由 jamlee800 在 12-29-2002 10:33 发表:
我的rh8.0已初步构架完毕，请各位大虾测试、指正：http(ftp)://211.92.54.97
我的rh8.0已初步构架完毕，请各位大虾测试、指正：
http(ftp)://211.92.54.97
由 jamlee800 在 12-29-2002 10:39 发表:
我的rh8.0已初步构架完毕，请各位大虾测试、指正：
http(ftp)://211.92.54.97
防火墙配置：
echo "Enable IP Forwarding..."
echo 1 >/proc/sys/net/ipv4/ip_forward
echo "Starting iptables rules..."
/sbin/modprobe iptable_filter
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -F POSTROUTING -t nat
iptables -F PREROUTING -t nat
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -m tcp --dport 21 --syn -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -m tcp --dport 80 --syn -j ACCEPT
iptables -A INPUT -i eth1 -m limit --limit 100/s --limit-burst 100 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.168.0.192/26 -p tcp -m tcp --dport ! 80 -j ACCEPT
iptables -A FORWARD -s 192.168.0.192/26 -p udp -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.192/26 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.192/26 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth1 -j DNAT --to 192.168.0.203
/etc/rc.d/init.d/iptables restart
iptables -L
由 jamlee800 在 12-29-2002 13:33 发表:
我的配置：
proftpd.conf
#ServerName "GRC FTP Server"
ServerType standalone
DefaultServer on
Port 21 is the standard FTP port.
Port 21
1<limit login="">
2
3DenyAll
4
5</limit>
Umask 022
MaxInstances 30
Set the user and group under which the server will run.
User nobody
Group nobody
DefaultRoot ~
Normally, we want files to be overwriteable.
1<directory></directory>
AllowRetrieveRestart on
AllowOverwrite on
1<virtualhost 192.168.0.203="">
2
3
4
5ServerIdent Off
6
7#Port 2001
8
9#Umask 027
10
11MaxLoginAttempts 3
12
13
14
15# A basic anonymous configuration, no upload directories.
16
17<anonymous book="" ~ftp="">
18<limit login="">
19
20AllowAll
21
22</limit>
23
24
25
26User ftp
27
28Group ftp
29
30
31
32# We want clients to be able to login with "anonymous" as well as "ftp"
33
34UserAlias anonymous ftp
35
36
37
38MaxClients 10
39
40
41
42DisplayLogin welcome.msg
43
44DisplayFirstChdir .message
45
46
47
48# Limit WRITE everywhere in the anonymous chroot
49
50<limit write="">
51
52DenyAll
53
54</limit>
55
56
57
58HideUser root
59
60HideGroup root
61
62
63
64</anonymous>
65<anonymous ftp="" home="" xxx="">
66
67User xxx
68
69Group xxx
70
71UserAlias xx xxx
72
73AnonRequirePassword on
74
75MaxClients 2
76
77DisplayLogin welcome.msg
78
79DisplayFirstChdir .message
80
81
82
83<limit login="">
84
85AllowGroup xxx
86
87DenyAll
88
89</limit>
90
91
92
93
94
95GroupOwner xxx
96
97Umask 007
98
99
100
101HideUser root
102
103HideGroup root
104
105
106
107</anonymous>
108
109
110
111#</virtualhost>
squid.conf
NETWORK OPTIONS
-----------------------------------------------------------------------------
#Default:
http_port 3128
OPTIONS WHICH AFFECT THE NEIGHBOR SELECTION ALGORITHM
-----------------------------------------------------------------------------
#We recommend you to use at least the following line.
hierarchy_stoplist cgi-bin ?
#We recommend you to use the following two lines.
acl QUERY urlpath_regex cgi-bin ?
