Authentication Gateway HOWTO

Nathan Zorn

           zornnh@musc.edu
        

yomoyomo - 擔杮岅栿

ymgrtq@ma.neweb.ne.jp

Revision History                                                       
Revision 0.06            2002-11-05         Revised by: nhz            
Revision 0.05            2002-05-10         Revised by: nhz            
Revision 0.04            2002-02-28         Revised by: nhz            
Revision 0.03            2001-09-28         Revised by: nhz            
Revision 0.02            2001-09-28         Revised by: KET            
Revision 0.01            2001-09-06         Revised by: nhz            

  柍慄僱僢僩儚乕僋傗丄恾彂娰傗椌側偳偺岞奐傾僋僙僗僄儕傾偵偍偗傞僙僉儏
儕僥傿偵偼丄懡偔偺寽擮帠崁偑偁傝傑偡丅偦偆偟偨寽擮帠崁偼丄尰峴偺僙僉儏
儕僥傿幚憰偱偼夝寛偱偒傑偣傫丅偦偺夞旔嶔偲偟偰丄擣徹僎乕僩僂僃僀傪棙梡
偡傞曽朄偑悇彠偝傟偰偒傑偟偨丅偙偺僎乕僩僂僃僀偼丄儐乕僓偑僱僢僩儚乕僋
傪棙梡偡傞嵺偵擣徹傪嫮惂偡傞偙偲偱丄僙僉儏儕僥傿偵娭偡傞寽擮帠崁偵庢傝
慻傓傕偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Table of Contents
1. 偼偠傔偵
   
    1.1. 挊嶌尃忣曬
    1.2. 柶愑
    1.3. 嵟怴斉
    1.4. 僋儗僕僢僩
    1.5. 僼傿乕僪僶僢僋
   
2. 昁梫側傕偺
   
    2.1. Netfilter
    2.2. 摦揑側 Netfilter 儖乕儖偵懳墳偡傞僜僼僩僂僃傾
    2.3. DHCP 僒乕僶
    2.4. 擣徹偺儊僇僯僘儉
    2.5. DNS 僒乕僶
   
3. 僎乕僩僂僃僀僒乕價僗偺愝掕
   
    3.1. Netfilter偺愝掕
    3.2. 摦揑側 Netfilter 儖乕儖
    3.3. DHCP 僒乕僶愝掕
    3.4. 擣徹庤朄偺愝掕
    3.5. DNS 偺愝掕
   
4. 擣徹僎乕僩僂僃僀偺棙梡
5. 廔傢傝偵
6. 捛壛偺忣曬尮
7. 幙栤偲摎偊
8. 擔杮岅栿偵偮偄偰

1. 偼偠傔偵

  柍慄僱僢僩儚乕僋傗岞奐傾僋僙僗僄儕傾偵丄嫋壜偝傟偰側偄儐乕僓偑傾僋僙
僗偡傞偺偼偲偰傕娙扨偱偡丅嫋壜偝傟偰側偄儐乕僓偱傕丄捠怣傪扵傝丄偦偺捠
怣偐傜愙懕忣曬傪墶庢傝偱偒傑偡丅嫋壜偝傟偰側偄儐乕僓偑丄儅僔儞傪岞奐僞
乕儈僫儖偵偮側偓丄僱僢僩儚乕僋偵傾僋僙僗偡傞偙偲偑壜擻側偺偱偡丅僙僉儏
儕僥傿偑 WEP 側偳偱惍旛偝傟偰偒偰傑偡偑丄偙偆偟偨傕偺偵傛傞僙僉儏儕僥傿
偼丄AirSnort 側偳偺僣乕儖偵傛偭偰攋傜傟傞壜擻惈偑偁傝傑偡丅埲忋偺栤戣傪
夝寛偡傞傾僾儘乕僠偺堦偮偲偟偰丄柍慄偺僙僉儏儕僥傿婡擻偵棅傜偢丄戙傢傝
偵柍慄僱僢僩儚乕僋傗岞奐傾僋僙僗僄儕傾偺慜柺偵擣徹僎乕僩僂僃僀傪愝抲偟
丄儐乕僓偑僱僢僩儚乕僋傪棙梡偡傞慜偵丄偦偺僎乕僩僂僃僀偵擣徹傪庴偗傞偙
偲傪嫮惂偡傞偲偄偆偺偑偁傝傑偡丅偙偺 HOWTO 偼丄Linux 偱偙偺僎乕僩僂僃僀
傪峔抸偡傞曽朄傪愢柧偡傞傕偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

