Linux的ufw和SeLinux设置
一.防火墙设置
-
查看防火状态
systemctl status firewalld
service iptables status
-
暂时关闭防火墙
systemctl stop firewalld
service iptables stop
-
永久关闭防火墙
systemctl disable firewalld
chkconfig iptables off
-
重启防火墙
systemctl enable firewalld
service iptables restart
-
永久关闭后重启
chkconfig iptables on
-
关闭防火墙及关闭防火墙开机自启
systemctl stop firewalld.service
systemctl disable firewalld.service
二.开放或限制端口
1、开放端口
(1)如我们需要开启putty连接时需要使用的22端口
firewall-cmd --zone=public --add-port=22/tcp --permanent
其中--permanent的作用是使设置永久生效,不加的话机器重启之后失效
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)可通过如下命令查看是否生效
firewall-cmd --zone=public --query-port=22/tcp
(4)如下命令可查看当前系统打开的所有端口
firewall-cmd --zone=public --list-ports
2、限制端口
(1)比如我们现在需要关掉刚刚打开的22端口
firewall-cmd --zone=public --remove-port=22/tcp --permanent
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)再去查看系统所有开放的端口,已经看到没有22端口了
firewall-cmd --zone=public --list-ports
3、批量开放或限制端口
(1)批量开放端口,如从100到500这之间的端口我们全部要打开
firewall-cmd --zone=public --add-port=100-500/tcp --permanent
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)查看系统所有开放的端口,可以看到从100到500的端口已被全部开放
firewall-cmd --zone=public --list-ports
(4)同理,批量限制端口为
firewall-cmd --zone=public --remove-port=100-500/tcp --permanent
firewall-cmd --reload
三、开放或限制IP
1、限制IP地址访问
(1)比如限制IP为192.168.0.200的地址禁止访问80端口即禁止访问机器
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.0.200" port protocol="tcp" port="80" reject"
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)查看已经设置的规则
firewall-cmd --zone=public --list-rich-rules
2、解除IP地址限制
(1)解除刚才被限制的192.168.0.200
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.0.200" port protocol="tcp" port="80" accept"
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)再查看规则设置发现已经没有192.168.0.200的限制了
firewall-cmd --zone=public --list-rich-rules
3、限制IP地址段
(1)如我们需要限制10.0.0.0-10.0.0.255这一整个段的IP,禁止他们访问
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.0.0.0/24" port protocol="tcp" port="80" reject"
其中10.0.0.0/24表示为从10.0.0.0这个IP开始,24代表子网掩码为255.255.255.0,共包含256个地址,即从0-255共256个IP,即正好限制了这一整段的IP地址
(2)重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
(3)查看规则,确认是否生效
firewall-cmd --zone=public --list-rich-rules
(4)同理,打开限制为
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.0.0.0/24" port protocol="tcp" port="80" accept"
firewall-cmd --reload
四、SeLinux
(1)查看SeLinux状态
[root@localhost ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: error (Success)
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
(2)临时关闭SeLinux
[root@localhost ~]# setenforce 0
(3)查看SeLinux状态
[root@localhost ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: error (Success)
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
(4)永久关闭SeLinux,需要重启机器
修改配置文件/etc/selinux/config,将SELINU设置为disabled
查看修改后
[root@localhost ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
# SELINUX=enforcing
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
[root@localhost ~]# sestatus
SELinux status: disabled