阿里云windows服務(wù)器安全設(shè)置(防火墻策略)
更新時間：2016年10月15日 22:58:41 投稿：mdxy-dxy
請您根據(jù)您的服務(wù)器操作系統(tǒng)，下載對應(yīng)的腳本運行，運行后您的防火墻策略會封禁對外發(fā)包的行為，確保您的主機不會再出現(xiàn)惡意發(fā)包的情況，為您進(jìn)行后續(xù)數(shù)據(jù)備份操作提供足夠的時間
通過防火墻策略限制對外掃描行為
請您根據(jù)您的服務(wù)器操作系統(tǒng)，下載對應(yīng)的腳本運行，運行后您的防火墻策略會封禁對外發(fā)包的行為，確保您的主機不會再出現(xiàn)惡意發(fā)包的情況，為您進(jìn)行后續(xù)數(shù)據(jù)備份操作提供足夠的時間。
Window2003的批處理文件
@rem 配置windows2003系統(tǒng)的IP安全策略 @rem version 3.0 time:2014-5-12 netsh ipsec static add policy name=drop netsh ipsec static add filterlist name=drop_port netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=21 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=22 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=23 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=25 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=53 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=80 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=135 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=139 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=443 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=445 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=1314 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=1433 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=1521 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=2222 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=3306 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=3433 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=3389 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=4899 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=8080 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any dstport=18186 protocol=TCP mirrored=no netsh ipsec static add filter filterlist=drop_port srcaddr=me dstaddr=any protocol=UDP mirrored=no netsh ipsec static add filteraction name=denyact action=block netsh ipsec static add rule name=kill policy=drop filterlist=drop_port filteraction=denyact netsh ipsec static set policy name=drop assign=y
Window2008的批處理文件
@rem 配置windows2008系統(tǒng)的IP安全策略 @rem version 3.0 time:2014-5-12 @rem 重置防火墻使用默認(rèn)規(guī)則 netsh firewall reset netsh firewall set service remotedesktop enable all @rem 配置高級windows防火墻 netsh advfirewall firewall add rule name="drop" protocol=TCP dir=out remoteport="21,22,23,25,53,80,135,139,443,445,1433,1314,1521,2222,3306,3433,3389,4899,8080,18186" action=block netsh advfirewall firewall add rule name="dropudp" protocol=UDP dir=out remoteport=any action=block
Linux系統(tǒng)腳本
#!/bin/bash
#########################################
#Function: linux drop port
#Usage: bash linux_drop_port.sh
#Author: Customer Service Department
#Company: Alibaba Cloud Computing
#Version: 2.0
#########################################
check_os_release()
{
while true
do
os_release=$(grep "Red Hat Enterprise Linux Server release"/etc/issue 2>/dev/null)
os_release_2=$(grep "Red Hat Enterprise Linux Server release"/etc/redhat-release 2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep "release 5" >/dev/null2>&1
then
os_release=redhat5
echo "$os_release"
elif echo "$os_release"|grep "release 6">/dev/null 2>&1
then
os_release=redhat6
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
os_release=$(grep "Aliyun Linux release" /etc/issue2>/dev/null)
os_release_2=$(grep "Aliyun Linux release" /etc/aliyun-release2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep "release 5" >/dev/null2>&1
then
os_release=aliyun5
echo "$os_release"
elif echo "$os_release"|grep "release 6">/dev/null 2>&1
then
os_release=aliyun6
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
os_release=$(grep "CentOS release" /etc/issue 2>/dev/null)
os_release_2=$(grep "CentOS release" /etc/*release2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep "release 5" >/dev/null2>&1
then
os_release=centos5
echo "$os_release"
elif echo "$os_release"|grep "release 6">/dev/null 2>&1
then
os_release=centos6
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
os_release=$(grep -i "ubuntu" /etc/issue 2>/dev/null)
os_release_2=$(grep -i "ubuntu" /etc/lsb-release2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep "Ubuntu 10" >/dev/null2>&1
then
os_release=ubuntu10
echo "$os_release"
elif echo "$os_release"|grep "Ubuntu 12.04">/dev/null 2>&1
then
os_release=ubuntu1204
echo "$os_release"
elif echo "$os_release"|grep "Ubuntu 12.10">/dev/null 2>&1
