7.6. Protecting a Host

最新推荐文章于 2022-05-23 00:18:53 发布

转载最新推荐文章于 2022-05-23 00:18:53 发布 · 517 阅读

文章标签：

#application #tcp #layer #network #ssh #system

转《Guide To IP Layer Network Administration With Linux Version 0.4.4》专栏收录该内容

48 篇文章

订阅专栏

本文探讨了传统的主机保护方式，包括使用libwrap验证连接请求，并通过配置文件实现允许或拒绝连接的功能。此外，还介绍了如何利用iptables阻止特定目的地的连接请求，并通过REJECT目标拒绝连接。

7.6. Protecting a Host

Host protection in the past was typically performed with application layer checks on the originating IP or hostname. This was (and still is) frequently accomplished with libwrap, which verifies whether or not to allow a connection based on the contents of the system wide configuration files /etc/hosts.allow and /etc/hosts.deny.

Host protection is one part of protecting a host, by preventing inbound packets from reaching higher layers. This is no substitute for tight application layer security. Strong network and host-level packet filters mitigate a host's exposure when it is connected to a network.

Example 7.1. Blocking a destination and using the REJECT target, cf. Example D.17, “Adding a prohibit route with route add”

[root@masq-gw]# iptables -I FORWARD -p tcp -d 209.10.26.51 --dport 22 -j REJECT
[root@tristan]# ssh 209.10.26.51
ssh: connect to address 209.10.26.51 port 22: Connection refused
[root@masq-gw]# tcpdump -nnq -i eth2
tcpdump: listening on eth2
22:16:59.111947 192.168.99.35.51991 > 209.10.26.51.22: tcp 0 (DF)
22:16:59.112270 192.168.99.254 > 192.168.99.35: icmp: 209.10.26.51 tcp port 22 unreachable (DF) [tos 0xc0]