linux 防火墙设置案例

公司的服务器是linux系统，之前有被黑了一台，于是，新的服务器需要做安全的相关设置，做iptables的设置的时候，特别要注意的是，ssh的远端链接一定要开放，否者一旦启用防火墙，ssh不能连接就悲剧了。这里做个小结，设置iptables的相关注意事项：

1。一定要开放ssh端口

2。默认策略都是ACCEPT，将ssh端口开放，不要重启iptables

3。设置需要的策略，将默认策略设置为DROP

4。重启iptables

5。备份iptables的策略

示例策略：只做了INPUT 一条链路的策略

[XXX]# iptables -L

Chain INPUT (policy DROP)

target     prot opt source               destination         

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     all  --  anywhere             anywhere            

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:21010:21021

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:22010:22021

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:24010:24021

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:microsan:20006

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:7111:7112

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:virprot-lm:7122

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:7131:7132

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

设置之后，第二天查看日志情况，明显日志安静多了！

----------------------------------------------------------------------------

Dec 14 17:10:08 XXX sshd[21453]: pam_unix(sshd:session): session closed for user root

Dec 14 17:15:07 XXX sshd[21667]: Accepted password for root from 58.48.146.159 port 17405 ssh2

Dec 14 17:15:07 XXX sshd[21667]: pam_unix(sshd:session): session opened for user root by (uid=0)

Dec 14 17:15:07 XXX sshd[21667]: subsystem request for sftp

Dec 14 17:15:39 XXX sshd[21667]: pam_unix(sshd:session): session closed for user root

Dec 14 18:06:59 XXX sshd[22059]: Accepted password for root from 58.49.183.219 port 18309 ssh2

Dec 14 18:06:59 XXX sshd[22059]: pam_unix(sshd:session): session opened for user root by (uid=0)

Dec 14 18:07:03 XXX sshd[22059]: Received disconnect from 58.49.183.219: 0:

Dec 14 18:07:03 XXX sshd[22059]: pam_unix(sshd:session): session closed for user root

Dec 14 19:53:19 XXX sshd[20634]: pam_unix(sshd:session): session closed for user root

Dec 14 20:05:44 XXX sshd[20616]: pam_unix(sshd:session): session closed for user root

Dec 14 20:05:49 XXX sshd[19055]: pam_unix(sshd:session): session closed for user root

Dec 14 22:54:55 XXX sshd[22316]: Connection closed by 167.114.76.146

Dec 15 00:43:13 XXX sshd[22394]: refused connect from 116.31.116.34 (116.31.116.34)

Dec 15 06:04:09 XXX sshd[22893]: refused connect from 116.31.116.34 (116.31.116.34)

Dec 15 06:16:26 XXX sshd[22896]: Did not receive identification string from 169.54.233.121

Dec 15 07:21:33 XXX sshd[22927]: Did not receive identification string from 223.30.110.130

Dec 15 08:17:39 XXX sshd[22985]: Connection closed by 14.161.20.53

Dec 15 09:06:07 XXX sshd[23012]: Accepted password for root from 58.49.183.219 port 2046 ssh2

Dec 15 09:06:07 XXX sshd[23012]: pam_unix(sshd:session): session opened for user root by (uid=0)

Dec 15 09:09:52 XXX sshd[23035]: Accepted password for root from 58.49.183.219 port 2274 ssh2

Dec 15 09:09:52 XXX sshd[23035]: pam_unix(sshd:session): session opened for user root by (uid=0)

Dec 15 09:09:52 XXX sshd[23035]: subsystem request for sftp

Dec 15 09:10:44 XXX sshd[23035]: subsystem request for sftp

Dec 15 09:11:47 XXX sshd[23035]: pam_unix(sshd:session): session closed for user root