linux中如何限制IP访问服务器

最新推荐文章于 2024-05-22 13:32:09 发布

转载最新推荐文章于 2024-05-22 13:32:09 发布 · 1.7w 阅读

Linux 专栏收录该内容

32 篇文章

订阅专栏

本文介绍如何通过配置Linux的hosts.allow与hosts.deny文件实现精确的远程访问控制，并展示了在AIX系统中利用IP安全过滤规则进行访问权限管理的方法。

http://purpen.iteye.com/blog/1135342

==============================Linux===========================

hosts.allow与hosts.deny两个文件均在/etc/目录下，优先级为先检查hosts.deny，再检查hosts.allow，后者设定可越过前者限制。

例如：
1.限制所有的ssh，
除非从218.64.87.0——127

vi /etc/hosts.deny
hosts.deny:
in.sshd:ALL

-------------------------------------------------

vi /etc/hosts.allow
hosts.allow:
in.sshd:218.64.87.0/255.255.255.128
in.sshd:218.64.88.10
---------------------------------
hosts.allow:
ALL:192.100.248.247

2.封掉218.64.87.0——127的telnet
hosts.deny:
in.sshd:218.64.87.0/255.255.255.128

3.限制所有人的TCP连接，除非从218.64.87.0——127访问
hosts.deny:
ALL:ALL

hosts.allow:
ALL:218.64.87.0/255.255.255.128

4.限制218.64.87.0——127对所有服务的访问
hosts.deny
ALL:218.64.87.0/255.255.255.128

其中冒号前面是TCP daemon的服务进程名称，通常系统进程在/etc/inetd.conf中指定，比如in.ftpd，in.telnetd，in.sshd

其中IP地址范围的写法有若干中，主要的三种是：
1.网络地址——子网掩码方式：
218.64.87.0/255.255.255.0

2.网络地址方式（我自己这样叫，呵呵）
218.64.（即以218.64打头的IP地址）

3.缩略子网掩码方式，既数一数二进制子网掩码前面有多少个“1”比如：
218.64.87.0/255.255.255.0《====》218.64.87.0/24
______________________________
设置好后，要重新启动
# /etc/rc.d/init.d/xinetd restart
# /etc/rc.d/init.d/network restart

==============================AIX============================

1.增加一个过滤规则以允许接受从10.152.129.49发来的ftp请求：
# smitty ipsec4---> Advanced IP Security Configuration------> Configure IP Security Filter Rules---------> Add an IP Security Filter Rule ->Add an IP Security Filter Rule
* Rule Action -----------------------------------[permit] +
* IP Source Address -----------------------------[10.152.129.49]
* IP Source Mask --------------------------------[255.255.255.255]
IP Destination Address --------------------------[]
IP Destination Mask ---------------------------- []
* Apply to Source Routing? (PERMIT/inbound only) [yes]+
* Protocol --------------------------------------[all]+
* Source Port / ICMP Type Operation -------------[any]+
* Source Port Number / ICMP Type ----------------[0] #
* Destination Port / ICMP Code Operation --------[eq]+
* Destination Port Number / ICMP Type -----------[21] #
* Routing ---------------------------------------[both] +
* Direction -------------------------------------[both]+
* Log Control -----------------------------------[no]+
* Fragmentation Control -------------------------[0]+
* Interface -------------------------------------[all] +
其他缺省值
2. 增加另一个过滤规则以拒绝其它所有向10.110.157.151发出的ftp请求：
Add an IP Security Filter Rule
* Rule Action -----------------------------------[deny]+
* IP Source Address -----------------------------[0.0.0.0]
* IP Source Mask --------------------------------[0.0.0.0]—
IP Destination Address ------------------------[10.110.157.151]—
IP Destination Mask ---------------------------[255.255.255.255] *
Apply to Source Routing? (PERMIT/inbound only) [yes] +
* Protocol --------------------------------------[all]+
* Source Port / ICMP Type Operation -------------[any] +
* Source Port Number / ICMP Type ----------------[0] #
* Destination Port / ICMP Code Operation --------[eq]+
* Destination Port Number / ICMP Type -----------[21]#
* Routing ---------------------------------------[both]+
* Direction -------------------------------------[both]+
* Log Control -----------------------------------[no] +
* Fragmentation Control ------------------------ [all packets]+
* Interface ------------------------------------ [all] +

2. 激活设置的过滤规则：
# smitty ipsec4---> Advanced IP Security Configuration----> Activate/Update/Deactivate IP ---->Security Filter Rule ---------> Activate / Update

3. 上面的操作进行完后，用户将只能从10.152.129.49 ftp至 10.110.157.151，任何其它机器试图ftp至10.110.157.151的操作将失败。