Linux:SSH实用技巧及常用命令使用说明

SFTP 可以使用的命令
CD 改变目录
LS 列出文件
MKDIR
RMDIR
PWD
CHGRP
CHOWN
CHMOD
LN OLDNAEM NEWNAME
RM PATH
RENAME OLDNAME NEWNAEM
EXIT 推出
LCD PATH 改变当前目录到本机目录
LLS
LMKDIR
LPWD L=LOCALHOST
PUT LOCALHOST_PATH HOST_PATH
PUT 本机目录或者文件
GET 远程主机目录文件 本机目录
GET 远程主机目录或者文件
GET *
GET *.RPM
# $OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.
#Port 22 SSH 默认的坚挺端口
#Protocol 2,1 选择SSH的版本
#ListenAddress 0.0.0.0 监听的IP地址
#ListenAddress ::
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key SSH VERSION 1 使用的密钥
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key SSH VERSION 2 使用的RSA私钥
#HostKey /etc/ssh/ssh_host_dsa_key SSH VAESION 2 使用的 DSA私钥
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600 版本一的密钥从新生成时间间隔
#ServerKeyBits 768 SERVER_KEY 的长度
# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH SSH登陆系统 记录信息 记录的位置 默认是/VAR/LOG/SECUER
SyslogFacility AUTHPRIV
#LogLevel INFO
# Authentication:
#UserLogin no 在SSH 下不接受LOGIN 程序登陆
#LoginGraceTime 120
#PermitRootLogin yes 是否让ROOT用户登陆
#StrictModes yes 用户的HOST_KEY 改面的时候不让登陆
#RSAAuthentication yes 是否使用纯的RAS认证 针对VERSION 1
#PubkeyAuthentication yes 是否使用PUBLIC_KEY 针对VERSION 2
#AuthorizedKeysFile .ssh/authorized_keys 使用不需要密码登陆的的帐号时帐号的存放文件所在的文件名
# rhosts authentication should not be used
#RhostsAuthentication no 本机系统不使用 RHOSTS 使用RHOSTS 不安全
# Don’t read the user’s ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes 是否取消上面的认证方式 当然选是
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no 不使用针对 VERSION 1 使用RHOSTS 文件在/ETC/HOSTS.EQUIV 配合RAS进行认证 不建议使用
# similar for protocol version 2
#HostbasedAuthentication no 针对VERSION 2 也是上面的功能
# Change to yes if you don’t trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no 是否忽略主目录的 ~/.ssh/known_hosts文件记录
# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes 是否需要密码验证
#PermitEmptyPasswords no 是否允许空密码登陆
# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes 挑战任何密码验证
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#AFSTokenPassing no
# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no
# Set this to ‘yes’ to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of ‘PasswordAuthentication’
#PAMAuthenticationViaKbdInt no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes 是否显示上次登陆信息
#PrintLastLog yes 显示上次登陆信息
#KeepAlive yes 发送连接信息
#UseLogin no
#UsePrivilegeSeparation yes 用户权限设置
#PermitUserEnvironment no
#Compression yes
#MaxStartups 10 连接的画面的设置 从连接就是登陆画面
# no default banner path
#Banner /some/path
#VerifyReverseMapping no
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
DenyUsers * 设置受阻的用户 代表全部用户
DenyUsers test
DenyGroups test
SSH 自动登陆设置
1设置CLIENT端建立PUBLIC_KEY 和 PRIVATE_KEY
[TEST@TEST TEST] SSH-KEYGEN –T RSA //-T 说明使用RSA 加密算法
生成密钥的文件夹 $HOME/.SSH/ID_RSA
上传PUBLIC_KEY 到SERVER
SFTP TEST@TEST
LCD /HOME/.SSH
PUT ID_RSA.PUB
EXIT
登陆到SERVER
执行命令
[TEST@TEST SSH] CAT ../ID_RSA.PUB >> AUTHORIZED_KEYS
相关的安全设置
/ETC/SSH/SSHD_CONFIG
/ETC/HOSTS.ALLOW
/ETC/HOSTS.DENY
IPTABLES
编辑/ETC/HOSTS.DENY
SSHD : ALL :SPAWN (/BIN/ECHO SECURITY NOTICE FROM HOST `/BIN/HOSTNAME` ;\
/BIN/ECHO ; /USR/SBIN/SAFE_FINGER @%H )\
/BIN/MAIL –S “%d -%H SECURITY” ROOT@LOCALHOST &\
:TWIST (/BIN/ECHO –E “\N\nWARNING connection not allowed. You attempt has been logged. \n\n\n 警告信息
来源:赛迪网