1.1. 挊嶌尃忣曬

  This document is copyrighted (c) 2001 Nathan Zorn. Permission is
granted to copy, distribute and/or modify this document under the terms
of the GNU Free Documentation License, Version 1.1 or any later version
published by the Free Software Foundation; with no Invariant Sections,
with no Front-Cover Texts, and with no Back-Cover Texts. A copy of the
license is available at http://www.gnu.org/copyleft/fdl.html

  (擔杮岅栿) This document is copyrighted (c) 2001 Nathan Zorn. 偙偺暥
彂偺暋惢丄攝晍丄廋惓偼丄Free Software Foundation 偵傛傝岞奐偝傟偰偄傞丄
GNU Free Documentation License (埲壓 GFDL) 僶乕僕儑儞 1.1丄傕偟偔偼偦傟
埲崀偺僶乕僕儑儞偺尦偱嫋壜偝傟傑偡丅偨偩偟丄偙偺暥彂偵偼 GFDL 偱婯掕偝
傟偰偄傞乽曄峏晄壜晹暘乿偼偁傝傑偣傫偟丄傑偨昞巻僥僉僗僩傗棤昞巻僥僉僗
僩側偳傕偁傝傑偣傫丅偙偺儔僀僙儞僗偺僐僺乕偼丄http://www.gnu.org/
copyleft/fdl.html 偱擖庤壜擻偱偡丅

壗偐幙栤偑偁傟偽丄<zornnh@musc.edu> 偵楢棈偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

1.2. 柶愑

  偙偺暥彂偺撪梕偵娭偟偰偼丄壗偺愑擟傕帩偰傑偣傫丅偛帺恎偺愑擟偺尦偱丄
偙偺暥彂偺僐儞僙僾僩丄椺丄偦偟偰偦偺懠偺撪梕傪棙梡偟偰偔偩偝偄丅偙傟偼
杮暥彂偺怴斉偱偡偺偱丄岆傝傗晄惓妋側婰弎傪娷傫偱偄傞偐傕偟傟傑偣傫偟丄
偦傟傜偺岆傝傗晄惓妋側婰弎偵傛偭偰丄偁側偨偺僔僗僥儉偵旐奞傪梌偊傞壜擻
惈傕傑偨摉慠側偑傜偁傝傑偡丅怲廳偵撉傒恑傫偱偔偩偝偄丅幚嵺偵壗傜偐偺旐
奞傪惗偢傞偲偄偭偨壜擻惈偼傎偲傫偳柍偄偼偢偱偡偑丄偨偲偊偦偆偟偨偙偲偑
婲偒偰偟傑偭偨偲偟偰傕丄挊幰(払)偼丄偦傟偵偮偄偰壗偺愑擟傕晧偄傑偣傫丅

  摿偵婰弎偑側偄尷傝丄挊嶌尃偼偦傟偧傟偺曐桳幰偵婣偡傞傕偺偲偟傑偡丅傑
偨偙偺暥彂拞偱巊梡偝傟傞梡岅偼丄奺彜昗偺斖埻偵掞怗偟側偄傕偺偲偟傑偡丅

  摿掕偺彜昳柤傗僽儔儞僪柤傪嫇偘偨応崌偱傕丄偦傟傜傪悇彠偡傞傕偺偱偼偁
傝傑偣傫丅

庡梫側僀儞僗僩乕儖傪峴偆慜偵偛棙梡偺僔僗僥儉偺僶僢僋傾僢僾傪庢傝丄偦偟
偰僶僢僋傾僢僾傪掕婜揑偵峴偆偙偲傪嫮偔偍姪傔偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

1.3. 嵟怴斉

偙偺暥彂偺嵟怴斉偼丄 http://www.itlab.musc.edu/~nathan/
authentication_gateway/ <http://www.itlab.musc.edu/~nathan/
authentication_gateway/> 偵偁傝傑偡丅娭楢偡傞 HOWTO 暥彂偼丄 Linux
Documentation Project <http://www.linuxdoc.org/> 儂乕儉儁乕僕偱尒偮偗傜
傟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

