Network security and host basic protection

First, the network packet enters the host the process introduction

Linux system has built-in firewall mechanism, the default Linux firewall has two mechanisms, these two mechanisms are independent existence. The first layer is the packet-filtering NetFilter firewall, and the other is the TCP Wrappers firewall through the software control.

1) IP Filtering or Net Filter

To enter the Linux native of the packet will first through the Linux core preset firewall, is called the NetFilter, simply said, is iptables This software provides firewall features. Why is it called packet filtering? Because he mainly analyzes the TCP/IP packet header to filter the mechanism, the main analysis is the OSI combined second layer, the main control is the MAC, IP, ICMP, TCP and UDP port and state (SYN, ACK ...) and so on.

2) TCP Wrappers

After the NetFilter, the network packet will begin to accept Super daemons and tcp_wrappers test, what is that? This is the/etc/hosts.allow and/etc/hosts.deny configuration file function. This function is also for the Header of the TCP analysis again, you can also set some mechanism to resist some IP or port, so that the source of the packet is discarded or passed the test;

3) Basic functions of the Service (daemon):

Some IP sources can be regulated within the configuration file httpd.conf httpd service is not available.

4) SELinux control over the details of network services:

SELinux can set some rules for the permissions of the network service, so that the function of the program can be limited, so even if the user's file permissions set error, and the program has a problem, the program can do the action is limited, even if the program is using root permissions. For example, the previous step of the httpd really was cracker attack and let the other side to get root access, because httpd has been controlled by SELinux in/var/www/html, and the ability to perform functions have been regulated, so CRA Cker will not be able to use this program for further damage to the system.

5) using the host's file system resources

File permissions.

Second, the protection suggestion

Establish a perfect login password rule limit, perfect host permission setting, set up automatic upgrade and fix software vulnerability, remove dangerous software, strengthen security setting project in each system service setting, utilize iptables, tcp_wrappers strengthen network firewall, utilize host monitor software such as MRTG and Logwatch to analyze the host status and login files;

Network security and host basic protection