tailieunhanh - Router Security Configuration Guide phần 4

Điều này có thể được thực hiện bằng cách gán một mật khẩu để trình độ trung cấp, giống như 5 hoặc 10, và sau đó gán các lệnh đặc biệt để vinh dự màdanh sách đặc quyền exec mức 15 cho thấy truy cập danh sách các đặc quyền exec mức 15 cho thấy khai thác gỗ! nếu | Router Security Configuration Guide East config access-list 102 permit icmp any any echo East config access-list 102 permit icmp any any parameter-problem East config access-list 102 permit icmp any any packet-too-big East config access-list 102 permit icmp any any source-quench East config access-list 102 deny icmp any any log Another program that deals with certain ICMP message types is traceroute. Traceroute is a utility that prints the IP addresses of the routers that handle a packet as the packet hops along the network from source to destination. On Unix and Linux operating systems traceroute uses UDP packets and causes routers along the path to generate ICMP message types Time Exceeded and Unreachable . An attacker can use traceroute response to create a map of the subnets and hosts behind the router just as they could do with ping s ICMP Echo Reply messages. Therefore block naive inbound traceroute by including a rule in the inbound interface access list as shown in the example below ports 33400 through 34400 are the UDP ports commonly used for traceroute . East config access-list 100 deny udp any any range 33400 34400 log A router may be configured to allow outbound traceroute by adding a rule to the outbound interface access list as shown in the example below. East config access-list 102 permit udp any any range 33400 34400 log Distributed Denial of Service DDoS Attacks Several high-profile DDoS attacks have been observed on the Internet. While routers cannot prevent DDoS attacks in general it is usually sound security practice to discourage the activities of specific DDoS agents . zombies by adding access list rules that block their particular ports. The example below shows access list rules for blocking several popular DDoS attack tools. Note that these rules might also impose a slight impact on normal users because they block high-numbered ports that legitimate network clients may randomly select. You may choose to apply these rules only when an .