1.4. 僋儗僕僢僩

Jamin W. Collins

Kristin E Thomas

Logu (visolve.com)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

1.5. 僼傿乕僪僶僢僋

偙偺暥彂偵娭偡傞僼傿乕僪僶僢僋傪丄傕偪傠傫娊寎偟傑偡丅偁側偨偑偨偺採埬
傗堄尒偑側偗傟偽丄偙偺暥彂偼懚嵼偟側偐偭偨偱偟傚偆丅捛壛丄斸昡丄偦偟偰
斸敾傪埲壓偺揹巕儊乕儖傾僪儗僗傑偱偍憲傝偔偩偝偄: <zornnh@musc.edu>

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2. 昁梫側傕偺

偙偺僙僋僔儑儞偱偼丄擣徹僎乕僩僂僃僀偵昁梫側傕偺偵偮偄偰婰弎偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.1. Netfilter

擣徹僎乕僩僂僃僀偼丄僼傽僀儎僂僅乕儖傪娗棟偡傞偺偵丄Netfilter 偲
iptables 傪棙梡偟傑偡丅 Netfilter HOWTO <http://netfilter.samba.org/
unreliable-guides/packet-filtering-HOWTO/index.html> 傪嶲徠偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.2. 摦揑側 Netfilter 儖乕儖偵懳墳偡傞僜僼僩僂僃傾

Netfilter 儖乕儖傪摦揑偵憓擖丄嶍彍偡傞庤抜偺堦偮偵丄 pam_iptables 偺棙
梡偑偁傝傑偡丅偙傟偼 Nathan Zorn 偵傛偭偰彂偐傟偨僾儔僌壜擻擣徹儌僕儏乕
儖(PAM)偱丄 http://www.itlab.musc.edu/~nathan/pam_iptables <http://
www.itlab.musc.edu/~nathan/pam_iptables/> 偐傜擖庤偱偒傑偡丅偙偺 PAM 儌
僕儏乕儖偵傛傝丄儐乕僓偼僎乕僩僂僃僀偱擣徹傪峴偄丄 ssh 傗 telnet 傪棙梡
偱偒傞傛偆偵側傝傑偡丅

Netfilter 儖乕儖傪摦揑偵捛壛丄嶍彍偡傞傕偆堦偮偺庤抜偲偟偰丄 NocatAuth
偺棙梡偑偁傝傑偡丅NocatAuth 偼丄 http://nocat.net 偐傜擖庤偱偒傑偡丅
NocatAuth 偵傛傝丄僂僃僽僋儔僀傾儞僩偐傜僎乕僩僂僃僀偺擣徹偑峴偊傞傛偆
偵側傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.3. DHCP 僒乕僶

  擣徹僎乕僩僂僃僀偼丄岞奐僱僢僩儚乕僋偵懳偟偰丄摦揑儂僗僩愝掕僾儘僩僐
儖 (DHCP)僒乕僶偺栶妱傪壥偨偟傑偡丅偦傟偼岞奐僱僢僩儚乕僋偐傜偺 DHCP 僒
乕價僗梫媮偵偺傒墳摎偟傑偡丅巹偼 ISC DHCP Server <http://www.isc.org/
products/DHCP/> 傪巊梡偟傑偟偨丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.4. 擣徹偺儊僇僯僘儉

僎乕僩僂僃僀偼丄PAM 偺擣徹曽朄側傜偳傟偱傕棙梡偱偒傑偡丅僒僂僗僇儘儔僀
僫堛戝偑巊梡偟偰偄傞擣徹婡峔偼 LDAP 偱偡丅 LDAP 偼擣徹栚揑偵巊傢傟傞偺
偱丄僎乕僩僂僃僀婡忋偺 PAM 儌僕儏乕儖偼丄LDAP 傪巊梡偡傞傛偆偵愝掕偝傟
傑偟偨丅傕偭偲懡偔偺忣曬傪丄 http://www.padl.com/pam_ldap.html <http://
www.padl.com/pam_ldap.html> 偱尒偮偗傞偙偲偑偱偒傑偡丅PAM 偵傛傝丄懡偔
偺擣徹庤抜傪棙梡偱偒傞傛偆偵側傝傑偡丅懠偺庤朄偵偮偄偰偺忣曬傪傕偭偲抦
傝偨偄応崌偼丄 PAM 儌僕儏乕儖偵偮偄偰偺暥復 <http://www.kernel.org/pub/
linux/libs/pam/modules.html> 傪嶲徠偟偰偔偩偝偄丅

