存档

2010年1月 的存档

LINUX安全防范 入侵检测

2010年1月22日
没有评论

今日在系统/var/log/secure文件里发现大量的验证错误日志

Jan 22 01:04:27 tony sshd[6729]: Invalid user fdasfasd from 116.22.243.188
Jan 22 01:04:27 tony sshd[6730]: input_userauth_request: invalid user fdasfasd
Jan 22 01:04:28 tony sshd[6729]: pam_unix(sshd:auth): check pass; user unknown
Jan 22 01:04:28 tony sshd[6729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.22.243.188
Jan 22 01:04:28 tony sshd[6729]: pam_succeed_if(sshd:auth): error retrieving information about user admin

经过检查发现是明显的密码攻击 admin为攻击者尝试的用户名 管理员应该尽可能的关闭root的直接登陆

在/etc/ssh/sshd_config 设置PermitRootLogin no

下面发一条有趣的命令 可以统计攻击者使用用户的频率

grep pam_succeed_if /var/log/secure* | awk '{print $12}' | sort | uniq -c

作者: admin 分类: Linux&Unix 标签:

2010年1月16日
没有评论

系统所有环境都是采用yum安装
安装系统时设置标准的主机名

  1. mail.hamigua.com

复制代码

改变系统语言
vi /etc/sysconfig/i18n

  1. LANG="en_US"
  2. #LANG="zh_CN.UTF-8"
  3. SUPPORTED="zh_CN.UTF-8:zh_CN:zh:zh_TW.UTF-8:zh_TW:zh:en_US.UTF-8:en_US:en"
  4. SYSFONT="latarcyrheb-sun16"

复制代码

关闭selinux
vi /etc/selinux/config
去除IPV6

vi /etc/modprobe.conf

  1. alias net-pf-10 off
  2. alias ipv6 off

复制代码

修改网关
vi /etc/sysconfig/network

设IP
vi /etc/sysconfig/network-scripts/ifcfg-eth0

定义yum的非官方库
vi /etc/yum.repos.d/dag.repo

  1. [dag]
  2. name=Dag RPM Repository for Red Hat Enterprise Linux
  3. baseurl=http://apt.sw.be/redhat/el$releasever/en/$basearch/dag
  4. gpgcheck=1
  5. enabled=1
  6. gpgkey=http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt

复制代码

关闭不需要的服务
chkconfig mcstrans off
chkconfig restorecond off
chkconfig ip6tables off
chkconfig iptables off
chkconfig netfs off

安装必需软件
yum -y install ntsysv ntp telnet wget rsync vixie-cron logwatch perl-Unix-Syslog perl-Net-Daemon perl-PlRPC perl-DBI perl-DBD-MySQL  freetype-demos freetype-devel libart_lgpl-devel libpng libpng-devel perl-Time-HiRes perl-Time-HiRes-Value perl-File-Tail  perl-libwww-perl perl-HTML-Parser perl-HTML-Tagset perl-IO-stringy perl-IO-Multiplex perl-MailTools perl-TimeDate perl-Convert-ASN1 perl-Convert-BinHex perl-MIME-tools perl-FCGI perl-GD rrdtool rrdtool-perl apr-devel apr-docs apr-util-devel apr-util-docs giflib libgdiplus mono-core dbus-sharp dbus-sharp-devel dbus-glib-devel dbh dbh-devel pcre pcre-devel httpd httpd-devel httpd-manual mysql mysql-devel mysql-server cyrus-sasl cyrus-sasl-plain bind bind-chroot amavisd-new clamd clamav clamav-db spamassassin bison bzip2-devel expect fam-devel flex freetype-devel gcc gcc-c++ gdbm-devel libc-client-devel libjpeg-devel libmcrypt libmcrypt-devel libpng-devel libxslt-devel make rpm-build mod_ssl php php-gd php-mysql php-mbstring php-mcrypt phpmyadmin perl-Mon perl-Authen-PAM perl-Filter perl-Net_SSLeay.pm perl-Convert-BER perl-URI   perl-XML-SAX perl-Crypt-Blowfish perl-Crypt-CBC perl-Date-Calc  ncurses-devel net-snmp-devel libtool openssl openssl-devel openssl-perl pam-devel pkgconfig postgresql-devel zlib-devel

启动mysql和apahce
chkconfig httpd on
chkconfig mysqld on

升级包
yum -y update

重启系统
reboot

重新生成rpm包安装postfix
cd /usr/local/src
wget http://mirror.centos.org/centos/ ... fix-2.3.3-2.src.rpm
rpm -ivh postfix-2.3.3-2.src.rpm
cd /usr/src/redhat/SPECS
vi postfix.spec

