Linux SELinux settings and Firewall service settings

Security-enhanced Linux

NSA National Bureau led the Development, a set of enhanced Linux system security of the mandatory access control system,

Integrated into the Linux kernel (2.6 and above).

RHEL7 provides a preset protection strategy for users, processes, directories, and files based on the SELinux system.

and management tools.

SELinux Mode of operation

Enforcing (mandatory)

Permissive (Loose)

Disabled (completely disabled)

Getenforce View current SELinux status

Setenforce 0 or 1 sets the current SELinux state

Permanent configuration: Vim/etc/selinux/config

Selinux=premissive

Firewall Policy Management (Firewall)

Role: Isolation

Block into the intranet, allow outside the network

System server: FIREWALLD

Administrative Tools: Firewall-cmd (command)

Firewall-cmd (Graphics)

View Firewall Service Status

Systemctl Status Firewalld.service

The default protection rule set is based on the location of the network location.

Public: Only a few services that allow access to native sshd are allowed.

Trusted: Allow any access.

Block: Reject any request for a visit.

Drop: Discards any data that is being visited.

Rules for firewall judgment: Match and stop.

1. First look at the source IP address in the request (client), in all regions

For the policy for that IP address, the request enters the zone if there is one.

2. Go directly to the default zone.

Firewall-cmd--zone=public--list-all View Zone rule information

Firewall-cmd--zone=public--add-service=http Add service

--permanent Options: Implementing Permanent settings

Firewall-cmd--permanent--zone=public--add-service=ftp

Firewall-cmd--reload Reload Firewall

Modify the default zone and do not need to add--permanent

Firewall-cmd--set-default-zone=block Modifying the default zone

Firewall-cmd--get-default-zone Viewing the default zone

Implementing a native port mapping

Port redirection for on-premises applications (port 1---port 2)

The request from the client to access port 1 is automatically mapped to the native Port 2.

Example: Visit two addresses to see the same page

Firefox http://172.25.0.11:5423--->172.25.0.11:80

Firewall-cmd--permanent--zone=public

--add-forward-port=port=5423:proto=tcp:toport=80

Firewall-cmd--reloa

Linux SELinux settings and Firewall service settings