Share

Snort 中文手册

摘要snort有三种工作模式:嗅探器、数据包记录器、网络入侵检测系统。嗅探器模式仅仅是从网络上读取数据包并作为连续不断的流显示在终端上。数据包记录器模式把数据包记录到硬盘上。网路入侵检测模式是最复杂的,而且是可配置的。我们可以让snort分析网络数据流以匹配用户定义的一些规则,并根据检测结果采取一定的动作。(2003-12-11 16:39:12)
Snort 用户手册

第一章 snort简介
snort有三种工作模式:嗅探器、数据包记录器、网络入侵检测系统。嗅探器模式仅仅是从网络上读取数据包并作为连续不断的流显示在终端上。数据包记录器模式把数据包记录到硬盘上。网路入侵检测模式是最复杂的,而且是可配置的。我们可以让snort分析网络数据流以匹配用户定义的一些规则,并根据检测结果采取一定的动作。
嗅探器
所谓的嗅探器模式就是snort从网络上读出数据包然后显示在你的控制台上。首先,我们从最基本的用法入手。如果你只要把TCP/IP包头信息打印在屏幕上,只需要输入下面的命令:
  ./snort -v
使用这个命令将使snort只输出IP和TCP/UDP/ICMP的包头信息。如果你要看到应用层的数据,可以使用:
  ./snort -vd
这条命令使snort在输出包头信息的同时显示包的数据信息。如果你还要显示数据链路层的信息,就使用下面的命令:
  ./snort -vde
注意这些选项开关还可以分开写或者任意结合在一块。例如:下面的命令就和上面最后的一条命令等价:
  ./snort -d -v –e
数据包记录器
如果要把所有的包记录到硬盘上,你需要指定一个日志目录,snort就会自动记录数据包:
  ./snort -dev -l ./log
当然,./log目录必须存在,否则snort就会报告错误信息并退出。当snort在这种模式下运行,它会记录所有看到的包将其放到一个目录中,这个目录以数据包目的主机的IP地址命名,例如:192.168.10.1
  如果你只指定了-l命令开关,而没有设置目录名,snort有时会使用远程主机的IP地址作为目录,有时会使用本地主机IP地址作为目录名。为了只对本地网络进行日志,你需要给出本地网络:
  ./snort -dev -l ./log -h 192.168.1.0/24
这个命令告诉snort把进入C类网络192.168.1的所有包的数据链路、TCP/IP以及应用层的数据记录到目录./log中。
如果你的网络速度很快,或者你想使日志更加紧凑以便以后的分析,那么应该使用二进制的日志文件格式。所谓的二进制日志文件格式就是tcpdump程序使用的格式。使用下面的命令可以把所有的包记录到一个单一的二进制文件中:
  ./snort -l ./log -b
注意此处的命令行和上面的有很大的不同。我们勿需指定本地网络,因为所有的东西都被记录到一个单一的文件。你也不必冗余模式或者使用-d、-e功能选项,因为数据包中的所有内容都会被记录到日志文件中。
你可以使用任何支持tcpdump二进制格式的嗅探器程序从这个文件中读出数据包,例如: tcpdump或者Ethereal。使用-r功能开关,也能使snort读出包的数据。snort在所有运行模式下都能够处理tcpdump格式的文件。例如:如果你想在嗅探器模式下把一个tcpdump格式的二进制文件中的包打印到屏幕上,可以输入下面的命令:
  ./snort -dv -r packet.log
在日志包和入侵检测模式下,通过BPF(BSD Packet Filter)接口,你可以使用许多方式维护日志文件中的数据。例如,你只想从日志文件中提取ICMP包,只需要输入下面的命令行:
  ./snort -dvr packet.log icmp

