Здравейте на всички.
Не знам дали това е правелния раздел, затова ако съм сбъркал сори...
И така какъв е проблема. Сложих в /etc/init.d/boot.local следните редове:
| Примерен код |
#! /bin/sh
#
# Copyright (c) 2002 SuSE Linux AG Nuernberg, Germany. All rights reserved.
#
# Author: Werner Fink <werner@suse.de>, 1996
# Burchard Steinbild, 1996
#
# /etc/init.d/boot.local
#
# script with local commands to be executed from init on system startup
#
# Here you should add things, that should happen directly after booting
# before we're going to the first run level.
# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#
# Enable always defragging Protection
#echo 1 > /proc/sys/net/ipv4/ip_always_defrag
#
# Enable broadcast echo Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#
# Enable bad error message Protection
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#
# Enable IP spoofing protection
# turn on Source Address Verification
for f in /proc/sys/net/ipv4/conf/all/rp_filter; do
echo 1 > $f
done
#
# Disable ICMP Redirect Acceptance
for f in /proc/sys/net/ipv4/conf/all/accept_redirects; do
echo 0 > $f
done
#
for f in /proc/sys/net/ipv4/conf/all/send_redirects; do
echo 0 > $f
done
#
# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/all/accept_source_route; do
echo 0 > $f
done
|
И се интересувам дали това е правилното място за тези защити? Че накой от тях трябва да се изпълнят в определено време....
Eто какво казва /var/log/boot.msg:
| Цитат |
Creating /var/log/boot.msg
doneStarting Firewall Initialization (phase 1 of 2) SuSEfirewall2: Warning: ip6tables does not support state matching. Extended IPv6 support disabled.
done
Activating remaining swap-devices in /etc/fstab...
doneSetting current sysctl status from /etc/sysctl.conf
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.rp_filter = 1
warning: /etc/sysctl.conf( : invalid syntax, continuing...
done
Enabling syn flood protectiondone
Disabling IP forwardingdone
Disabling IPv6 forwardingdone
Disabling IPv6 privacydone
done
done
System Boot Control: The system has been set up
Failed features: boot.apparmor
System Boot Control: Running /etc/init.d/boot.local
done<notice>killproc: kill(800,3)
INIT: Entering runlevel: 5 |
Според мен всичко е наред, но не знам как да проверя дали е така. Та затова ще съм Ви благодарен ако някой ми помогне....
Не искам да правя поразии, а просто да си изградя сигурно защита..., че има доста хора които правят spoof и т.н в тази Лан която съм....
Предварително благодаря!
