为你的 Linux 服务器加把锁
安全 防火墙 FirewallD UFW iptables
![](/data/attachment/album/201612/25/144708p5vukd7hkbm7bxh8.png)



> 
> 无论你使用的哪种 Linux 发行版，你都需要使用基于 iptables 的防火墙来保护它。
> 
> 
> 


啊哈！你已经设置好了你的第一台 Linux 服务器并且已经准备发车了！是么？嗯，慢着。


默认情况下，你的 Linux 系统对攻击者来说并非是足够安全的。当然，它比 Windows XP 要安全多了，但这说明不了什么。


想要使你的 Linux 系统真正稳固，你需要按照 [Linode](https://www.linode.com/) 的 [服务器安全指南](https://www.linode.com/docs/security/securing-your-server) 来操作。


总的来说，**首先你必须**关闭那些你不需要的服务。当然要这样做的话，你先要知道你正在使用哪些网络服务。


你可以使用 shell 命令来找到是哪些服务：



```
netstat -tulpn

```

[netstat](http://www.faqs.org/docs/linux_network/x-087-2-iface.netstat.html) 将会告诉你正在运行哪些服务和这些服务正在使用的端口是什么。如果你不需要其中的某项服务或端口，你就应该关闭它。例如，除非你正在运行一个网站，否则你是不需要运行中的 [Apache](https://httpd.apache.org/) 或 [Nginx](https://www.nginx.com/) 服务器，也不需要开启 80 或 8080 端口。


总之一句话，不确定的话，就关了它先。


在一个最简单的，没有做过任何额外更改的 Linux 服务器上，你会看到 [SSH](https://www.linode.com/docs/tools-reference/ssh/)、 [RPC](http://www.linux.org/threads/tcp-ip-service-remote-procedure-call-rpc.4913/) 和 [NTPdate](https://help.ubuntu.com/lts/serverguide/NTP.html) 运行在它们的公开端口上。不要添加像 [telnet](http://www.telnet.org/htm/faq.htm) 这样陈旧而不安全的 shell 程序，否则老司机就会在你不经意间将你的 Linux 小跑车开走了。也许，在上世纪 80 年代的时候你喜欢把 telnet 当作你 SunOS 机器上的备份登录方式，但是那早已成为了过去。


就 SSH 来说，你应该使用 [RSA 密钥](https://www.linode.com/docs/security/securing-your-server/#create-an-authentication-key-pair) 和 [Fail2Ban](https://www.linode.com/docs/security/securing-your-server/#use-fail2ban-for-ssh-login-protection) 来加固。除非你需要 RPC，否则就卸载它——如果你不知道需要不需要它的话，那就是不需要。


关于如何关门已经说的够多了；让我们来聊聊利用 iptables 来锁定进来的流量吧。


当你启动 Linux 服务器的时候它是没有任何规则的。这就意味着所有的流量都是被允许的。这当然是**不好的**。因此，你需要及时的设置你的防火墙。


Iptables 是一种用来给 [netfilter](https://www.netfilter.org/) 设置网络策略规则的 shell 工具，netfilter 是Linux 系统下的默认防火墙，它利用一组规则来允许或禁止流量。当有人尝试连接上你的系统——有些人无时不刻地尝试这么干，而且从不气馁——iptables 就会检查这些请求是否与规则列表相匹配。如果没有匹配到任何的规则，它就会采取默认操作。


这个默认操作应该是将连接“Drop”掉，即禁掉这些意图闯入者。而且这不会让他们知道这些网络探测行为发生了什么。（你也可以将链接“Reject”掉，但是这会同时让他们知道你有一个正在运行的 Linux 防火墙。就目前而言，让陌生人能获取到我们系统的信息越少越好。至少，我是这么认为的。）


现在，你可以用 iptables 来设置你的防火墙了。我已经这么做了。就像以前，我骑着自行车去六英里外上班，并且两边都是上坡。而现在，我开车去。


这其实比喻的是我使用 Fedora 发行版的 [FirewallD](http://www.firewalld.org/) 和 Debian 系发行版的 [UFW](https://help.ubuntu.com/community/UFW)（Uncomplicated Firewall）。这些都是易用的 iptables 的 shell 前端。你可以在以下的 Linode 指南中找到适合的使用方式：[FirewallD](https://www.linode.com/docs/security/firewalls/introduction-to-firewalld-on-centos) 和 [UFW](https://www.linode.com/docs/security/firewalls/configure-firewall-with-ufw)。


从本质上来说设置这些规则就是在你的服务器上放置“非请勿入”的告示牌。用起来吧。


但是也别太兴奋地把所有的链接都关闭了。例如：



```
sudo ufw default deny incoming

```

看起来是个好主意哦。别忘了，它禁止了所有链接，包括你自己哦！


很好，它就是这么干的。这意味着它也同样禁止了 SSH 的登录。也就是说你再也不能登录你那新服务器了。哇哦！


不过，如果你犯了错，错误的将更多的链接都禁止了。你看，老司机也同样被你挡在门外了。


或者，更准确得说，这不是你或你的服务器所遇到的个别现象。当然，你也不是[每天受到 3 亿多次攻击尝试的美国国家安全局（NSA）](http://thehackernews.com/2016/02/nsa-utah-data-center.html)。但是攻击脚本根本不在乎你是谁。它只是不断的检查寻找网络中存在已知漏洞的服务器。在平常的一天中我自己的小服务器就会受到数以百计的攻击。


都这样了，你还在等什么呢？去吧，加固你的网络服务吧。安装 FirewallD 或者 UFW 来加固你的服务器吧。你会愿意去做的。




---


关于作者：


Steven J. Vaughan-Nichols 是一位资深的 IT 专栏作家，他的作品出现在许多行业领袖媒体上，包括 ZDNet.com、PC Magazine、InfoWorld、ComputerWorld、Linux Today 和 eWEEK 等。Steven 在 IT 专业方面的见解犀利，虽然他的观点和云计算方面的认识，并不代表 Linode 观点，但是我们仍然非常感谢他的贡献。你可以在 Twitter 上关注他 （@sjvn）。




---


via: <https://medium.com/linode-cube/locking-down-your-linux-server-24d8516ae374#.qy8qq4bx2>


作者：[Steven J. Vaughan-Nichols](https://medium.com/linode-cube/locking-down-your-linux-server-24d8516ae374#.qy8qq4bx2) 译者：[wcnnbdk1](https://github.com/wcnnbdk1) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 组织编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
# Locking Down Your Linux Server

## By: Steven J. Vaughan-Nichols

*No matter what your Linux, you need to protect it with an iptables-based firewall.*

Yes! You’ve just set up your first Linux server and you’re ready to rock and roll! Right? Uh, no.

By default, your Linux box is not secure against attackers. Oh sure, it’s more secure than Windows XP, but that’s not saying much.

To really nail down your Linux system you need to follow the instructions in [Linode](https://www.linode.com/)’s [Securing your Server](https://www.linode.com/docs/security/securing-your-server) guide.

To summarize, you must — first — turn off the services you don’t need. Of course to do that, you need to know what network services you’re running in the first place.

You can find out what those are with the shell command:

*netstat -tulpn*

[ Netstat](http://www.faqs.org/docs/linux_network/x-087-2-iface.netstat.html) will tell you what services you’re running and what ports they’re using. If you don’t need a particular service or port, you should turn it off. For example, unless you’re running a website, you don’t need to be running the

[Apache](https://httpd.apache.org/)or

[Nginx](https://www.nginx.com/)web servers or have the 80 or 8080 ports open.

In short, when in doubt, turn it off or close it down.

On a plain vanilla Linux server, with nothing extra, you’ll see [SSH](https://www.linode.com/docs/tools-reference/ssh/), [RPC](http://www.linux.org/threads/tcp-ip-service-remote-procedure-call-rpc.4913/), and [NTPdate](https://help.ubuntu.com/lts/serverguide/NTP.html) up and running with open ports. Do not add such old and insecure shell programs as [telnet](http://www.telnet.org/htm/faq.htm) or the hackers will rise up and slap your server right out of your control. Yeah, maybe you loved telnet back on your SunOS box in the 80s, but that was then and this is now.

As for SSH, be sure to lock it down with [RSA keys](https://www.linode.com/docs/security/securing-your-server/#create-an-authentication-key-pair) and [Fail2Ban](https://www.linode.com/docs/security/securing-your-server/#use-fail2ban-for-ssh-login-protection). Unless you need RPC — and if you need it, you’ll know — go ahead and uninstall it.

So much for closing your doors; let’s talk about using iptables to lock them from intruders.

When you start your Linux server it has no — nada — rules. That means all traffic is allowed. This is NOT GOOD. So, you need to setup your firewall … as soon as possible!

Iptables is a shell utility that sets network rule policies for [netfilter](https://www.netfilter.org/), Linux’s default firewall, using a set of rules to allow or block traffic. When someone tries to connect with your system — and someone will every day, without fail — iptables looks to match the request with its rules list. If it can’t find a match, it will resort to whatever the default action is.

That action should be to “Drop” the connection, which will block those outsiders wanting in. But it won’t let them know what happened to their attempts to knock on your server’s network door. (You could also “Reject” the connection, but that let’s them know you have a Linux firewall up and running. These days, the less information a stranger has about my system, the better. At least, that’s my philosophy.)

Now, you could set up your firewall with *just* iptables. I’ve done it. But then, I used to ride a bike to work six miles away, uphill both directions. These days, I drive.

That means I use [FirewallD](http://www.firewalld.org/) for the Fedora distributions and [UFW](https://help.ubuntu.com/community/UFW) [Uncomplicated Firewall] for the Debian family. These are easy-to-use, shell front-ends to iptables. For the finer details on how use either, see these Linode guides: [FirewallD](https://www.linode.com/docs/security/firewalls/introduction-to-firewalld-on-centos) and [UFW](https://www.linode.com/docs/security/firewalls/configure-firewall-with-ufw).

Both come with default rule sets that, in essence, put up “No Trespassing” signs around your server. Use them.

But don’t get too excited about shutting down all your connections. For example:

*sudo ufw default deny incoming*

may look like a good idea. After all, it blocks everything!

Well, yes. Yes, it does. That means it also blocks ssh. And *that* means you can no longer get to your shiny new server. Whoops!

Still, if you’re going to err, err on the side of blocking more connections. You see — the hackers really are out to get you.

Or, to be more exact, it’s not you or your servers personally. Sure, you’re not the [National Security Agency (NSA), which gets — no kidding — 300-million hacking attempts per day](http://thehackernews.com/2016/02/nsa-utah-data-center.html). But a hacking script doesn’t care. It just screens the internet looking for a server with a known hole. My own quiet little servers get hundreds of attacks — on a slow day.

So, what are you waiting for? Go, lock down your network services. Install FirewallD or UFW and secure your servers. You’ll be glad you did.

*Please feel free to share below any comments or insights about your experience locking down a Linux server with an IPtables-based firewall. And if this blog was useful, consider sharing it through social media.*

*About the blogger: Steven J. Vaughan-Nichols is a veteran IT journalist whose estimable work can be found on a host of channels, including **ZDNet.com**, **PC Magazine**, **InfoWorld**, **ComputerWorld**, **Linux Today** and **eWEEK**. Steven’s IT expertise comes without parallel. And while his views and cloud situations are solely his and don’t necessarily reflect those of Linode, we are grateful for his contributions. He can be followed on Twitter (@sjvn).*