  1. %define LDAP 2
  2. %define mysql 1
  3. %define pcre 1
  4. %define sasl 2
  5. %define tls 1
  6. %define ipv6 0

复制代码

rpmbuild -bb postfix.spec
rpm -Uvh /usr/src/redhat/RPMS/i386/postfix-2.3.*

新建邮件用户、组
/usr/sbin/groupadd -g 1000 vgroup
/usr/sbin/useradd -g 1000 -u 1000 -M -s /bin/false vuser

安装courier-authlib
cd /usr/local/src
wget http://downloads.sourceforge.net ... hlib-0.61.0.tar.bz2
tar jxvf courier-authlib-0.61.0.tar.bz2
cd courier-authlib-0.61.0

  1. ./configure \
  2. --prefix=/usr/local/courier-authlib \
  3. --without-stdheaderdir \
  4. --without-authuserdb \
  5. --without-authpam \
  6. --without-authldap \
  7. --without-authpwd \
  8. --without-authshadow \
  9. --without-authvchkpw \
  10. --without-authpgsql \
  11. --without-authcustom \
  12. --with-authmysql \
  13. --with-redhat
  14. make
  15. make install
  16. make install-configure
  17. echo "/usr/local/courier-authlib/lib/courier-authlib" >> /etc/ld.so.conf

复制代码

ldconfig
ldconfig -v
cp courier-authlib.sysvinit /etc/rc.d/init.d/courier-authlib
chmod 755 /etc/rc.d/init.d/courier-authlib
chkconfig --add courier-authlib
chkconfig courier-authlib on
chmod 755 /usr/local/courier-authlib/var/spool/authdaemon
mv /usr/local/courier-authlib/etc/authlib/authmysqlrc /usr/local/courier-authlib/etc/authlib/authmysqlrc.bak

vi /usr/local/courier-authlib/etc/authlib/authmysqlrc

  1. MYSQL_SERVER            localhost
  2. MYSQL_USERNAME          extmail
  3. MYSQL_PASSWORD          ext00mail
  4. MYSQL_SOCKET            /var/lib/mysql/mysql.sock
  5. MYSQL_PORT              3306
  6. MYSQL_OPT               0
  7. MYSQL_DATABASE          extmail
  8. MYSQL_USER_TABLE        mailbox
  9. MYSQL_CRYPT_PWFIELD     password
  10. MYSQL_UID_FIELD         uidnumber
  11. MYSQL_GID_FIELD         gidnumber
  12. MYSQL_LOGIN_FIELD       username
  13. MYSQL_HOME_FIELD        homedir
  14. MYSQL_NAME_FIELD        name
  15. MYSQL_MAILDIR_FIELD     maildir
  16. MYSQL_QUOTA_FIELD       quota
  17. MYSQL_SELECT_CLAUSE     SELECT username,password,"",uidnumber,gidnumber,             \
  18.                         CONCAT('/home/domains/',homedir),                            \
  19.                         CONCAT('/home/domains/',maildir),                            \
  20.             quota,                                                       \
  21.             name,                                                        \
  22.             CONCAT("disableimap=",disableimap,",disablepop3=",           \
  23.             disablepop3,",disablewebmail=",disablewebmail,               \
  24.             ",disablesmtpd=",disablesmtpd,",disablesmtp=",               \
  25.             disablesmtp,",disablenetdisk=",disablenetdisk,               \
  26.             ",netdiskquota=",netdiskquota)                               \
  27.             FROM mailbox                                                 \
  28.             WHERE username = '$(local_part)@$(domain)'                   \
  29.                         DEFAULT_DOMAIN        hamigua.com

复制代码

设置smtpd
vi /usr/lib/sasl2/smtpd.conf

  1. pwcheck_method: authdaemond
  2. log_level: 3
  3. mech_list: PLAIN LOGIN
  4. authdaemond_path:/usr/local/courier-authlib/var/spool/authdaemon/socket

复制代码

service courier-authlib start
ln -s /usr/local/courier-authlib/bin/courierauthconfig /usr/bin/courierauthconfig

安装maildorp
cd /usr/local/src
wget http://downloads.sourceforge.net/courier/maildrop-2.0.4.tar.bz2
tar jvxf maildrop-2.0.4.tar.bz2
cd maildrop-2.0.4

  1. ./configure   \
  2. --enable-sendmail=/usr/sbin/sendmail \
  3. --enable-trusted-users='root vuser' \
  4. --enable-syslog=1 \
  5. --enable-maildirquota \
  6. --enable-maildrop-uid=1000 \
  7. --enable-maildrop-gid=1000 \
  8. --with-trashquota \
  9. --with-dirsync
  10. make
  11. make install

