tailieunhanh - hack proofing linux a Guide to Open Source Security phần 8

VPN một lần đăng nhập, telecommuter có quyền truy cập vào mạng công ty. Cô nhận được các quyền người dùng và đặc quyền trên mạng của công ty là nếu cô ấy đăng nhập vật lý tại một trạm làm việc của công ty. Nếu telecommuter có một kết nối Internet nhanh, | 470 Chapter 9 Implementing a Firewall with Ipchains and Iptables Tools Traps. Modem Banks One Way Around Your Firewall One of the easiest ways to avoid a firewall is to find and exploit improperly configured modem banks. Many times modems are configured to allow access to all areas of the network and are often not protected or monitored very closely. As you establish your firewall consider inspecting any and all systems for modems. You should approach your modem bank with the same care and consideration as you would your firewall. Even modems not configured to receive incoming calls can be a danger. Consider also that an end user who connects to another network through a modem may be opening up a security breach. For example suppose that a user has mapped several drives mapped to a file server that contains sensitive information. If an end user connects regularly to a remote dial-up server it is possible for a malicious user to discover this connection and gain access to the mapped drives and hence to the sensitive information. Iptables Modules Table lists some of the most commonly used modules for Iptables. Table Iptables Masquerading Modules Module Description ipt_tables The module for Iptables support. As with all of these modules it is possible to compile the kernel so that all of these modules are included. ipt_LOG Support for advanced logging which includes the ability to log only initial bursts of traffic and capture an certain amount of traffic over a period of time. ipt_mangle ipt_nat The IP masquerading module. The NAT module. You can load these modules using insmod. Iptables masquerades the FTP RealAudio and IRC protocols by default. Implementing a Firewall with Ipchains and Iptables Chapter 9 471 Exercise Masquerading Connections Using Ipchains or Iptables 1. Configure your Linux system with at least two NICs. 2. Enable IP forwarding using the instructions given earlier in this chapter. 3. Using either Ipchains or Iptables .