还有更多的.就看这里….http://man.chinaunix.net/network/snort/Snortman.htm

Share

修改的postfix 邮件提示信息

我修改的postfix 邮件提示信息

自己胡乱修改的,注意标题不可以修改成中文
postfix的提示信息存储在/etc/postfix/bounce.cf
修改完成后,运行postconf -b /etc/postfix/bounce.cf重新加载,加载后会显示内容。看一下是否修改成功。
复制内容到剪贴板
代码:

#
# Do not edit this file. This file shows the default delivery status
# notification (DSN) messages that are built into Postfix.
#
# To change Postfix DSN messages, perhaps to add non-English text,
# follow instructions in the bounce(5) manual page.
#

#
# The failure template is used when mail is returned to the sender;
# either the destination rejected the message, or the destination
# could not be reached before the message expired in the queue.
#

failure_template = <<EOF
Charset: utf-8
From: MAILER-DAEMON (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
Postmaster-Subject: Postmaster Copy: Undelivered Mail

这里是 $myhostname 邮件服务器。
This is the mail system at host $myhostname.

很抱歉通知您,你的邮件无法投递到一个或者多个地址,

如果需要更多帮助,请将此邮件转发给邮件管理员。

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system
EOF

#
# The delay template is used when mail is delayed. Note a neat trick:
# the default template displays the delay_warning_time value as hours
# by appending the _hours suffix to the parameter name; it displays
# the maximal_queue_lifetime value as days by appending the _days
# suffix.
#
# Other suffixes are: _seconds, _minutes, _weeks. There are no other
# main.cf parameters that have this special behavior.
#
# You need to adjust these suffixes (and the surrounding text) if
# you have very different settings for these time parameters.
#

delay_template = <<EOF
Charset: utf-8
From: MAILER-DAEMON (Mail Delivery System)
Subject: Delayed Mail (still being retried)
Postmaster-Subject: Postmaster Warning: Delayed Mail

这里是 $myhostname 邮件服务器。
This is the mail system at host $myhostname.

####################################################################
# 这只是一条警告信息,你不需要再次发送你的邮件 #
# THIS IS A WARNING ONLY. YOU DO NOT NEED TO RESEND YOUR MESSAGE. #
####################################################################

你的邮件发送不成功,系统会在$maximal_queue_lifetime_days day(s)内每$delay_warning_time_hours hour(s)再次重新发送

如果需要更多帮助,请将此邮件转发给邮件管理员。
Your message could not be delivered for more than $delay_warning_time_hours hour(s).
It will be retried until it is $maximal_queue_lifetime_days day(s) old.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system
EOF

#
# The success template is used when mail is delivered to mailbox,
# when an alias or list is expanded, or when mail is delivered to a
# system that does not announce DSN support. It is an error to specify
# a Postmaster-Subject: here.
#

success_template = <<EOF
Charset: utf-8
From: MAILER-DAEMON (Mail Delivery System)
Subject: Successful Mail Delivery Report

这里是 $myhostname 邮件服务器。
This is the mail system at host $myhostname.

你的邮件已经成功投递到目标地址。
Your message was successfully delivered to the destination(s)
listed below. If the message was delivered to mailbox you will
receive no further notifications. Otherwise you may still receive
notifications of mail delivery errors from other systems.

The mail system
EOF

#
# The verify template is used for address verification (sendmail -bv
# address...). or for verbose mail delivery (sendmail -v address...).
# It is an error to specify a Postmaster-Subject: here.
#

verify_template = <<EOF
Charset: utf-8
From: MAILER-DAEMON (Mail Delivery System)
Subject: Mail Delivery Status Report

这里是 $myhostname 邮件服务器。
This is the mail system at host $myhostname.
你请求的邮件投递报告随此邮件附上。
Enclosed is the mail delivery report that you requested.