NocatAuth 傪棙梡偡傞偵偼丄擣徹僒乕價僗傪峔抸偡傞昁梫偑偁傝傑偡丅
NocatAuth 擣徹僒乕價僗偼丄LDAP, RADIUS, MySQL, 偦偟偰僷僗儚乕僪僼傽僀儖
傪棙梡偟偨擣徹婡擻傪巟墖偟傑偡丅 http://nocat.net/download/NoCatAuth/
<http://nocat.net/download/NoCatAuth/> 偵傕偭偲懡偔偺忣曬偑偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.5. DNS 僒乕僶

僎乕僩僂僃僀偼丄岞奐僱僢僩儚乕僋偵懳偡傞 DNS 僒乕僶偺婡擻傕壥偨偟傑偡丅
巹偼 Bind <http://www.isc.org/products/BIND/> 傪僀儞僗僩乕儖偟丄偦傟傪
僉儍僢僔儞僌僱乕儉僒乕僶偲偟偰巊梡偟偰偄傑偡丅僉儍僢僔儞僌僒乕僶峔抸偵
偼 Red Hat 偵摨崼偝傟偰偄傞 caching-namserver 偲偄偆 RPM 僷僢働乕僕傕棙
梡壜擻偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3. 僎乕僩僂僃僀僒乕價僗偺愝掕

偙偺僙僋僔儑儞偱偼丄擣徹僎乕僩僂僃僀偺奺晹暘偺愝掕曽朄傪愢柧偟傑偡丅偙
偙偱巊梡偝傟傞椺偼丄僒僽僱僢僩偑 10.0.1.0 偺僾儔僀儀乕僩岞奐僱僢僩儚乕
僋偱偡丅eth0 偼撪晹僱僢僩儚乕僋偵愙懕偝傟傞丄僎乕僩僂僃僀偺僀儞僞僼僃乕
僗偱偡丅eth1 偑岞奐僱僢僩儚乕僋偵愙懕偝傟傞僀儞僞僼僃乕僗偱偡丅偙偺僀儞
僞僼僃乕僗懁偺 IP 傾僪儗僗偼 10.0.1.1 偱偡丅偙傟傜偺愝掕偼丄偁側偨偑棙
梡偟偰偄傞僱僢僩儚乕僋偵崌偆傛偆偵曄峏壜擻偱偡丅僎乕僩僂僃僀婡偵偼 Red
Hat 7.1 傪棙梡偟偨偺偱丄懡偔偺椺偑 Red Hat 偵尷掕偝傟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.1. Netfilter偺愝掕

  netfilter 傪愝掕偡傞偨傔偵偼丄netfilter 僒億乕僩傪壛偊偰僇乕僱儖傪嵞
僐儞僷僀儖偟側偗傟偽側傝傑偣傫丅僇乕僱儖偺愝掕偲僐儞僷僀儖偵偮偄偰傕偭
偲忣曬偑昁梫側傜丄 Kernel-HOWTO <http://www.linuxdoc.org/HOWTO/
Kernel-HOWTO.html> 傪嶲徠偟偰偔偩偝偄丅

