Ellhniko Firewalling kai Proxy Server HOWTO: Prohgmenes Morfes

9. Prohgmenes Morfes

Yparxei mia morfh poy 8a h8ela na asxolh8w prin kleisw ayth th tekmhriwsh. Ayth molis th skiagrafhsa kai pi8anws 8a ikanopoihsei arketous. Pantws, skeftomai oti to epomeno skiagrafhma 8a deijei perissotero prohgmenhs morfhs apo to na jeka8arisei kapoies erwthseis. Ean exete erwthseis pera apo aytes poy molis kalyca, h apla endiafereste gia thn eykamcia twn diakomistwn ejoysiodothshs kai twn firewalls, synexiste to diabasma.

9.1 Ena megalo diktyo me emfash sthn asfaleia

Peite, gia paradeigma, oti eiste o epikefalhs parastratiwtikhs organwshs kai 8elete na diktywsete th 8esh sas. Exete 50 H/Y kai ena ypodiktyo apo 32 IR ari8mous twn 5 stoixeiwn (bits). Xreiazeste diaforetika epipeda prosbashs mesa sto diktyo sas epeidh lete stoys akolou8oys sas diaforetika pragmata. Etsi, 8a xreiasthte na prostateusete sygkekrimena tmhmata toy diktuoy apo to ypoloipo.

Ta epipeda einai:

To ejwteriko epipedo. Ayto to epipedo poy deixnete stoys pantes. Edw einai poy fwnazete kai parallhlhte gia na parete neoys e8elontes.
Stratiwtiko Edw einai to epipedo apo atoma poy exoyn perasei pera apo to ejwteriko epipedo. Edw einai poy toys didaskete sxetika me thn evail kybernhsh kai sto pws na ftiaxnoyn bombes.
Mis8oforoi Edw einai poy ta pragmatika plana kratountai. Se ayto to epipedo einai apo8hkeymenes oles oi plhrofories panw sto pws h tritokosmikh kybernhsh phgainei na katakthsei to kosmo, ta plana sas emplekoyn tis Newt Gingrish, Oklahoma City, lown endiaferontos proionta kai ti pragmatika einai apo8hkeymeno mesa sta ypostega tis perioxhs 51.

H egkatastash toy diktuoy

Oi IR ari8moi einai katanemhmenoi ws ejhs:

1 ari8mos einai 192.168.2.2555, poy einai h dieu8ynsh ekpomphs kai den xrhsimopoieitai
23 apo tis 32 IR diey8unseis einai topo8ethmenes sta 23 mhxanhmata poy 8a einai prosbashma sto Internet.
1 epipleon IR phgainei se ena koyti linux se ayto to diktyo
1 epipleon phgainei se ena diaforetiko koyti linux se ayto to diktyo.
2 IR ari8moi pane sto dromologhth
4 afe8hkan sth panta, alla toys do8hkan ta topika onomata paul, ringo, john, kai george, apla gia na mperdeuoyn ta pragmata ligaki.
Ta prostateyomena diktya amfotera exoyn diey8unseis 192.168.2.xxx

Meta, duo xwrista diktya dhmioyrgh8hkan, to ka8ena se diaforetika dwmatia. Ayta dromologh8hkan mesw ypery8roy Ethernet etsi einai apolutws aorata sta ejwterika dwmatia. Eytyxws, ta ypery8ra ethernet doyleuoyn san ta kanonika ethernet.

Ayta ta diktya einai to ka8ena syndedemeno me apo ena koyti linux me mia epipleon IR dieu8ynsh.

Yparxei enas diakomisths arxeiwn (file server) poy syndeei ta duo prostateyomena diktya. Ayto ginetai epeidh gia thn katakthsh toy kosmoy emplekontai kai ychloteroi stratiwtes. O diakomisths arxeiwn krata thn dieu8ynsh 192.168.2.17 gia to Stratiwtiko diktyo kai thn 192.168.2.23 gia to Mis8oforiko diktyo. Aytos exei diaforetikes IR diey8unseis epeidh exei diaforetikes kartes Ethernet. To IR Forwarding panw se ayton einai kleisto.

To IR Forwarding einai kai sta duo koytia linux epishs kleisto. O dromologhths den 8a prow8ei paketa proorismena gia 192.168.2.xxx ektos ean den toy dhlw8ei kathgorhmatika na to kanei, etsi to Internet den 8a einai ikano na mpei mesa. O logos poy apenergopoih8hke to IP Forwarding edw egine giati etsi ta paketa apo to diktyo twn Stratiwtwn den 8a einai ikana na proseggisoyn to Mis8oforiko diktyo, kai to anapodo.

