论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2008-03-31 16:14 |只看该作者 |倒序浏览

安装好openbsd后的一些基本设定（原创)

安装完后我们还需要进一步设置！
安装必须的软件吧！复制内容到剪贴板代码:#export PKG_PATH=ftp://ftp.freebsdchina.org/pub/OpenBSD/snapshots/packages/i386/
#pkg_add -v pftop-0.5.tgz
#pkg_add -v cvsup-16.1h-no_x11.tgz
#pkg_add -v squid-2.5.STABLE13-transparent-snmp.tgz
新建 /root/cvs-supfile
复制内容到剪贴板代码:#Defaults that apply to all the collections
*default release=cvs
*default delete use-rel-suffix
*default umask=002
*default host=anoncvs.tw.openbsd.org
*default base=/usr
*default prefix=/usr
# If your network link is a T1 or faster, comment out the following line.
*default compress
#OpenBSD-all
#OpenBSD-src
#OpenBSD-www
OpenBSD-ports
#OpenBSD-x11
#OpenBSD-xf4更新　port tree复制内容到剪贴板代码:cvsup -g -L 2 cvs-supfile
先设置　/etc/sysctl.conf 吧！
复制内容到剪贴板代码:/etc/sysctl.conf
net.inet.ip.forwarding=1
#sysctl net.inet.ip.forwarding=1设置　/etc/inetd.conf复制内容到剪贴板代码:#ftp       stream tcp nowait root /usr/libexec/ftpd ftpd -US
#ftp       stream tcp6 nowait root /usr/libexec/ftpd ftpd -US
127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy -n -t 180设置　/etc/squid/squid.conf 加上复制内容到剪贴板代码:#mkdir -p /etc/squid/etc
#mkdir -p /etc/squid/etc/badKeyWord.txt
#mkdir -p /etc/squid/etc/badpages.txt
#mkdir -p /etc/squid/etc/denydn.txt
#mkdir -p /etc/squid/etc/denyurl2.txt
#mkdir -p /etc/squid/etc/denyurl3.txt复制内容到剪贴板代码:httpd_accel_port 80
httpd_accel_host virtual
httpd_accel_with_proxy off
httpd_accel_uses_host_header on
#查找　http_access deny all 改成下面
#user define
#acl BadPagesURL urlpath_regex "/etc/squid/etc/badpages.txt"
#把要挡的网站写在上面的档案中
#acl BadPagesTAG urlpath_regex "/etc/squid/etc/badKeyWord.txt"
#把要挡的关键词写在上面的档案中
#http_access allow !BadPagesURL
#http_access allow !BadPagesTAG
#以挡网站为例：在 squid.conf 中设定方式如下：
acl denydn dstdomain "/etc/squid/etc/denydn.txt"
http_access deny denydn
#请注意：在 denyurl.txt 檔中，每个想要挡掉的网址，须一个项目写成一行。
#挡掉特定的网页，在 squid.conf 中设定方式如下：
acl denyurl url_regex "/etc/squid/etc/denyurl2.txt"
http_access deny denyurl
#注意：在 denyurl2.txt 檔中，每个想要挡掉的网页项目，须一个项目写成一行。
#挡掉特定的网页，在 squid.conf 中设定方式如下：
acl denyurlpath urlpath_regex -i "/etc/squid/etc/denyurl3.txt"
http_access deny denyurlpath
#同上：在 denyurl3.txt 檔中，每个想要挡掉的字词项目，须一个项目写成一行
#time contral
acl worktime time MTWHF 7:15-12:00 14:00-18:00
http_access deny !worktime
#acl mmxfile urlpath_regex \.mp3$ \.avi$ \.exe$
#http_access deny mmxfile
http_access allow all设置　/etc/rc.conf复制内容到剪贴板代码:pf=YES
#在后面加上
####################################
## Constonma services ####
squid=YES
dhcpd=NO
mysqld=NO
named=NO
####################################
设置　/etc/rc.local复制内容到剪贴板代码:#在后面加上
#########################################
## Coustemer services ####
# squid service
if [ X"${squid}" == X"YES" -a -x /usr/local/sbin/squid ]; then
      echo Starting squid
      /usr/local/sbin/squid
fi
