yum clean [packages|header|all]

packages:将已下载的软件文件删除

headers&＃xff1a;将下载的软件文件头删除

all:将所有容器数据都删除

 

添加镜像站点&＃xff1a;mirrorlist&＃61;http://ftp.twaren.net/Linux/CentOS/6/os/x86_64/

http://free.nchc.org.tw/drbl-core/i386/RPMS.drbl-stable/

 

 

 

[root&＃64;szm ~]# nmap  localhost

Starting Nmap 5.21 ( http://nmap.org ) at 2013-03-23 14:32 CST

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000017s latency).

rDNS record for 127.0.0.1: localhost.localdomain

Not shown: 995 closed ports

PORT    STATE SERVICE

22/tcp  open  ssh

25/tcp  open  smtp

111/tcp open  rpcbind

139/tcp open  netbios-ssn

445/tcp open  microsoft-ds

 

Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds

 

扫描本机的TCP/UDP端口&＃xff1a;[root&＃64;szm ~]# nmap -sTU localhost

Starting Nmap 5.21 ( http://nmap.org ) at 2013-03-23 14:31 CST

Nmap scan report for localhost (127.0.0.1)

Host is up (0.0028s latency).

rDNS record for 127.0.0.1: localhost.localdomain

Not shown: 1990 closed ports

PORT    STATE         SERVICE

22/tcp  open          ssh

25/tcp  open          smtp

111/tcp open          rpcbind

139/tcp open          netbios-ssn

445/tcp open          microsoft-ds

68/udp  open|filtered dhcpc

111/udp open          rpcbind

137/udp open          netbios-ns

138/udp open|filtered netbios-dgm

781/udp open|filtered hp-collector

Nmap done: 1 IP address (1 host up) scanned in 2.14 seconds

 

 

扫描网段主机IP情况&＃xff1a;
[root&＃64;szm ~]# nmap -sP 172.16.128.0/24

扫描网段主机IP与端口情况&＃xff1a;
[root&＃64;szm ~]# nmap 172.16.128.0/24

 stand alone:/etc/init.d/sshd restart

super daemon:/etc/init.d/xinetd restart(配置文件一般在&＃xff1a;etc/xinetd.d)

 

关闭端口占用&＃xff1a;
1.[root&＃64;szm ~]# netstat -tnlp | grep 111

 

tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1878/rpcbind
tcp        0      0 :::111                      :::*                        LISTEN      1878/rpcbind
2.[root&＃64;szm ~]# which rpcbind
/sbin/rpcbind
3.[root&＃64;szm ~]# rpm -qf /sbin/rpcbind
rpcbind-0.2.0-8.el6.i686
4.[root&＃64;szm ~]# rpm -qc rpcbind | grep init
/etc/rc.d/init.d/rpcbind
telnet服务器&＃xff1a;
[root&＃64;szm ~]# rpm -qc telnet-server
/etc/xinetd.d/telnet
 service telnet
{
socket_type&＃61;stream
wait&＃61;no
user&＃61;root
server&＃61;/usr/sbin/in.telnetd
log_on_failure&＃43;&＃61;USERID
disable&＃61;yes
}
第一行&＃xff0c;说明该配置用来设置telnet服务。
第二行&＃xff0c;说明Socket连接类型是stream&＃xff0c;也就是TCP
第三行&＃xff0c;是指不等待到启动完成
第四行&＃xff0c;是指以root用户启动服务进程
第五行&＃xff0c;是指服务进程是/usr/sbin/in.telnetd
第六行&＃xff0c;是用于做一些出错日志
第七行&＃xff0c;是指禁止远方telnet&＃xff0c;如果需要开放则将该配置改为&＃xff1a;disable&＃61;no
修改了xinetd的配置&＃xff0c;需要重启xinetd才能够生效&＃xff0c;有两种方法可以实现&＃xff1a;
1&＃xff09; 执行如下命令&＃xff1a;
/etc/rc.d/init.d/xinetd restart
2&＃xff09; 执行如下命令&＃xff1a;
killall -HUP xinetd

 

 

 

[root&＃64;szm ~]# netstat -tnlp | grep 23

tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      2233/master

tcp        0      0 :::23                       :::*                        LISTEN      3759/xinetd

