ProHoster > Блог > Isakoso > xtables-addons: àlẹmọ jo nipa orilẹ-ede

xtables-addons: àlẹmọ jo nipa orilẹ-ede

xtables-addons: àlẹmọ jo nipa orilẹ-ede
Iṣẹ-ṣiṣe ti didi awọn ijabọ lati awọn orilẹ-ede kan dabi pe o rọrun, ṣugbọn awọn ifihan akọkọ le jẹ ẹtan. Loni a yoo sọ fun ọ bi eyi ṣe le ṣe imuse.

prehistory

Awọn abajade wiwa Google kan lori koko yii jẹ itaniloju: ọpọlọpọ awọn solusan ti pẹ “rotten” ati nigbami o dabi pe koko yii ti wa ni ipamọ ati gbagbe nipa lailai. A ti lọ nipasẹ ọpọlọpọ awọn igbasilẹ atijọ ati pe a ti ṣetan lati pin ẹya igbalode ti awọn itọnisọna.

A ṣeduro pe ki o ka gbogbo nkan naa ṣaaju ṣiṣe awọn aṣẹ wọnyi.

Ngbaradi ẹrọ ṣiṣe

Sisẹ yoo wa ni tunto nipa lilo awọn IwUlO iptables, eyiti o nilo itẹsiwaju lati ṣiṣẹ pẹlu data GeoIP. Yi itẹsiwaju le ri ni xtables-addons. xtables-addons nfi awọn amugbooro sii fun awọn iptables bi awọn modulu ekuro ominira, nitorinaa ko si iwulo lati tun ekuro OS naa ṣe.

Ni akoko kikọ, ẹya lọwọlọwọ ti xtables-addons jẹ 3.9. Sibẹsibẹ, 20.04 nikan ni a le rii ni boṣewa Ubuntu 3.8 LTS awọn ibi ipamọ, ati 18.04 ni awọn ibi ipamọ Ubuntu 3.0. O le fi itẹsiwaju sii lati ọdọ oluṣakoso package pẹlu aṣẹ atẹle:

apt install xtables-addons-common libtext-csv-xs-perl

Ṣe akiyesi pe awọn iyatọ kekere ṣugbọn pataki wa laarin ẹya 3.9 ati ipo lọwọlọwọ ti iṣẹ akanṣe, eyiti a yoo jiroro nigbamii. Lati kọ lati koodu orisun, fi sori ẹrọ gbogbo awọn idii pataki:

apt install git build-essential autoconf make libtool iptables-dev libxtables-dev pkg-config libnet-cidr-lite-perl libtext-csv-xs-perl

Di ibi ipamọ naa di:

git clone https://git.code.sf.net/p/xtables-addons/xtables-addons xtables-addons-xtables-addons


cd xtables-addons-xtables-addons

xtables-addons ni ọpọlọpọ awọn amugbooro, sugbon a wa nikan nife ninu xt_geoip. Ti o ko ba fẹ fa awọn amugbooro ti ko wulo sinu eto naa, o le yọ wọn kuro ninu kikọ. Lati ṣe eyi o nilo lati ṣatunkọ faili naa mconfig. Fun gbogbo awọn modulu ti o fẹ, fi sori ẹrọ y, ki o si samisi gbogbo awọn ti ko wulo n. A gba:

./autogen.sh

./configure

make

Ati fi sori ẹrọ pẹlu awọn ẹtọ superuser:

make install

Lakoko fifi sori ẹrọ ti awọn modulu ekuro, aṣiṣe ti o jọra si atẹle le waye:

INSTALL /root/xtables-addons-xtables-addons/extensions/xt_geoip.ko
At main.c:160:
- SSL error:02001002:system library:fopen:No such file or directory: ../crypto/bio/bss_file.c:72
- SSL error:2006D080:BIO routines:BIO_new_file:no such file: ../crypto/bio/bss_file.c:79
sign-file: certs/signing_key.pem: No such file or directory