# dhcpd service
if [ X"${dhcpd}" == X"YES" -a -x /usr/sbin/dhcpd ]; then
      echo Starting dhcpd
      /usr/sbin/dhcpd rl0
fi
# mysqld service
if [ X"${mysqld}" == X"YES"]; then
echo 'Starting  mysql'
if [ -x /usr/local/sbin/mysql.server ]; then
   ./usr/local/sbin/mysql.server start
   for i in 1 2 3 4 5 6 7 8; do
            if [ -S /var/run/mysql/mysql.sock ]; then
                     break
            else
                     sleep 1
                     echo -n '.'
            fi
   done
   mkdir -p /var/www/var/run/mysql
   ln -f /var/run/mysql/mysql.sock /var/www/var/run/mysql/mysql.sock
fi
echo '.'
fi
# named service
if [ X"${named}" == X"YES" -a -x /usr/sbin/named ]; then
      echo Starting dhcpd
      /usr/sbin/named -u named -c /etc/named.conf
fi
############ end #########设置　/etc/pf.conf
复制内容到剪贴板代码:#touch /etc/blockip
#touch /etc/blockurl
#touch /etc/teacher_user
#touch /etc/student_user复制内容到剪贴板代码:#macros
ext_if="fxp0"
#定义外网网卡
int_if="bge0"
#定义内网网卡
tcp_services="{21,80,8021}"
#开放的端口，暂时未用
icmp_types = "echoreq"
#icmp的类型
#priv_nets="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 127.0.0.0/8,
0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3,
20.20.20.0/24 }"
priv_nets="{ 172.16.0.0/12, 127.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3, 20.20.20.0/24 }"
#定义不该在外网网卡上出现的数据包
ssh_nets="{ 192.168.10.0/23 }"
#定义可ssh的主机范围
int_net="{ 192.168.10.0/23 }"
#定义nat带的内网的地址范围
www_server="192.168.10.3"
#rdr转换的内部server地址
permit_port="{ 20,21,22,23,25,53,69,80,110,443,8000,8021,10024> persist file "/etc/student_user"
table  persist file "/etc/teacher_user"
table  persist file "/etc/blockip"
table  persist file "/etc/blockurl"
#定义　teacher 组和　leader 组的用户表
#options
set block-policy drop
#block的默认规则是drop，不再返回任何回应数据包，节省资源
set loginterface $ext_if
#pf统计ext_if网卡的进/出流量和pass/block的数据包数目
set optimization aggressive
#自状态表中主动终止空闲连接
#scrub
scrub in all
#流量整形，避免最终的数据包出现非法目的，同时也会重组数据包碎片，保护操作系统免受攻击，丢失某些带有非法联合标记的TCP数据包。
#############################
##ALTQ部分，控制垃圾邮件
##################################
altq on $int_if cbq bandwidth 10Mb queue { std_in mail }
  queue std_in bandwidth 8Mb cbq(default)
  queue mail bandwidth 1Mb
#altq on $ext_if cbq bandwidth 1Mb queue { std_out }
#  queue std_out bandwidth 1Mb cbq(default)
altq on $ext_if cbq bandwidth 6Mb queue { teacher, student, Admin, std_out }
  queue teacher bandwidth 1Mb priority 2 cbq(red ecn)
  queue student bandwidth 3Mb cbq(default)
  queue Admin bandwidth 1Mb priority 5 cbq(borrow)
  queue std_out bandwidth 500Kb cbq
##################################################
##nat rules nat的规则必须写到filter规则的前面
##################################################
nat on $ext_if from $int_net to any -> ($ext_if)
#nat转换所有的内部地址，（）是让PF自动更新ext_if的地址
#rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
#让内网可以使用ftp client软件连接外部的ftp服务器
rdr on $ext_if proto tcp from any to any port 80 -> $www_server
