服务器VPS安全攻防：CSF防火墙的设置，上海做网站公司

访问：次作者：天也网络

CSF 包括了一套防火墙规则，例如打开哪些端口，根据何种规则判断某个 IP 为恶意，并作出相应的处理，此外还有 lfd（ Login Failure Daemon），它的作用是对那些嗅探密码的 IP 加入黑名单，这可以很好的预防您的密码被暴力破解——但即使有 lfd 的保护，设置一个复杂而不易猜测的密码也是重要的，以免弱口令被轻易猜出。
CSF的配置文件是 /etc/csf/csf.conf。使用您习惯的文本编辑器（vim,nano,etc)编辑该文件，让 CSF更好的为您工作。

管理哪些端口可以打开：
# Allow incoming TCP ports
# 推荐您更改 SSH 的默认端口（22）为其他端口，但请注意一定要把新的端口加到下一行中
TCP_IN = 20,21,47,81,1723,25,53,80,110,143,443,465,587,993,995
# Allow outgoing TCP ports同上，把 SSH 的登录端口加到下一行。
# 在某些程序要求打开一定范围的端口的情况下，例如Pureftpd的passive mode，可使用类似 30000:35000 的方式打开30000-35000范围的端口。
TCP_OUT = 20,21,47,81,1723,25,53,80,110,113,443
# Allow incoming UDP ports
UDP_IN = 20,21,53
# Allow outgoing UDP ports
# To allow outgoing traceroute add 33434:33523 to this list
UDP_OUT = 20,21,53,113,123
# Allow incoming PING 是否允许别人ping你的服务器，默认为1，允许。0为不允许。
ICMP_IN = 1

免疫某些类型的小规模 DDos 攻击：
# Connection Tracking. This option enables tracking of all connections from IP
# addresses to the server. If the total number of connections is greater than
# this value then the offending IP address is blocked. This can be used to help
# prevent some types of DOS attack.
#
# Care should be taken with this option. It s entirely possible that you will
# see false-positives. Some protocols can be connection hungry, e.g. FTP, IMAPD
# and HTTP so it could be quite easy to trigger, especially with a lot of
# closed connections in TIME_WAIT. However, for a server that is prone to DOS
# attacks this may be very useful. A reasonable setting for this option might
# be arround 200.
#
# To disable this feature, set this to 0
CT_LIMIT = 200
# Connection Tracking interval. Set this to the the number of seconds between
# connection tracking scans
CT_INTERVAL = 30
# Send an email alert if an IP address is blocked due to connection tracking
CT_EMAIL_ALERT = 1
# If you want to make IP blocks permanent then set this to 1, otherwise blocks
# will be temporary and will be cleared after CT_BLOCK_TIME seconds
# 是否对可疑IP采取永久屏蔽，默认为0，即临时性屏蔽。
CT_PERMANENT = 0
# If you opt for temporary IP blocks for CT, then the following is the interval
# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)
# 临时性屏蔽时间
CT_BLOCK_TIME = 1800
# If you don t want to count the TIME_WAIT state against the connection count
# then set the following to 1
CT_SKIP_TIME_WAIT = 0
# If you only want to count specific states (e.g. SYN_RECV) then add the states
# to the following as a comma separated list. E.g. SYN_RECV,TIME_WAIT
#
# Leave this option empty to count all states against CT_LIMIT
CT_STATES =
# If you only want to count specific ports (e.g. 80,443) then add the ports
# to the following as a comma separated list. E.g. 80,443
#
# Leave this option empty to count all ports against CT_LIMIT
# 通常只需定义对提供 HTTP 服务的 80 端口进行检测。
CT_PORTS = 80

其他的设置还有很多，如果您有较好的英语基础，阅读那些注释，自定义配置，让 CSF 更符合您的需要。当您编辑完该配置文件后，记得关闭测试模式：
# Testing flag – enables a CRON job that clears iptables incase of
# configuration problems when you start csf. This should be enabled until you
# are sure that the firewall works – i.e. incase you get locked out of your
# server! Then do remember to set it to 0 and restart csf when you re sure
# everything is OK. Stopping csf will remove the line from /etc/crontab
# 把默认的1修改为0。
TESTING = 0

上海网站建设

prev 上海网站建设公司天也网络常用的PHP集成环境

next 网站设计技术要领及操作步骤

服务器VPS安全攻防：CSF防火墙的设置，上海做网站公司

推荐资讯

天也网络做网站常用的开发语言

网站建设采用静态页面好还是动态页面好

天也网络做网站技巧之内容原创

企业网站建设-为什么要注册一级域名

天也网络网站设计流程

上海网站建设网站推广的方式

互联网信息服务管理办法

中国互联网络域名管理办法

13917162708 张

214703270