复制代码

maildrop -v

安装courier-imap
cd /usr/local/src
wget http://downloads.sourceforge.net ... -imap-4.4.1.tar.bz2
tar jvxf courier-imap-4.4.1.tar.bz2
cd courier-imap-4.4.1

  1. ./configure \
  2. --prefix=/usr/local/courier-imap \
  3. --with-redhat \
  4. --enable-unicode \
  5. --disable-root-check \
  6. --with-trashquota \
  7. --without-ipv6 COURIERAUTHCONFIG='/usr/local/courier-authlib/bin/courierauthconfig'
  8. make
  9. make install

复制代码

cp /usr/local/courier-imap/etc/imapd.dist /usr/local/courier-imap/etc/imapd
cp /usr/local/courier-imap/etc/imapd-ssl.dist /usr/local/courier-imap/etc/imapd-ssl
cp /usr/local/courier-imap/etc/pop3d.dist /usr/local/courier-imap/etc/pop3d
cp /usr/local/courier-imap/etc/pop3d-ssl.dist /usr/local/courier-imap/etc/pop3d-ssl
cp courier-imap.sysvinit /etc/rc.d/init.d/courier-imapd
chmod 755 /etc/rc.d/init.d/courier-imapd
chkconfig --add courier-imapd

配置pop
vi /usr/local/courier-imap/etc/pop3d

  1. POP3DSTART=YES
  2. MAXDAEMONS=512
  3. MAXPERIP=4000

复制代码

将extmail,extman,slock安装包上传

安装extmail
cd /usr/local/src
mkdir /var/www/extsuite
tar -zxvf extmail-1.0.5.tar.gz
cp -r extmail-1.0.5 /var/www/extsuite/extmail
cd /var/www/extsuite/extmail
cp webmail.cf.default webmail.cf
chown -R vuser:vgroup /var/www/extsuite/extmail/cgi/

配置extmail

  1. sed -i "s#SYS_MYSQL_USER = db_user#SYS_MYSQL_USER = extmail#g" /var/www/extsuite/extmail/webmail.cf
  2. sed -i "s#SYS_MYSQL_PASS = db_pass#SYS_MYSQL_PASS = ext00mail#g" /var/www/extsuite/extmail/webmail.cf
  3. sed -i "s#SYS_SHOW_SIGNUP = 1#SYS_SHOW_SIGNUP = 0#g" /var/www/extsuite/extmail/webmail.cf
  4. sed -i "s#SYS_MESSAGE_SIZE_LIMIT = 5242880#SYS_MESSAGE_SIZE_LIMIT = 52428800#g" /var/www/extsuite/extmail/webmail.cf

复制代码

安装extman
cd /usr/local/src
tar -zxvf extman-0.2.5.tar.gz
cp -r extman-0.2.5 /var/www/extsuite/extman/
chown -R vuser:vgroup /var/www/extsuite/extman/cgi/
mkdir /var/www/extsuite/extman/tmp
chown -R vuser:vgroup /var/www/extsuite/extman/tmp

配置extman

  1. sed -i "s#SYS_SESS_DIR = /tmp/extman/#SYS_SESS_DIR = /var/www/extsuite/extman/tmp/#g" /var/www/extsuite/extman/webman.cf
  2. sed -i "s#SYS_MYSQL_PASS = webman#SYS_MYSQL_PASS = web00man#g" /var/www/extsuite/extman/webman.cf

复制代码

vi /var/www/extsuite/extman/docs/init.sql
将extmail.org改为你的域名比如hamigua.com

导入数据库

  1. mysql -u root -p < /var/www/extsuite/extman/docs/extmail.sql
  2. mysql -u root -p < /var/www/extsuite/extman/docs/init.sql

复制代码

生成extmail系统管理员的用户目录
cd /var/www/extsuite/extman/tools
./maildirmake.pl /home/domains/hamigua.com/postmaster/Maildir
chown -R vuser:vgroup /home/domains

cp -r /var/www/extsuite/extman/addon/mailgraph_ext/ /usr/local/mailgraph_ext/
echo "/usr/local/mailgraph_ext/mailgraph-init start" >> /etc/rc.d/rc.local
echo "/usr/local/mailgraph_ext/qmonitor-init start" >> /etc/rc.d/rc.local

cp /var/www/extsuite/extman/docs/mysql_virtual_* /etc/postfix/

  1. sed -i "s#password = extmail#password = ext00mail#g" /etc/postfix/mysql_virtual_alias_maps.cf
  2. sed -i "s#password = extmail#password = ext00mail#g" /etc/postfix/mysql_virtual_domains_maps.cf
  3. sed -i "s#password = extmail#password = ext00mail#g" /etc/postfix/mysql_virtual_limit_maps.cf
  4. sed -i "s#password = extmail#password = ext00mail#g" /etc/postfix/mysql_virtual_mailbox_maps.cf
  5. sed -i "s#password = extmail#password = ext00mail#g" /etc/postfix/mysql_virtual_sender_maps.cf