#rdr内部的www_server
rdr on $int_if inet proto tcp from $int_net to any port 80 -> 127.0.0.1 port 3128
#使用squid 作为代理，将80端口映射到 3128
#####################
##filter rules
#####################
block all
#block所有的包，然后依实际情况开放
block in quick proto tcp all flags SF/SFRA
#block in quick proto tcp all flags SFUP/SFRAU
block in quick proto tcp all flags FPU/SFRAUP
block in quick proto tcp all flags /SFRA
block in quick proto tcp all flags F/SFRA
block in quick proto tcp all flags U/SFRAU
#防止一些网络扫描软件
pass quick on lo0 all
#允许localhost数据包通行
###############
#int_if内网网卡
###############
pass in quick on $int_if inet proto { tcp, udp } from any to any port 53 keep state
#允许DNS解析
pass in quick on $int_if proto tcp from $ssh_nets to any port 22 flags S/SA keep state
#允许ssh_nets的计算机ssh登录
pass in on $int_if inet  proto icmp all icmp-type $icmp_types keep state
#允许ping内网网卡
block in on $int_if proto tcp from any to any port 22 flags S/SA
#禁止其它机器ssh登录，因为有block all，似乎可以不要了，但是加上更放心！
block in quick on $int_if proto tcp from $int_net to any port $deny_port flags S/SA
#封端口
pass in log quick on $int_if proto tcp from $int_net to 127.0.0.1 keep state queue std_in
#pass in log quick on $int_if proto tcp from $int_net to any keep state queue std_in
pass in log quick on $int_if proto tcp from $int_net to any port $permit_port keep state queue std_in
block in on $int_if from $int_net
pass out on $int_if from any to $int_net
#允许内网网卡和内网之间通讯
###############
#ext_if外网网卡
###############
block drop in quick on $ext_if from $priv_nets to any
#拒绝所有私有地址进入ext_if网卡
block drop out quick on $ext_if from any to $priv_nets
#拒绝所有私有地址出去ext_if网卡
pass in on $ext_if proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
#允许开放端口的数据包进入ext_if网卡
pass in on $ext_if proto tcp from any to $www_server port 80 flags S/SA synproxy state
#www_server的连接由PF来进行TCP代理，防止TCP SYN FLOODs欺骗
pass out on $ext_if proto tcp all modulate state flags S/SA queue std_out
#ext_if网卡上允许tcp数据包出去，并为匹配规则的数据包产生强壮的初始化序列号
pass out on $ext_if proto {udp,icmp} all keep state queue std_out
#ext_if网卡上允许udp、icmp数据包出去
pass out on  $ext_if from $Admin to any keep state queue Admin
#admin 组匹配　Admin　的队列分配数据流
pass out on  $ext_if from  to any keep state queue teacher
#teacher 组匹配　teacher　的队列分配数据流
block out  quick on $ext_if from  to any
pass  out on  $ext_if proto tcp from  to any port 80  keep state queue student
#block student　组的所有数据，设置　student 组只能浏览网页
block out  quick on $ext_if from  to any
#限制 blockip 组不能上网
block out  quick on $ext_if from any to
#限制 blockurl 所记录不能上的网站最后开启服务复制内容到剪贴板代码:#启动 squid 服务
#/usr/local/sbin/squid -z
#/usr/local/sbin/squid
#pfctl -e
#pfctl -f /etc/pf.conf

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u2/64726/showart_512866.html

文库|博客

返回列表

Chinaunix › 论坛 › 操作系统 › BSD › BSD文档中心 › 安装好openbsd后的一些基本设定（原创)

安装好openbsd后的一些基本设定（原创) [复制链接]

浏览过的版块