Linux服务器上适用的防火墙分析
点击次数：36 次 发布日期：2008-11-22 09:42:39 作者：源代码网
|
#!/bin/bash echo-e" 33[1;31mRainLowfirewall 33[mserverversion1.0rc1--09/24/2004 " echo-e"############################################" echo-e"Thissoftwaremaybeusedanddistributedaccordingto" echo-e"thetermsoftheGNUGeneralPublicLicense(GPL)provided" echo-e"creditisgiventotheoriginalauthor." echo-e" 33[1;31mCopyright(c)2004rainlow 33[m " echo-e" Allrightsreserved " echo-e"#######################################" #nowbeginsthefirewall echo-e" Welcometo 33[3;31mRainlowFirewall 33[0m " echo-e" 33[1;32mhttp://www.rainlow.com 33[m " PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin ./etc/init.d/functions exit_failure() { echo-en" 33[3;031m[FAILED] 33[0m " echo-en" 33[3;031m->FATAL:$FAILURE 33[0m " echo-en" 33[3;031m->**ABORTED**. 33[0m " exit1 } check_root() { ROOT_ID=0 echo"Checkingifyouareroot...." if["$UID"="$ROOT_ID"] then echo-e" OK!continue.... " echo-e"a" else echo-e"Sorry,youarenotrootandnotpermittedtodothisoption... " echo-e"a" FAILURE="youcannotrunthiscommand,youmustberoottodothis" exit_failure fi } check_enviroment() { echo-e" 33[1;31mNowCheckingsoftwareenvrioment 33[m " OS=`uname-s` _OS=$OS if["$_OS"!="Linux"];then FAILURE="Sorrythisversioncanonlyworkunderlinux" exit_failure else echo-en" 33[1;32mPASS 33[m " fi KERNELMAJ=`uname-r|sed-e"s,..*,,"` KERNELMIN=`uname-r|sed-e"s,[^.]*.,,"-e"s,..*,,"` if["$KERNELMAJ"-lt2];then FAILURE="Sorryyoukernelistooold,pleaseupgradeitfirst!" exit_failure fi if["$KERNELMAJ"-eq2-a"$KERNELMIN"-lt4];then FAILURE="onlykernelgreaterthan2.4issupported" exit_failure fi if((`iptables-V2>&1|grep-c"Commandnotfound"`));then FAILURE="cannotfindiptablescommandyoumustinstalliptablesfirst" exit_failure fi if!((`whichmodprobe2>&1|grep-c"which:nomodprobein"`))&& ([-a/proc/modules]||![-a/proc/version]);then if((`lsmod|grep-c"ipchains"`));then rmmodipchains>/dev/null2>&1 fi fi } wait() { echo|awk"{printf"||",$1}" forxin`seq110`; do sleep1 echo"#"|awk"{printf"%s",$1}" done echo-en" " } iptables() { /sbin/iptables"$@" } mp() { /sbin/modprobe"$@" } load_module() { if[-e/lib/modules/`uname-r`/kernel/net/ipv4/netfilter/ip_tables.o] then echo-e" Loadingiptablesmodulespleasewait...." mpip_tables mpipt_LOG mpipt_owner mpipt_MASQURADE mpipt_REJECT mpipt_conntrack_ftp mpipt_conntrack_irc mpiptable_filter mpiptable_nat mpiptable_mangle mpip_conntrack mpipt_limit mpipt_state mpipt_unclean mpipt_TCPMSS mpipt_TOS mpipt_TTL mpipt_quota mpipt_iplimit mpipt_pkttype mpipt_ipv4options mpipt_MARK echo-e" 33[3;032m[OK] 33[0m " else echo-e" Sorry,noiptablesmodulesfound!!" fi } ip_stack_adjust() { if[-e/proc/sys/net/ipv4/ip_forward] then echo-e"enableip_forward.pleasewait...." echo0>/proc/sys/net/ipv4/ip_forward echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/ip_default_ttl] then echo-e"changingdefaultttl...." echo88>/proc/sys/net/ipv4/ip_default_ttl echo-e" 33[3;032m[OK] 33[0m " fi echo-e" disabledynamicipsupport...." echo0>/proc/sys/net/ipv4/ip_dynaddr echo-e" 33[3;032m[OK] 33[0m " if[-e/proc/sys/net/ipv4/ip_no_pmtu_disc] then echo-e"disablepathmtudiscovery.pleasewait...." echo0>/proc/sys/net/ipv4/ip_no_pmtu_disc echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/ipfrag_high_thresh] then echo-e"changingipfrag_high_thresh.pleasewait...." echo5800>/proc/sys/net/ipv4/ipfrag_high_thresh echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/ipfrag_low_thresh] then echo-e"changingipfrag_low_thresh.pleasewait...." echo2048>/proc/sys/net/ipv4/ipfrag_low_thresh echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/ipfrag_time] then echo-e"changingipfrag_low_thresh.pleasewait...." echo20>/proc/sys/net/ipv4/ipfrag_time echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/ipfrag_secret_interval] then echo-e"changingipfrag_secret_interval.pleasewait...." echo600>/proc/sys/net/ipv4/ipfrag_secret_interval echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_syn_retries] then echo-e"changingtcp_syn_retries.pleasewait...." echo4>/proc/sys/net/ipv4/tcp_syn_retries echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_synack_retries] then echo-e"changingtcp_synack_retries.pleasewait...." echo4>/proc/sys/net/ipv4/tcp_synack_retries echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_keepalive_time] then echo-e"changingtcp_keepalive_time.pleasewait...." echo300>/proc/sys/net/ipv4/tcp_keepalive_time echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_keepalive_probes] then echo-e"changingtcp_keepalive_probes.pleasewait...." echo4>/proc/sys/net/ipv4/tcp_keepalive_probes echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_keepalive_intvl] then echo-e"changingtcp_keepalive_intvl.pleasewait...." echo60>/proc/sys/net/ipv4/tcp_keepalive_intvl echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_retries1] then echo-e"changingtcp_retriest.pleasewait...." echo3>/proc/sys/net/ipv4/tcp_retries1 echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_retries2] then echo-e"changingtcp_retriest.pleasewait...." echo15>/proc/sys/net/ipv4/tcp_retries2 echo-e" 33[3;032m[OK] 33[0m " fi if[-e/proc/sys/net/ipv4/tcp_orphan_retries] then echo-e"disabletcp源代码网供稿. |