The mail system
EOF

来自:http://www.iredmail.org/bbs/viewthread.php?tid=84&pid=1171&page=1&extra=

Share

看 Wietse 教你如何在 3 小时内投递 1000000 封邮件

从 ExtMail 论坛看到,然后去找了原文,希望对大家有帮助。

原文地址:
http://marc.info/?l=postfix-users&m=100153886212837&w=2

复制内容到剪贴板
代码:

List: postfix-users
Subject: Re: 1.000.000 email posted in a single delivery process
From: wietse () porcupine ! org (Wietse Venema)
Date: 2001-09-26 21:14:15
[Download message RAW]

If you want to deliver 1000000 queue files in 3 hours, that is 10
milliseconds per file. That seems a bit optimistic to me, considering
the latencies of real disks (every file needs to be read from disk,
the cache is cold) and of real networks (having a local DNS server
should really make a difference).

Neither qmail nor Postfix currently has connection caching, which
can make a difference sending mail to sites that have slow servers.

0 - In the /etc/syslog.conf file, put a - in front of the maillog
filename, so that the stupid syslogd does not hammer the disk
after writing each logfile record.

1 - The default settings of two levels of directory hashing in the
queue should suffice. If you disagree, change this with:

postconf -e hash_queue_depth=3
postfix reload

2 - Configure an adequate number of delivery agents in the master.cf
file: 500+. On your typical Linux box, this will run the kernel
out of resources and Postfix will slam on the brakes until you
fix it.

3 - Test the setup with the smtp-source and smtp-sink programs.
For the test, specify a relayhost name that points to the
smtp-sink program, and send messages with thousands of recipients
into Postfix, and have Postfix perform one-recipient deliveries.

On the Postfix host:

postconf -e relayhost=smtp-sink.host:9999 \
smtp_destination_recipient_limit=1

On the mail sink host (can be same as postfix host, if you have
enough memory and process slots and space for open files):

./smtp-sink -c :9999 1000

On the smtp-source host (can be same as postfix host):

./smtp-source -c -m 1000 -s 10 -r 10000 -t foo@postfix.host postfix.host

Postfix breaks up the deliveries into transactions of 1 recipient
each, so one message with 10000 recipients will keep lots of
delivery agents busy.

4 - Before submitting the real mail:

postconf -e defer_transports=smtp relayhost= \
smtp_destination_recipient_limit=\$default_destination_recipient_limit
postfix reload

(and don't let anyone execute a "sendmail -q" command).

5 - SUBMIT THE MAIL VIA SMTP, not via /usr/sbin/sendmail. Otherwise
you are throwing away all the performance.

6 - On Doomsday,

postconf -e defer_transports=
postfix reload
sendmail -q

7 - From here on, do not touch the box. Each time you stop or reload
Postfix, or do a sendmail -q, it slows down dramatically.

Wietse

Alexander:
> (I've posted this message in QMAIL and EXIM mailing list.
> Many people say me that POSTFIX can do a good work)
>
> This is a case study and it's NOT for create a spamming system or other
> terrible mail bombing system.
> I HATE them !
>
> Title: the best mode to deliver 1.000.000 email messages (recipient are ALL
> different and email are ALL different) in few hours during a single delivery
> session.
>
> You suppose to have a SMP Linux server (i.e. dual P-III 800 Mhz, 512 MB Ram,
> SCSI Raid 5, kernel 2.4.9 and RaiserFS) and a good internet connection (4
> Mbit/sec full bandwidth) and a fast DNS server near me.
>
> During the night a program running on the same server creates 1 million of
> email (getting user data and infos data from a SQL DB).
> This process need about 3 hours. Meanwhile email are created, they are
> "injected" in MTA queue (i.e. using qmail-inject or
> exim -odq -t) and they are NOT delivered: they stay in queue.
> The email are all different but short: about 800-1000 bytes each and the
> recipients are all different and are all remote.
> Yes, we can have a vary big number of different recipient domain but
> statistically we also have a large number of email directed on mass email
> system (Hotmail, Yahoo...)
>
> So 1.000.000 x 1.000 bytes = 1 GBytes data. Yes, like a technical
> information email system with personalized info for each recipient.
>
> Then every day at 8.00 AM the remote delivery needs to start (exim -q ,
> qmail-remote) and delivery is done once per day.
>
> Target: send 1 million of email in a very short time, shortest as possibile,
> it must end as soon as possibile. Bandwidth occupation is not a problem: we
> can use all 4 Mbit/sec (about 1 GB / 500 Kbytes/sec = about 2000 seconds , 1
> hour and few minutes. 2 or 3 hours are ok anyway).
>
> And now the questions:
>
> 1) QMAIL vs EXIM vs POSTFIX: which is the best MTA to manage 1.000.000 email
> in queue ?
> (EXIM with option "split_spool_directory" and QMAIL patched to have a more
> "deep" in queue tree, POSTIFIX ??)
>
> 2) EXIM can deliver all messages during a single SMTP session to the same
> email system (useful for mass system like HOTMAIL,YAHOO, ....), QMAIL no.
> Is it faster to have either for example 300 (more or less) qmail-remote
> process running and sending 1 messages each or for example 20 (more or
> less) "exim -q" process running sending more messages in a single SMTP
> connection ? Remember: the target is to use less time than possible.
>
> Thanks for any suggestion about.
> POSTFIX ,I've never used it, can be an alternative ?
>
>
>

