Linux SELinux settings and Firewall service settings

Source: Internet
Author: User

Security-enhanced Linux

NSA National Bureau led the Development, a set of enhanced Linux system security of the mandatory access control system,

Integrated into the Linux kernel (2.6 and above).

RHEL7 provides a preset protection strategy for users, processes, directories, and files based on the SELinux system.

and management tools.

SELinux Mode of operation

Enforcing (mandatory)

Permissive (Loose)

Disabled (completely disabled)

Getenforce View current SELinux status

Setenforce 0 or 1 sets the current SELinux state

Permanent configuration: Vim/etc/selinux/config

Selinux=premissive

Firewall Policy Management (Firewall)

Role: Isolation

Block into the intranet, allow outside the network

System server: FIREWALLD

Administrative Tools: Firewall-cmd (command)

Firewall-cmd (Graphics)

View Firewall Service Status

Systemctl Status Firewalld.service

The default protection rule set is based on the location of the network location.

Public: Only a few services that allow access to native sshd are allowed.

Trusted: Allow any access.

Block: Reject any request for a visit.

Drop: Discards any data that is being visited.

Rules for firewall judgment: Match and stop.

1. First look at the source IP address in the request (client), in all regions

For the policy for that IP address, the request enters the zone if there is one.

2. Go directly to the default zone.

Firewall-cmd--zone=public--list-all View Zone rule information

Firewall-cmd--zone=public--add-service=http Add service

--permanent Options: Implementing Permanent settings

Firewall-cmd--permanent--zone=public--add-service=ftp

Firewall-cmd--reload Reload Firewall

Modify the default zone and do not need to add--permanent

Firewall-cmd--set-default-zone=block Modifying the default zone

Firewall-cmd--get-default-zone Viewing the default zone


Implementing a native port mapping

Port redirection for on-premises applications (port 1---port 2)

The request from the client to access port 1 is automatically mapped to the native Port 2.

Example: Visit two addresses to see the same page

Firefox http://172.25.0.11:5423--->172.25.0.11:80

Firewall-cmd--permanent--zone=public

--add-forward-port=port=5423:proto=tcp:toport=80

Firewall-cmd--reloa

Linux SELinux settings and Firewall service settings

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.