Firewall + Proxy autenticado + Apache (Centos 5.5 32/64 bits)
Iptables + Proxy. Este é um tutorial completo dessas duas soluções básica para se aplicar em uma empresa. Abordarei: configuração do script de firewall, instalação e configuração do proxy Squid com autenticação por usuário, configuração do Sarg (para relatórios de sites acessados), configuração do Sarg na contrab (para geração automática de relatórios) e configuração do web server Apache.
Ambiente
O ambiente usado neste artigo consiste em uma VM (Virtual Machine ou Máquina Virtual), rodando Centos 5.5 64 bits com duas placas de redes. Uma para o link de Internet, e outra para a rede interna.
Testei e tenho em produção tudo que abordaremos neste artigo. Dúvidas, dicas e críticas construtivas são sempre bem-vindas.
Lista dos pacotes que utilizaremos:
Tendo em vista que:
# yum update -y
Depois instalaremos os pacotes necessários que incluem bibliotecas GCC, Apache, PHP, Joe e Squid:
# yum install gcc* httpd php php-devel squid joe -y
Instalado todos os pacotes acima, chegou a hora do Sarg:
# cd /root/
# wget http://www.sfr-fresh.com/unix/privat/sarg-2.3.1.tar.gz
Depois descompactamos o Sarg e efetuamos sua instalação:
# tar -zxvf sarg-2.3.1.tar.gz
# cd sarg-2.3.1
# ./configure
# make && make install
Crie o arquivo:
# joe /etc/rc.d/rc.firewall
E nele, cole o que estiver abaixo:
Avisos:
Agora daremos permissão de execução ao script:
# chmod 777 /etc/rc.d/rc.firewall
Testei e tenho em produção tudo que abordaremos neste artigo. Dúvidas, dicas e críticas construtivas são sempre bem-vindas.
Lista dos pacotes que utilizaremos:
- Firewall: Iptables
- Proxy: Squid 2.6 Stable
- Relatórios de acesso a sites: Sarg 2.3.1
- Web Server: Apache 2.2.3
- Sistema Operacional: Centos 5.5 64 Bits
Tendo em vista que:
- eth0 = Minha placa de rede INTERNA
- eth1 = Minha placa de rede EXTERNA
- 192.168.1.0/24 = Cadeia de ips da minha rede interna
Instalação dos pacotes necessários
Primeiramente atualizaremos o sistema:# yum update -y
Depois instalaremos os pacotes necessários que incluem bibliotecas GCC, Apache, PHP, Joe e Squid:
# yum install gcc* httpd php php-devel squid joe -y
Instalado todos os pacotes acima, chegou a hora do Sarg:
# cd /root/
# wget http://www.sfr-fresh.com/unix/privat/sarg-2.3.1.tar.gz
Depois descompactamos o Sarg e efetuamos sua instalação:
# tar -zxvf sarg-2.3.1.tar.gz
# cd sarg-2.3.1
# ./configure
# make && make install
Configuração do seu Firewall (Iptables)
O script que utilizaremos é simples, mas eficaz. Ele bloqueia TUDO e depois você tem que liberar o que é necessário para sua rede. No script teremos todos os comentários possíveis ajudando na sua interpretação:Crie o arquivo:
# joe /etc/rc.d/rc.firewall
E nele, cole o que estiver abaixo:
#!/bin/sh
### Script criado por Lucas Possamai ######################################
###############################################################
###############################################################
############ Define Variaveis ########################################
echo "Definindo variaveis.................................[OK]"
EXT=eth1
INT=eth0
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
echo "Ativando roteamento.................................[OK]"
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Limpando Regras.....................................[OK]"
### Limpando regras iptables ###
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -X
###############################################################
############ Politicas #############################################
###############################################################
echo "Dropando tudo.......................................[OK]"
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
###############################################################
############## NAT #############################################
###############################################################
echo "Definindo NAT.......................................[OK]"
## Redireciona SQUID rede INT ##
iptables -t nat -A PREROUTING -i $INT -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
## Mascarando internet ##
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o $EXT -j MASQUERADE
###############################################################
############ INPUT ##############################################
###############################################################
echo "Definindo INPUT......................................[OK]"
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
## Aceita conexao SSH qualquer lugar ##
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
## Aceita APACHE ##
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Aceita ping ##
iptables -A INPUT -p icmp -j ACCEPT
## Libera SQUID na rede INT ##
iptables -A INPUT -i $INT -p tcp --dport 3128 -j ACCEPT
###############################################################
############ OUTPUT #############################################
###############################################################
echo "Definindo OUTPUT.....................................[OK]"
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
###############################################################
############ FORWARD ############################################
###############################################################
echo "Definindo FORWARD.....................................[OK]"
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
## Liberando ( TCP ) DNS, smtp, pop, http e squid para rede interna ##
iptables -A FORWARD -p tcp -m multiport --dports 25,53,80,110,3128 -j ACCEPT
## Liberando DNS ( UDP ) para rede interna ##
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
## Liberando PING para rede interna ##
iptables -A FORWARD -p icmp -j ACCEPT
### Script criado por Lucas Possamai ######################################
###############################################################
###############################################################
############ Define Variaveis ########################################
echo "Definindo variaveis.................................[OK]"
EXT=eth1
INT=eth0
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
echo "Ativando roteamento.................................[OK]"
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Limpando Regras.....................................[OK]"
### Limpando regras iptables ###
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -X
###############################################################
############ Politicas #############################################
###############################################################
echo "Dropando tudo.......................................[OK]"
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
###############################################################
############## NAT #############################################
###############################################################
echo "Definindo NAT.......................................[OK]"
## Redireciona SQUID rede INT ##
iptables -t nat -A PREROUTING -i $INT -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
## Mascarando internet ##
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o $EXT -j MASQUERADE
###############################################################
############ INPUT ##############################################
###############################################################
echo "Definindo INPUT......................................[OK]"
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
## Aceita conexao SSH qualquer lugar ##
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
## Aceita APACHE ##
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
## Aceita ping ##
iptables -A INPUT -p icmp -j ACCEPT
## Libera SQUID na rede INT ##
iptables -A INPUT -i $INT -p tcp --dport 3128 -j ACCEPT
###############################################################
############ OUTPUT #############################################
###############################################################
echo "Definindo OUTPUT.....................................[OK]"
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
###############################################################
############ FORWARD ############################################
###############################################################
echo "Definindo FORWARD.....................................[OK]"
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
## Liberando ( TCP ) DNS, smtp, pop, http e squid para rede interna ##
iptables -A FORWARD -p tcp -m multiport --dports 25,53,80,110,3128 -j ACCEPT
## Liberando DNS ( UDP ) para rede interna ##
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
## Liberando PING para rede interna ##
iptables -A FORWARD -p icmp -j ACCEPT
Avisos:
- Você deve alterar a variavel EXT para qual for sua placa de rede ligada a internet
- Você deve alterar a variavel INT para qual for sua placa de rede ligada a rede interna
- Você deve alterar os campos aonde contém 192.168.1.0/24 para a range de IPS da sua rede interna
Agora daremos permissão de execução ao script:
# chmod 777 /etc/rc.d/rc.firewall
Se a politica é:
iptables -P OUTPUT ACCEPT
para que você depois faz:
echo "Definindo OUTPUT.....................................[OK]"
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
Não estariam abertas essas portas de qualquer maneira?
Valeu!!!!!!