http://purpen.iteye.com/blog/1135342
==============================Linux===========================
例如:
1.限制所有的ssh,
除非从218.64.87.0——127
vi /etc/hosts.deny
hosts.deny:
in.sshd:ALL
-------------------------------------------------
vi /etc/hosts.allow
hosts.allow:
in.sshd:218.64.87.0/255.255.255.128
in.sshd:218.64.88.10
---------------------------------
hosts.allow:
ALL:192.100.248.247
2.封掉218.64.87.0——127的telnet
hosts.deny:
in.sshd:218.64.87.0/255.255.255.128
3.限制所有人的TCP连接,除非从218.64.87.0——127访问
hosts.deny:
ALL:ALL
hosts.allow:
ALL:218.64.87.0/255.255.255.128
4.限制218.64.87.0——127对所有服务的访问
hosts.deny
ALL:218.64.87.0/255.255.255.128
其中冒号前面是TCP daemon的服务进程名称,通常系统进程在/etc/inetd.conf中指定,比如in.ftpd,in.telnetd,in.sshd
其中IP地址范围的写法有若干中,主要的三种是:
1.网络地址——子网掩码方式:
218.64.87.0/255.255.255.0
2.网络地址方式(我自己这样叫,呵呵)
218.64.(即以218.64打头的IP地址)
3.缩略子网掩码方式,既数一数二进制子网掩码前面有多少个“1”比如:
218.64.87.0/255.255.255.0《====》218.64.87.0/24
______________________________
设置好后,要重新启动
# /etc/rc.d/init.d/xinetd restart
# /etc/rc.d/init.d/network restart
==============================AIX============================
1.增加一个过滤规则以允许接受从10.152.129.49发来的ftp请求:
# smitty ipsec4---> Advanced IP Security Configuration------> Configure IP Security Filter Rules---------> Add an IP Security Filter Rule ->Add an IP Security Filter Rule
* Rule Action -----------------------------------[permit] +
* IP Source Address -----------------------------[10.152.129.49]
* IP Source Mask --------------------------------[255.255.255.255]
IP Destination Address --------------------------[]
IP Destination Mask ---------------------------- []
* Apply to Source Routing? (PERMIT/inbound only) [yes]+
* Protocol --------------------------------------[all]+
* Source Port / ICMP Type Operation -------------[any]+
* Source Port Number / ICMP Type ----------------[0] #
* Destination Port / ICMP Code Operation --------[eq]+
* Destination Port Number / ICMP Type -----------[21] #
* Routing ---------------------------------------[both] +
* Direction -------------------------------------[both]+
* Log Control -----------------------------------[no]+
* Fragmentation Control -------------------------[0]+
* Interface -------------------------------------[all] +
其他缺省值
2. 增加另一个过滤规则以拒绝其它所有向10.110.157.151发出的ftp请求:
Add an IP Security Filter Rule
* Rule Action -----------------------------------[deny]+
* IP Source Address -----------------------------[0.0.0.0]
* IP Source Mask --------------------------------[0.0.0.0]—
IP Destination Address ------------------------[10.110.157.151]—
IP Destination Mask ---------------------------[255.255.255.255] *
Apply to Source Routing? (PERMIT/inbound only) [yes] +
* Protocol --------------------------------------[all]+
* Source Port / ICMP Type Operation -------------[any] +
* Source Port Number / ICMP Type ----------------[0] #
* Destination Port / ICMP Code Operation --------[eq]+
* Destination Port Number / ICMP Type -----------[21]#
* Routing ---------------------------------------[both]+
* Direction -------------------------------------[both]+
* Log Control -----------------------------------[no] +
* Fragmentation Control ------------------------ [all packets]+
* Interface ------------------------------------ [all] +
2. 激活设置的过滤规则:
# smitty ipsec4---> Advanced IP Security Configuration----> Activate/Update/Deactivate IP ---->Security Filter Rule ---------> Activate / Update
3. 上面的操作进行完后,用户将只能从10.152.129.49 ftp至 10.110.157.151,任何其它机器试图ftp至10.110.157.151的操作将失败。