Ipkungfu Tulemüür - Revision history

Hniidas: /* Parameetrid */

2015-05-22T09:59:40Z

Parameetrid

← Older revision		Revision as of 12:59, 22 May 2015
Line 156:		Line 156:


	*Konfiguratsioonifailide asukohad [http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]		*Konfiguratsioonifailide asukohad: [http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]
	**/etc/ipkungfu/ipkungfu.conf		**/etc/ipkungfu/ipkungfu.conf
	**/etc/ipkungfu/advanced.conf		**/etc/ipkungfu/advanced.conf
Line 168:		Line 168:


	*ReadMe ja FAQ dokumendid leiab kaustast:		*ReadMe ja FAQ dokumendid leiab kaustast: [http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]
	**/usr/share/doc/ipkungfu		**/usr/share/doc/ipkungfu
	**/usr/share/doc/ipkungfu/AUTHORS		**/usr/share/doc/ipkungfu/AUTHORS

Hniidas: /* Parameetrid */

2015-05-22T09:59:02Z

Parameetrid

← Older revision		Revision as of 12:59, 22 May 2015
Line 166:		Line 166:
	**/etc/ipkungfu/services.conf		**/etc/ipkungfu/services.conf
	**/usr/sbin/ipkungfu		**/usr/sbin/ipkungfu


			*ReadMe ja FAQ dokumendid leiab kaustast:
			**/usr/share/doc/ipkungfu
	**/usr/share/doc/ipkungfu/AUTHORS		**/usr/share/doc/ipkungfu/AUTHORS
	**/usr/share/doc/ipkungfu/README		**/usr/share/doc/ipkungfu/README
Line 172:		Line 176:
	**/usr/share/doc/ipkungfu/COPYING		**/usr/share/doc/ipkungfu/COPYING


	*ReadMe ja FAQ dokumendid leiab kaustast:
	~~/usr/share/doc/ipkungfu~~

	*Lisainfo [http://manpages.ubuntu.com/manpages/trusty/man8/iptables.8.html]		*Lisainfo [http://manpages.ubuntu.com/manpages/trusty/man8/iptables.8.html]

Hniidas at 08:47, 14 May 2015

2015-05-14T08:47:42Z

← Older revision		Revision as of 11:47, 14 May 2015
Line 182:		Line 182:
	all of these files. They are located in /etc/ipkungfu/ and are:		all of these files. They are located in /etc/ipkungfu/ and are:

	accept_hosts.conf : IP addresses of hosts or nets to always ACCEPT and		accept_hosts.conf : IP addresses of hosts or nets to always ACCEPT and
	optionally the ports they are allowed to access		optionally the ports they are allowed to access

	advanced.conf : Configuration settings for advanced users.		advanced.conf : Configuration settings for advanced users.

	custom.conf : Here you will find sample rules several sample rules already		custom.conf : Here you will find sample rules several sample rules already
	predefined. This is where you would add any custom rules you want applied		predefined. This is where you would add any custom rules you want applied
	to your firewall. This file is parsed first, before any other rules are		to your firewall. This file is parsed first, before any other rules are
	added by ipkungfu, to ensure that none of ipkungfu's rules override the		added by ipkungfu, to ensure that none of ipkungfu's rules override the
	rules in this file.		rules in this file.

	deny_hosts.conf : You can list IP addresses/subnets:ports:protocols you wish		deny_hosts.conf : You can list IP addresses/subnets:ports:protocols you wish
	to block completely. This file is parsed before accept_hosts.conf and takes		to block completely. This file is parsed before accept_hosts.conf and takes
	precedence over it.		precedence over it.

	ipkungfu.conf : This is the main configuration file. Edit this file, if		ipkungfu.conf : This is the main configuration file. Edit this file, if
	nothing else. For most people, this is the only file that needs to be		nothing else. For most people, this is the only file that needs to be
	edited to set up a decent firewall, with or without Internet connection		edited to set up a decent firewall, with or without Internet connection
	sharing.		sharing.
	WARNING: ALLOW_TCP_IN and ALLOW_UDP_IN are now deprecated and mantained only		WARNING: ALLOW_TCP_IN and ALLOW_UDP_IN are now deprecated and mantained only
	for backward compatability. Now use services.conf.		for backward compatability. Now use services.conf.