巹偺僇乕僱儖愝掕偼丄埲壓偺傛偆側姶偠偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   #                                                                劆
劆   # Networking options                                             劆
劆   #                                                                劆
劆   CONFIG_PACKET=y                                                  劆
劆   # CONFIG_PACKET_MMAP is not set                                  劆
劆   # CONFIG_NETLINK is not set                                      劆
劆   CONFIG_NETFILTER=y                                               劆
劆   CONFIG_NETFILTER_DEBUG=y                                         劆
劆   CONFIG_FILTER=y                                                  劆
劆   CONFIG_UNIX=y                                                    劆
劆   CONFIG_INET=y                                                    劆
劆   CONFIG_IP_MULTICAST=y                                            劆
劆   # CONFIG_IP_ADVANCED_ROUTER is not set                           劆
劆   # CONFIG_IP_PNP is not set                                       劆
劆   # CONFIG_NET_IPIP is not set                                     劆
劆   # CONFIG_NET_IPGRE is not set                                    劆
劆   # CONFIG_IP_MROUTE is not set                                    劆
劆   # CONFIG_INET_ECN is not set                                     劆
劆   # CONFIG_SYN_COOKIES is not set                                  劆
劆                                                                    劆
劆                                                                    劆
劆   #   IP: Netfilter Configuration                                  劆
劆   #                                                                劆
劆   CONFIG_IP_NF_CONNTRACK=y                                         劆
劆   CONFIG_IP_NF_FTP=y                                               劆
劆   CONFIG_IP_NF_IPTABLES=y                                          劆
劆   CONFIG_IP_NF_MATCH_LIMIT=y                                       劆
劆   CONFIG_IP_NF_MATCH_MAC=y                                         劆
劆   CONFIG_IP_NF_MATCH_MARK=y                                        劆
劆   CONFIG_IP_NF_MATCH_MULTIPORT=y                                   劆
劆   CONFIG_IP_NF_MATCH_TOS=y                                         劆
劆   CONFIG_IP_NF_MATCH_TCPMSS=y                                      劆
劆   CONFIG_IP_NF_MATCH_STATE=y                                       劆
劆   CONFIG_IP_NF_MATCH_UNCLEAN=y                                     劆
劆   CONFIG_IP_NF_MATCH_OWNER=y                                       劆
劆   CONFIG_IP_NF_FILTER=y                                            劆
劆   CONFIG_IP_NF_TARGET_REJECT=y                                     劆
劆   CONFIG_IP_NF_TARGET_MIRROR=y                                     劆
劆   CONFIG_IP_NF_NAT=y                                               劆
劆   CONFIG_IP_NF_NAT_NEEDED=y                                        劆
劆   CONFIG_IP_NF_TARGET_MASQUERADE=y                                 劆
劆   CONFIG_IP_NF_TARGET_REDIRECT=y                                   劆
劆   CONFIG_IP_NF_NAT_FTP=y                                           劆
劆   CONFIG_IP_NF_MANGLE=y                                            劆
劆   CONFIG_IP_NF_TARGET_TOS=y                                        劆
劆   CONFIG_IP_NF_TARGET_MARK=y                                       劆
劆   CONFIG_IP_NF_TARGET_LOG=y                                        劆
劆   CONFIG_IP_NF_TARGET_TCPMSS=y                                     劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

儖乕儖偑愝掕偝傟偨傜丄埲壓偺僐儅儞僪傪幚峴偟偰丄 IP 僼僅儚乕僨傿儞僌傪
桳岠偵偟偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   echo 1 > /proc/sys/net/ipv4/ip_forward                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

儅僔儞偺嵞婲摦帪偵 IP 僼僅儚乕僨傿儞僌偑妋幚偵桳岠偵側傞傛偆偵丄埲壓偺
峴傪 /etc/sysctl.conf 偵捛壛偟偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   net.ipv4.ip_forward = 1                                          劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

傕偟 NocatAuth 傪棙梡偟偰偄傞側傜丄 NoCatAuth 僎乕僩僂僃僀愝掕僙僋僔儑
儞傑偱撉傒旘偽偟偰偐傑偄傑偣傫丅

iptables 傪僀儞僗僩乕儖偡傞昁梫偑偁傝傑偡丅iptables 傪僀儞僗僩乕儖偡傞
偵偼丄偛棙梡偺僨傿僗僩儕價儏乕僔儑儞偵摨崼偝傟偰偄傞僷僢働乕僕傪棙梡偡
傞偐丄僜乕僗偐傜僀儞僗僩乕儖偟偰偔偩偝偄丅忋婰偺僆僾僔儑儞傪愝掕偟怴偟
偄僇乕僱儖傪嶌惉偟偰 iptables 傪僀儞僗僩乕儖偟偨屻偵丄巹偼埲壓偺傛偆偵
僨僼僅儖僩偺僼傽僀儎僂僅乕儖儖乕儖傪愝掕偟傑偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE               劆
劆   iptables -A INPUT -i eth0 -m state --state NEW, INVALID -j DROP    劆
劆   iptables -A FORWARD -i eth0 -m state --state NEW, INVALID -j DROP  劆
劆   iptables -I FORWARD -o eth0 -j DROP                                劆
劆   iptables -I FORWARD -s 10.0.1.0/24 -d 10.0.1.1 -j ACCEPT           劆
劆                                                                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

  忋婰偺僐儅儞僪偼丄僒乕僶偑嵞婲摦偡傞嵺偵婲摦偡傞傛偆偵丄initscript 偺
拞偵抲偔偙偲傕偱偒傑偡丅儖乕儖偑捛壛偝傟偨偙偲傪妋偐傔傞偨傔偵丄埲壓偺
僐儅儞僪傪敪峴偟偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   iptables -v -t nat -L                                            劆
劆   iptables -v -t filter -L                                         劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

