Samba与iptables笔记

2016-10-04 00:01:53 Albin Wong 1522

linux Samba iptables

Samba文件服务器
提供内网服务
Linux Server    Windows Client

端口： smbd  提供资源访问   tcp  139 445
       nmbd  提供主机名解析 udp  137 138

搭建Samba文件服务
1）软件安装： samba   ISO 镜像文件
`# mount /dev/sr0 /mnt/cdrom `
`# yum -y install samba `
2)配置文件

实验1：Linux Server共享目录/movie  安全级别 share
1修改配置文件
`# vim /etc/samba/smb.conf
```shell
101         security = share
...
263 [movie]
264         comment = dianying
265         path = /movie
266         browseable = yes
267         guest ok = yes
268         writable = yes
```
2）建立目录
`# mkdir /movie `
`# chmod 777 /movie `

3)启动服务 测试
(防火墙关闭  selinux 关闭)
`# service smb start
`# service nmb start

测试：windows  \\192.168.159.251

实验2 共享目录/pub  /soft  安全级别 user
1)修改配置文件
`# vim /etc/samba/smb.conf `
```shell
101         security = user

263 [pub]  
264         comment = public
265         path = /pub
266         browseable = yes
267         writable = yes
268         
269 [soft]
270         comment = software
271         path = /soft
272         browseable = yes
273         writable = yes
```
2)建立目录
`# mkdir /pub `
`# mkdir /soft `
`# chmod 777 /pub `
`# chmod 700 /soft `
`# useradd aa `
`# passwd aa `
`# chown aa /soft `

3)建立添加samba用户
`# smbpasswd  -a  aa `
`# smbpasswd  -a shuiwa `
`# pdbedit -L   查看samba用户 `

4）重启服务 测试
`# service smb restart  `- 
`# service nmb restart  `-

测试：windows  \\192.168.159.251   aa用户访问    shuiwa访问

linux   #smbclient //192.168.159.251/soft -U aa

防火墙配置

结构：表 --> 链 --> 规则
- filter 数据包过滤 重点   INPUT 链    OUTPUT 链    FORWARD 链
- nat  网络地址转发
- mangle 数据包标记

基本语法规则
`# iptables -t filter  -L  -n  `
-t 表  -L查看规则   -n  IP和端口显示
`# iptables -F  清除防火墙规则 `
`# iptables -X  清除自定义链 `
`# iptables -Z  统计归零 `

定制默认策略 -P 
`# iptables -t filter  -P INPUT   DROP  设置默认策略为拒绝 （最后设置） `

IP与网卡接口设置
`# iptables  -A 　INPUT  -i lo  -j  ACCEPT `
允许本机回环网卡通信，在INPUT链

禁止IP访问（封IP）
`# iptables -A  INPUT  -i  eth0  -s 192.168.159.250  -j  DROP  `
`# iptables -A  INPUT  -i  eth0  -s 192.168.159.0/24  -j  DROP (禁止网段访问) `

禁止端口访问（封端口）
`# iptables -A  INPUT  -i eth0  -p tcp  -s  192.168.159.250  --dport 22  -j DROP `

模块调用 -m  state  --state  状态模块
`# iptables -A INPUT -i eth0  -m state --state  ESTABLISHED,RELATED  -j ACCEPT `

物理地址模块 -m  mac  --mac-source   
`# iptables -A INPUT -i eth0  -m mac --mac-source  aa\:bb\:cc\:dd\:ee\:ff -j  DROP `

简易防火墙
```shell
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED  -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
```
防火墙管理
`# chkconfig  iptables on  开机自启动 `

`# service iptables save   保存防火墙设置脚本 `

防火墙脚本
`# vim  /root/iptables.rule `
```shell
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED  -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
```
`# chmod +x  /root/iptables.rule `

`# vim /etc/rc.local   脚本开机自启动 `
`/root/iptables.rule`

(3) Comments

John Doe- Reply

February 26, 2013 at 1:18 pm
- saqib sarwar- Reply
  
  February 26, 2013 at 1:20 pm
  
  Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Typi non habent claritatem insitam; est usus legentis in iis qui facit eorum claritatem. Investigationes demonstraverunt lectores legere me lius quod ii legunt saepius. Claritas est etiam processus dynamicus, qui sequitur mutationem consuetudium lectorum. Mirum est notare quam littera gothica, quam nunc putamus parum claram, anteposuerit litterarum formas humanitatis per seacula quarta decima et quinta decima. Eodem modo typi, qui nunc nobis videntur parum clari, fiant sollemnes in futurum.
John Doe- Reply

February 26, 2013 at 1:27 pm

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat.

Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum.

Your email address will not be published. Required fields are marked *

Name *

Email *

Website

Comment

You can use these HTML tags and attributes <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Samba与iptables笔记

(3) Comments

John Doe- Reply

saqib sarwar- Reply

John Doe- Reply

Leave a Reply