ETC/자격증
[리눅스마스터]제1602회 리눅스마스터 1급 2차 시험 작업식 풀이 2
AnKiWoong
2022. 3. 31. 08:28
반응형
14. 다음은 xinetd 관련 로그 기록을 별도의 파일에 저장하도록 설정하는 과정이다. 아래의 조건을 참조하여 ( 괄호 ) 안에 알맞은 내용을 적으시오.
# vi ( ① )
( ② ) = ( ③ ) ( ④ )<조 건>
- ① : 관련 파일명을 절대 경로로 적는다.
- ② ~ ④ : 관련 로그는 /var/log/xinetd.log에 기록하도록 설정한다.
/etc/xinetd.conf : xinted로 동작하는 서비스 전체에 대한 설정 파일
xinted 방식 : 서비스 요청시 실행하는 방식(서비스 요청이 적을때 효율적 / telnet, ftp 등)
log_type : SYSLOG와 FILE 두 가지 설정이 가능 / 로그 기록을 syslog에 위임 할지, 별도 파일로 지정할지 선택
ex) log_type = FILE /var/logs/xinet.log
[root@server1 ~]# find / -name xinetd*
/run/xinetd.pid
/sys/fs/cgroup/devices/system.slice/xinetd.service
/sys/fs/cgroup/systemd/system.slice/xinetd.service
/etc/systemd/system/multi-user.target.wants/xinetd.service
/etc/sysconfig/xinetd
/etc/xinetd.d
/etc/xinetd.conf
/usr/sbin/xinetd
/usr/lib/systemd/system/xinetd.service
/usr/lib/python2.7/site-packages/sos/plugins/xinetd.py
/usr/lib/python2.7/site-packages/sos/plugins/xinetd.pyc
/usr/lib/python2.7/site-packages/sos/plugins/xinetd.pyo
/usr/share/doc/xinetd-2.3.15
/usr/share/augeas/lenses/dist/xinetd.aug
/usr/share/man/man5/xinetd.conf.5.gz
/usr/share/man/man5/xinetd.log.5.gz
/usr/share/man/man8/xinetd.8.gz
/usr/share/vim/vim74/ftplugin/xinetd.vim
/usr/share/vim/vim74/indent/xinetd.vim
/usr/share/vim/vim74/syntax/xinetd.vim
[root@server1 ~]# vi /etc/xinetd.conf# This is the master xinetd configuration file. Settings in the
# default section will be inherited by all service configurations
# unless explicitly overridden in the service configuration. See
# xinetd.conf in the man pages for a more detailed explanation of
# these attributes.
defaults
{
# The next two items are intended to be a quick access place to
# temporarily enable or disable services.
#
# enabled =
# disabled =
# Define general logging characteristics.
log_type = SYSLOG daemon info
log_on_failure = HOST
log_on_success = PID HOST DURATION EXIT
# Define access restriction defaults
#
# no_access =
# only_from =
# max_load = 0
cps = 50 10
instances = 50
per_source = 10
# Address and networking defaults
#
# bind =
# mdns = yes
v6only = no
# setup environmental attributes
#
# passenv =
groups = yes
umask = 002
# Generally, banners are not used. This sets up their global defaults
#
# banner =
# banner_fail =
# banner_success =
}
includedir /etc/xinetd.d
① /etc/xinetd.conf
② log_type
③ FILE
④ /var/log/xinetd.log
15. 다음은 DHCP 서버의 설정 과정이다. 아래의 조건을 참조하여 ( 괄호 ) 안에 알맞은 내용을 적으시오.
( ① ) ( ② ) {
( ③ ) 08:00:07:26:c0:a5;
( ④ ) 192.168.1.22;
}<조 건>
- 맥(MAC) 주소가 08:00:07:26:c0:a5인 경우에는 고정적으로 192.168.1.22번 IP 주소를 할당한다.
- 호스트명은 ihd_pc로 관리한다.
