Metin2 Server Güvenliği ve Bakımı

sysinstall [enter] --> [seçin]
configure [enter] --> [seçin]
src [enter] --> seçin
base ve sys [işaretleyin] --> [sağ sol tuş ile alttan ok'u seçin] --> [enter]
FTP [enter]
main site [enter] --> bekleyin
sysinstall'e kadar geri dönün

PF_LOAD="NO"

PF_LOAD="YES"

device[TAB][TAB]pf
device[TAB][TAB]pflog
device[TAB][TAB]pfsync
options[TAB][TAB]ALTQ
options[TAB][TAB]ALTQ_CBQ
options[TAB][TAB]ALTQ_RED
options[TAB][TAB]ALTQ_RIO
options[TAB][TAB]ALTQ_HFSC
options[TAB][TAB]ALTQ_PRIQ
options[TAB][TAB]ALTQ_NOPCC

pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/whistle-pflog"
pflog_flags=""

pass - Kilidi kaldırmak için kullanılan koşul, paket geçme izni, port kilidi açma vs.
block - pass karşısında paket, port vs engellemek için kullanılan koşul
quick - PF'de belirli bir kuralı durdurmak, kuralları ve akışı görüntülemesini iptal etmek (ağ güvenliği için yararlı) kullanılan koşul.
proto - Protokol, örneğin TCP protolünü tanımlar.

any - Tüm kaynaklardan
from - Bir yerden bir yere ("from any to any" gibi)
all - Tümü (örneğin herşeyi engellemek için)
on - ne, hangi kartı
in / out - paket ve kurallarda giriş çıkışları kontrol etmek için
max 'num' (Örnek: "max 200")  istek paketin byte boyutunu belirler

TCP - Unix üzerinden hemen hemen her yerde kullanabilirsiniz, port tarama, bağlantı noktası tarama vs standart ve en yaygın kullanılan protokol. Whistle
UDP - İletim ve Birleştirme için standart bir protokol Saldırılarda genellikle DoS saldırılarında tespit için olan protokol sınırı çok azdır.
ICMP -  Genellikle sistemin kendi aktif bağlantıları, engellenmemiş bağlantıları kontrol etmek için kullanılan protokol
ICMP6 -  -Whistle-

modulate state - Durumu değiştirir, daha iyi bir pf için kullanılır
keep state -  Aşırı yükte iletişimi kesmek için kullanılır

F -- FIN, Bağlantıyı kapatma 
S -- SYN, Bağlantıyı açma 
R -- RST, Bağlantıyı yeniden başlatma
P -- PSH, Verilerin gelen trafiğini kontrol etmek için
A -- ACK, Alınanlar paketler için 
U -- URG, Paketin acil olduğunu belirtmek için

#makro
int_if = "em1"
ext_if = "em0"




#PF kurallari
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
pass in on $ext_if proto tcp all modulate state flags S/SA
pass in on $ext_if proto { udp, icmp } all keep state
pass quick on lo0 all

ext_if="em0"
int_if="em1"
***_net="10.0.0.0/24"
tcp_services="{ 3306, 22 }"
udp_services="{ 3306, 22 }"
icmp_types="echoreq"
set skip on lo0
set block-policy return
set loginterface $ext_if
scrub in all
block in on $ext_if
pass in on $int_if from $***_net to any
pass out on $int_if from any to $***_net
antispoof log quick for $int_if
pass in on $ext_if proto tcp from any to any port $tcp_services modulate state flags S/SA
pass in on $ext_if proto udp from any to any port $udp_services keep state
pass out on $ext_if proto tcp from any to any port $tcp_services modulate state flags S/SA
pass out on $ext_if proto udp from any to any port $udp_services keep state
pass in on $ext_if proto { tcp, udp } from any to $ext_if port 53
pass in inet proto icmp all icmp-type $icmp_types keep state
pass out on $ext_if proto { tcp, udp, icmp } all

ok > FTP > URL

options[tab][tab]IPFIREWALL # IPFW için gerekli
options[tab][tab]IPFIREWALL_VERBOSE # LOG için gerekli
options[tab][tab]IPFIREWALL_VERBOSE_LIMIT=10 # Giriş limiti
options[tab][tab]IPDIVERT # NATD için gerekli

firewall_enable="YES"
firewall_script="/etc/ipfw.rules"

IPF="ipfw -q add"
ipfw -q -f flush




#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag




# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any




# open port ftp (20,21), ssh (22), mail (25)
# http (80), dns (53) etc
$IPF 110 allow tcp from any to any 21 in
$IPF 120 allow tcp from any to any 21 out
$IPF 130 allow tcp from any to any 22 in
$IPF 140 allow tcp from any to any 22 out
$IPF 150 allow tcp from any to any 25 in
$IPF 160 allow tcp from any to any 25 out
$IPF 170 allow udp from any to any 53 in
$IPF 175 allow tcp from any to any 53 in
$IPF 180 allow udp from any to any 53 out
$IPF 185 allow tcp from any to any 53 out
$IPF 200 allow tcp from any to any 80 in
$IPF 210 allow tcp from any to any 80 out




# deny and log everything
$IPF 500 deny log all from any to any

service ipfw start - IPFW Başlatır
service ipfw restart - IPFW Yeniden Başlatır
service ipfw stop - IPFW Durdurur

$IPF 200 allow all from any to any 11002 in
$IPF 210 allow all from any to any 11002 out

# IP yasaklari
# Ornek
$IPF 100 deny all from IP/32 to any in
$IPF 101 deny all from IP/32 to any in
# SSH, Mysql yasakları
$IPF 120 deny log all from IP/20 to any 22 in
$IPF 121 deny log all from IP/20 to any 22 in
$IPF 122 deny log all from IP/20 to any 3306 in
$IPF 123 deny log all from IP/20 to any 3306 in

#######################
####AĞ Değerleri####
#######################




sshd_enable="YES"
mysql_enable="YES"
apache22_enable="YES"
ntpdate_enable="YES"
ntpdate_hosts="213.186.33.99"




###################
####Bakım####
###################
fsck_y_enable="YES"
clear_tmp_enable="YES"
named_enable="YES"




#############################
####AĞ Yapılandırması####
#############################




ifconfig_em0="inet 37.59.18.89 netmask 255.255.255.0 broadcast 37.59.18.255"
defaultrouter="37.59.18.254"
hostname="ns232361.ovh.net"




######################
####Güvenlik####
######################




icmp_drop_redirect="YES"
icmp_log_redirect="YES"
tcp_drop_synfin="YES"
icmp_bmcastecho="NO"
icmp_bandlim="YES"
clear_tmp_enable="YES"




#################
####Firewall####
#################




firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
firewall_logging="YES"
natd_enable="YES"
natd_interface="em0"
natd_flags="-dynamic -m"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""












#################
####Diğer####
#################




# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"

#################
###PF Kurallari  :###
#################




#makro
ext_if="re0"
***_net="10.0.0.0/24"
tcp_services="{ 9987, 3306, 22, 53, 25 }"
#udp_services="{ 3306, 25, 53, 22 }"
icmp_types="echoreq"




#filtre
set skip on lo0
set optimization normal
set ruleset-optimization basic
set require-order yes
set block-policy return
set loginterface $ext_if
set state-policy if-bound
scrub in all
scrub on $ext_if fragment drop-ovl
scrub on $ext_if all reassemble tcp
block in quick from urpf-failed
block in quick from urpf-failed label uRPF
antispoof log quick for $ext_if




#loopback
pass out quick on lo0 proto tcp all
pass in quick on lo0 proto tcp all keep state




#istisnalar




#seçilen oslar
pass in quick on $ext_if from any os Windows keep state
pass in quick on $ext_if from any os "Windows XP" keep state
pass in quick on $ext_if from any os "Windows Vista" keep state
pass in quick on $ext_if from any os "Windows 7" keep state
pass in quick on $ext_if from any os unknown keep state




#engellenen oslar
block in quick on $ext_if from any os "Linux 2.4 ts"
#block in quick on $ext_if from any os unknown
block in quick on $ext_if from any os OpenBSD
block in quick on $ext_if from any os Linux
block in quick on $ext_if from any os Debian




#engelli ipler
table <blockip> persist file "/etc/blockip.txt"
block in quick on $ext_if from <blockip> to any




#port yönlendirme
pass in quick on $ext_if proto tcp from any to any port $tcp_services keep state flags S/SA
pass out quick on $ext_if proto tcp from any to any port $tcp_services keep state flags S/SA
#pass in quick on $ext_if proto udp from any to any port $udp_services keep state
#pass out quick on $ext_if proto udp from any to any port $udp_services keep state
pass in quick inet proto icmp all icmp-type $icmp_types keep state
pass out quick on $ext_if proto { tcp, udp, icmp } all modulate state




#varsayılan kilit
block return
block in all
block out all

# $FreeBSD: release/9.0.0/etc/sysctl.conf 112200 2003-03-13 18:43:50Z mux $
#
#  This file is read when going to multi-user and its contents piped thru
#  ``sysctl'' to adjust kernel values.  ``man 5 sysctl.conf'' for details.
#




# Uncomment this to prevent users from seeing information about processes that
# are being run under another UID.
#security.bsd.see_other_uids=0




##########################################
####Sınırlama ve Ağ ayarları####
##########################################




n#security.bsd.see_other_uids=0
security.bsd.see_other_uids=0
net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1
net.inet.ip.ttl=128
kern.maxfilesperproc=200000
kern.maxvnodes=600000
kern.maxfiles=204800
kern.ipc.maxsockbuf=16777216
kern.ipc.shmmax=1073741824
kern.ipc.somaxconn=32768
kern.ipc.shmall=134217728
net.inet.tcp.rfc1323=1
net.inet.tcp.recvbuf_max=16777216
net.inet.tcp.sendbuf_auto=1
net.inet.tcp.sendbuf_inc=262144
net.inet.tcp.recvbuf_auto=1
net.inet.tcp.recvbuf_inc=524288
net.inet.tcp.hostcache.expire=1
net.inet.ip.redirect=0
net.inet.ip.sourceroute=0
net.inet.ip.accept_sourceroute=0
net.inet.icmp.maskrepl=0
net.inet.icmp.log_redirect=0
net.inet.icmp.drop_redirect=1
net.inet.tcp.drop_synfin=1
net.inet.tcp.msl=5000
net.inet.tcp.fast_finwait2_recycle=1
net.inet.ip.intr_queue_maxlen=4096
net.inet.ip.forwarding=1
net.inet.ip.fastforwarding=1
net.inet.tcp.ecn.enable=1
net.inet.ip.random_id=1
net.inet.tcp.log_in_vain=0
net.inet.tcp.log_debug=0
net.inet.udp.log_in_vain=0
kern.random.sys.harvest.ethernet=0
kern.random.sys.harvest.interrupt=0
kern.random.sys.harvest.point_to_point=0
net.inet.icmp.icmplim=40
net.inet.tcp.delayed_ack=1
net.inet.tcp.mssdflt=1460
net.inet.tcp.path_mtu_discovery=0
net.inet.tcp.recvspace=65536
net.inet.tcp.sendspace=65536
net.inet.udp.recvspace=65536
net.local.stream.recvspace=65536
net.inet6.ip6.accept_rtadv=0
net.inet6.ip6.auto_linklocal=0




kern.ipc.nmbjumbop=192000
net.inet.tcp.maxtcptw=163840




net.inet.tcp.sendbuf_max=16777216
net.inet.tcp.cc.algorithm=htcp
net.inet.tcp.hostcache.expire=5400
net.route.netisr_maxqlen=4096
net.inet.tcp.nolocaltimewait=1
net.local.stream.sendspace=163840
net.local.stream.recvspace=163840
net.inet.tcp.local_slowstart_flightsize=32
net.inet.tcp.slowstart_flightsize=32
net.inet.tcp.rfc3390=0
net.inet.tcp.syncache.rexmtlimit=1
net.inet.ip.rtexpire=2




net.inet.ip.check_interface=1
net.inet.ip.portrange.randomized=1
net.inet.ip.process_options=0
net.inet.icmp.bmcastecho=0
net.inet.icmp.maskfake=0




vfs.read_max=128




net.link.ether.inet.log_arp_movements=0
net.inet.tcp.log_in_vain=1
net.inet.udp.log_in_vain=1
net.inet.ip.rtminexpire=2
net.inet.tcp.icmp_may_rst=0








#####################
####IPFW Firewall####
#####################




net.inet.ip.fw.verbose=1
net.inet.ip.fw.verbose_limit=5

Putty'e Giriniz ve Aşağıdaki Komutu Yazınız
cp /usr/local/share/mysql/my-medium.cnf /var/db/mysql/my.cnf


Kodu Yazıp ENTER Tuşuna Basınız ve Alttaki Komutu Yazınız.


ee /var/db/mysql/my.cnf


Karşınıza Gelen Ekranda Aşağıdaki Yerleri Değiştiriniz


[client] Kısmındaki
port     = 3306
3306 Yerine Yeni Portunuzu Giriniz Max 4 Hane 4295 Gibi
Sonra Az Daha Aşağı Doğru İniniz


[mysqld] Kısmındaki
port     = 3306
3306 Yerine Üsste Girdiğiniz Yeni Portunuzu Tekrar Giriniz Hatasız Girmeye Özen Gösterin Yoksa MYSQL Bağlantınız Kopar


Portları Düzenledikten Sonra ESC Tuşuna Basınız ve 2 Kere ENTER Tuşuna Basınız .
Ana Ekrana Dönünce reboot Atınız. Artık Yeni Portunuz Aktif. MYSQL Bağlanırken Navicattaki 3306 Yerine Yeni Portunuzu Giriniz