-
To unsubscribe, send mail to majordomo@postfix.org with content
(not subject): unsubscribe postfix-users

来自:http://www.iredmail.org/bbs/viewthread.php?tid=76&pid=1170&page=1&extra=#pid1170

Share

IRedMail-doc-MySQL-0.2

在这里帮忙为新的开发软件iRedMail做个堆广.也给自己留下一个笔记.好让自己想要找的时候可以找的更快.想复习的时候也可以再学习.

注意:本文档只适用于 iRedMail-0.2 版本。
如果您发现文档里有错误、不准确的地方,请您务必 联系我们,以便我们能尽快修正问题。感谢您的反馈。
Tutorial
iRedMail 安装要求
Overview
iRedMail 安装前的准备
建立 vmail 用户,作为所有邮件的拥有者
Apache 与 PHP
MySQL:存储邮件虚拟域和用户
Postfix:SMTP 服务
Dovecot:提供 POP3/IMAP 服务及 SASL 认证
Policyd:有效防止垃圾邮件
Amavisd-new:MTA 与 Anti-Spam,Anti-Virus 软件的桥梁
Roundcubemail:使用 AJAX 技术的 web mail 程序
phpMyAdmin:最好的 MySQL 数据库管理工具
PostfixAdmin:web 界面的虚拟域、虚拟用户管理程序
ClamAV:为邮件服务加上防病毒功能
SpamAssassin:为邮件服务加上基于邮件内容的发垃圾邮件功能
SPF: Sender Policy Framework
DKIM: DomainKeys Identified Mail
其它文档
Cyrus-SASL:为邮件服务提供用户验证功能
SquirrelMail:WebMail
参考文档
iRedMail 反垃圾邮件心得与总结
取自”http://www.iredmail.org/wiki/index.php?title=IRedMail-doc-MySQL-0.2&variant=zh-cn

Share

Red Hat Enterprise Linux AS 5 下载地址及安装号码

红帽子企业Linux 5安装序列号 Server:* Red Hat Enterprise Linux (Server including virtualization): 2515dd4e215225dd + Red Hat Enterprise Linux Virtualization Platform: 49af89414d147589 Client:* Red Hat Enterprise Linux Desktop: 660266e267419c67 + Red Hat Enterprise Linux Desktop + Workstation Option: da3122afdb7edd23 + Red Hat Enterprise Linux Desktop + Workstation + DualOS Option (Virtualization): 7fcc43557e9bbc42 + Red Hat Enterprise Linux Desktop + DualOS Option (Virtualization): fed67649ff918c77redhat linux as 5.0 正式DVD版的下载地址ftp://ftp.centoschina.com:2121/rhel.5.0.server.centoschina.com.dvd.iso
RHEL5 i386 FTP无限制全速下载!!!
不限速,不限流,不限线程,建议多线程下载!
ftp://60.232.126.152/os/linux/redhat/rhel5/rhel-5-server-i386-disc1.isoftp://60.232.126.152/os/linux/redhat/rhel5/rhel-5-server-i386-disc2.isoftp://60.232.126.152/os/linux/redhat/rhel5/rhel-5-server-i386-disc3.isoftp://60.232.126.152/os/linux/redhat/rhel5/rhel-5-server-i386-disc4.isoftp://60.232.126.152/os/linux/redhat/rhel5/rhel-5-server-i386-disc5.iso

Share