/etc/dhcp/dhcpd.conf : DHCP 환경 설정 파일
DHCP 서버를 통한 고정 IP 설정 방법
host linux {
option host-name "linux.example.com";
hardware ethernet 00:A0:78:8E:9E:AA;
fixed-address 192.168.1.1;
}
[root@server1 ~]# find / -name dhcp*
/sys/fs/selinux/booleans/dhcpc_exec_iptables
/sys/fs/selinux/booleans/dhcpd_use_ldap
/etc/selinux/targeted/modules/active/modules/dhcp.pp
/etc/sysconfig/dhcpd
/etc/openldap/schema/dhcp.schema
/etc/dhcp
/etc/dhcp/dhcpd.conf
/etc/dhcp/dhcpd6.conf
/var/lib/dhcpd
/var/lib/dhcpd/dhcpd.leases
/var/lib/dhcpd/dhcpd6.leases
/usr/sbin/dhcpd
/usr/lib/systemd/system/dhcpd.service
/usr/lib/systemd/system/dhcpd6.service
/usr/lib/python2.7/site-packages/sos/plugins/dhcp.py
/usr/lib/python2.7/site-packages/sos/plugins/dhcp.pyc
/usr/lib/python2.7/site-packages/sos/plugins/dhcp.pyo
/usr/lib/dracut/modules.d/40network/dhcp-root.sh
/usr/lib/firewalld/services/dhcp.xml
/usr/lib/firewalld/services/dhcpv6-client.xml
/usr/lib/firewalld/services/dhcpv6.xml
/usr/share/doc/dhcp-common-4.2.5
/usr/share/doc/dhcp-4.2.5
/usr/share/doc/dhcp-4.2.5/dhcpd.conf.example
/usr/share/doc/dhcp-4.2.5/dhcpd6.conf.example
/usr/share/doc/dhcp-4.2.5/ldap/dhcp.schema
/usr/share/doc/dhcp-4.2.5/ldap/dhcpd-conf-to-ldap
/usr/share/augeas/lenses/dist/dhcpd.aug
/usr/share/man/man5/dhcp-eval.5.gz
/usr/share/man/man5/dhcp-options.5.gz
/usr/share/man/man5/dhcpd.conf.5.gz
/usr/share/man/man5/dhcpd.leases.5.gz
/usr/share/man/man8/dhcpd.8.gz
/usr/share/systemtap/tapset/dhcpd.stp
[root@server1 ~]# vi /etc/dhcp/dhcpd.conf# DHCP Server Configuration file.
# see /usr/share/doc/dhcp*/dhcpd.conf.example
# see dhcpd.conf(5) man page
#
[root@server1 ~]# man dhcpdOptions
DHCP (and also BOOTP with Vendor Extensions) provide a mechanism whereby the server can provide the
client with information about how to configure its network interface (e.g., subnet mask), and also how
the client can access various network services (e.g., DNS, IP routers, and so on).
These options can be specified on a per-subnet basis, and, for BOOTP clients, also on a per-client
basis. In the event that a BOOTP client declaration specifies options that are also specified in its
subnet declaration, the options specified in the client declaration take precedence. A reasonably com‐
plete DHCP configuration might look something like this:
subnet 239.252.197.0 netmask 255.255.255.0 {
range 239.252.197.10 239.252.197.250;
default-lease-time 600 max-lease-time 7200;
option subnet-mask 255.255.255.0;
option broadcast-address 239.252.197.255;
option routers 239.252.197.1;
option domain-name-servers 239.252.197.2, 239.252.197.3;
option domain-name "isc.org";
}
A bootp host on that subnet that needs to be in a different domain and use a different name server might
be declared as follows:
host haagen {
hardware ethernet 08:00:2b:4c:59:23;
fixed-address 239.252.197.9;
filename "/tftpboot/haagen.boot";
option domain-name-servers 192.5.5.1;
option domain-name "vix.com";
}
A more complete description of the dhcpd.conf file syntax is provided in dhcpd.conf(5).
① host
② ihd_pc
③ hadware ethernet
④ fixed-address
16. 다음은 하나의 공인 IP 주소를 공유해서 다수의 컴퓨터의 인터넷 사용이 가능하도록 설정하는 과정이다.
( 괄호 ) 안에 알맞은 내용을 적으시오.
# iptables –t ( ① ) –A ( ② ) ( ③ ) eth0 –j ( ④ ) --to 203.247.40.100<조 건>
- 해당 시스템에는 이더넷 카드가 두 개가 장착되어 있는데, 첫 번째 이더넷 카드에서 나가는 패킷에 대해 공인 IP 주소인 203.247.40.100을 할당한다.
iptables : 패킷 필터링 도구 / 방화벽 구성이나 NAT에 사용
-A : APPEND : 정책 추가
-o : 출력 인터페이스와 매칭(––out-interface)
-j : 매치되는 패킷을 어떻게 처리할지 지정 (--jump)
DNAT : PREROUTING / 목적지 IP를 변환(NAT)한다.
SNAT : POSTROUTING / 소스 IP를 [변환(NAT)|NAT]한다.
[root@server1 ~]# iptables [-t 테이블] [액션] [체인] [매치] [-j 타겟]
[root@server1 ~]# iptables -help
iptables v1.4.21
Usage: iptables -[ACD] chain rule-specification [options]
iptables -I chain [rulenum] rule-specification [options]
iptables -R chain rulenum rule-specification [options]
iptables -D chain rulenum [options]
iptables -[LS] [chain [rulenum]] [options]
iptables -[FZ] [chain] [options]
iptables -[NX] chain
iptables -E old-chain-name new-chain-name
iptables -P chain target [options]
iptables -h (print this help information)
Commands:
Either long or short options are allowed.
