벌써 두번째 당했습니다.. 나쁜 헤커들 ....요+ㄱ은 못하겠고...
 수법은 두번다 같고...
. atmd (auto mount daemon process를 이용...2xxx대 port를 열고..)
   --> 초보라 잘 모르지만 0씨의 말에 의하면...2xxx port하고
       inet과 쫑이 나서..telnet, ftp 가 안된다고 합니다.
. nobody 계정으로 nfs로 리눅스의 디스크를 공유해서리..(rpc ?)
. ftp를 이용 구멍난 login 프로그램을 깔고...
. inetd /tmp/h 해서리... inet program사용하는 로그를 가져가는지 ?
  (password 등을 기록해서리...빼간다고 함....)
  증상으론....
. telnet 과 ftp 가 안됨..(이 게시판에 약 57개정도 올라와있는데..혹시? )
. 리부팅시 부팅이 안될수도 있고...
  세번째 리눅스 깔면서....ipchains을 좀 공부했는데...
 이번에 또 뚤리면....인제 리눅스 사용한다는 말 못하겠어요..
 MASQ 는 안쓸꺼구여...단순히...firewall 기능으로 port만 블록
시킬려구요..
 --- 아래 스크립트 주어와서 제 환경에 맞게 설정했지여..
여러분들도 써보세요..redhat 6.0 이상에선 firewall도 다 들어있다고 하던데..
맞나여 ?
 ---  MASQ 와 firewall 같이 들어있으니까...수정해서 사용하세요..
 -----------------------------------------------------------------------
#!/bin/bash
#
# Firewall Script - Version 0.9.0
 # chkconfig: 2345 09 99
# description: firewall script for 2.2.x kernel
 # Set for testing
# set -x
 #
# NOTES:
#
#  This script is written for RedHat 6.0 or better.
#
#  This firewall script should work for most routers, dial-up or cable modem.
#  It was written for RedHat distributions.
#
#  Be careful about offering public services like web or ftp servers.
#
# INSTALLATION:
#  1. This file planned for a RedHat system.  It would work
#     on other distro's with perhaps no modification, but again...
#     Who knows?!!?  These instructions apply to RedHat systems.
#
#  2. place this file in /etc/rc.d/init.d  (you'll have to be root..)
#     call it something like "firewall"    :-)
#     make it root owned -->  "chown root.root <filename>"
#     make it executable -->  "chmod 755 <filename>"
#
#  3. set the values for your network, internal interface, and DNS servers
#     uncomment lines further down to enable optional in-bound services
#     make sure "eth0" is your internal NIC (or change the value below)
#     test it -->  "/etc/rc.d/init.d/<filename> start"
#     you can list the rules -->  "ipchains -L -n"
#     fix anything that broke...  :-)
#
#  4. add the firewall to the RH init structure --> "chkconfig --add <filename>"
#     next time the router boots, things should happen automagically!
#     sleep better at night knowing you are *LESS* vulnerable than before...
#
# RELEASE NOTES
#   20 July, 1999 - initial writing - Anthony Ball <tony at LinuxSIG.org>
#   11 Dec, 1999 - updated by Mark Grennan <mark at grennan.com>
#
 ################################################
#  Fill in the values below to match your
#  local network.
 PRIVATENET=xxx.xxx.xxx.xxx/xx
 PUBLIC=ppp0
PRIVATE=eth0
 # your dns servers
DNS1=xxx.xxx.xxx.xxx
DNS2=xxx.xxx.xxx.xxx
 ################################################
 # some handy generic values to use
ANY=0.0.0.0/0
ALLONES=255.255.255.255
 # Source function library.
. /etc/rc.d/init.d/functions
 # Source networking configuration.
. /etc/sysconfig/network
 # Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0
 # See how we are called
case "$1" in
   start)
        # Start providing access
        action "Starting firewall: " /bin/true
         ##
        ## Setup Envirement
        ##
        # Flush all lists
        /sbin/ipchains -F input
        /sbin/ipchains -F output
        /sbin/ipchains -F forward
         # Plug up everything
        /sbin/ipchains -I input 1 -j DENY
         # set policy to deny (Default is ACCEPT)
        /sbin/ipchains -P input DENY
        /sbin/ipchains -P output ACCEPT
        /sbin/ipchains -P forward ACCEPT
         # Turn on packet forwarding
        echo 1 > /proc/sys/net/ipv4/ip_forward
         ##
        ## Install Modules
        ##
        # Insert the active ftp module.  This will allow non-passive ftp to machines
        # on the local network (but not to the router since it is not masq'd)
        if ! ( /sbin/lsmod | /bin/grep masq_ftp > /dev/null ); then
            /sbin/insmod ip_masq_ftp
        fi
         ##
        ## Some Security Stuff
        ##
        # turn on Source Address Verification and get spoof protection
        # on all current and future interfaces.
        if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
            for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
                echo 1 > $f
            done
        else
            echo
            echo "PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED."
            echo
        fi
         # deny bcasts on remaining interfaces
        /sbin/ipchains -A input -d 0.0.0.0 -j DENY
        /sbin/ipchains -A input -d 255.255.255.255 -j DENY
         # deny these without logging 'cause there tend to be a lot...
        /sbin/ipchains -A input -p udp -d $ANY 137 -j DENY   # NetBIOS over IP
        /sbin/ipchains -A input -p tcp -d $ANY 137 -j DENY   #   ""
        /sbin/ipchains -A input -p udp -d $ANY 138 -j DENY   #   ""
        /sbin/ipchains -A input -p tcp -d $ANY 138 -j DENY   #   ""
        /sbin/ipchains -A input -p udp -d $ANY 67 -j DENY    # bootp
        /sbin/ipchains -A input -p udp -d $ANY 68 -j DENY    #   ""
        /sbin/ipchains -A input -s 224.0.0.0/8 -j DENY       # Multicast addresses
         ##
        ## Allow private network out
        ##
        # allow all packets on the loopback interface
        /sbin/ipchains -A input -i lo -j ACCEPT
         # allow all packets from the internal "trusted" interface
        /sbin/ipchains -A input -i $PRIVATE -s $PRIVATENET -d $ANY -j ACCEPT
        /sbin/ipchains -A input -i $PRIVATE -d $ALLONES -j ACCEPT
         ##
        ## Allow Outside Services into the firewall (if you dare)
        ##
        # allow ICMP
        /sbin/ipchains -A input -p icmp -j ACCEPT
        # allow TCP
        /sbin/ipchains -A input -p tcp ! -y -j ACCEPT
         # allow lookups to DNS (on firewall)
        /sbin/ipchains -A input -p udp -s $DNS1 domain -d $ANY 1023: -j ACCEPT
        /sbin/ipchains -A input -p udp -s $DNS2 domain -d $ANY 1023: -j ACCEPT
        # or (BETTER IDEA) run a caching DNS server on the router and use the
        # following two lines instead...
        # /sbin/ipchains -A input -p udp -s $DNS1 domain -d $ANY domain -j ACCEPT
        # /sbin/ipchains -A input -p udp -s $DNS2 domain -d $ANY domain -j ACCEPT
         # uncomment the following to allow ssh in
        /sbin/ipchains -A input -p tcp -d $ANY 22 -j ACCEPT
         # uncomment the following to allow telnet in (BAD IDEA!!)
        /sbin/ipchains -A input -p tcp -d $ANY telnet -j ACCEPT
         # uncomment to allow NTP (network time protocol) to router
        # /sbin/ipchains -A input -p udp -d $ANY ntp -j ACCEPT
         # uncomment to allow SMTP in (not for mail clients - only a server)
        /sbin/ipchains -A input -p tcp -d $ANY smtp -j ACCEPT
         # uncomment to allow POP3 in (for mail clients)
        /sbin/ipchains -A input -p tcp -d $ANY 110 -j ACCEPT
         # allow auth in for sending mail or doing ftp
        /sbin/ipchains -A input -p tcp -d $ANY auth -j ACCEPT
         # uncomment to allow HTTP in (only if you run a web server on the router)
        /sbin/ipchains -A input -p tcp -d $ANY http -j ACCEPT
         # uncomment to allow FTP in
        /sbin/ipchains -A input -p tcp -d $ANY ftp -j ACCEPT
         ##
        ## Masquerading stuff
        ##
        # masquerade packets forwarded from internal network
        /sbin/ipchains -A forward -s $PRIVATENET -d $ANY -j MASQ
         ##
        ## deny EVERYthing else and log them to /var/log/messages
        ##
        /sbin/ipchains -A input -l -j DENY
         # Remove the Plug
        /sbin/ipchains -D input 1
         ;;
   stop)
        action "Stoping firewall: " /bin/true
        echo 0 > /proc/sys/net/ipv4/ip_forward
        /sbin/ipchains -F input
        /sbin/ipchains -F output
        /sbin/ipchains -F forward
         echo
        ;;
   restart)
        action "Restarting firewall: " /bin/true
        $0 stop
        $0 start
         echo
        ;;
   status)
        # List out settings
        /sbin/ipchains -L
        ;;
   test)
        ##
        ## This is about as simple as it gets
        ##    (This is not secure AT ALL)
        action "WARNING Test Firewall:" /bin/true
        /sbin/ipchains -F input
        /sbin/ipchains -F output
        /sbin/ipchains -F forward
        echo 1 > /proc/sys/net/ipv4/ip_forward
        /sbin/ipchains -A input -j ACCEPT
        /sbin/ipchains -A output -j ACCEPT
        /sbin/ipchains -P forward DENY
        /sbin/ipchains -A forward -i $PUBLIC -j MASQ
         echo
        ;;
   *)
        echo "Usage:$0 {start|stop|restart|status|test}"
        exit 1
 esac
   --------------------------------------------------------------------------------
    
--
@~@