Ipo yii waye nitori ailagbara ti wíwọlé awọn modulu ekuro, nitori ohunkohun lati wole. O le yanju iṣoro yii pẹlu awọn aṣẹ meji:

cd /lib/modules/(uname -r)/build/certs

cat <<EOF > x509.genkey

[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts

[ req_distinguished_name ]
CN = Modules

[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
EOF

openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config x509.genkey -outform DER -out signing_key.x509 -keyout signing_key.pem

Module ekuro ti a ṣajọpọ ti fi sori ẹrọ, ṣugbọn eto naa ko rii. Jẹ ki a beere lọwọ eto lati ṣẹda maapu igbẹkẹle kan ni akiyesi module tuntun, ati lẹhinna gbe e:

depmod -a

modprobe xt_geoip

Jẹ ki a rii daju pe xt_geoip ti kojọpọ sinu eto:

# lsmod | grep xt_geoip
xt_geoip               16384  0
x_tables               40960  2 xt_geoip,ip_tables

Ni afikun, rii daju pe a ti kojọpọ itẹsiwaju sinu awọn iptables:

# cat /proc/net/ip_tables_matches 
geoip
icmp

A ni idunnu pẹlu ohun gbogbo ati gbogbo ohun ti o ku ni lati ṣafikun orukọ module si / ati be be lo / awọn moduluki module ṣiṣẹ lẹhin atunbere OS. Lati isisiyi lọ, iptables loye awọn aṣẹ geoip, ṣugbọn ko ni data to lati ṣiṣẹ pẹlu. Jẹ ki a bẹrẹ ikojọpọ aaye data geoip.

Gbigba aaye data GeoIP

A ṣẹda itọsọna kan ninu eyiti alaye ti oye si itẹsiwaju iptables yoo wa ni ipamọ:

mkdir /usr/share/xt_geoip

Ni ibẹrẹ nkan naa, a mẹnuba pe awọn iyatọ wa laarin ẹya lati koodu orisun ati ẹya lati ọdọ oluṣakoso package. Iyatọ ti o ṣe akiyesi julọ ni iyipada ninu ataja data ati iwe afọwọkọ xt_geoip_dl, eyiti o ṣe igbasilẹ data tuntun.

Package faili version

Iwe afọwọkọ naa wa lori ọna / usr/lib/xtables-addons, ṣugbọn nigbati o ba gbiyanju lati ṣiṣẹ, iwọ yoo rii aṣiṣe alaye pupọ:

# ./xt_geoip_dl 
unzip:  cannot find or open GeoLite2-Country-CSV.zip, GeoLite2-Country-CSV.zip.zip or GeoLite2-Country-CSV.zip.ZIP.

Ni iṣaaju, ọja GeoLite, ti a mọ ni bayi bi GeoLite Legacy, ti a pin labẹ iwe-aṣẹ, ni a lo bi ibi ipamọ data Creative Commons ASA 4.0 ile-iṣẹ MaxMind. Awọn iṣẹlẹ meji ṣẹlẹ pẹlu ọja yii ni ẹẹkan pe ibamu “bu” pẹlu itẹsiwaju iptables.

Ni akọkọ, ni Oṣu Kini ọdun 2018 kede nipa ifopinsi atilẹyin ọja naa, ati ni Oṣu Kini Ọjọ 2019, Ọdun 2, gbogbo awọn ọna asopọ si igbasilẹ ẹya atijọ ti data data ni a yọkuro lati oju opo wẹẹbu osise. Awọn olumulo titun ni iṣeduro lati lo ọja GeoLite2 tabi ẹya isanwo rẹ GeoIPXNUMX.

Ni ẹẹkeji, lati Oṣu kejila ọdun 2019 MaxMind ṣalaye nipa iyipada nla ni iraye si awọn apoti isura infomesonu wọn. Lati ni ibamu pẹlu Ofin Aṣiri Olumulo California, MaxMind pinnu lati “bo” pinpin GeoLite2 pẹlu iforukọsilẹ.

Niwọn igba ti a fẹ lati lo ọja wọn, a yoo forukọsilẹ ni oju-iwe yii.

xtables-addons: àlẹmọ jo nipa orilẹ-ede
Iwọ yoo gba imeeli kan ti o beere lọwọ rẹ lati ṣeto ọrọ igbaniwọle kan. Ni bayi ti a ti ṣẹda akọọlẹ kan, a nilo lati ṣẹda bọtini iwe-aṣẹ kan. Ninu akọọlẹ ti ara ẹni a wa nkan naa Awọn bọtini iwe-aṣẹ Mi, ati lẹhinna tẹ bọtini naa Ṣe ina titun License Key.

