TCP Wrapper(tcpd), Snort, tcpdump, sendmail, iptables, PAM, syslog, nmap, access list, rate-limit 문법 비교

[TCP Wrapper(tcpd)]

○ 경로 : /etc/hosts.allow, /etc/hosts.deny

○ 예시 : in.telnetd : 192.168.0.1 : SPAWN /bin/mail -s "denied" root (이거는 hosts.deny 파일)

[Snort]

○ 경로 : /etc/snort/rules/local.rules

○ 예시 : alert tcp 192.168.0.1 any -> 192.168.1.254 80 (msg:"flooding"; content:"GET / HTTP/1."; nocase; depth:13; sid:1000001; threshold:type threshold, track by_src, count10, seconds 10;)

[tcpdump]

○ 예시 1 : tcpdump host 192.168.0.1 and \(A or B\)

○ 예시 2 : tcpdump -i eth0 tcp dst port 80 and not dst net 192.168.0.0/24

[sendmail]

○ 경로 : /etc/mail/access

○ 예시 : 

sunlinux.net RELAY

192.168.0.1 REJECT

[iptables]

○ 경로 : /etc/sysconfig/iptables

○ 예시 : iptables -A INPUT -p tcp -s 192.168.0.1 --dport:80 --tcp-flags SYN,FIN SYN -j DROP

[PAM]

○ 경로 : /etc/pam.d

○ 예시 : auth requisite pam_security.so

[syslog]

○ 경로 : /etc/syslogd.conf

○ 예시 : authpriv.info;auth.* /var/log/messages

[nmap]

○ 예시 : nmap -T4 -sT -p 1:1023 192.168.0.0 0.0.0.255 

[access list]

○ 예시 1 : access-list 150 permit icmp host 192.168.0.1 host 192.168.0.2 echo-reply

○ 예시 2 : access-list 100 deny ip 192.168.10.0 0.0.0.255 host 192.168.22.2

[rate-limit]

○ 예시 : rate-limit input access-group 150 2000000 250000 250000 conform-action transmit exceed-action drop