![[PukiWiki]](image/../localimages/Atom.gif "[PukiWiki]")
設定
# ip route add default via 192.168.10.245 dev ens32
確認
# ip ro default via 192.168.10.245 dev ens32 default via 192.168.200.1 dev ens34 proto static metric 1024 192.168.10.0/24 dev ens32 proto kernel scope link src 192.168.10.205 192.168.200.0/24 dev ens34 proto kernel scope link src 192.168.200.3
UNIX System V系のinit→ systemdにより「ランレベル」から「ターゲット」に変更された。
# systemctl get-default graphical.target
これはSystem V系のランレベル5
# systemctl list-units -t target -a --no-pager UNIT LOAD ACTIVE SUB DESCRIPTION basic.target loaded active active Basic System cryptsetup.target loaded active active Encrypted Volumes emergency.target loaded inactive dead Emergency Mode final.target loaded inactive dead Final Step getty.target loaded active active Login Prompts graphical.target loaded active active Graphical Interface local-fs-pre.target loaded active active Local File Systems (Pre) local-fs.target loaded active active Local File Systems multi-user.target loaded active active Multi-User System network-online.target loaded inactive dead Network is Online network.target loaded active active Network (中略) LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 27 loaded units listed. To show all installed unit files use 'systemctl list-unit-files'.
# systemctl set-default multi-user.target rm '/etc/systemd/system/default.target' ln -s '/usr/lib/systemd/system/multi-user.target' '/etc/systemd/system/default.target' # systemctl get-default multi-user.target
# systemctl isolate graphical.target
| runlevel | systemdでの変更コマンド | |
| システム停止 | 0 | systemctl isolate poweroff.target |
| シングルユーザモード | 1 | systemctl isolate rescue.target |
| マルチユーザモード | 3 | systemctl isolate multi-user.target |
| グラフィカルユーザモード | 5 | systemctl isolate graphical.target |
| 再起動 | 6 | systemctl isolate reboot.target |
| 緊急モード | - | systemctl isolate emergency.target |
| SystemV系 | systemd | |
| サービス開始 | /etc/rc.d/ini.d/httpd start | systemctl start httpd |
| サービス停止 | /etc/rc.d/ini.d/httpd stop | systemctl stop httpd |
| サービス再起動 | /etc/rc.d/ini.d/httpd restart | systemctl restart httpd |
| 設定ファイルの再読み込み | /etc/rc.d/ini.d/httpd reload | systemctl relaod httpd |
| サービス状態 | /sbin/chkconfig httpd status | systemctl status httpd |
| サービス自動起動 | /sbin/chkconfig httpd on | systemctl enable httpd |
| サービス自動起動停止 | /sbin/chkconfig httpd off | systemctl disable httpd |
| ランレベル毎のサービスの有効無効表示 | /sbin/chkconfig --list | systemctl -t services list-unit-files |
| ランレベル毎の指定サービスの有効無効表示 | /sbin/chkconfig --list httpd | systemctl -t services list-unit-files (パイプ) grep httpd |
ネットワーク再起動
# systemctl restart NetworkManager.service
# systemctl list-units -t service -a | grep rsyslog rsyslog.service loaded active running System Logging Service
サービス起動
# systemctl start vsftpd
起動時のサービス設定
# systemctl enable vsftpd ln -s '/usr/lib/systemd/system/vsftpd.service' '/etc/systemd/system/multi-user.target.wants/vsftpd.service'
確認
# systemctl list-unit-files -t service | grep vsftpd vsftpd.service enabled ← ここを確認 vsftpd@.service disabled
起動時のサービス解除
# systemctl disable vsftpd rm '/etc/systemd/system/multi-user.target.wants/vsftpd.service'
確認
# systemctl list-unit-files -t service | grep vsftpd vsftpd.service disabled ← ここを確認 vsftpd@.service disabled
NIC毎に設定が可能になった。
NICにゾーンを割り当て管理している。ゾーンごとファイアウォールが定義でき、デフォルトで9個用意されている
「block、dmz、drop、external、home、internal、public、trusted、work」
現在のゾーンを表示
# firewall-cmd --get-active-zones public interfaces: ens32
NIC(ens32)にpublicというゾーンが割り振られている
ではpublicの設定は(デフォルトゾーン表示)
# firewall-cmd --list-all public (default, active) interfaces: ens32 sources: services: dhcpv6-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules:
または
# cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas. You do not trust the other computers \ on networks to not harm your computer. Only selected incoming connections are \ accepted.</description> <service name="dhcpv6-client"/> <service name="ssh"/> </zone>
sshとdhcpv6-clientが外部→内部パケット許可
すべてゾーン設定表示は
#firewall-cmd --list-all-zone block interfaces: sources: services: ports: masquerade: no forward-ports: icmp-blocks: rich rules: dmz interfaces: （略）
定義ファイルは/usr/lib/firewalld/zones/にある
一時追加は --permanentを省略(permanentなしの場合はすぐに適用されるので、--reloadは不要)
ゾーンpublicにtcp 12220ポートを追加
