# iptables基本配置
# 查看当前规则
# iptables -L -n -v

# 清除所有规则
# iptables -F
# iptables -X
# iptables -Z

# 设置默认策略
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT

# 允许回环接口
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A OUTPUT -o lo -j ACCEPT

# 允许已建立的连接
# iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# 允许SSH连接
# iptables -A INPUT -p tcp –dport 22 -j ACCEPT

# 允许HTTP和HTTPS
# iptables -A INPUT -p tcp –dport 80 -j ACCEPT
# iptables -A INPUT -p tcp –dport 443 -j ACCEPT

# 允许特定IP访问
# iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

# 防止SYN洪水攻击
# iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 3 -j ACCEPT

# 防止端口扫描
# iptables -A INPUT -p tcp –tcp-flags ALL NONE -j DROP
# iptables -A INPUT -p tcp –tcp-flags ALL ALL -j DROP

# 保存规则
# service iptables save
# 或
# iptables-save > /etc/sysconfig/iptables

# firewalld基本配置
# 启动firewalld
# systemctl start firewalld
# systemctl enable firewalld

# 查看状态
# firewall-cmd –state

# 查看所有规则
# firewall-cmd –list-all

# 开放端口
# firewall-cmd –permanent –add-port=80/tcp
# firewall-cmd –permanent –add-port=443/tcp
# firewall-cmd –permanent –add-port=22/tcp

# 开放服务
# firewall-cmd –permanent –add-service=http
# firewall-cmd –permanent –add-service=https
# firewall-cmd –permanent –add-service=ssh

# 允许特定IP访问
# firewall-cmd –permanent –add-source=192.168.1.0/24

# 拒绝特定IP访问
# firewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”192.168.2.0/24″ reject’

# 端口转发
# firewall-cmd –permanent –add-forward-port=port=80:proto=tcp:toport=8080

# 重新加载配置
# firewall-cmd –reload

# Snort安装和配置
# 安装依赖
# yum install -y gcc flex bison zlib libpcap pcre libdnet tcpdump

# 下载并安装Snort
# wget https://www.snort.org/downloads/snort/snort-2.9.18-1.centos7.x86_64.rpm
# rpm -ivh snort-2.9.18-1.centos7.x86_64.rpm

# 配置Snort
# vi /etc/snort/snort.conf

# 设置网络变量
ipvar HOME_NET 192.168.1.0/24
ipvar EXTERNAL_NET any

# 设置规则路径
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules

# 启用输出模块
output unified2: filename snort.log, limit 128

# 启用规则
include $RULE_PATH/alert.rules
include $RULE_PATH/attack-responses.rules
include $RULE_PATH/backdoor.rules
include $RULE_PATH/bad-traffic.rules

# 启动Snort
# snort -A console -q -c /etc/snort/snort.conf -i eth0

# OSSEC安装和配置
# 下载OSSEC
# wget https://github.com/ossec/ossec-hids/archive/3.6.0.tar.gz
# tar -zxvf 3.6.0.tar.gz
# cd ossec-hids-3.6.0

# 安装OSSEC
# ./install.sh

# 配置OSSEC
# vi /var/ossec/etc/ossec.conf

# 配置日志监控

syslog
/var/log/messages

apache
/var/log/httpd/access_log

# 配置告警

1
7

# 配置邮件告警

yes
admin@fgedu.net.cn
smtp.fgedu.net.cn
ossec@fgedu.net.cn

# 启动OSSEC
# /var/ossec/bin/ossec-control start

# Suricata安装和配置
# 安装依赖
# yum install -y gcc libpcap-devel pcre-devel libyaml-devel file-devel zlib-devel jansson-devel nss-devel

# 下载并安装Suricata
# wget https://www.openinfosecfoundation.org/download/suricata-6.0.4.tar.gz
# tar -zxvf suricata-6.0.4.tar.gz
# cd suricata-6.0.4
# ./configure –prefix=/usr –sysconfdir=/etc –localstatedir=/var
# make
# make install-full

# 配置Suricata
# vi /etc/suricata/suricata.yaml

# 设置网络变量
vars:
address-groups:
HOME_NET: “[192.168.1.0/24]”
EXTERNAL_NET: “!$HOME_NET”
port-groups:
HTTP_PORTS: “80”
SHELLCODE_PORTS: “!80”

