosts.allow sshd: 127.0.0.1 1.2.3.4 1.2.3.5 1.2.4. sshd 127.0.0.1 1.2.3.4 1.2.3.5 1.2.4.0/24 1.2.4.0 1.2.4.255 127.0.0.1 /etc/hosts.allow /etc/hosts.deny /etc/hosts.deny # # hosts.deny This le describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # # The portmap line is redundant, but it is left to remind you that # the new secure portmap uses hosts.deny and hosts.allow. In particular # you should know that NFS uses portmap! sshd: ALL protmap line /etc/hosts.deny sshd TCP wrapper TCP /etc/services TCP /etc/hosts.allow ftp 192.168.100.0/24 # /etc/hosts.allow ftp: 192.168.100. # /etc/hosts.deny ftp: ALL TCP TCP TCP wrapper UDP
262 11.5 Internet firewall TCP wrapper TCP UDP ICMP 11.5.1 11-18 SE SE NSA policy SE
263 SELINUX NSA's Open Source Security Enhanced O'Reilly SE Internet Internet 11.5.2 iptables iptables iptables runlevel runlevel 2 3 4 5 iptables 11.6 Nmap Nmap Nmap Nmap Nmap http://www.insecure.org/ Nmap Nmap scan TCP UDP Nmap Nmap / Nmap nmap nmap-frontend
264 GNOME KDE Nmap nmap nmapfe Nmap FE Nmap FE nmap X Nmap FE GUI nmap 11-19 Nmap FE Nmap FE root Nmap FE Scan Discover Timing File Options Scan Target 127.0.0.1 Scan Scan Type Connect Scan Scanned Ports Range Given Below Range 1-1023 Scan Extensions
265 Scan Nmap 11-19 Nmap FE ssh root 127.0.0.1 Enter 1-1023 1024 1024 ISP ISP 11.7 Internet Internet
266 Building Internet Firewalls Elizabeth D. Zwicky Simon Cooper D. Brent Chapman Building Secure Servers with Michael D. Bauer Computer Security Basics Deborah Russell G.T. Gangemi, Sr. Security Cookbook Daniel J. Barrett Richard Silverman Robert G. Byrnes Server Hacks Rob Flickenger Practical Unix & Internet Security Simson Garfinkel Gene Spafford Alan Schwartz Red Hat Firewalls Bill McCarty Red Hat Press mailing list http://www.cert.org CERT Red Hat Network