[root&＃64;szm ~]# chkconfig --list | grep rpcbind
rpcbind         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --level 35 rpcbind off
常见必须要存在的服务&＃xff1a;
[root&＃64;szm ~]# chkconfig --list | grep acpid电源管理模块
acpid           0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep atd单一计划任务
atd             0:off   1:off   2:off   3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep crond计划任务
crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep haldaemon检测硬件变更
haldaemon       0:off   1:off   2:off   3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep network
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep postfi内部邮件传递服务
postfix         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep rsyslog日志
rsyslog         0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep sshd
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off
[root&＃64;szm ~]# chkconfig --list | grep xinetd
xinetd          0:off   1:off   2:off   3:on    4:on    5:on    6:off
xinetd based services:
[root&＃64;szm ~]# rpm -qc $(rpm -qf $(which rpc.statd))
/etc/nfsmount.conf
/etc/rc.d/init.d/nfs
/etc/rc.d/init.d/nfslock
/etc/rc.d/init.d/rpcgssd
/etc/rc.d/init.d/rpcidmapd
/etc/rc.d/init.d/rpcsvcgssd
/etc/sysconfig/nfs
/var/lib/nfs/etab
/var/lib/nfs/rmtab
/var/lib/nfs/state
/var/lib/nfs/xtab
[root&＃64;szm bin]# sh closedaemon.sh
Shutting down NFS mountd:                                  [FAILED]
Shutting down NFS daemon:                                  [FAILED]
Shutting down NFS quotas:                                  [FAILED]
Stopping NFS statd:                                        [  OK  ]
Stopping RPC gssd:                                         [FAILED]
Stopping RPC idmapd:                                       [  OK  ]
Stopping xinetd:                                           [  OK  ]
Stopping rpcbind:                                          [  OK  ]
[root&＃64;szm bin]# cat closedaemon.sh
for daemon in nfs nfslock rpcgssd rpcidmapd rpcsvcgssd xinetd rpcbind
do
chkconfig $daemon off
/etc/init.d/$daemon stop
done

 SELinux使用所谓的委任式访问控制&＃xff08;Mandatory Access Control&＃xff0c;MAC&＃xff09;

策略1 &＃xff1a;targeted,针对网络服务限制较多&＃xff0c;针对本机限制较少&＃xff0c;是默认的策略

策略2 &＃xff1a;完整的SELinux限制&＃xff0c;限制方面较为严格

安全性环境存放在Inode内

 

 

 

[root&＃64;szm bin]# ls -Z

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 closedaemon.sh

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 lftp

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 lftp.sh

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 ping.sh

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 ping.txt

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 useradd.sh

 Identify:role:type(身份识别&＃xff0c;角色&＃xff0c;类型)

身份识别&＃xff1a;
root:表示Root的帐号身份
system_u:表示系统程序方面的识别&＃xff0c;通常就是程序
user_u:代表的是一般用户账号相关的身份

角色&＃xff1a;
object_r:文件或目录等文件资源&＃xff1b;
system_r:代表的就是程序

类型&＃xff1a;&＃xff08;默认targeted策略&＃xff0c;前两个字段基本上是不重要的&＃xff09;
Type&＃xff1a;在文件资源(object)中称为类型(Type)
Domain&＃xff1a;在主体程序(subject)中则称为域(Domain)

Selinux的三种模式&＃xff1a;
1.Enforcing&＃xff1a;
2.Permissive&＃xff1a;警告&＃xff0c;可以用于Debug
3.Disabled&＃xff1a;

[root&＃64;szm ~]# ll -Zd /usr/sbin/httpd /var/www/html/

 

 

-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd

drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/

[root&＃64;szm ~]# getenforce
Enforcing
 
&＃xff08;Diable&＃xff09;改动后必须重新启动&＃xff0c;因为SELinux是整合到内核中的
[root&＃64;szm ~]# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX&＃61; can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX&＃61;enforcing
# SELINUXTYPE&＃61; can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE&＃61;targeted

 如果SELinux出错了&＃xff0c;可以切换到Permissive下使用命令&＃xff1a;restorecon -Rv /还原Selinux类型

复制SELinux会变为目标目录SELinux&＃xff0c;移动文件SELinux不会变

 

 

[root&＃64;szm ~]# cp /etc/hosts /root/

[root&＃64;szm ~]# ls -dZ /etc/hosts /root/hosts /root/

-rw-r--r--. root root system_u:object_r:net_conf_t:s0  /etc/hosts

dr-xr-x---. root root system_u:object_r:admin_home_t:s0 /root/

-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /root/hosts

[root&＃64;szm ~]# ll -Zd /tmp/ /tmp/hosts
drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /tmp/
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /tmp/hosts