# firewall-cmd --zone=public --add-port=12220/tcp --permanent success # firewall-cmd --reload success
defaultゾーンの表示
# firewall-cmd --list-all public (default, active) interfaces: ens32 sources: services: dhcpv6-client ssh ports: 12220/tcp masquerade: no forward-ports: icmp-blocks: rich rules:
tcp 12220ポートを削除
# firewall-cmd --zone=public --remove-port=12220/tcp --permanent success # firewall-cmd --reload success
ゾーンtrusted（すべて許可）に変更
# firewall-cmd --set-default-zone=trusted success # firewall-cmd --get-default-zone trusted # firewall-cmd --list-all trusted (default, active) interfaces: ens32 sources: services: ports: masquerade: no forward-ports: icmp-blocks: rich rules:
/usr/lib/firewalld/servicesにいくつかあるのでそれを参考に作成
rsyslog.xml
<?xml version="1.0" encoding="utf-8"?> <service> <short>RSYSLOG</short> <description>RSYSLOG Edit By JE2ISM.</description> <port protocol="tcp" port="514"/> <port protocol="udp" port="514"/> </service>
追加コマンド
# firewall-cmd --zone=public --add-service=rsyslog --permanent success # firewall-cmd --reload success
はじめは2つのインターフェイスがゾーンpubilicに設定されている
# firewall-cmd --list-all public (default, active) interfaces: ens32 ens34 sources: services: dhcpv6-client ssh ports: masquerade: no forward-ports: icmp-blocks: rich rules:
インターフェイスens34をゾーンtrustedに変更
# firewall-cmd --zone=trusted --change-interface=ens34 success
アクティブゾーン表示
# firewall-cmd --get-active-zones public interfaces: ens32 trusted interfaces: ens34
デフォルトゾーンの変更
publicに変更
# firewall-cmd --set-default-zone=public success
ゾーンtrustedを表示
# firewall-cmd --list-all --zone=trusted trusted (active) interfaces: ens34 sources: services: ports: masquerade: no forward-ports: icmp-blocks: rich rules:
接続許可IPを指定
# firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -m conntrack --ctstate \ NEW -m tcp -p tcp --dport 22 -s 192.168.10.47/32 -j ACCEPT success
それ以外を禁止
# firewall-cmd --direct --add-rule ipv4 filter INPUT 3 -m conntrack --ctstate \NEW -m tcp -p tcp --dport 22 -j REJECT success
条件解除
# firewall-cmd --direct --remove-rule ipv4 filter INPUT 1 -m conntrack\ --ctstate NEW -m tcp -p tcp --dport 22 -s 192.168.10.47/32 -j ACCEPT success
確認
# iptables -L -n --line-number Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 3 INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0 4 INPUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0 5 INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 6 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 7 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 3 FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0 4 FORWARD_IN_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0 5 FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0 6 FORWARD_OUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0 7 FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 8 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 9 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited (略) Chain INPUT_ZONES (1 references) num target prot opt source destination 1 IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto] 2 IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto] 3 IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto] Chain INPUT_ZONES_SOURCE (1 references) num target prot opt source destination Chain INPUT_direct (1 references) num target prot opt source destination 1 ACCEPT tcp -- 192.168.10.47 0.0.0.0/0 ctstate NEW tcp dpt:22 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2 REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW tcp dpt:22 reject-with icmp-port-unreachable ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Chain IN_public (3 references) num target prot opt source destination 1 IN_public_log all -- 0.0.0.0/0 0.0.0.0/0 2 IN_public_deny all -- 0.0.0.0/0 0.0.0.0/0 3 IN_public_allow all -- 0.0.0.0/0 0.0.0.0/0 Chain IN_public_allow (1 references) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 ctstate NEW 2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW 3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:514 ctstate NEW 4 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:514 ctstate NEW Chain IN_public_deny (1 references) num target prot opt source destination Chain IN_public_log (1 references) num target prot opt source destination Chain OUTPUT_direct (1 references) num target prot opt source destination
CentOS7のプロセス関係
ファイアウオール関係
