Ubuntu-Server 6.10 防火墙系统安装

Next edit /etc/ppp/options. It should look like this:

lock

Now do:

touch /etc/ppp/options.pptpd

Now edit /etc/ppp/options.pptpd. It should look like this:

lock
ms-dns 192.168.1.1
ms-wins 192.168.1.1
domain your.domain.here
debug
name pptp-vpn
auth
proxyarp
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
chapms-strip-domain
lcp-echo-failure 10
lcp-echo-interval 30
nobsdcomp

Next, edit /etc/ppp/chap-secrets. It should look like this:

# Secrets for authentication using CHAP
# client	server	secret			IP addresses
user  pptp-vpn  abcdefg  "*"

Now do:

/etc/init.d/pptpd restart

You must be able now to setup a vpn connection from the inside of your firewall as "user" with paswword "abcdefg" (without the quotes) Change this initial username and password and add some users, if you like. Maybe you'll have to reboot some machines to make it work.

Now open your firewall for vpn connections. To do this, set your /etc/shorewall/rules as shown.

My /etc/shorewall/rules at this time:

#############################################################################################################
#ACTION		SOURCE		DEST		PROTO	DEST	SOURCE		ORIGINAL	RATE		USER/
#							PORT	PORT(S)		DEST		LIMIT		GROUP
#								PORT	PORT(S) DEST			LIMIT	GROUP
#
#	Accept DNS connections from the firewall to the network
#
ACCEPT	net	$FW	tcp	25
ACCEPT	net	$FW	tcp	443
ACCEPT	net	$FW	tcp	993
ACCEPT	net	$FW	udp	6277
DNAT	net	loc:192.168.1.1	tcp	1723
DNAT	net	loc:192.168.1.1	47
DNS/ACCEPT	$FW		net
#
#	Accept SSH connections from the local network for administration
#
SSH/ACCEPT	loc		$FW
#
#	Allow Ping from the local network
#
Ping/ACCEPT	loc		$FW
#
# Reject Ping from the "bad" net zone.. and prevent your log from being flooded..
#

To comlete this step, do:

/etc/init.d/shorewall restart

So now your customers will be able to do their job at home as well.

Note, that this only makes sense when your server has a reliable broadband connection to the internet, which in The Netherlands is the defacto standard, even for very tiny offices and most home addresses. In this respect we are way ahead of the rest of the world.

Next do:

cd /root

wget http://surfnet.dl.sourceforge.net/sourceforge/clamav/clamav-0.88.6.tar.gz

Like before, pick a mirror close to you.

groupadd clamav

useradd -g clamav -s /bin/false -c "Clam Antivirus" clamav

tar -zxvf clamav-0.88.6.tar.gz

cd clamav-0.88.6

./configure --sysconfdir=/etc

make

make install

touch /var/log/freshclam.log

chmod 600 /var/log/freshclam.log

chown clamav /var/log/freshclam.log

Now edit /etc/clamd.conf. Comment out "EXAMPLE" (without quotes). Next do the same in/etc/freshclam.conf.

Next do:

/usr/local/bin/freshclam

Now make this a cron job and run it every hour. Preferably not on the hour or anywhere near, as the clamav servers will be flooded when everybody does so. Choose a smart time for this job. The service is absolutely FREE! Let's keep it that way.

/etc/init.d/mailscanner restart

Now I want to do some perl jobs. If you actually use the ancient hardware I did to make this tuto, be advised that it is going to take some time.

Note that you can do without this, for starters. You may wish to schedule this job anywhere soon. If you choose so, you are

DONE!

Alternatively go all the way right now and do:

perl -MCPAN -e shell

Accept all defaults, except for the question where you can answer "UNINST=1" (without the quotes). I think it is best to actually do UNINST=1.

Now do:

install ExtUtils::CBuilder

reload cpan

The "reload cpan" command should be given right after each step in the cpan shell. Better safe than sorry. I only mention this once.

install ExtUtils::MakeMaker

As a result of the next commands you will be asked some questions. Just hit "enter" in all cases.

install Bundle::CPAN

install Bundle::LWP

install Mail::ClamAV

Now leave the cpan shell:

q

/etc/init.d/mailscanner restart

Now clean your /root directory. That's where all the downloads went.

Warning!!! Don't install Mail::SpamAssassin from cpan alongside the ubuntu spamassassin package as it will breake your system. No more rules du jour, and the rules, my friends, that's what it is mostly about!

 如果您对本文有任何疑问或者建议，请到讨论区发表您的意见: >> 论坛入口 <<

上一页 1 2 3 4 5 6 7 89 下一页

上一篇：Shorewall的单用户简单设置   下一篇：在breezy安装AntiVir的全攻略

【文章评论】 【收藏本文】 【推荐好友】 【打印本文】 【我要投稿】 【论坛讨论】