--append -A chain Append to chain
--check -C chain Check for the existence of a rule
--delete -D chain Delete matching rule from chain
--delete -D chain rulenum
Delete rule rulenum (1 = first) from chain
--insert -I chain [rulenum]
Insert in chain as rulenum (default 1=first)
--replace -R chain rulenum
Replace rule rulenum (1 = first) in chain
--list -L [chain [rulenum]]
List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
--flush -F [chain] Delete all rules in chain or all chains
--zero -Z [chain [rulenum]]
Zero counters in chain or all chains
--new -N chain Create a new user-defined chain
--delete-chain
-X [chain] Delete a user-defined chain
--policy -P chain target
Change policy on chain to target
--rename-chain
-E old-chain new-chain
Change chain name, (moving any references)
Options:
--ipv4 -4 Nothing (line is ignored by ip6tables-restore)
--ipv6 -6 Error (line is ignored by iptables-restore)
[!] --protocol -p proto protocol: by number or name, eg. `tcp'
[!] --source -s address[/mask][...]
source specification
[!] --destination -d address[/mask][...]
destination specification
[!] --in-interface -i input name[+]
network interface name ([+] for wildcard)
--jump -j target
target for rule (may load target extension)
--goto -g chain
jump to chain with no return
--match -m match
extended match (may load extension)
--numeric -n numeric output of addresses and ports
[!] --out-interface -o output name[+]
network interface name ([+] for wildcard)
--table -t table table to manipulate (default: `filter')
--verbose -v verbose mode
--wait -w [seconds] maximum wait to acquire xtables lock before give up
--wait-interval -W [usecs] wait time to try to acquire xtables lock
default is 1 second
--line-numbers print line numbers when listing
--exact -x expand numbers (display exact values)
[!] --fragment -f match second or further fragments only
--modprobe=<command> try to insert modules using this command
--set-counters PKTS BYTES set the counter during insert/append
[!] --version -V print package version.
[root@server1 ~]# man iptablesTABLES
There are currently five independent tables (which tables are present at any time depends on the kernel
configuration options and which modules are present).
-t, --table table
This option specifies the packet matching table which the command should operate on. If the ker‐
nel is configured with automatic module loading, an attempt will be made to load the appropriate
module for that table if it is not already there.
The tables are as follows:
filter:
This is the default table (if no -t option is passed). It contains the built-in chains INPUT
(for packets destined to local sockets), FORWARD (for packets being routed through the box),
and OUTPUT (for locally-generated packets).
nat:
This table is consulted when a packet that creates a new connection is encountered. It con‐
sists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT
(for altering locally-generated packets before routing), and POSTROUTING (for altering pack‐
ets as they are about to go out). IPv6 NAT support is available since kernel 3.7.
mangle:
This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-
in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering
locally-generated packets before routing). Since kernel 2.4.18, three other built-in chains
are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering
packets being routed through the box), and POSTROUTING (for altering packets as they are
about to go out).
raw:
This table is used mainly for configuring exemptions from connection tracking in combination
with the NOTRACK target. It registers at the netfilter hooks with higher priority and is
thus called before ip_conntrack, or any other IP tables. It provides the following built-in
chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets gen‐
erated by local processes)
security:
This table is used for Mandatory Access Control (MAC) networking rules, such as those enabled
by the SECMARK and CONNSECMARK targets. Mandatory Access Control is implemented by Linux
Security Modules such as SELinux. The security table is called after the filter table,
allowing any Discretionary Access Control (DAC) rules in the filter table to take effect
before MAC rules. This table provides the following built-in chains: INPUT (for packets com‐
ing into the box itself), OUTPUT (for altering locally-generated packets before routing), and
FORWARD (for altering packets being routed through the box).
iptables 확인
[root@server1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
FORWARD_direct all -- anywhere anywhere
FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere
FORWARD_IN_ZONES all -- anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere
FORWARD_OUT_ZONES all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_public all -- anywhere anywhere [goto]
FWDI_public all -- anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_public all -- anywhere anywhere [goto]
FWDO_public all -- anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_public (2 references)
target prot opt source destination
FWDI_public_log all -- anywhere anywhere
FWDI_public_deny all -- anywhere anywhere
FWDI_public_allow all -- anywhere anywhere
Chain FWDI_public_allow (1 references)
target prot opt source destination
Chain FWDI_public_deny (1 references)
target prot opt source destination
Chain FWDI_public_log (1 references)
target prot opt source destination
Chain FWDO_public (2 references)
target prot opt source destination
FWDO_public_log all -- anywhere anywhere
FWDO_public_deny all -- anywhere anywhere
FWDO_public_allow all -- anywhere anywhere
Chain FWDO_public_allow (1 references)
target prot opt source destination
Chain FWDO_public_deny (1 references)
target prot opt source destination
Chain FWDO_public_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_public all -- anywhere anywhere [goto]
IN_public all -- anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_public (2 references)
target prot opt source destination
IN_public_log all -- anywhere anywhere
IN_public_deny all -- anywhere anywhere
IN_public_allow all -- anywhere anywhere
Chain IN_public_allow (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW
Chain IN_public_deny (1 references)
target prot opt source destination
Chain IN_public_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
① nat
② POSTROUTING
③ -o
④ SNAT
반응형