	log.conf : This file specifies what the firewall will log and the rate at		log.conf : This file specifies what the firewall will log and the rate at
	which it is logged. By default, nearly all dropped packets are logged.		which it is logged. By default, nearly all dropped packets are logged.
	To turn logging off on a particular item, change the 1 (log) to a		To turn logging off on a particular item, change the 1 (log) to a
	0 (don't log). The default location of the log on most systems is		0 (don't log). The default location of the log on most systems is
	/var/log/syslog. Consult your syslogd configuration to find out where		/var/log/syslog. Consult your syslogd configuration to find out where
	kernel logs are stored.		kernel logs are stored.

	redirect.conf : Use this file to specify where certain traffic should be		redirect.conf : Use this file to specify where certain traffic should be
	routed on the SAME machine. If you want to redirect ports that come in on		routed on the SAME machine. If you want to redirect ports that come in on
	one port, and should go to another, set them up here. There is a single		one port, and should go to another, set them up here. There is a single
	entry here that is commented out by default- tcp:443:10000 which		entry here that is commented out by default- tcp:443:10000 which
	redirects incoming https traffic on port 443 to webmin on port 10000.		redirects incoming https traffic on port 443 to webmin on port 10000.
	Please see the file for more information.		Please see the file for more information.

	vhosts.conf : If you have virtual hosts, (servers on machines behind your		vhosts.conf : If you have virtual hosts, (servers on machines behind your
	gateway), define the routing rules here. This file makes it possible to		gateway), define the routing rules here. This file makes it possible to
	have servers behind the firewall, with private IP addresses, accessible		have servers behind the firewall, with private IP addresses, accessible
	from the Internet.		from the Internet.

	pre.conf : This is parsed and executed as a bash script prior to running		pre.conf : This is parsed and executed as a bash script prior to running
	ipkungfu.		ipkungfu.

	post.conf : This is parsed and executed as a bash script after ipkungfu		post.conf : This is parsed and executed as a bash script after ipkungfu
	has completed execution.		has completed execution.

	services.conf : Here you keep all of your rules previously defined in		services.conf : Here you keep all of your rules previously defined in
	ipkungfu.conf as ALLOW_TCP_IN and ALLOW_UDP_IN, plus more. Edit the file,		ipkungfu.conf as ALLOW_TCP_IN and ALLOW_UDP_IN, plus more. Edit the file,
	it's self explanatory.		it's self explanatory.

			Most people, especially those with very simple configurations, will only
			need to edit /etc/ipkungfu/ipkungfu.conf if anything at all. As of 0.5.1
			ipkungfu does a lot of detecting and guessing for the main configuration
			parameters unless you specify their values in ipkungfu.conf. This should
			work for most people. To go over the list of variables as ipkungfu
			knows them, run ipkungfu --show-vars. If anything looks wrong, edit the
			appropriate configuration file accordingly.

			A "#" is a comment. When a line begins with #, the whole line is ignored. If
			you want enable an option in a configuration file that is commented out,
			simply remove the leading #. If you wish to remove an option, place a #
			in front of that line.

			Note that anytime you edit a configuration file, you MUST rerun the ipkungfu
			as outlined below in order for changes to take effect.
			ipkungfu

			Most problems can be resolved by checking your settings in your configuration
			files.
			Many users overlook certain settings, so you may want to double-check them to
			be sure.
			Remember to run ipkungfu again (/usr/local/sbin/ipkungfu) after making any
			changes to the configuration files (located in /etc/ipkungfu/).
			Please see the FAQ for more troubleshooting issues and resolutions.

