linux 禁ping

今天用nmap扫描了局域网的主机,发现几个主机开着好多危险端口,做linux的,对这些安全知识有一点了解.遂用nmap扫描了自己的主机是否存在可利用端口.发现每次nmap都能成功的检测我的主机是alive状态.nmap功能强大,作为一个小小的个人主机,咱是无能为力禁止nmap发现主机了.但是咱可以禁止ping.让手段不高的人发现不了主机.

1.首先,linux没有禁止ping的情况下,能够平通自己的主机:

 localhost:~$ ping 8.8.8.2
 PING 8.8.8.1 (8.8.8.2) () bytes of data.
  bytes from 8.8.8.2: icmp_seq= ttl= time=0.079 ms
  bytes from 8.8.8.2: icmp_seq= ttl= time=0.080 ms

localhost:~$ sudo tcpdump -i any -nn icmp    用tcpdump 检测的效果
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size  bytes
::43.651510 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::43.651535 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length
::44.675532 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::44.675557 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length
::45.703558 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::45.703581 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length
::46.723521 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::46.723552 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length
::47.747520 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::47.747551 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length
::48.771511 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
::48.771538 IP 8.8.8.2 > 8.8.8.2: ICMP echo reply, id , seq , length 

2.linux系统运行起来后,用参数控制主机是否接收icmp协议(ping通过icmp协议来进行主机发现),这些参数加载到内存中,linux系统的/proc 目录就是内存的镜像,可以从/proc系统通过查找 /proc/sys/net/ipv4/icmp_echo_ignore_all 查看目前的主机是否禁用icmp协议,0表示没有禁用,就是说其他主机ping当前主机的时候,当前主机作出回应.1表示禁用ping,其他主机ping当前主机的时候,当前主机不回应.

 localhost:~$ cat /proc/sys/net/ipv4/icmp_echo_ignore_all
 

3.之后,用root权限修改 /etc/sysctl.conf文件,添加一行

 localhost:$ sudo vi /etc/sysctl.conf
 .......
 ......
 net.ipv4.icmp_echo_ignore_all = 1     #添加该行
 
 :wq   #保存退出
 
 localhost:~$ sudo sysctl -p          #执行着一条命令,使刚才的修改生效
 net.ipv4.icmp_echo_ignore_all = 1    #sysctl.conf 文件中生效的配置
 
 localhost:~$ cat /proc/sys/net/ipv4/icmp_echo_ignore_all     #再次查看该配置,现在已经禁用icmp协议回复ping了
 

4.在ping自己的主机看看,看到无法回复ping了.

 localhost:~$ ping 8.8.8.2
 PING 8.8.8.2 (8.8.8.2) () bytes of data.
 ^C
 --- 8.8.8.2 ping statistics ---
  packets transmitted,  received, % packet loss, time 2047ms

 localhost:~$ sudo tcpdump -i any -nn icmp     #可以看到只有request,没有replay了.
 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
 listening on any, link-type LINUX_SLL (Linux cooked), capture size  bytes
 ::32.054412 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::33.059607 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::34.083520 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::35.107526 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::36.131524 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::37.155536 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::38.179573 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::39.203568 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length
 ::40.227618 IP 8.8.8.2 > 8.8.8.2: ICMP echo request, id , seq , length