快捷導(dǎo)航

阿里云linux服務(wù)器上使用iptables設(shè)置安全策略的方法

更新時(shí)間：2016年10月15日 22:52:29 作者：netingcn

這篇文章主要介紹了阿里云linux服務(wù)器上使用iptables設(shè)置安全策略的方法,需要的朋友可以參考下

公司的產(chǎn)品一直運(yùn)行在云服務(wù)器上，從而有幸接觸過(guò)aws的ec2，盛大的云服務(wù)器，最近準(zhǔn)備有使用阿里云的彈性計(jì)算（云服務(wù)器）。前兩種云服務(wù)器在安全策略這塊做的比較好，提供簡(jiǎn)單明了的配置界面，而且給了默認(rèn)的安全策略，反觀阿里云服務(wù)器，安全策略需要自己去配置，甚至centos機(jī)器上都沒(méi)有預(yù)裝iptables（起碼我們申請(qǐng)兩臺(tái)上都沒(méi)有），算好可以使用yum來(lái)安裝，安裝命令如下：

yum install -y iptables

iptables安裝好后就可以來(lái)配置規(guī)則了。由于作為web服務(wù)器來(lái)使用，所以對(duì)外要開(kāi)放 80 端口，另外肯定要通過(guò)ssh進(jìn)行服務(wù)器管理，22 端口也要對(duì)外開(kāi)放，當(dāng)然最好是把ssh服務(wù)的默認(rèn)端口改掉，在公網(wǎng)上會(huì)有很多人試圖破解密碼的，如果修改端口，記得要把該端口對(duì)外開(kāi)發(fā)，否則連不上就悲劇了。下面提供配置規(guī)則的詳細(xì)說(shuō)明：

第一步：清空所有規(guī)則

當(dāng)Chain INPUT (policy DROP)時(shí)執(zhí)行/sbin/iptables -F后，你將和服務(wù)器斷開(kāi)連接
所有在清空所有規(guī)則前把policy DROP該為INPUT，防止悲劇發(fā)生，小心小心再小心
/sbin/iptables -P INPUT ACCEPT
清空所有規(guī)則
/sbin/iptables -F
/sbin/iptables -X
計(jì)數(shù)器置0
/sbin/iptables -Z

第二步：設(shè)置規(guī)則

允許來(lái)自于lo接口的數(shù)據(jù)包，如果沒(méi)有此規(guī)則，你將不能通過(guò)127.0.0.1訪問(wèn)本地服務(wù)，例如ping 127.0.0.1
/sbin/iptables -A INPUT -i lo -j ACCEPT 

開(kāi)放TCP協(xié)議22端口，以便能ssh，如果你是在有固定ip的場(chǎng)所，可以使用 -s 來(lái)限定客戶端的ip
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT

開(kāi)放TCP協(xié)議80端口供web服務(wù)
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

10.241.121.15是另外一臺(tái)服務(wù)器的內(nèi)網(wǎng)ip，由于之間有通信，接受所有來(lái)自10.241.121.15的TCP請(qǐng)求
/sbin/iptables -A INPUT -p tcp -s 10.241.121.15 -j ACCEPT

接受ping
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

這條規(guī)則參看：http://www.netingcn.com/iptables-localhost-not-access-internet.html
/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

屏蔽上述規(guī)則以為的所有請(qǐng)求，不可缺少，否則防火墻沒(méi)有任何過(guò)濾的功能
/sbin/iptables -P INPUT DROP

可以使用 iptables -L -n 查看規(guī)則是否生效

至此防火墻就算配置好，但是這是臨時(shí)的，當(dāng)重啟iptables或重啟機(jī)器，上述配置就會(huì)被清空，要想永久生效，還需要如下操作：

/etc/init.d/iptables save 
或
service iptables save

執(zhí)行上述命令可以在文件 /etc/sysconfig/iptables 中看到配置

以下提供一個(gè)干凈的配置腳本：

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z

/sbin/iptables -A INPUT -i lo -j ACCEPT 
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -s 10.241.121.15 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -P INPUT DROP

最后執(zhí)行 service iptables save ，先確保ssh連接沒(méi)有問(wèn)題，防止規(guī)則錯(cuò)誤，導(dǎo)致無(wú)法連上服務(wù)器，因?yàn)闆](méi)有save，重啟服務(wù)器規(guī)則都失效，否則就只有去機(jī)房才能修改規(guī)則了。也可以參考：ubuntu iptables 配置腳本來(lái)寫(xiě)一個(gè)腳本。