Nigbati o ba ṣẹda bọtini kan, a yoo beere ibeere kan nikan: ṣe a yoo lo bọtini yii ninu eto Imudojuiwọn GeoIP? A dahun ni odi ati tẹ bọtini naa jẹrisi. Bọtini naa yoo han ni window agbejade kan. Fi bọtini yi pamọ si aaye ailewu, bi ni kete ti o ba tii window agbejade, iwọ kii yoo ni anfani lati wo gbogbo bọtini naa mọ.

xtables-addons: àlẹmọ jo nipa orilẹ-ede
A ni agbara lati ṣe igbasilẹ awọn apoti isura data GeoLite2 pẹlu ọwọ, ṣugbọn ọna kika wọn ko ni ibamu pẹlu ọna kika ti a reti nipasẹ iwe afọwọkọ xt_geoip_build. Eyi ni ibi ti awọn iwe afọwọkọ GeoLite2xtables wa si igbala. Lati ṣiṣẹ awọn iwe afọwọkọ, fi sori ẹrọ NetAddr :: IP perl module:

wget https://cpan.metacpan.org/authors/id/M/MI/MIKER/NetAddr-IP-4.079.tar.gz

tar xvf NetAddr-IP-4.079.tar.gz

cd NetAddr-IP-4.079

perl Makefile.PL

make

make install

Nigbamii, a ṣe ẹda ibi ipamọ pẹlu awọn iwe afọwọkọ ati kọ bọtini iwe-aṣẹ ti o gba tẹlẹ si faili kan:

git clone https://github.com/mschmitt/GeoLite2xtables.git

cd GeoLite2xtables

echo YOUR_LICENSE_KEY=’123ertyui123' > geolite2.license

Jẹ ki a ṣiṣẹ awọn iwe afọwọkọ:

# Скачиваем данные GeoLite2
./00_download_geolite2
# Скачиваем информацию о странах (для соответствия коду)
./10_download_countryinfo
# Конвертируем GeoLite2 базу в формат GeoLite Legacy 
cat /tmp/GeoLite2-Country-Blocks-IPv{4,6}.csv |
./20_convert_geolite2 /tmp/CountryInfo.txt > /usr/share/xt_geoip/dbip-country-lite.csv

MaxMind fi opin si awọn igbasilẹ 2000 fun ọjọ kan ati, pẹlu nọmba nla ti awọn olupin, nfunni lati kaṣe imudojuiwọn lori olupin aṣoju.

Jọwọ ṣe akiyesi pe faili ti o jade ni a gbọdọ pe dbip-orilẹ-ede-lite.csv... Laanu, 20_convert_geolite2 ko ṣe agbejade faili pipe. Iwe afọwọkọ xt_geoip_build nireti awọn ọwọn mẹta:

  • ibẹrẹ ibiti adirẹsi;
  • opin ibiti adirẹsi;
  • koodu orilẹ-ede ni iso-3166-alpha2.

Ati pe faili ti o jade ni awọn ọwọn mẹfa:

  • ibẹrẹ ibiti adirẹsi (aṣoju okun);
  • opin ibiti adirẹsi (aṣoju okun);
  • ibẹrẹ ibiti adirẹsi (aṣoju nọmba);
  • opin ibiti adirẹsi (aṣoju nọmba);
  • koodu ti orilẹ-ede;
  • orukọ orilẹ-ede naa.

Iyatọ yii jẹ pataki ati pe o le ṣe atunṣe ni ọkan ninu awọn ọna meji:

  1. satunkọ 20_convert_geolite2;
  2. satunkọ xt_geoip_build.

Ni igba akọkọ ti a dinku atẹjade si ọna kika ti a beere, ati ni keji - a yipada iṣẹ iyansilẹ si oniyipada $cc on $ kana->[4]. Lẹhin eyi o le kọ:

/usr/lib/xtables-addons/xt_geoip_build -S /usr/share/xt_geoip/ -D /usr/share/xt_geoip

. . .
 2239 IPv4 ranges for ZA
  348 IPv6 ranges for ZA
   56 IPv4 ranges for ZM
   12 IPv6 ranges for ZM
   56 IPv4 ranges for ZW
   15 IPv6 ranges for ZW

Ṣe akiyesi pe onkọwe naa GeoLite2xtables ko ṣe akiyesi awọn iwe afọwọkọ rẹ ti o ṣetan fun iṣelọpọ ati awọn ipese orin fun idagbasoke awọn iwe afọwọkọ xt_geoip_* atilẹba. Nitorinaa, jẹ ki a lọ si apejọ lati awọn koodu orisun, ninu eyiti awọn iwe afọwọkọ wọnyi ti ni imudojuiwọn tẹlẹ.

Orisun version

Nigba fifi sori lati awọn iwe afọwọkọ koodu orisun xt_geoip_* ti wa ni be ninu awọn katalogi /usr/agbegbe/libexec/xtables-addons. Eleyi ti ikede awọn akosile nlo a database IP to Orilẹ-ede Lite. Iwe-aṣẹ naa jẹ Iwe-aṣẹ Ifọwọsi Creative Commons, ati lati inu data ti o wa nibẹ ni awọn ọwọn mẹta ti o ṣe pataki pupọ. Ṣe igbasilẹ ati ṣajọ data data:

cd /usr/share/xt_geoip/

/usr/local/libexec/xtables-addons/xt_geoip_dl

/usr/local/libexec/xtables-addons/xt_geoip_build

Lẹhin awọn igbesẹ wọnyi, iptables ti ṣetan lati ṣiṣẹ.

Lilo geoip ni iptables

Module xt_geoip ṣe afikun awọn bọtini meji nikan:

geoip match options:
[!] --src-cc, --source-country country[,country...]
	Match packet coming from (one of) the specified country(ies)
[!] --dst-cc, --destination-country country[,country...]
	Match packet going to (one of) the specified country(ies)

NOTE: The country is inputed by its ISO3166 code.

Awọn ọna fun ṣiṣẹda awọn ofin fun iptables, ni gbogbogbo, ko yipada. Lati lo awọn bọtini lati awọn afikun modulu, o gbọdọ pato awọn orukọ ti awọn module pẹlu awọn -m yipada. Fun apẹẹrẹ, ofin kan lati dènà awọn asopọ TCP ti nwọle lori ibudo 443 kii ṣe lati AMẸRIKA lori gbogbo awọn atọkun:

iptables -I INPUT ! -i lo -p tcp --dport 443 -m geoip ! --src-cc US -j DROP

Awọn faili ti a ṣẹda nipasẹ xt_geoip_build ni a lo nikan nigbati o ba ṣẹda awọn ofin, ṣugbọn kii ṣe akiyesi nigba sisẹ. Nitorinaa, lati ṣe imudojuiwọn data geoip ni deede, o gbọdọ kọkọ ṣe imudojuiwọn awọn faili iv *, lẹhinna tun gbogbo awọn ofin ti o lo geoip ni iptables.

ipari

Sisẹ awọn apo-iwe ti o da lori awọn orilẹ-ede jẹ ilana ti o gbagbe diẹ nipasẹ akoko. Bi o ti lẹ jẹ pe eyi, awọn irinṣẹ sọfitiwia fun iru sisẹ ti wa ni idagbasoke ati, boya, laipẹ ẹya tuntun ti xt_geoip pẹlu olupese data geoip tuntun yoo han ninu awọn alakoso package, eyiti yoo jẹ ki igbesi aye awọn oludari eto rọrun pupọ.

xtables-addons: àlẹmọ jo nipa orilẹ-ede

Awọn olumulo ti o forukọsilẹ nikan le kopa ninu iwadi naa. wọle, Jowo.

Njẹ o ti lo sisẹ nipasẹ orilẹ-ede?

  • 59,1%Bẹẹni13

  • 40,9%No9

22 olumulo dibo. 3 olumulo abstained.

orisun: www.habr.com

Fi ọrọìwòye kun