	=Testimine=		=Testimine=

Hniidas at 20:55, 13 May 2015

2015-05-13T20:55:40Z

← Older revision		Revision as of 23:55, 13 May 2015
Line 7:		Line 7:
	=Mis on Ipkungfu=		=Mis on Ipkungfu=
	Tegemist on iptables[http://linux.die.net/man/8/iptables] baasil loodud, kuid lihtsustatud Linuxi tulemüüriga mis hõlbustab võrguliikluse administreerimist. Rakendus töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on omakorda kerneli tulemüürimooduli Netfilter'i kasutajaliides. Tänu lihtsale menüüle sobib rakendus nii algajale kui eksperdile.		Tegemist on iptables[http://linux.die.net/man/8/iptables] baasil loodud, kuid lihtsustatud Linuxi tulemüüriga mis hõlbustab võrguliikluse administreerimist. Rakendus töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on omakorda kerneli tulemüürimooduli Netfilter'i kasutajaliides. Tänu lihtsale menüüle sobib rakendus nii algajale kui eksperdile.
	Toote trumpideks peetakse: [~~https~~://~~help~~.~~ubuntu~~.com/~~community~~/~~firewall~~/~~ipkungfu~~]		Toote trumpideks peetakse: [http://www.adercon.com/ac/node/93]
	*Turvalisust		*Turvalisust
	*Lihtsat hallatavust		*Lihtsat hallatavust
Line 13:		Line 13:


	Tänu Linuxi kerneli võimekusele leiab tarkvara laialdast rakendust ning toetab [~~https~~://~~help~~.~~ubuntu~~.com/~~community~~/~~firewall~~/~~ipkungfu~~]		Tänu Linuxi kerneli võimekusele leiab tarkvara laialdast rakendust ning toetab [http://www.adercon.com/ac/node/93]
	*Võrguühenduse jagamist		*Võrguühenduse jagamist
	*Virtualhoste		*Virtualhoste
Line 49:		Line 49:
	nano /etc/ipkungfu/ipkungfu.conf		nano /etc/ipkungfu/ipkungfu.conf

	Muudan faili vastavalt soovile. Testis tegin järgmised muudatused failis:[https://wiki.itcollege.ee/images/f/f7/Ipkungfu.conf_changed.pdf]		*Muudan faili vastavalt soovile. Testis tegin järgmised muudatused failis:[https://wiki.itcollege.ee/images/f/f7/Ipkungfu.conf_changed.pdf]

	*Määran logide asukoha
	# Set the path to ipkungfu's runtime error log.		# Set the path to ipkungfu's runtime error log.
	# Default: /var/log/ipkungfu.log		# Default: /var/log/ipkungfu.log
Line 96:		Line 95:


	*Tulemüüri automaatseks käivitamiseks ava järgnev fail ning muuda seadistust:		*Tulemüüri automaatseks käivitamiseks ava järgnev fail ning muuda seadistust: [http://www.adercon.com/ac/node/93]
	nano /etc/default/ipkungfu		nano /etc/default/ipkungfu

Line 177:		Line 176:
	/usr/share/doc/ipkungfu		/usr/share/doc/ipkungfu

	*Lisainfo [~~https~~://~~help~~.ubuntu.com/~~community~~/~~firewall~~/~~ipkungfu~~]		*Lisainfo [http://manpages.ubuntu.com/manpages/trusty/man8/iptables.8.html]
	There are several configuration files, each one corresponding to a specific		There are several configuration files, each one corresponding to a specific
	function or set of functions.		function or set of functions.
Line 240:		Line 239:

	=Kokkuvõte=		=Kokkuvõte=
	Ipkungfu on linuxi tulemüür mille konfigureerimine käib tabelite baasil, mis ~~koondavad endasse~~ pakettide filtreerimiseks ning suunamiseks vajalike reegleid. Seadistamine võttis vähe aega ning oli arusaadav.		Ipkungfu on linuxi tulemüür mille konfigureerimine käib tabelite baasil, mis sisaldavad endas pakettide filtreerimiseks ning suunamiseks vajalike reegleid. Seadistamine võttis vähe aega ning oli arusaadav.

