Day 76 (Firewall)

<목차>

1. ACL

2. 구성도

3. 세부 설정

---

1. ACL

Source	Destination	Service	Action
up_side_admin_win10	middle_side_dns_linux	ssh	allow
	middle_side_ftp_linux
	middle_side_web_linux
	under_side_dns_linux
	under_side_DB_linux
under_side_dns_linux	under_side_admin_win10	dns	allow
	under_side_DB_linux	dns	allow
under_side_DB_linux	middle_side_web_linux	oracle	allow
middle_side_dns_linux	middle_side_ftp_linux	dns	allow
	middle_side_web_linux	dns	allow
middle_side_ftp_linux	up_side_network	ftp	allow
middle_side_web_linux	up_side_network	web	allow
any	any	any	drop

 

2. 구성도

1) 네트워크 구성도

2) 방화벽 설정

구성 host들

방화벽 규칙

 

3. 세부 설정

1) DNS작동

[root@dns ~]# cat /etc/resolv.conf // dns주소 변경
# Generated by NetworkManager
nameserver 192.168.112.151
[root@dns ~]# cat /etc/named.conf // dns 정보 읽어올 파일 설정
options {
        directory       "/var/named";
};
zone "." {
        type hint;
        file "named.ca";
};

zone "bst.ykd" {
        type master;
        file "bst.ykd";
};

[root@dns ~]# cat /var/named/bst.ykd // DB client web서버로 연결을 위한 zone파일 설정
$TTL    1D
@       IN      SOA     ns.bst.ykd.   root.ns.bst.ykd. (
                                                                1       ; Serial
                                                                1D      ; Refresh
                                                                1H      ; Retry
                                                                1W      ; Expire
                                                                3H )    ; Minimum
; Name Server
        IN      NS      ns.bst.ykd.
; Host Address
        IN      A       192.168.112.154
ns      IN      A       192.168.112.154
www     IN      CNAME   ns

2) Oracle Client 작동

TNS-12545: Connect failed because target host or object does not exist
 TNS-12560: TNS:protocol adapter error
  TNS-00515: Connect failed because target host or object does not exist
   Linux Error: 99: Cannot assign requested address // /etc/hosts & tnsnames.ora확인

 

3) 통합 작동확인

Web서버와 다른 네트워크인 under_side에 있는 Window10에서도 DNS서버가 정상작동 확인되고 Web서버와 정상 연결되는 것을 확인했다.

 

4) FTP작동 확인

기존 보안 요구 명세 조건 적용 내용 : https://nwblog06.tistory.com/122

Day 57 (FTP보안명세구현_최종본)

FTP서비스에서 Passive mode에서 사용할 포트를 지정해주었다.

[root@m-ftp ~]# vi /etc/vsftpd/vsftpd.conf
...
listen_ipv6=YES

pam_service_name=vsftpd
tcp_wrappers=YES

userlist_enable=YES
userlist_deny=YES

chroot_local_user=YES
chroot_list_enable=YES
allow_writeable_chroot=YES
chroot_list_file=/etc/vsftpd/chroot_list

pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1030

[root@m-ftp ~]# cat /etc/vsftpd/user_list
# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
st01
st02
st03
...

[root@m-ftp ~]# vi /etc/vsftpd/chroot_list
root