APF(Advanced Policy Firewall)是 Rf-x Networks 出品的Linux环境下的软件防火墙,被大部分Linux服务器管理员所采用,使用iptables的规则,易于理解及使用.可算是Linux使用较多的防火墙.APF的配置参数众多,有效利用这些配置参数可加强你的服务器安全,APF应该在每一台Linux服务器中得到应用.
安装APF
1.下载最新的安装包并解压缩,APF项目详细信息.
#cd /usr/local/src#wget http://www.rfxn.com/downloads/apf-current.tar.gz #tar -zxf apf-current.tar.gz#cd apf-9.7-1/
2.执行安装
#sh ./install.sh
结束安装好你会得到一些信息:
...Installation Details:Install path: /etc/apf/Config path: /etc/apf/conf.apfExecutable path: /usr/local/sbin/apf...
3.进行详细配置
#vi /etc/apf/conf.apf
默认的参数适合大多数场合,按照需要进行修改即可
DEVEL_MODE="1" >> DEVEL_MODE="0"RAB="0" >> RAB="1"RAB_PSCAN_LEVEL="2" >> RAB_PSCAN_LEVEL="3"TCR_PASS="1" >> TCR_PASS="0"DLIST_PHP="0" >> DLIST_PHP="1"DLIST_SPAMHAUS="0" >> DLIST_SPAMHAUS="1"DLIST_DSHIELD="0" >> DLIST_DSHIELD="1"DLIST_RESERVED="0" >> DLIST_RESERVED="1"
流入端口过滤
# Common ingress (inbound) TCP portsIG_TCP_CPORTS="20,21,22,25,26,53,80,110,143,443,465,993,995,3306"# Common ingress (inbound) UDP portsIG_UDP_CPORTS="21,53,465"
流出端口过滤,虚拟主机推荐开启
# Outbound (egress) filteringEGF="1"# Common outbound (egress) TCP portsEG_TCP_CPORTS="21,22,25,26,37,43,53,80,110,113,443,465,3306"# Common outbound (egress) UDP portsEG_UDP_CPORTS="20,21,53,465"
ICMP过滤
# Common ICMP outbound (egress) types# 'internals/icmp.types' for type definition; 'all' is wildcard for anyEG_ICMP_TYPES="all"
另外还有两个值得注意的设置文件: /etc/apf/allow_hosts.rules 和 /etc/apf/deny_hosts.rules 可设置目标主机的过滤规则.如添加信任主机操作等.
启动APF
#/usr/local/sbin/apf -s
重启APF
#/usr/local/sbin/apf -r
查看运行日志
#tail -f /var/log/apf_log
添加为系统启动
#vi /etc/rc.local
在其中添加 “/usr/local/sbin/apf -s” 即可(不含双引号).
详细参数说明
usage /usr/local/sbin/apf [OPTION]-s|--start ......................... load all firewall rules-r|--restart ....................... stop (flush) & reload firewall rules-f|--stop........ .................. stop (flush) all firewall rules-l|--list .......................... list all firewall rules-t|--status ........................ output firewall status log-e|--refresh ....................... refresh & resolve dns names in trust rules-a HOST CMT|--allow HOST COMMENT ... add host (IP/FQDN) to allow_hosts.rules and immediately load new rule into firewall-d HOST CMT|--deny HOST COMMENT .... add host (IP/FQDN) to deny_hosts.rules and immediately load new rule into firewall-u|--remove HOST ................... remove host from [glob]*_hosts.rules and immediately remove rule from firewall-o|--ovars ......................... output all configuration options
此外,APF自9.6 (rev:2)版本之后增加了RAB模块.该模块取代了旧版本的antidos模块.可有效减轻拒绝服务攻击带来的影响,但需要iptables的内核模块ipt_recent的支持.如下图我在VPS上启动APF后的屏显,提示RAB模块无法启用.内核模块ipt_recent没有找到.因此建议在内核支持以及iptables模块支持的情况下使用.
Faq
Problem: If you get this error apf(xxxxx): {glob} unable to load iptables module (ip_tables), aborting.Solution: Try changing SET_MONOKERN=”0″ to SET_MONOKERN=”1″ , then apf -r
Problem: If you get this message: apf(xxxxx): {glob} !!DEVELOPMENT MODE ENABLED!! – firewall will flush every 5 minutes.Solution: you need to change DEVEL_MODE=1 to DEVEL_MODE=0, make sure your config is working first.
Via:http://www.securecentos.com/basic-security/install-firewall/
走自己的路,让别人说去吧