 

 

[root&＃64;szm ~]# chcon -t net_conf_t /tmp/hosts
[root&＃64;szm ~]# ll -Z /tmp/hosts

-rw-r--r--. root root unconfined_u:object_r:net_conf_t:s0 /tmp/hosts

[root&＃64;szm ~]# chcon --reference&＃61;/var/spool/mail/ /tmp/hosts
[root&＃64;szm ~]# ll -Z /tmp/hosts
-rw-r--r--. root root system_u:object_r:mail_spool_t:s0 /tmp/hosts

 

 

 

[root&＃64;szm ~]# mv /tmp/hosts /root/

[root&＃64;szm ~]# ll -Z /root/hosts

-rw-r--r--. root root system_u:object_r:mail_spool_t:s0 /root/hosts

[root&＃64;szm ~]# restorecon -Rv /root/

restorecon reset /root/.ssh context system_u:object_r:ssh_home_t:s0->system_u:object_r:home_ssh_t:s0

restorecon reset /root/.ssh/known_hosts context unconfined_u:object_r:ssh_home_t:s0->system_u:object_r:home_ssh_t:s0

restorecon reset /root/hosts context system_u:object_r:mail_spool_t:s0->system_u:object_r:admin_home_t:s0

restorecon reset /root/.gstreamer-0.10/registry.i686.bin context unconfined_u:object_r:admin_home_t:s0->system_u:object_r:gstreamer_home_t:s0

目录默认的SELinux类型&＃xff1a;
[root&＃64;szm ~]# ls /etc/selinux/targeted/contexts/
customizable_types      default_type            initrc_context          securetty_types         virtual_domain_context
dbus_contexts           failsafe_context        netfilter_contexts      userhelper_context      virtual_p_w_picpath_context
default_contexts        files/                  removable_context       users/                  x_contexts

 

semanage {boolean|login|user|port|interface|module|node|fcontext} -{l|D|E} [-n]
semanage fcontext -{a|d|m} [-efrst] file_spec
[root&＃64;szm ~]# semanage fcontext -l | grep &＃39;/var/www/html&＃39;
/var/www/html/[^/]*/cgi-bin(/.*)?                  all files          system_u:object_r:httpd_sys_script_exec_t:s0
/var/www/html/configuration\.php                   all files          system_u:object_r:httpd_sys_rw_content_t:s0
/var/www/html/munin(/.*)?                          all files          system_u:object_r:httpd_munin_content_t:s0
/var/www/html/munin/cgi(/.*)?                      all files          system_u:object_r:httpd_munin_script_exec_t:s0
[root&＃64;szm ~]# mkdir /srv/vbird
[root&＃64;szm ~]# ll -Zd /srv/vbird/
drwxr-xr-x. root root unconfined_u:object_r:var_t:s0   /srv/vbird/
[root&＃64;szm ~]# semanage fcontext -l | grep &＃39;/srv&＃39;
/etc/rc\.d/init\.d/srvsvcd                         regular file       system_u:object_r:likewise_initrc_exec_t:s0
/srv                                               directory          system_u:object_r:var_t:s0
/srv/([^/]*/)?ftp(/.*)?                            all files          system_u:object_r:public_content_t:s0
/srv/([^/]*/)?rsync(/.*)?                          all files          system_u:object_r:public_content_t:s0
/srv/([^/]*/)?www(/.*)?                            all files          system_u:object_r:httpd_sys_content_t:s0
/srv/.*                                            all files          system_u:object_r:var_t:s0
/srv/gallery2(/.*)?                                all files          system_u:object_r:httpd_sys_content_t:s0
/srv/git(/.*)?                                     all files          system_u:object_r:git_system_content_t:s0
/usr/sbin/srvsvcd                                  regular file       system_u:object_r:srvsvcd_exec_t:s0
/var/run/srvsvcd.pid                               regular file       system_u:object_r:srvsvcd_var_run_t:s0
配置vbird下的所有文件&＃xff1a;
[root&＃64;szm ~]# semanage fcontext -a -t public_content_t "/srv/vbird/.*)"
[root&＃64;szm ~]# semanage fcontext -l | grep &＃39;/srv/vbird&＃39;
/srv/vbird/(/.*)                                   all files          system_u:object_r:public_content_t:s0
查看SELinux&＃xff1a;
[root&＃64;szm ~]# cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Do not edit directly.
/srv/vbird/.*    system_u:object_r:public_content_t:s0
[root&＃64;szm ~]# restorecon -Rv /srv/vbird/
restorecon reset /srv/vbird context unconfined_u:object_r:var_t:s0->system_u:object_r:public_content_t:s0
restorecon reset /srv/vbird/bbb context unconfined_u:object_r:var_t:s0->system_u:object_r:public_content_t:s0
restorecon reset /srv/vbird/ccc context unconfined_u:object_r:var_t:s0->system_u:object_r:public_content_t:s0
restorecon reset /srv/vbird/aaa context unconfined_u:object_r:var_t:s0->system_u:object_r:public_content_t:s0
配置Vbird这个文件夹和这个文件夹一的所有文件&＃xff1a;
[root&＃64;szm ~]# semanage fcontext -a -t public_content_t "/srv/vbird(/.*)?"
[root&＃64;szm ~]# restorecon -Rv /srv/vbird/
restorecon reset /srv/vbird context unconfined_u:object_r:var_t:s0->system_u:object_r:public_content_t:s0

[root&＃64;szm ~]# yum install setools-console
[root&＃64;szm ~]# seinfo

Statistics for policy file: /etc/selinux/targeted/policy/policy.24
Policy Version & Type: v.24 (binary, mls)
Classes:            77    Permissions:       229
Sensitivities:       1    Categories:       1024
   Types:            3073    Attributes:        250
Users:               9    Roles:              13
 Booleans:          168    Cond. Expr.:       203
Allow:          269649    Neverallow:          0
Auditallow:         44    Dontaudit:      162489
Type_trans:      10914    Type_change:        38
Type_member:        44    Role allow:         20
Role_trans:        241    Range_trans:      2590
Constraints:        64    Validatetrans:       0
Initial SIDs:       27    Fs_use:             22
Genfscon:           82    Portcon:           378
Netifcon:            0    Nodecon:             0
Permissives:        21    Polcap:              2
[root&＃64;szm ~]# seinfo -r(role)
[root&＃64;szm ~]# seinfo -u(user)
[root&＃64;szm ~]# seinfo -t&＃xff08;type&＃xff09;
[root&＃64;szm ~]# seinfo -b | grep httpd

查询SELinux解析&＃xff1a;
[root&＃64;szm ~]# sesearch --all -t httpd_sys_content_t
[root&＃64;szm ~]# sesearch --all -b httpd_enable_homedirs

SEbool设置情况&＃xff1a;
[root&＃64;szm ~]# getsebool -a

 

 

[root&＃64;szm ~]# getsebool httpd_enable_homedirs

httpd_enable_homedirs --> off

[root&＃64;szm ~]# setsebool -P httpd_enable_homedirs&＃61;1&＃xff08;-P将设置写入配置文件&＃xff09;

[root&＃64;szm ~]# getsebool httpd_enable_homedirs

httpd_enable_homedirs --> on

 setroubleshoot服务会将关于SELinux的错误信息与克服方法记录到/var/log/messages与/var/log/setroubleshoot/*中。

 

 [root&＃64;szm ~]# yum install setroubleshoot setroubleshoot-server

[root&＃64;szm ~]# /etc/init.d/auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
 CentOS 6.x对setroubleshoot的动作方式是&＃xff1a;先由auditd去呼叫audispd服务&＃xff0c;然后audispd服务去启动sedispatch程序&＃xff0c;sedispatch再将原本的auditd信息转成setrouble

解决SELinux问题示例&＃xff1a;
1.[root&＃64;szm ~]# cat /var/log/messages | grep setroubleshoot
2.[root&＃64;szm ~]# sealert -l 88a27066-910c-4f9d-bd33-e44e6200413c

3. Fix Command:

/sbin/restorecon &＃39;/var/www/html/index.html&＃39;

[root&＃64;szm ~]# vi /etc/setroubleshoot/setroubleshoot.cfg
recipients_filepath &＃61; /var/lib/setroubleshoot/email_alert_recipients
console &＃61; True
[root&＃64;szm ~]# cat /var/lib/setroubleshoot/email_alert_recipients
root&＃64;localhost
464421145&＃64;qq.com