5月技术考核1

CentOS系统基本设置(考试20分钟)
1.修改ssh远程端口为12345,验证能用12345端口登录即可。
2.设置开启CentOS防火墙,并通过tcp的12345和3306端口,只能设置一条规则。
3.在配置文件里面关闭SELINUX,在不重启系统的情况下生效。

查看ssh端口,一般是默认的22
[root@mysql200 ~]# netstat -antulp | grep sshd
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 1101/sshd
tcp6 0 0 :::22 :::
LISTEN 1101/sshd
修改ssh端口,找到第18行,加一行Port 12345,保存退出
[root@mysql200 ~]# vim /etc/ssh/sshd_config

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#

#Port 22
Port 12345
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
重启ssh服务才能生效,再查看端口,修改成功
[root@mysql200 ~]# systemctl restart sshd
[root@mysql200 ~]# netstat -antulp | grep sshd
tcp 0 0 0.0.0.0:12345 0.0.0.0: LISTEN 3463/sshd
tcp6 0 0 :::12345 :::
LISTEN 3463/sshd

查看防火墙状态
[root@mysql200 ~]# firewall-cmd --state
Running
若果没开启就运行
[root@mysql200 ~]# systemctl start firewalld
[root@mysql200 ~]# firewall-cmd --state
Running

防火墙服务预设的安全区域 public、trusted、drop
public 区域:为默认区域,只允许针对本机的 SSH 服务,其他都拒绝
trusted 区域:对本机的任何访问都被允许
drop 区域:访问本机的任何数据包都会被拒绝

[root@mysql200 ~]# firewall-cmd --list-all
You're performing an operation over default zone ('trusted'),
but your connections/interfaces are in zone 'public' (see --get-active-zones)
You most likely need to use --zone=public option.

trusted
target: ACCEPT
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
修改默认
[root@mysql200 ~]# firewall-cmd --set-default-zone=public
Success
[root@mysql200 ~]# firewall-cmd --reload
Success
[root@mysql200 ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: ssh dhcpv6-client
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
添加通过tcp的12345和3306端口
[root@mysql200 ~]# firewall-cmd --permanent --zone=public --add-port=12345/tcp --add-port=3306/tcp
success
[root@mysql200 ~]# firewall-cmd --reload
success
[root@mysql200 ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: ssh dhcpv6-client
ports: 12345/tcp 3306/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

在配置文件里面关闭SELINUX,在不重启系统的情况下生效。

修改selinux配置文件,SELINUX=disabled
vim /etc/selinux/
#* This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.*

SELINUXTYPE=targeted
查看selinux’状态
[root@mysql200 selinux]# getenforce
Enforcing 强制

临时关闭
[root@mysql200 selinux]# setenforce 0
[root@mysql200 selinux]# getenforce
Permissive

转载于:https://blog.51cto.com/13673837/2122680

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值