close
記錄防火牆和SeLinux的開關指令,
1. FW
檢查狀態
service iptables status 或 /etc/init.d/iptables status
暫時開關-重啟失效
service iptables start 或 /etc/init.d/iptables start
service iptables stop 或 /etc/init.d/iptables stop
暫時無效-重啟生效
chkconfig iptables on/off #開/關
另外也可以vi /etc/sysconfig/iptables 內容,來配置防火牆(建議此法)
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
以上是預設的情況,要如何設定寫在此有點長,請參考
https://gigenchang.wordpress.com/2014/04/19/10%E5%...
2.SeLinux
檢查狀態
/usr/sbin/sestatus -v
暫時開關-重啟失效
setenforce 1/0 #開/關
暫時無效-重啟生效
vi /etc/selinux/config
將SELINUX=enabled -> SELINUX=disabled 存檔.
也可以設定個別程序的設定政策,(但我也不懂,詳情還請看鳥哥私房菜
http://linux.vbird.org/linux_basic/0440processcont...
全站熱搜
留言列表
