Linux-tcpdump Grab Bag-mail encryption Configuration-nmap scan-tcpwrap use

Grab Bag Tool tcpdump

[email protected] conf]# which tcpdump

/usr/sbin/tcpdump

[Email protected] conf]# Rpm-qf/usr/sbin/tcpdump

Tcpdump-4.0.0-5.20090921gitdf3cb4.2.el6.x86_64

[Email protected] conf]#

tcpdump [Options] [filter conditions]

Common monitoring options

-I, specifying the network interface for monitoring

-A, converted to acsii code for easy reading

-W, saving the packet information to the specified file

-R to read packet information from the specified file

Filter conditions for Tcpdump

Type: Host, net, port, Portrange

Direction: SRC, DST

Protocol: TCP, UDP, IP, WLAN, ARP 、......

Multiple condition combinations: and, or, not

TCPDUMP-A DST host 172.40.55.10 and TCP port 21

TCPDUMP-A DST host 172.40.55.10 and TCP port 110-w/tmp/mail2.cap

Tcpdump-a-r/tmp/mail.cap

Tcpdump-a-r/tmp/ftp.cap

Wireshark Protocol Analyzer

Yum-y Install Wireshark Wireshark-gnome

++++++++++++++++++++++++++++++++++++++

Message encryption (the public key is generated in the CDA build, where the generated public key is used directly)

Build mail server (172.40.55.10) DNS

Vim/etc/postfix/main.cf

Smtpd_use_tls = yes

#smtpd_tls_auth_only = yes

Smtpd_tls_key_file =/etc/pki/tls/private/mailsvr.key

Smtpd_tls_cert_file =/etc/pki/tls/certs/mailsvr.crt

: Wq

[Email protected] ~]# vim/etc/dovecot/conf.d/10-ssl.conf

SSL = yes

Ssl_cert = </etc/pki/tls/certs/www.crt

Ssl_key = </etc/pki/tls/private/www.key

: Wq

++++++++++++++++++++++++++++++++++

Nmap Scan Tool

Yum-y Install Nmap

Man Nmap

Nmap [Scan type] [options] < scan target ...>

Nmap 172.40.55.190

Common types of scans

-SS,TCP SYN Scan (semi-open)

-ST,TCP Connection Scan (full open)

-SU,UDP Scan

-SP,ICMP Scan

-A, target system comprehensive analysis

~]# nmap-p 21-22 192.168.4.0/24

172.40.55.10

~]# Nmap-su svr5.tarena.com

Nmap-n-SP 192.168.4.0/24

Nmap-a 172.40.55.190

+++++++++++++++++++++++++++++

Use of Tcpwrap

Can only be controlled by the XINETD service management process Chkconfig--list

Support libwrap.so Module Service LDD $ (which httpd) | grep libwrap

/etc/hosts.allow

/etc/hosts.deny

List of service names: Client address Lists

vsftpd,sshd:172.40.55.120,172.40.55.129

vsftpd,sshd:172.40.55.1?,172.40.55.20

vsftpd:172.40.55.0/255.255.255.0

vsftpd:172.40.55.*

Linux-tcpdump Grab Bag-mail encryption Configuration-nmap scan-tcpwrap use