	=Kasutatud kirjandus=		=Kasutatud kirjandus=
	*http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html		*http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html
	*https://help.ubuntu.com/community/firewall/ipkungfu
	*http://teqnix.blogspot.com/2006/06/ipkungfu-kicks-firestarter-out-of-my.html		*http://teqnix.blogspot.com/2006/06/ipkungfu-kicks-firestarter-out-of-my.html
	*http://www.adercon.com/ac/node/93		*http://www.adercon.com/ac/node/93
	*https://wiki.itcollege.ee/index.php/Iptables
	*http://www.linuxkungfu.org/		*http://www.linuxkungfu.org/
	*http://manpages.ubuntu.com/manpages/trusty/man8/iptables.8.html		*http://manpages.ubuntu.com/manpages/trusty/man8/iptables.8.html

Hniidas at 18:06, 13 May 2015

2015-05-13T18:06:51Z

← Older revision		Revision as of 21:06, 13 May 2015
Line 176:		Line 176:
	*ReadMe ja FAQ dokumendid leiab kaustast:		*ReadMe ja FAQ dokumendid leiab kaustast:
	/usr/share/doc/ipkungfu		/usr/share/doc/ipkungfu

	*Lisainfot leiab
	~~man ipkungfu~~

	*Lisainfo [https://help.ubuntu.com/community/firewall/ipkungfu]		*Lisainfo [https://help.ubuntu.com/community/firewall/ipkungfu]

Hniidas at 18:05, 13 May 2015

2015-05-13T18:05:31Z

← Older revision		Revision as of 21:05, 13 May 2015
Line 46:		Line 46:
	Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]		Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]

	*Ava fail /etc/ipkungfu/ipkungfu.conf[https://wiki.itcollege.ee/images/a/ac/Ipkungfu.conf.pdf]		*Ava fail /etc/ipkungfu/ipkungfu.conf [https://wiki.itcollege.ee/images/a/ac/Ipkungfu.conf.pdf]
	nano /etc/ipkungfu/ipkungfu.conf		nano /etc/ipkungfu/ipkungfu.conf

Hniidas at 18:04, 13 May 2015

2015-05-13T18:04:06Z

← Older revision		Revision as of 21:04, 13 May 2015
Line 46:		Line 46:
	Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]		Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]

	*Ava fail /etc/ipkungfu/ipkungfu.conf []		*Ava fail /etc/ipkungfu/ipkungfu.conf[https://wiki.itcollege.ee/images/a/ac/Ipkungfu.conf.pdf]
	nano /etc/ipkungfu/ipkungfu.conf		nano /etc/ipkungfu/ipkungfu.conf

	Muudan faili vastavalt soovile. Testis tegin järgmised muudatused failis:		Muudan faili vastavalt soovile. Testis tegin järgmised muudatused failis:[https://wiki.itcollege.ee/images/f/f7/Ipkungfu.conf_changed.pdf]

	*Määran logide asukoha		*Määran logide asukoha

Hniidas at 17:53, 13 May 2015

2015-05-13T17:53:17Z

← Older revision		Revision as of 20:53, 13 May 2015
Line 240:		Line 240:
	=Testimine=		=Testimine=
	*Ühenduste testimiseks kasutasin ShieldUP-i[https://www.grc.com/x/ne.dll?bh0bkyd2]		*Ühenduste testimiseks kasutasin ShieldUP-i[https://www.grc.com/x/ne.dll?bh0bkyd2]
			[[File:ExposureTest.jpg\|800px\|]]

	=Kokkuvõte=		=Kokkuvõte=

Hniidas at 17:41, 13 May 2015

2015-05-13T17:41:26Z

← Older revision		Revision as of 20:41, 13 May 2015
Line 1:		Line 1:
	=Sissejuhatus=		=Sissejuhatus=
	Artikli eesmärgiks on tutvustada ipkungfu tulemüüri, anda ülevaade rakenduse paigaldamisest, konfigureerimisest, haldamisest ~~ning eesmärkidest~~.		Artikli eesmärgiks on tutvustada ipkungfu tulemüüri, anda ülevaade rakenduse paigaldamisest, konfigureerimisest ning haldamisest.