no_cache deny QUERY
OPTIONS WHICH AFFECT THE CACHE SIZE
-----------------------------------------------------------------------------
cache_mem 16 MB
#Default:
maximum_object_size 1024 KB
LOGFILE PATHNAMES AND CACHE DIRECTORIES
-----------------------------------------------------------------------------
#Default:
cache_dir ufs /var/spool/squid 100 16 256
#Default:
cache_access_log /var/log/squid/access.log
#Default:
cache_log /var/log/squid/cache.log
#Default:
cache_store_log /var/log/squid/store.log
OPTIONS FOR EXTERNAL SUPPORT PROGRAMS
-----------------------------------------------------------------------------
#Default:
dns_nameservers 127.0.0.1
OPTIONS FOR TUNING THE CACHE
-----------------------------------------------------------------------------
TIMEOUTS
-----------------------------------------------------------------------------
ACCESS CONTROLS
-----------------------------------------------------------------------------
#Recommended minimum configuration:
acl all src 0/0
acl wlb src 192.168.0.192/26
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
#Default:
http_access allow wlb
http-access deny all
Only allow cachemgr access from localhost
http_access allow manager localhost
http_access deny manager
Deny requests to unknown ports
http_access deny !Safe_ports
Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports
INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
And finally deny all other access to this proxy
http_access allow localhost
http_access deny all
ADMINISTRATIVE PARAMETERS
-----------------------------------------------------------------------------
OPTIONS FOR THE CACHE REGISTRATION SERVICE
-----------------------------------------------------------------------------
HTTPD-ACCELERATOR OPTIONS
-----------------------------------------------------------------------------
#Default:
httpd_accel_host virtual
httpd_accel_port 80
#Default:
httpd_accel_with_proxy on
#Default:
httpd_accel_uses_host_header on
MISCELLANEOUS
-----------------------------------------------------------------------------
httpd.conf
ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 300
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 15
1<ifmodule prefork.c="">
2
3StartServers 8
4
5MinSpareServers 5
6
7MaxSpareServers 20
8
9MaxClients 150
10
11MaxRequestsPerChild 1000
12
13</ifmodule>
1<ifmodule worker.c="">
2
3StartServers 2
4
5MaxClients 150
6
7MinSpareThreads 25
8
9MaxSpareThreads 75
10
11ThreadsPerChild 25
12
13MaxRequestsPerChild 0
14
15</ifmodule>
1<ifmodule perchild.c="">
2
3NumServers 5
4
5StartThreads 5
6
7MinSpareThreads 5
8
9MaxSpareThreads 10
10
11MaxThreadsPerChild 20
12
13MaxRequestsPerChild 0
14
15</ifmodule>
Listen 192.168.0.203:80
Include conf.d/*.conf
LoadModule access_module modules/mod_access.so
LoadModule auth_module modules/mod_auth.so
LoadModule auth_anon_module modules/mod_auth_anon.so
LoadModule auth_dbm_module modules/mod_auth_dbm.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule expires_module modules/mod_expires.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule unique_id_module modules/mod_unique_id.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule asis_module modules/mod_asis.so
LoadModule info_module modules/mod_info.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule imap_module modules/mod_imap.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
User nobody
Group nobody
ServerAdmin root@localhost
#ServerName www.grcinfo.com:80
UseCanonicalName Off
DocumentRoot "/var/www/grcweb"
1<directory></directory>
Options FollowSymLinks
AllowOverride None
1<directory "="" grcweb"="" var="" www="">
2
3
4
5Options Indexes FollowSymLinks
6
7AllowOverride None
8
9
10
11Order allow,deny
12
13Allow from all
14
15
16
17</directory>
1<locationmatch "^="" $="">
2
3Options -Indexes
4
5ErrorDocument 403 /error/noindex.html
6
7</locationmatch>
1<ifmodule mod_userdir.c="">
2
3
4
5UserDir disable
6
7
8
9</ifmodule>
DirectoryIndex index.htm index.html index.html.var
AccessFileName .htaccess
1<files "^\\.ht"="" ~="">
2
3Order allow,deny
4
5Deny from all
6
7</files>
TypesConfig /etc/mime.types
DefaultType text/plain
1<ifmodule mod_mime_magic.c="">
2
3
4
5MIMEMagicFile conf/magic
6
7</ifmodule>
HostnameLookups Off
ErrorLog logs/error_log
LogLevel warn
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
LogFormat "%h %l %u %t "%r" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog logs/access_log combined
ServerSignature On
Alias /icons/ "/var/www/icons/"
1<directory "="" icons"="" var="" www="">
2
3Options Indexes MultiViews
4
5AllowOverride None
6
7Order allow,deny
8
9Allow from all
10
11</directory>
Alias /manual "/var/www/manual"
1<directory "="" manual"="" var="" www="">
2
3Options Indexes FollowSymLinks MultiViews
4
5AllowOverride None
6
7Order allow,deny
8
9Allow from all
10
11</directory>
1<ifmodule mod_dav_fs.c="">
2
3# Location of the WebDAV lock database.
4
5DAVLockDB /var/lib/dav/lockdb
6
7</ifmodule>
ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
1<ifmodule mod_cgid.c="">
2</ifmodule>
1<directory "="" cgi-bin"="" var="" www="">
2
3AllowOverride None
4
5Options None
6
7Order allow,deny
8
9Allow from all
10
11</directory>
IndexOptions FancyIndexing VersionSort NameWidth=*
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif REA