then
os_release=ubuntu1210
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
os_release=$(grep -i "debian" /etc/issue 2>/dev/null)
os_release_2=$(grep -i "debian" /proc/version 2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep "Linux 6" >/dev/null2>&1
then
os_release=debian6
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
os_release=$(grep "openSUSE" /etc/issue 2>/dev/null)
os_release_2=$(grep "openSUSE" /etc/*release 2>/dev/null)
if [ "$os_release" ] && [ "$os_release_2" ]
then
if echo "$os_release"|grep"13.1" >/dev/null 2>&1
then
os_release=opensuse131
echo "$os_release"
else
os_release=""
echo "$os_release"
fi
break
fi
break
done
}
exit_script()
{
echo -e "\033[1;40;31mInstall $1 error,will exit.\n\033[0m"
rm-f $LOCKfile
exit 1
}
config_iptables()
{
iptables -I OUTPUT 1 -p tcp -m multiport --dport21,22,23,25,53,80,135,139,443,445 -j DROP
iptables -I OUTPUT 2 -p tcp -m multiport --dport 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186-j DROP
iptables -I OUTPUT 3 -p udp -j DROP
iptables -nvL
}
ubuntu_config_ufw()
{
ufwdeny out proto tcp to any port 21,22,23,25,53,80,135,139,443,445
ufwdeny out proto tcp to any port 1433,1314,1521,2222,3306,3433,3389,4899,8080,18186
ufwdeny out proto udp to any
ufwstatus
}
####################Start###################
#check lock file ,one time only let thescript run one time
LOCKfile=/tmp/.$(basename $0)
if [ -f "$LOCKfile" ]
then
echo -e "\033[1;40;31mThe script is already exist,please next timeto run this script.\n\033[0m"
exit
else
echo -e "\033[40;32mStep 1.No lock file,begin to create lock fileand continue.\n\033[40;37m"
touch $LOCKfile
fi
#check user
if [ $(id -u) != "0" ]
then
echo -e "\033[1;40;31mError: You must be root to run this script,please use root to execute this script.\n\033[0m"
rm-f $LOCKfile
exit 1
fi
echo -e "\033[40;32mStep 2.Begen tocheck the OS issue.\n\033[40;37m"
os_release=$(check_os_release)
if [ "X$os_release" =="X" ]
then
echo -e "\033[1;40;31mThe OS does not identify,So this script isnot executede.\n\033[0m"
rm-f $LOCKfile
exit 0
else
echo -e "\033[40;32mThis OS is $os_release.\n\033[40;37m"
fi
echo -e "\033[40;32mStep 3.Begen toconfig firewall.\n\033[40;37m"
case "$os_release" in
redhat5|centos5|redhat6|centos6|aliyun5|aliyun6)
service iptables start
config_iptables
;;
debian6)
config_iptables
;;
ubuntu10|ubuntu1204|ubuntu1210)
ufwenable <<EOF
y
EOF
ubuntu_config_ufw
;;
opensuse131)
config_iptables
;;
esac
echo -e "\033[40;32mConfig firewallsuccess,this script now exit!\n\033[40;37m"
rm -f $LOCKfile
上述文件下載到機器內(nèi)部直接執(zhí)行即可。
設(shè)置iptables，限制訪問
/sbin/iptables -P INPUT ACCEPT /sbin/iptables -F /sbin/iptables -X /sbin/iptables -Z /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -p tcp --dport 8080 -j ACCEPT /sbin/iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT /sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT /sbin/iptables -P INPUT DROP service iptables save
以上腳本，在每次重裝完系統(tǒng)后執(zhí)行一次即可，其配置會保存至/etc/sysconfig/iptables
相關(guān)文章
Windows Server 2012 R2安裝Web服務(wù)器IIS
本文主要介紹了Windows Server 2012 R2安裝Web服務(wù)器IIS,文中通過圖文介紹的非常詳細(xì),對大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價值,需要的朋友們下面隨著小編來一起學(xué)習(xí)學(xué)習(xí)吧2024-05-05
其實，在服務(wù)器的安全設(shè)置方面，我雖然有一些經(jīng)驗，但是還談不上有研究，以前在站長網(wǎng)服務(wù)器安全講座上也講了不少類似的文章，雖然談不上多牛B的技術(shù)但是一點小小的經(jīng)驗，大家自行挑選學(xué)習(xí)。2009-09-09
win2008下IIS7、IIS7.5 配置ASP+ACCESS使用環(huán)境
Windows 中IIS7、IIS7.5是默認(rèn)不安裝的，所以在安裝完Windows Vista/windows 7/windows 2008之后如果需要安裝IIS7/iis7.5的話，就要自己動手了。2011-04-04
GNUZip是一個GNU自由軟件的文件壓縮程序。gzip可以極大的加速網(wǎng)站。需要這篇文章的，應(yīng)該已經(jīng)比較了解gzip了2012-04-04![win2003服務(wù)器定時自動重啟命令[計劃任務(wù)]](http://img.jbzj.com/images/xgimg/bcimg4.png)
win2003服務(wù)器定時自動重啟命令[計劃任務(wù)]
win2003服務(wù)器定時自動重啟命令，其實就是通過shutdown.exe結(jié)合計劃任務(wù)來實現(xiàn)的。2011-05-05
IIS下Zend 出現(xiàn) Unable to view file mapping 問題的解決方法匯總
這篇文章主要介紹了IIS下Zend 出現(xiàn) Unable to view file mapping 問題的解決方法匯總,需要的朋友可以參考下2014-05-05
這篇文章主要介紹了iis7.5 URL重寫零基礎(chǔ)入門介紹,需要的朋友可以參考下2017-04-04
這篇文章主要為大家詳細(xì)介紹了Windows7下IIS+php配置教程，文中步驟介紹的非常詳細(xì)，具有一定的參考價值，感興趣的小伙伴們可以參考一下2017-05-05
win2008下安裝SQL SERVER 2005出現(xiàn)IIS功能要求 警告解決方案
這篇文章主要介紹了在windows server 2008 R2系統(tǒng)中，安裝sql server 2005時，出現(xiàn)功能要求警告的解決方法，有遇到此問題的朋友，可以參考下2013-05-05
IIS7.5 配置自定義后綴的ASP文件 無法執(zhí)行 總是提示下載的解決方法
這篇文章主要介紹了IIS7.5 配置自定義后綴的ASP文件 無法執(zhí)行 總是提示下載的解決方法,需要的朋友可以參考下2016-06-06