csf防火墙配置

悠悠 2022-07-17 00:50 295阅读 0赞

服务器经常被人猜解，打开ssh的日志secure一看，都是尝试登录的。无语啊，唉，黑客你就不能安分点吗？好吧，虽然说用shell脚本来定时检测日志文件，统计一个时间段有多少次访问，超过一定的阀值就封掉IP，也是个可行之法。但是，，，但是，，好吧，我承认我比较懒，，，，，其实吧，，硬件防火墙才是王道，，，可是，，，好吧，大家都懂的。。。。。

简单说说csf防火墙吧  
1 防止暴力破解密码，自动屏蔽连续登陆失败的IP  
2 管理网络端口，只开放必要的端口  
3 免疫小流量的 DDos 和 CC 攻击。  
csf防火墙提供了基于web GUI的管理方式，并且提供 cPanel 插件，而且还可以基于CLI来管理，其实，说实话，我连vps的管理面板是个什么东西都不知道，更别说见过了，朋友的vps，平时维护什么的都是ssh上来的。从来没用过面板什么的。  
csf的安装：  
一、安装依赖包：  
yum install perl-libwww-perl perl iptables

二、下载并安装 CSF：  
wget [http://www.configserver.com/free/csf.tgz][http_www.configserver.com_free_csf.tgz]  
tar -xzf csf.tgz  
cd csf  
sh install.sh

三、测试 CSF 是否能正常工作:  
\[root@localhost csf\]\# perl /etc/csf/csftest.pl  
Testing ip\_tables/iptable\_filter...OK  
Testing ipt\_LOG...OK  
Testing ipt\_multiport/xt\_multiport...OK  
Testing ipt\_REJECT...OK  
Testing ipt\_state/xt\_state...OK  
Testing ipt\_limit/xt\_limit...OK  
Testing ipt\_recent...OK  
Testing xt\_connlimit...OK  
Testing ipt\_owner/xt\_owner...OK  
Testing iptable\_nat/ipt\_REDIRECT...OK  
Testing iptable\_nat/ipt\_DNAT...OK  
RESULT: csf should function on this server

csf的配置：  
CSF的配置文件是 /etc/csf/csf.conf  
\# Allow incoming TCP ports  
\# 推荐您更改 SSH 的默认端口（22）为其他端口，但请注意一定要把新的端口加到下一行中  
TCP\_IN = “20,21,47,81,1723,25,53,80,110,143,443,465,587,993,995〃  
\# Allow outgoing TCP ports同上，把 SSH 的登录端口加到下一行。  
\# 在某些程序要求打开一定范围的端口的情况下，例如Pureftpd的passive mode，可使用类似 30000:35000 的方式打开30000-35000范围的端口。  
TCP\_OUT = “20,21,47,81,1723,25,53,80,110,113,443〃  
\# Allow incoming UDP ports  
UDP\_IN = “20,21,53〃  
\# Allow outgoing UDP ports  
\# To allow outgoing traceroute add 33434:33523 to this list  
UDP\_OUT = “20,21,53,113,123〃  
\# Allow incoming PING 是否允许别人ping你的服务器，默认为1，允许。0为不允许。  
ICMP\_IN = “1〃

以上这些配置大家一看就懂了，下面再介绍几个比较常用的：  
免疫某些类型的小规模 DDos 攻击：  
\# Connection Tracking. This option enables tracking of all connections from IP  
\# addresses to the server. If the total number of connections is greater than  
\# this value then the offending IP address is blocked. This can be used to help  
\# prevent some types of DOS attack.  
\#  
\# Care should be taken with this option. It’s entirely possible that you will  
\# see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD  
\# and HTTP so it could be quite easy to trigger, especially with a lot of  
\# closed connections in TIME\_WAIT. However, for a server that is prone to DOS  
\# attacks this may be very useful. A reasonable setting for this option might  
\# be arround 200.  
\#  
\# To disable this feature, set this to 0  
CT\_LIMIT = "200"\#\#固定时间内同一个IP请求的此数  
\# Connection Tracking interval. Set this to the the number of seconds between  
\# connection tracking scans  
CT\_INTERVAL = "30" \#\#指上面的固定时间，单位为秒  
\# Send an email alert if an IP address is blocked due to connection tracking  
CT\_EMAIL\_ALERT = "1" \#\#是否发送邮件  
\# If you want to make IP blocks permanent then set this to 1, otherwise blocks  
\# will be temporary and will be cleared after CT\_BLOCK\_TIME seconds  
\# 是否对可疑IP采取永久屏蔽，默认为0，即临时性屏蔽。  
CT\_PERMANENT = "0"  
\# If you opt for temporary IP blocks for CT, then the following is the interval  
\# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)  
\# 临时性屏蔽时间 [www.2cto.com][]  
CT\_BLOCK\_TIME = "1800"  
\# If you don’t want to count the TIME\_WAIT state against the connection count  
\# then set the following to “1〃  
CT\_SKIP\_TIME\_WAIT = "0" \#\#是否统计TIME\_WAIT链接状态  
\# If you only want to count specific states (e.g. SYN\_RECV) then add the states  
\# to the following as a comma separated list. E.g. “SYN\_RECV,TIME\_WAIT”  
\# Leave this option empty to count all states against CT\_LIMIT  
CT\_STATES = "" \#\#是否分国家来统计，填写的是国家名  
\# If you only want to count specific ports (e.g. 80,443) then add the ports  
\# to the following as a comma separated list. E.g. “80,443〃  
\#  
\# Leave this option empty to count all ports against CT\_LIMIT  
\# 对什么端口进行检测，为空则检测所有，防止ssh的话可以为空，统计所有的。  
CT\_PORTS = ""

做了以上设置之后，可以先测试一下。如果没有问题的话，就更改为正式模式，刚才只是测试模式。  
\# 把默认的1修改为0。  
TESTING = "0"

在/etc/csf/下面还有2个文件  
csf.allow和csf.deny  
这里面保存的就是允许的IP和禁止的IP，可以手动编辑这两个文件，比如想禁止某人来访问本站，就把他的IP加入到csf.deny列表里面去，或者是为了防止误封。可以把自己的IP加入到csf.allow列表里面去。加入之后记得重启一下csf防火墙。  
/etc/init.d/csf restart或者csf -r 都可以重启。

[http_www.configserver.com_free_csf.tgz]: http://www.configserver.com/free/csf.tgz
[www.2cto.com]: http://www.2cto.com/Article/201209/156645.html