# 配置IPS模式
af-packet:
– interface: eth0
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
use-mmap: yes
threads: auto

# 启用规则
rule-files:
– suricata.rules
– emerging-threats.rules

# 启动Suricata
# suricata -c /etc/suricata/suricata.yaml -i eth0

# OpenVPN服务器配置
# 安装OpenVPN
# yum install -y openvpn easy-rsa

# 初始化PKI
# cd /usr/share/easy-rsa/3
# ./easyrsa init-pki
# ./easyrsa build-ca
# ./easyrsa gen-req server nopass
# ./easyrsa sign-req server server
# ./easyrsa gen-dh
# openvpn –genkey –secret ta.key

# 配置OpenVPN服务器
# vi /etc/openvpn/server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
push “redirect-gateway def1 bypass-dhcp”
push “dhcp-option DNS 8.8.8.8”
push “dhcp-option DNS 8.8.4.4”
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
cipher AES-256-CBC
auth SHA256
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3

# 启动OpenVPN
# systemctl start openvpn@server
# systemctl enable openvpn@server

# OpenVPN客户端配置
client
dev tun
proto udp
remote vpn.fgedu.net.cn 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
verb 3

# 使用iptables防护DDoS
# 防止SYN洪水攻击
# iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 3 -j ACCEPT

# 防止UDP洪水攻击
# iptables -A INPUT -p udp -m limit –limit 1/s –limit-burst 3 -j ACCEPT

# 防止ICMP洪水攻击
# iptables -A INPUT -p icmp –icmp-type echo-request -m limit –limit 1/s –limit-burst 3 -j ACCEPT

# 防止连接耗尽攻击
# iptables -A INPUT -m connlimit –connlimit-above 50 -j DROP

# 使用sysctl优化内核参数
# vi /etc/sysctl.conf

# 启用SYN Cookies
net.ipv4.tcp_syncookies = 1

# 减少SYN重试次数
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2

# 减少FIN超时时间
net.ipv4.tcp_fin_timeout = 15

# 启用TCP时间戳
net.ipv4.tcp_timestamps = 1

# 增加最大连接数
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 4096

# 应用配置
# sysctl -p

# Cisco交换机VLAN配置
# 进入配置模式
# configure terminal

# 创建VLAN
# vlan 10
# name Servers
# exit

# vlan 20
# name Users
# exit

# vlan 30
# name DMZ
# exit

# 配置端口
# interface fastethernet0/1
# switchport mode access
# switchport access vlan 10
# exit

# interface fastethernet0/2
# switchport mode access
# switchport access vlan 20
# exit

# 配置Trunk端口
# interface gigabitethernet0/1
# switchport mode trunk
# switchport trunk allowed vlan 10,20,30
# exit

# 配置VLAN接口
# interface vlan 10
# ip address 192.168.10.1 255.255.255.0
# exit

# interface vlan 20
# ip address 192.168.20.1 255.255.255.0
# exit

# interface vlan 30
# ip address 192.168.30.1 255.255.255.0
# exit

# 保存配置
# write memory

# 使用ntopng监控网络流量
# 安装ntopng
# yum install -y ntopng

# 配置ntopng
# vi /etc/ntopng/ntopng.conf

-i=eth0
-d=/var/lib/ntopng
-r=/var/lib/ntopng/ntopng.pid
-w=3000

# 启动ntopng
# systemctl start ntopng
# systemctl enable ntopng

# 访问Web界面
# http://fgedudb:3000

# 使用nload监控网络流量
# nload eth0

# 使用iftop监控网络流量
# iftop -i eth0

# 使用tcpdump抓包
# tcpdump -i eth0 -w capture.pcap
# tcpdump -i eth0 -nn -X ‘port 80’

# 安全事件响应流程

1. 准备阶段
– 建立应急响应团队
– 制定应急响应计划
– 准备应急响应工具
– 进行应急响应培训

2. 识别阶段
– 监控安全告警
– 确认安全事件
– 评估事件影响
– 收集证据

3. 抑制阶段
– 隔离受影响系统
– 阻断攻击源
– 保存现场证据
– 防止事件扩散

4. 根除阶段
– 清除恶意软件
– 修复安全漏洞
– 恢复系统配置
– 加强安全措施

5. 恢复阶段
– 恢复系统服务
– 验证系统功能
– 监控系统状态
– 恢复业务运营

6. 总结阶段
– 分析事件原因
– 评估响应效果
– 改进安全措施
– 更新应急计划