	=Eeldused=		=Eeldused=
	Artikli koostamisel on testimiseks kasutatud Ubuntu v.12.04 LTS		Artikli koostamisel on testimiseks kasutatud Ubuntu v.12.04 LTS tarkvara.

	=Mis on ~~ipkungfu~~=		=Mis on Ipkungfu=
	Tegemist on iptables[http://linux.die.net/man/8/iptables] baasil loodud, kuid lihtsustatud Linuxi tulemüüriga mis hõlbustab võrguliikluse administreerimist. Rakendus töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on omakorda kerneli tulemüürimooduli Netfilter'i kasutajaliides. Tänu lihtsale menüüle sobib rakendus nii algajale kui eksperdile.		Tegemist on iptables[http://linux.die.net/man/8/iptables] baasil loodud, kuid lihtsustatud Linuxi tulemüüriga mis hõlbustab võrguliikluse administreerimist. Rakendus töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on omakorda kerneli tulemüürimooduli Netfilter'i kasutajaliides. Tänu lihtsale menüüle sobib rakendus nii algajale kui eksperdile.
	Toote trumpideks peetakse: [https://help.ubuntu.com/community/firewall/ipkungfu]		Toote trumpideks peetakse: [https://help.ubuntu.com/community/firewall/ipkungfu]
Line 27:		Line 27:


	=~~Installeerimine~~=		=Paigaldamine=

	Tulemüür töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on kerneli tulemüürimooduli Netfilter'i kasutajaliides. Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu (lisa conf fail?) mida on võimalik vastavalt soovile muuta.[http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]		Tulemüür töötab iptables ja sysctl baasil. Võib öelda, et tegemist on iptables liidesega mis on kerneli tulemüürimooduli Netfilter'i kasutajaliides. Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu (lisa conf fail?) mida on võimalik vastavalt soovile muuta.[http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]
Line 43:		Line 43:
	ipkungfu -d		ipkungfu -d

	=~~Konfigureerimine~~=		=Seadistamine=
	Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]		Konfiguratsiooni failid asuvad kaustas /etc/ipkungfu mida on võimalik vastavalt soovile muuta.[http://www.adercon.com/ac/node/93]

	*Ava fail /etc/ipkungfu/ipkungfu.conf [~~FAILI LINK~~]		*Ava fail /etc/ipkungfu/ipkungfu.conf []
	nano /etc/ipkungfu/ipkungfu.conf		nano /etc/ipkungfu/ipkungfu.conf

Line 90:		Line 90:
	KNOWN_BAD="REJECT"		KNOWN_BAD="REJECT"

	*Keelan portide ~~skännimise~~:		*Keelan portide skaneeringu:
	# What to do with port scans		# What to do with port scans
	#PORT_SCAN="REJECT"		#PORT_SCAN="REJECT"

Hniidas at 17:26, 13 May 2015

2015-05-13T17:26:57Z

@@ Line 103: / Line 103: @@
   IPKFSTART=1
 =Parameetrid=
@@ Line 130: / Line 117: @@
                     major configuration options are correct before putting them
                     into action.
         -d  (or  --disable)
@@ Line 165: / Line 155: @@
         --no-caching
                     Disables rules caching feature.
 *Konfiguratsioonifailide asukohad [http://manpages.ubuntu.com/manpages/trusty/man8/ipkungfu.8.html]
@@ Line 182: / Line 173: @@
 **/usr/share/doc/ipkungfu/COPYING
 =Kokkuvõte=
+Ipkungfu on linuxi tulemüür mille konfigureerimine käib tabelite baasil, mis koondavad endasse pakettide filtreerimiseks ning suunamiseks vajalike reegleid. Seadistamine võttis vähe aega ning oli arusaadav.
 =Kasutatud kirjandus=