复制代码

安装slockd
cd /usr/local/src
tar -zxvf slockd-0.2.tar.gz
cp -r slockd-0.2 /usr/local/slockd
echo "/usr/local/slockd/slockd-init start" >> /etc/rc.d/rc.local

配置apache
vi /etc/httpd/conf/httpd.conf

  1. #AddDefaultCharset UTF-8
  3. NameVirtualHost *:80
  4. Include conf/vhost_*.conf
  6. vi /etc/httpd/conf/vhost_extmail.conf
  7. # VirtualHost for ExtMail Solution
  8. <VirtualHost *:80>
  9. ServerName mail.fsnws.com
  10. DocumentRoot /var/www/extsuite/extmail/html/
  11. LoadModule fastcgi_module modules/mod_fastcgi.so
  12. <Ifmodule mod_fastcgi.c>
  13. FastCgiExternalServer /usr/bin/dispatch.fcgi -host 127.0.0.1:8888
  14. </Ifmodule>
  15. Alias /extmail/cgi/ /usr/bin/dispatch.fcgi/
  16. <Location "/extmail/cgi">
  17. SetHandler fastcgi-script
  18. </Location>
  20. #ScriptAlias /extmail/cgi/      /var/www/extsuite/extmail/cgi/
  21. Alias /extmail                  /var/www/extsuite/extmail/html/
  22. ScriptAlias /extman/cgi/        /var/www/extsuite/extman/cgi/
  23. Alias /extman                   /var/www/extsuite/extman/html/
  24. Alias /phpmyadmin               /var/www/extsuite/phpmyadmin/
  25. Alias /phpldapadmin             /var/www/extsuite/phpldapadmin/htdocs/
  26. # Suexec config
  27. SuexecUserGroup vuser vgroup
  28. </VirtualHost>

复制代码

安装fastcgi模块
cd /usr/local/src
wget http://www.fastcgi.com/dist/mod_fastcgi-2.4.6.tar.gz
tar xfz mod_fastcgi-2.4.6.tar.gz
cd mod_fastcgi-2.4.6
ln -s ../../usr/lib/httpd/build /etc/httpd/build
cp Makefile.AP2 Makefile
make top_dir=/etc/httpd install
echo "/var/www/extsuite/extmail/dispatch-init start" >> /etc/rc.d/rc.local
/var/www/extsuite/extmail/dispatch-init start

配置phpmyadmin
ln -s /usr/share/phpmyadmin /var/www/extsuite/phpmyadmin
vi /usr/share/phpmyadmin/config.inc.php

  1. $cfg['blowfish_secret'] = '3234ffet43';

复制代码

配置postfix
vi /etc/postfix/main.cf
vi /etc/postfix/master.cf
vi /etc/amavisd.conf

  1. $max_servers = 20;
  2. $mydomain = 'example.com'
  3. ['ClamAV-clamd',
  4.    \&ask_daemon, ["CONTSCAN {}\n", "/tmp/clamd.socket"],
  5.    qr/\bOK$/, qr/\bFOUND$/,
  6.    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
  8. $final_virus_destiny      = D_DISCARD;
  9. $final_banned_destiny     = D_BOUNCE;
  10. $final_spam_destiny       = D_PASS;
  11. $final_bad_header_destiny = D_PASS;

复制代码

注：初始安装账户extmail，extman密码可能有点问题登陆不进去，这个可以用phpmyadmin来设置密码，默认phpmyadmin root密码为空
$1$ITIH4eKD$s9C2wHpLQXOLkzY5U1jYL. = extmail
而后再从extman后台去修改密码就可以了。

usermod -G amavis clamav
vi /etc/postfix/aliases

  1. virusalert:    root
  2. spam.police:   root
  3. postfix:       root@hamigua.com
  4. newaliases

复制代码

touch /etc/postfix/recipient_bcc
touch /etc/postfix/sender_bcc
postmap /etc/postfix/transport
postmap /etc/postfix/recipient_bcc
postmap /etc/postfix/sender_bcc

以后升级命令:
yum update --exclude postfix --exclude  postfix-pflogsumm
参考：
www.extmail.org论坛 wjkhubei写得centos5.3+extmail1.0.8+extman+spamassassin    http://www.extmail.org/forum/thread-10282-1-4.html

作者: admin 分类: Linux&Unix 标签: