Linux_防火墙与SElinux

一、防火墙与SElinux

1、防火墙和selinux

• 防火墙
  • iptables          默认允许所以
  • firewalld         默认拒绝所有
  • ebtables　　 不认识，不管
• selinux    安全上下文标识（使用 ls -Z 查看）

二、配置防火墙规则

1、查看防火墙当前规则

[root@localhost ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0               //当前网卡设备
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:              //副规则，主要在这添加规则

2、我这用httpd服务测试

• 查看当前防火墙状态

  • [root@localhost ~]# systemctl status firewalld
    ● firewalld.service - firewalld - dynamic firewall daemon
       Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
       Active: active (running) since Wed 2020-08-26 05:20:39 CST; 12min ago
         Docs: man:firewalld(1)
     Main PID: 1038 (firewalld)
        Tasks: 2 (limit: 11340)
       Memory: 36.5M
       CGroup: /system.slice/firewalld.service
               └─1038 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
    
    Aug 26 05:20:37 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon...
    Aug 26 05:20:39 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.

• 测试httpd测试主页是否可以访问
  • 

3、添加rich rules规则

[root@localhost ~]# firewall-cmd --add-rich-rule 'rule family=ipv4 source address=192.168.121.0/24 service name=http accept' --permanent
success                         //添加副规则                                                                                    //永久添加（开机永久生效）

 //重新加载防火墙规则 （此步骤必须要）
[root@localhost ~]# firewall-cmd --reload
success

4、查看是否添加rich rules规则

[root@localhost ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
	rule family="ipv4" source address="192.168.121.0/24" service name="http" accept

5、在次访httpd测试主页

四、配置SElinux规则

1、首先在防火墙放行8090端口

[root@localhost ~]# firewall-cmd --add-rich-rule 'rule family=ipv4 source address=192.168.121.0/24 port port=8090 protocol=tcp accept' --permanent
success

 //重新加载防火墙配置（此步骤必须做）
[root@localhost ~]# firewall-cmd --reload
success

2、查看防火墙配置

[root@localhost ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
	rule family="ipv4" source address="192.168.121.0/24" service name="http" accept
	rule family="ipv4" source address="192.168.121.0/24" port port="8090" protocol="tcp" accept

3、安装semanage命令

//首先查看semanage命令安装包
[root@localhost ~]# yum provides *bin/semanage
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:50:01 ago on Wed 26 Aug 2020 05:30:36 AM CST.
policycoreutils-python-utils-2.9-3.el8.noarch : SELinux policy core python utilities
Repo        : baseos
Matched from:
Other       : *bin/semanage

 //安装policycoreutils-python-utils
[root@localhost ~]# yum install -y policycoreutils-python-utils
............
Installed:
  policycoreutils-python-utils-2.9-3.el8.noarch           checkpolicy-2.9-1.el8.x86_64                       python3-audit-3.0-0.13.20190507gitf58ec40.el8.x86_64
  python3-libsemanage-2.9-1.el8.x86_64                    python3-policycoreutils-2.9-3.el8.noarch           python3-setools-4.2.2-1.el8.x86_64
Complete!

4、使用semanage查看httpd可使用的端口号

[root@localhost ~]# semanage port -l|grep http
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989

5、使用semanage给http添加可使用的端口号

[root@localhost ~]# semanage port -a -t http_port_t -p tcp 8090

 //再次查看端口是否添加
[root@localhost ~]# semanage port -l | grep http
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      8090, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989

6、使用IP:8090访问测试页面