O diakomisths NFS mporei epishs na oristei gia na prosferei diaforetika arxeia se diaforetika diktya. Ayto ginetai xeirokinhta, kai me liga tryk me tis symbolikes syndeseis (symbolic links) mporei na ginei etsi wste ta koina arxeia na moirazontai se oloys. Xrhsimopoiwntas ayto to sthsimo kai allh mia ethernet karta mporoume na prosferoyme ayto ton ena diakomisth arxeiwn kai gia ta tria diktya.

H egkatastash twn ejoysiodothsewn

Twra, afou kai ta tria epipeda 8eloyn na einai ikana na symboyleuontai to diktyo gia toys dikous toys skoteinous skopous, kai oi treis xreiazontai na exoyn prosbash sto Internet, etsi den exoyme na ta trofodothsoyme edw me diakomistes ejoysiodothshs. Ta Mis8oforiko kai Stratiwtiko diktya einai pisw apo firewalls, etsi einai anagkaio na sthsoyme diakomistes ejoysiodothshs ekei.

Amfotera ta diktya 8a exoyn egkatasta8ei paromoia. Kai ta duo exoyn tis idies IR diey8unseis topo8ethmenes epanw toys. 8a petajw merikes parametroys, apla gia na kanw ta pragmata pio endiaferonta.

Kanenas den mporei na xrhsimopoiei to diakomisth arxeiwn gia prosbash sto Internet. Ayth ek8etei to diakomisth arxeiwn se ious kai alla dysaresta pragmata, kai ayto einai kapws sobaro, etsi einai ektos twn oriwn.
Den 8a epitrepoyme prosbash twn stratiwtwn sto World Wide Web. Aytoi einai se ekpaideysh, kai ayths ths fushs oi plhrofories, anakthshs dunamhs, mporei na apodeix8oun katastrofikes.

Etsi, to arxeio sockd.conf sto koyti linux twn Stratiwtwn 8a exei ayth th grammh:

    deny 192.168.2.17 255.255.255.255

kai ston Mis8oforwn to mhxanhma:

    deny 192.168.2.23 255.255.255.255

Kai, to koyti linux twn Stratiwtwn 8a exei thn ejhs grammh:

    deny 0.0.0.0 0.0.0.0 eq 80

Ayth leei na arnh8ei prosbash se oles tis mhxanes poy prospa8oun na apokthsoyn prosbash se porta ish (equal) me 80, thn http porta. Ayto akoma epitrepei oles tis alles yphresies, apla apagoreuei Web prosbash.

Meta, amfotera ta arxeia 8a exoyn:

    permit 192.168.2.0 255.255.255.0

gia na epitrecete se oloys toys ypologistes panw sto 192.168.2.xxx diktyo na xrhsimopoioun ayto to diakomisth ejoysiodothshs ektos gia aytous poy toys exei hdh apagoreyth. (p.x o diakomisths arxeiwn kai h Web prosbash apo to diktyo twn stratiwtwn.)

To arxeio sockd.conf twn Stratiwtwn 8a einai kapws etsi:

    deny 192.168.2.17 255.255.255.255
    deny 0.0.0.0 0.0.0.0 eq 80
    permit 192.168.2.0 255.255.255.0

kai twn Mis8oforwn kapws etsi:

    deny 192.168.2.23 255.255.255.255
    permit 192.168.2.0 255.255.255.0

Ayto ofeilei na exei ta panta ry8mismena swsta. Ka8e diktyo einai apomonwmeno analoga, me th swsth posothta allhlepidrashs. Oloi ofeiloyn na einai xaroumenoi.

Twra, katakthste to kosmo!

Shmeiwsh toy Metafrasth

Gia opoiodhpote la8os sth metafrash zhtw na me sygxwrhsete mias kai parolo poy edwsa to kallitero eayto moy se merika shmeia den mporesa na kanw akribh metafrash. Se merika shmeia yparxoyn agglikes lejeis poy htan adunato na tis metafrasw oute me th boh8eia lejikwn. Elpizw na deijete th katanohsh sas opws epishs kai sta or8ografika la8h :-> Parakalw osoys exoyn epishmanei la8h h anakribeies na tis shmeiwsoyn kai na tis steiloyn eite sth synthrhtria twn ellhnikwn HOWTO, Boula Sanida voulariba@hellug.gr, eite se emena proswpika. Opoiadhpote epipleon plhroforia gia toys firewalls poy pi8anws 8a boh8hsei sthn egkatastash toys, epikoinwnhste me th synthrhtria.

Panagiwths Tsakirhs mazestix@ath.forthnet.gr 26 Ioynioy 1999

Next Previous Contents