Linux_防火墙与SElinux
2024-09-08 05:17:53
一、防火墙与SElinux
1、防火墙和selinux
- 防火墙
- iptables 默认允许所以
- firewalld 默认拒绝所有
- ebtables 不认识，不管
- selinux 安全上下文标识（使用 ls -Z 查看）
二、配置防火墙规则
1、查看防火墙当前规则
[root@localhost ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0 //当前网卡设备
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules: //副规则，主要在这添加规则
2、我这用httpd服务测试
- 查看当前防火墙状态
[root@localhost ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2020-08-26 05:20:39 CST; 12min ago
Docs: man:firewalld(1)
Main PID: 1038 (firewalld)
Tasks: 2 (limit: 11340)
Memory: 36.5M
CGroup: /system.slice/firewalld.service
└─1038 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid Aug 26 05:20:37 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
Aug 26 05:20:39 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.
- 测试httpd测试主页是否可以访问
3、添加rich rules规则
[root@localhost ~]# firewall-cmd --add-rich-rule 'rule family=ipv4 source address=192.168.121.0/24 service name=http accept' --permanent
success //添加副规则 //永久添加（开机永久生效） //重新加载防火墙规则 （此步骤必须要）
[root@localhost ~]# firewall-cmd --reload
success
4、查看是否添加rich rules规则
[root@localhost ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.121.0/24" service name="http" accept
5、在次访httpd测试主页
四、配置SElinux规则
1、首先在防火墙放行8090端口
[root@localhost ~]# firewall-cmd --add-rich-rule 'rule family=ipv4 source address=192.168.121.0/24 port port=8090 protocol=tcp accept' --permanent
success //重新加载防火墙配置（此步骤必须做）
[root@localhost ~]# firewall-cmd --reload
success
2、查看防火墙配置
[root@localhost ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.121.0/24" service name="http" accept
rule family="ipv4" source address="192.168.121.0/24" port port="8090" protocol="tcp" accept
3、安装semanage命令
//首先查看semanage命令安装包
[root@localhost ~]# yum provides *bin/semanage
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:50:01 ago on Wed 26 Aug 2020 05:30:36 AM CST.
policycoreutils-python-utils-2.9-3.el8.noarch : SELinux policy core python utilities
Repo : baseos
Matched from:
Other : *bin/semanage //安装policycoreutils-python-utils
[root@localhost ~]# yum install -y policycoreutils-python-utils
............
Installed:
policycoreutils-python-utils-2.9-3.el8.noarch checkpolicy-2.9-1.el8.x86_64 python3-audit-3.0-0.13.20190507gitf58ec40.el8.x86_64
python3-libsemanage-2.9-1.el8.x86_64 python3-policycoreutils-2.9-3.el8.noarch python3-setools-4.2.2-1.el8.x86_64
Complete!
4、使用semanage查看httpd可使用的端口号
[root@localhost ~]# semanage port -l|grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
5、使用semanage给http添加可使用的端口号
[root@localhost ~]# semanage port -a -t http_port_t -p tcp 8090 //再次查看端口是否添加
[root@localhost ~]# semanage port -l | grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 8090, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
6、使用IP:8090访问测试页面
最新文章
- Neil·Zou 语录二
- UDP网络通信OSC 协议
- js中的包装对象。
- 课程3——程序结构关键字
- [linux basic]--线程
- 理解KMP
- Could not calculate build plan: Plugin org.apache.maven.plugins:maven-resources-plugin:2.5
- mybatis源代码分析：mybatis延迟加载机制改进
- mysql中SQL执行过程详解与用于预处理语句的SQL语法
- webpack使用总结
- 建造者模式（Java与Kotlin版）
- 使用VIEWER.JS进行简单的图片预览
- 掌握一门语言Go
- android的Findbugs问题整理
- 持续代码质量管理-SonarQube Scanner部署
- go 方法
- python 函数返回值笔记
- Spring（十五）：通过注解配置 Bean
- android udev
- Winform 常用的方法