最后再次提醒，在清空規(guī)則之前一定要小心，確保Chain INPUT (policy ACCEPT)。

腳本之家補(bǔ)充阿里云的linux_drop_port.sh

#!/bin/bash
#########################################
#Function: linux drop port
#Usage:  bash linux_drop_port.sh
#Author:  Customer Service Department
#Company:  Alibaba Cloud Computing
#Version:  2.0
#########################################
 
check_os_release()
{
 while true
 do
 os_release=$(grep "Red Hat Enterprise Linux Server release"/etc/issue 2>/dev/null)
 os_release_2=$(grep "Red Hat Enterprise Linux Server release"/etc/redhat-release 2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep "release 5" >/dev/null2>&1
  then
  os_release=redhat5
  echo "$os_release"
  elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  then
  os_release=redhat6
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 os_release=$(grep "Aliyun Linux release" /etc/issue2>/dev/null)
 os_release_2=$(grep "Aliyun Linux release" /etc/aliyun-release2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep "release 5" >/dev/null2>&1
  then
  os_release=aliyun5
  echo "$os_release"
  elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  then
  os_release=aliyun6
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 os_release=$(grep "CentOS release" /etc/issue 2>/dev/null)
 os_release_2=$(grep "CentOS release" /etc/*release2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep "release 5" >/dev/null2>&1
  then
  os_release=centos5
  echo "$os_release"
  elif echo "$os_release"|grep "release 6">/dev/null 2>&1
  then
  os_release=centos6
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 os_release=$(grep -i "ubuntu" /etc/issue 2>/dev/null)
 os_release_2=$(grep -i "ubuntu" /etc/lsb-release2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep "Ubuntu 10" >/dev/null2>&1
  then
  os_release=ubuntu10
  echo "$os_release"
  elif echo "$os_release"|grep "Ubuntu 12.04">/dev/null 2>&1
  then
  os_release=ubuntu1204
  echo "$os_release"
  elif echo "$os_release"|grep "Ubuntu 12.10">/dev/null 2>&1
  then
  os_release=ubuntu1210
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 os_release=$(grep -i "debian" /etc/issue 2>/dev/null)
 os_release_2=$(grep -i "debian" /proc/version 2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep "Linux 6" >/dev/null2>&1
  then
  os_release=debian6
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 os_release=$(grep "openSUSE" /etc/issue 2>/dev/null)
 os_release_2=$(grep "openSUSE" /etc/*release 2>/dev/null)
 if [ "$os_release" ] && [ "$os_release_2" ]
 then
  if echo "$os_release"|grep"13.1" >/dev/null 2>&1
  then
  os_release=opensuse131
  echo "$os_release"
  else
  os_release=""
  echo "$os_release"
  fi
  break
 fi
 break
 done
}
 
exit_script()
{
 echo -e "\033[1;40;31mInstall $1 error,will exit.\n\033[0m"
 rm-f $LOCKfile
 exit 1
}
 
config_iptables()
{
 iptables -I OUTPUT 1 -p tcp -m multiport --dport21,22,23,25,53,80,135,139,443,445 -j DROP
 iptables -I OUTPUT 2 -p tcp -m multiport --dport 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186-j DROP
 iptables -I OUTPUT 3 -p udp -j DROP
 iptables -nvL
}
 
ubuntu_config_ufw()
{
 ufwdeny out proto tcp to any port 21,22,23,25,53,80,135,139,443,445
 ufwdeny out proto tcp to any port 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186
 ufwdeny out proto udp to any
 ufwstatus
}
 
####################Start###################
#check lock file ,one time only let thescript run one time
LOCKfile=/tmp/.$(basename $0)
if [ -f "$LOCKfile" ]
then
 echo -e "\033[1;40;31mThe script is already exist,please next timeto run this script.\n\033[0m"
 exit
else
 echo -e "\033[40;32mStep 1.No lock file,begin to create lock fileand continue.\n\033[40;37m"
 touch $LOCKfile
fi
 
#check user
if [ $(id -u) != "0" ]
then
 echo -e "\033[1;40;31mError: You must be root to run this script,please use root to execute this script.\n\033[0m"
 rm-f $LOCKfile
 exit 1
fi
 
echo -e "\033[40;32mStep 2.Begen tocheck the OS issue.\n\033[40;37m"
os_release=$(check_os_release)
if [ "X$os_release" =="X" ]
then
 echo -e "\033[1;40;31mThe OS does not identify,So this script isnot executede.\n\033[0m"
 rm-f $LOCKfile
 exit 0
else
 echo -e "\033[40;32mThis OS is $os_release.\n\033[40;37m"
fi
 
echo -e "\033[40;32mStep 3.Begen toconfig firewall.\n\033[40;37m"
case "$os_release" in
redhat5|centos5|redhat6|centos6|aliyun5|aliyun6)
 service iptables start
 config_iptables
 ;;
debian6)
 config_iptables
 ;;
ubuntu10|ubuntu1204|ubuntu1210)
 ufwenable <<EOF
y
EOF
 ubuntu_config_ufw
 ;;
opensuse131)
 config_iptables
 ;;
esac
 
echo -e "\033[40;32mConfig firewallsuccess,this script now exit!\n\033[40;37m"
rm -f $LOCKfile

上述文件下載到機(jī)器內(nèi)部直接執(zhí)行即可。

您可能感興趣的文章: