LINUXOR.SK ... open source notes ...

2008 - Debian 4 - Xen dom0 - fyzický HW

category: howtoz · date: 2008-07-13 · source: old.linuxor.sk/VIRTUALIZATION/REALSERVER/0.XEN_Debian_Server.txt

Anglická verzia tohto dokumentu: 2008 - Debian 4 - Xen dom0 - the physical hardware.

asciiart
|=----------------------------------=[ XEN ]=------------------------------=|
+---------------------------------------------------------------------------+
|                                                                           |
|                          XEN-server dom0 (REAL SERVER HW)                 |
|                                 Debian 4.0 Etch                           |
|                                                                           |
+---------------------------------------------------------------------------+
|=-------------------------------=[ BH 2008 ]=-----------------------------=|

XEN - Server

asciiart
        Kroky vykonane pri instalacii XEN servera pre XEN-projekt.
        Poznamka: Popisane su len zmeny oproti defaultnej konfiguracii.

Instalacia systemu

asciiart
        Nainstalovany bol zakladny system Debian Linux 4.0 z media: debian-40r0-i386-netinst
        URL: http://ftp.antik.sk/debian-cd/current/i386/iso-cd/debian-40r1-i386-netinst.iso

Schema particii + parametre

asciiart
        # /etc/fstab: static file system information.
        #
        # <file system>                 <mount point>   <type>          <options>                       <dump>  <pass>
        proc                            /proc           proc            defaults                        0       0
        /dev/mapper/system_xen-root     /               ext3            defaults,errors=remount-ro      0       1
        /dev/md0                        /boot           ext3            defaults,nodev,nosuid,noexec    0       2
        /dev/mapper/system_xen-tmp      /tmp            ext3            defaults,nodev,nosuid,noexec    0       2
        /dev/mapper/system_xen-usr      /usr            ext3            defaults,nodev                  0       2
        /dev/mapper/system_xen-var      /var            ext3            defaults,nodev,nosuid           0       2
        /dev/mapper/system_xen-var--log /var/log        ext3            defaults,nodev,nosuid,noexec    0       2
        /dev/mapper/system_xen-swap     none            swap            sw                              0       0
        /dev/scd0       /media/cdrom0   udf,iso9660     user,noauto                                     0       0

        # cat /proc/mdstat
        ------------------
        Personalities : [raid1]
        md4 : active raid1 sdc5[0] sdd5[1]
                488383872 blocks [2/2] [UU]

        md3 : active raid1 sda7[0] sdb7[1]
                87779008 blocks [2/2] [UU]

        md2 : active raid1 sda6[0] sdb6[1]
                48829440 blocks [2/2] [UU]

        md1 : active raid1 sda5[0] sdb5[1]
                19534912 blocks [2/2] [UU]

        md0 : active raid1 sda1[0] sdb1[1]
                144448 blocks [2/2] [UU]

        # cat /boot/grub/menu.lst
        -------------------------
        title           Xen 3.0.3-1-amd64 / Debian GNU/Linux, kernel 2.6.18-6-xen-amd64
        root            (hd0,0)
        kernel          /xen-3.0.3-1-amd64.gz
        module          /vmlinuz-2.6.18-6-xen-amd64 root=/dev/mapper/system_xen-root ro console=tty0
        module          /initrd.img-2.6.18-6-xen-amd64
        savedefault

        title           Debian GNU/Linux, kernel 2.6.18-6-amd64
        root            (hd0,0)
        kernel          /vmlinuz-2.6.18-6-amd64 root=/dev/mapper/system_xen-root ro
        initrd          /initrd.img-2.6.18-6-amd64
        savedefault

        title           Debian GNU/Linux, kernel 2.6.18-6-amd64 (single-user mode)
        root            (hd0,0)
        kernel          /vmlinuz-2.6.18-6-amd64 root=/dev/mapper/system_xen-root ro single
        initrd          /initrd.img-2.6.18-6-amd64
        savedefault

Nastavenie sietovej karty

asciiart
        # nano /etc/network/interfaces
        ------------------------------
        # The loopback network interface
        auto lo
        iface lo inet loopback

        # The primary network interface
        iface eth0 inet static
        address 192.168.254.254
        netmask 255.255.255.0
        network 192.168.254.0
        broadcast 192.168.254.255
        gateway 192.168.254.1
        dns-nameservers 192.0.2.52 192.0.2.53
        ------------------------------END->/etc/network/interfaces

Nastavenie zdrojov pre balickovaci system

asciiart
        # nano /etc/apt/sources.list
        ----------------------------
        # STABLE
        deb http://ftp.sk.debian.org/debian/ etch main
        deb-src http://ftp.sk.debian.org/debian/ etch main

        # SECURITY
        deb http://security.debian.org/ etch/updates main contrib
        deb-src http://security.debian.org/ etch/updates main contrib
        -------------------------------END->/etc/apt/sources.list

Instalacia dalsieho SW

asciiart
        # apt-get install less
        # apt-get install mc
        # apt-get install mailx
        # apt-get install mutt
        # apt-get install syslog-ng
        # apt-get install pciutils

Instalacia SSH servera (openbsd ssh)

asciiart
-------------
 Install ssh
-------------

        # apt-get install ssh

------------
 Config ssh
------------

        # nano /etc/ssh/sshd_config
        ---------------------------
        ListenAddress 192.168.254.254
        PermitRootLogin no
        AllowUsers bh skupko firefox
        X11Forwarding no
        Banner /etc/issue.net
        #Subsystem sftp /usr/lib/openssh/sftp-server
        ---------------------------END->/etc/ssh/sshd_config

--------------------
 Nastavenie banneru
--------------------

        # nano /etc/issue
        -----------------
        ***************************************************************************
                                       UPOZORNENIE

        Tento pocitacovy system je sukromnym majetkom. Mozu ho pouzivat iba
        autorizovani pouzivatelia. Sukromie pouzivatelov na tomto systeme nie je
        zarucene.

        Akekolvek pouzitie tohto pocitacoveho systemu moze byt zaznamenavane,
        monitorovane, podrobene auditu, inspekcii ci inej kontrole zamestnavatela,
        majitela ci legislativnych organov.

        Pouzivanim tohto systemu uzivatel suhlasi so zaznamenavanim a monitorovanim
        svojich aktivit v pocitacovom systeme, rovnako suhlasi s pripadnou inspekciou
        svojich aktivit v systeme majitelom alebo legislativnymi organmi. Neopravnene
        pouzitie systemu moze viest k disciplinarnym trestom zamestnavatela a k
        trestnopravnehu setreniu. Pouzivanim tohto systemu uzivatel potvrdzuje, ze
        je oboznameny s vyssie uvedenymi podmienkami. V pripade, ze s niecimm vyssie
        uvedenym nesuhlasite, okamzite sa so systemu odhlaste.
        ****************************************************************************
        -----------------END->/etc/issue

        # cat /etc/issue > /etc/issue.net
        ---------------------------------
        to iste ako /etc/issue ;-)

Instalacia iba lokalneho MAIL servera (postfix)

asciiart
-----------------
 Install postfix
-----------------

        # apt-get install postfix
        -------------------------
        Vybrat volbu "Local only"
        Mail name: xen

----------------
 Config postfix
----------------

        # nano /etc/postfix/main.cf
        ---------------------------

        ---------------------------END->/etc/postfix/main.cf

Konfiguracia Firewallu

asciiart
--------------------
 Pravidla firewallu
--------------------

        # nano /var/lib/iptables/active
        -------------------------------
        #
        # Iptables Firewall Template
        #
        # hajzer [at] gmail [dot] com
        # 2008
        #
        #######################
        #  NAT - POLICY
        #######################
        *nat
        :PREROUTING ACCEPT
        :POSTROUTING ACCEPT
        :OUTPUT ACCEPT
        #======================
        #  NAT - PREROUTING
        #======================
        #---
        #--- VIRTUALNE STROJE a ich sluzby
        #---
        #--- WWW (443) -> VM.www (443)
        #-A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 80 -j DNAT --to-destination 10.0.0.2:80
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 443 -j DNAT --to-destination 10.0.0.2:443
        #--- SSH (22222) -> VM.www (22)
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22222 -j DNAT --to-destination 10.0.0.2:22
        #--- SSH (22223) -> VM.ldap (22), WWW (80) -> VM.ldap
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22223 -j DNAT --to-destination 10.0.0.3:22
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 80 -j DNAT --to-destination 10.0.0.3:80
        #--- SSH (22224) -> VM.db (22)
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22224 -j DNAT --to-destination 10.0.0.4:22
        #--- SSH (22225) -> VM.jabber (22)
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22225 -j DNAT --to-destination 10.0.0.5:22
        #--- SSH (22226) -> VM.mail (22)
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22226 -j DNAT --to-destination 10.0.0.6:22
        #--- SSH (22227) -> VM.devel (22)
        -A PREROUTING -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22227 -j DNAT --to-destination 10.0.0.6:22
        #======================
        #  NAT - POSTROUTING
        #======================
        #--- NAT pre VMs
        -A POSTROUTING -s 10.0.0.0/255.255.255.0 -j SNAT --to-source 192.168.254.254
        #======================
        #  NAT - OUTPUT
        #======================
        COMMIT
        #######################
        #  MANGLE - POLICY
        #######################
        *mangle
        :PREROUTING ACCEPT
        :INPUT ACCEPT
        :FORWARD ACCEPT
        :OUTPUT ACCEPT
        :POSTROUTING ACCEPT
        #======================
        #  MANGLE - PREROUTING
        #======================
        #======================
        #  MANGLE - INPUT
        #======================
        #======================
        #  MANGLE - FORWARD
        #======================
        #======================
        #  MANGLE - OUTPUT
        #======================
        #======================
        #  MANGLE - POSTROUTING
        #======================
        COMMIT
        #######################
        #  FILTER - POLICY
        #######################
        *filter
        :INPUT DROP
        :FORWARD DROP
        :OUTPUT DROP
        #======================
        #  FILTER - INPUT
        #======================
        -A INPUT -m state --state INVALID -j LOG --log-prefix "IN_DROP_INVALID: " --log-tcp-options --log-ip-options
        -A INPUT -m state --state INVALID -j DROP
        #--- Blok WINDOWS somariny
        -A INPUT -p udp --dport 137:138 -j DROP
        -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
        #--- VM-base -> XEN ping
        -A INPUT -s 192.168.253.1 -d 192.168.253.128 -p icmp -m icmp -j ACCEPT
        #--- BH -> SSH
        -A INPUT -i eth0 -s 192.168.254.0/255.255.255.0 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        #--- BH (domica,firma,mailhost.provider.example) -> SSH
        -A INPUT -i eth0 -s 192.0.2.47 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        -A INPUT -i eth0 -s 192.0.2.27 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        -A INPUT -i eth0 -s 192.0.2.30 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        #--- skupko, firefox -> SSH
        -A INPUT -i eth0 -s 192.0.2.35 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        -A INPUT -i eth0 -s 192.0.2.34 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        #--- skupko (mobil) -> SSH
        -A INPUT -i eth0 -s 192.0.2.48/255.255.0.0 -d 192.168.254.254 -p tcp -m tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        #---
        #--- VIRTUALNE STROJE a ich sluzby
        #---
        -A INPUT -i ! lo -j LOG --log-prefix "IN_DROP: " --log-tcp-options --log-ip-options
        #======================
        #  FILTER - FORWARD
        #======================
        -A FORWARD -m state --state INVALID -j LOG --log-prefix "FW_DROP_INVALID: " --log-tcp-options --log-ip-options
        -A FORWARD -m state --state INVALID -j DROP
        -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
        #---
        #--- VIRTUALNE STROJE a ich sluzby
        #---
        #--- WWW (80,443) -> VM.www
        -A FORWARD -i eth0 -d 10.0.0.2 -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
        -A FORWARD -i eth0 -d 10.0.0.2 -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT
        #--- NAT pre VMs -> DNS, WWW (http,https), FTP, GPG kluce (11371)
        -A FORWARD -o eth0 -s 10.0.0.0/255.255.255.0 -p udp -m udp --sport 1024:65535 --dport 53 -j ACCEPT
        -A FORWARD -o eth0 -s 10.0.0.0/255.255.255.0 -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
        -A FORWARD -o eth0 -s 10.0.0.0/255.255.255.0 -p tcp -m tcp --sport 1024:65535 --dport 443 -j ACCEPT
        -A FORWARD -o eth0 -s 10.0.0.0/255.255.255.0 -p tcp -m tcp --sport 1024:65535 --dport 21 -j ACCEPT
        -A FORWARD -o eth0 -s 10.0.0.0/255.255.255.0 -p tcp -m tcp --sport 1024:65535 --dport 11371 -j ACCEPT
        #--- BH LAN (SSH) -> VM.www (22) VM.ldap (22,80) VM.db (22) VM.jabber (22) VM.mail (22)
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.2 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.3 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.3 -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.4 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.5 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.6 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.168.254.0/255.255.255.0 -d 10.0.0.100 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        #--- BH BigCorp (SSH) -> VM.www (22) VM.ldap (22,80) VM.db (22) VM.jabber (22) VM.mail (22)
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.2 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.3 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.3 -p tcp -m tcp --sport 1024:65535 --dport 80 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.4 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.5 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.6 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.27 -d 10.0.0.100 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        #--- skupko ANTIK
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.2 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.3 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.4 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.5 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.6 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i eth0 -s 192.0.2.34 -d 10.0.0.100 -p tcp -m tcp --sport 1024:65535 --dport 22 -j ACCEPT
        -A FORWARD -i ! lo -j LOG --log-prefix "FW_DROP: " --log-tcp-options --log-ip-options
        #======================
        #  FILTER - OUTPUT
        #======================
        -A OUTPUT -m state --state INVALID -j LOG --log-prefix "OUT_DROP_INVALID: " --log-tcp-options --log-ip-options
        -A OUTPUT -m state --state INVALID -j DROP
        -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
        #--- Dom0 -> vhosts
        -A OUTPUT -p tcp -s 10.0.0.129/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        -A OUTPUT -p tcp -s 10.0.0.130/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        -A OUTPUT -p tcp -s 10.0.0.131/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        -A OUTPUT -p tcp -s 10.0.0.132/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        -A OUTPUT -p tcp -s 10.0.0.133/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        -A OUTPUT -p tcp -s 10.0.0.227/32 --sport 1024:65535 -d 10.0.0.0/8 -m state --state NEW -j ACCEPT
        #--- FW -> NTP
        -A OUTPUT -o eth0 -p udp --sport 123 --dport 123 -j ACCEPT
        #--- FW -> SSH
        -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 22 --syn -m state --state NEW -j ACCEPT
        #--- FW -> FTP
        -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 21 --syn -m state --state NEW -j ACCEPT
        #--- FW -> SMTP
        -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 25 --syn -m state --state NEW -j ACCEPT
        #--- FW -> WWW (HTTP,HTTPS)
        -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 80 --syn -m state --state NEW -j ACCEPT
        -A OUTPUT -o eth0 -p tcp --sport 1024:65535 --dport 443 --syn -m state --state NEW -j ACCEPT
        #--- FW -> DNS
        -A OUTPUT -o eth0 -p udp --sport 1024:65535 --dport 53 -j ACCEPT
        #--- FW -> VMs ICMP
        -A OUTPUT -s 10.0.0.0/255.0.0.0 -d 10.0.0.0/255.0.0.0 -p icmp -j ACCEPT
        -A OUTPUT -o ! lo -j LOG --log-prefix "OUT_DROP: " --log-tcp-options --log-ip-options
        COMMIT
        -------------------------------END->/var/lib/iptables/active

--------------------------
 Firewall - Kernel tuning
--------------------------

        # nano /etc/sysctl.conf
        -----------------------
        # TCP SYN Cookie Protection - ON
        net.ipv4.tcp_syncookies = 1

        # IP Source Routing - OFF
        net.ipv4.conf.all.accept_source_route = 0

        # ICMP Redirect Acceptance - OFF
        net.ipv4.conf.all.accept_redirects = 0

        # IP Spoofing Protection - ON
        net.ipv4.conf.all.rp_filter = 1

        # Ignoring to ICMP Requests - ON
        net.ipv4.icmp_echo_ignore_all = 1

        # Ignoring Broadcasts Request - ON
        net.ipv4.icmp_echo_ignore_broadcasts = 1

        # Bad Error Message Protection - ON
        net.ipv4.icmp_ignore_bogus_error_responses = 1

        # Logging of Spoofed Packets, Source Routed Packets, Redirect Packets - ON
        net.ipv4.conf.all.log_martians = 1

        # IPV4 Forwarding
        net.ipv4.conf.all.forwarding=1
        -----------------------END->/etc/sysctl.conf

Instalacia Bastille linuxu

asciiart
------------------
 Install bastille
------------------

        # apt-get install bastille

-----------------
 Config bastille
-----------------

        # InteractiveBastille
        ---------------------
        >accept

        Q: Would you like to set more restrictive permissions on the administration utilities? [yes]
        Q: Would you like to disable SUID status for mount/umount? [yes]
        Q: Would you like to disable SUID status for ping? [yes]
        Q: Would you like to disable SUID status for at? [Yes]
        Q: Would you like to disable SUID status for traceroute? [yes]
        Q: Should Bastille disable clear-text r-protocols that use IP-based authentication? [yes]
        Q: Would you like to enforce password aging? [no]
        Q: Would you like to restrict the use of cron to administrative account? [yes]
        Q: Do you want to set the default umask? [yes]
        Q: What umask would you like to set for users on the system? [077]
        Q: Should we disallow root login on all ttys? [yes]
        Q: Would you like to password-protect the GRUB prompt? [yes]
        Q: Enter GRUB password, please. [xen.gr.54.x]
        Q: Would you like to disable CTRL-ALT-DELETE rebooting? [yes]
        Q: Would you like to password protect single-user mode? [yes]
        Q: Would you like to set a default-deny on TCP Wrappers and xinetd? [no]
        Q: Should Bastille ensure the telnet service does not run on this system? [yes]
        Q: Should Bastille ensure inetd's FTP service does not run on this system? [yes]
        Q: Would you like to display "Authorized Use" message at log-in time? [no]
        Q: Would you like to put limits on system resource usage? [yes]
        Q: Should we restrict console access to small group of the user accounts? [yes]
        Q: Which accounts should be able to login at console? [root bh skupko firefox]
        Q: Would you like to add additional logging? [no]
        Q: Would you like to install TMPDIR/TMP scripts? [no]
        Q: Would you like to run the packet filtering script? [no]
        Q: Are you finished answering the questions, i.e. may we make the changes? [yes]

Instalacia IDS (Snort)

asciiart
---------------
 Install snort
---------------

        # apt-get install snort
        -----------------------
        Please enter the address range that Snort will listen on [192.168.254.0/24]

        # dpkg-reconfigure snort (Tieto parametre sa daju nastavit aj v /etc/snort/snort.debian.conf)
        ---------------------------------------------------------------------------------------------
        When should Snort be started? [boot]
        On which interface(s) Snort listen? [eth0]
        Please enter the address range that Snort will listen on [192.168.3.0/24]
        Should Snort disable promiscuous mode on the interafce? [no]
        Should Snort's rules testing order be changed to Pass|Alert|Log [yes]
        Should daily summaries be sent by e-mail? [yes]
        Who should receive the daily statistics mails? [root]
        An alert needs to appear more times than this number to be included in the daily statistics [1]
        ---------------------------------------------------------------------------------------------

        Balicek 'oinkmaster' sluzi na aktualizovanie signatur pre snort
        ---------------------------------------------------------------
        # apt-get install oinkmaster

        Nastavenie URL pre stahovanie pravidiel
        =======================================

        # nano /etc/oinkmaster.conf
        ---------------------------
        url = http://www.snort.org/pub-bin/oinkmaster.cgi/45fa31ac78b82c5fcd8c306ad2b2bbea5d0ad431/snortrules-snapshot-2.3.tar.gz

        Adresar pre zalohovanie starych pravidiel
        -----------------------------------------
        # mkdir /etc/snort/rules-backup

        Automaticke aktualizovanie pravidiel
        ------------------------------------
        # touch /etc/cron.daily/snort_update
        # chmod +x /etc/cron.daily/snort_update

        # nano /etc/cron.daily/snort_update
        -----------------------------------
        #!/bin/bash
        /usr/sbin/oinkmaster -C /etc/oinkmaster.conf -o /etc/snort/rules/ -b /etc/snort/rules-backup 2>&1 | mutt -s "SNORT UPDATE: XEN" support@localhost

--------------
 Config snort
--------------

        # nano /etc/snort/snort.conf
        ----------------------------
        output alert_full: /var/log/snort/alert
        preprocessor sfportscan: proto {all} \
                                                         memcap { 10000000 } \
                                                         sense_level { medium } \
                                                         logfile { /var/log/snort/portscan.log }
        preprocessor stream4: disable_evasion_alerts detect_scans enforce_state state_protection enable_udp_sessions

--------------
 Chroot snort
--------------

        Vytvorenie adresarovej struktury (klietka)
        ------------------------------------------
        # mkdir -p /chroot/snort/var/log/snort
        # chown snort:snort /chroot/snort/var/log/snort

        Editneme subor /etc/default/snort
        ---------------------------------

        # nano /etc/default/snort
        -------------------------
        PARAMS="-m 027 -D -d -t /chroot/snort"
        LOGDIR="/chroot/snort/var/log/snort"

        # nano /etc/logrotate.d/snort
        -----------------------------
        /chroot/snort/var/log/snort/portscan.log /chroot/snort/var/log/snort/alert /chroot/snort/var/log/snort/portscan2.log {
                daily
                rotate 30
                compress
                missingok
                notifempty
                create 0640 snort adm
                sharedscripts
                postrotate
                        /etc/init.d/snort restart > /dev/null 2>&1
                endscript
        }

Instalacia XEN

asciiart
--------------------
 Install XEN 32 bit
--------------------

        # apt-get install xen-linux-system-2.6.18-6-xen-686
        # apt-get install libc6-xen
        # init 6

--------------------
 Install XEN 64 bit
--------------------

        # xen-linux-system-2.6.18-6-xen-amd64

!!! ESTE NEIMPLEMENTOVANE !!!

:-)

Monitoring

asciiart
-------------------------------------------------
 Install snortalog (statistiky snort a iptables)
-------------------------------------------------

        # apt-get install libgd-graph-perl
        # wget http://jeremy.chartier.free.fr/snortalog/downloads/snortalog/snortalog_v2.4.2.tgz

-------------------------------------------------
 Monitoring iptables
-------------------------------------------------

        # cat /var/log/iptables.log | /tools/snortalog/snortalog.pl -8 -o /var/log/iptables-sumar.txt -report
← howtoz(EN | SK)