埲忋偺儖乕儖傪曐懚偡傞偨傔丄巹偼 Red Hat 偺 init 僗僋儕僾僩傪棙梡偟傑偟
偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   /etc/init.d/iptables save                                        劆
劆   /etc/init.d/iptables restart                                     劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱僎乕僩僂僃僀偼僱僢僩儚乕僋傾僪儗僗曄姺(NAT)傪峴偊傞傛偆偵側傝傑偡
偑丄岞奐僱僢僩儚乕僋偺拞偐傜憲怣偝傟偨僎乕僩僂僃僀埗偰偺僷働僢僩埲奜偼
丄僼僅儚乕僨傿儞僌僷働僢僩傪偡傋偰攋婞偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.2. 摦揑側 Netfilter 儖乕儖

偙偺僙僋僔儑儞偱偼丄僎乕僩僂僃僀忋偱 Netfilter 儖乕儖傪摦揑偵捛壛丄嶍彍
偡傞偺偵昁梫側僜僼僩僂僃傾偺愝掕曽朄傪夝愢偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.2.1. PAM iptables 儌僕儏乕儖

僼傽僀儎僂僅乕儖儖乕儖傪憓擖偡傞 PAM 僙僢僔儑儞儌僕儏乕儖偑丄擣徹偝傟偨
僋儔僀傾儞僩偺偨傔偵僼僅儚乕僨傿儞僌傪峴偊傞傛偆偵偡傞偺偵昁梫偵側傝傑
偡丅偙傟傪娙扨偵僙僢僩傾僢僾偡傞偵偼丄扨偵僜乕僗 <ftp://
ftp.itlab.musc.edu/pub/pam_iptables.tar.gz> 傪擖庤偟丄埲壓偺僐儅儞僪傪
嶌摦偝偣偰丄僐儞僷僀儖傪峴偭偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     gcc -fPIC -c pam_iptables.c                                    劆
劆     ld -x --shared -o pam_iptables.so pam_iptables.o               劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱 pam_iptables.so 偲 pam_iptables.o 偲偄偆柤慜偺擇偮偺僶僀僫儕偑偱
偒傞偼偢偱偡丅pam_iptables.so 傪 /lib/security/pam_iptables.so 偵僐僺乕
偟偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     cp pam_iptables.so /lib/security/pam_iptables.so               劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偙偱 /usr/local/auth-gw 偵僼傽僀儎僂僅乕儖偺僗僋儕僾僩傪慻傒崬傒傑偡
丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     mkdir /usr/local/auth-gw                                       劆
劆     cp insFwall /usr/local/auth-gw                                 劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僎乕僩僂僃僀偵慖戰偝傟偨擣徹僋儔僀傾儞僩偼 SSH 偩偭偨偺偱丄埲壓偺峴傪 /
etc/pam.d/sshd 偵捛壛偟傑偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     session    required     /lib/security/pam_iptables.so          劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱儐乕僓偑SSH偱儘僌僀儞偡傟偽丄僼傽僀儎僂僅乕儖儖乕儖偑捛壛偝傟傞傛
偆偵側傝傑偡丅

pam_iptables 儌僕儏乕儖偑摦嶌偟偰偄傞偐僥僗僩偡傞偵偼丄埲壓偺庤弴傪幚峴
偟偰偔偩偝偄丅

 1. SSH 偱僎乕僩僂僃僀偵儘僌僀儞丅
   
 2. 儖乕儖偑捛壛偝傟偰偄傞偐丄iptables -L -v 偱妋擣丅
   
 3. 僎乕僩僂僃僀偐傜儘僌傾僂僩偟偰丄偦偺儖乕儖偑嶍彍偝傟偰偄傞偺傪妋擣
    丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.2.2. NoCatAuth 僎乕僩僂僃僀

偙偺僙僋僔儑儞偱偼丄NoCatAuth 僎乕僩僂僃僀傪峔抸偡傞僾儘僙僗傪夝愢偟傑
偡丅NocatAuth 僎乕僩僂僃僀傪峔抸偡傞偵偼丄僜乕僗 <http://nocat.net/
download/NoCatAuth/> 傪僟僂儞儘乕僪偟丄埲壓偺庤弴偱僀儞僗僩乕儖偟偰偔偩
偝偄丅

gpgv 偑僀儞僗僩乕儖偝傟偰偄傞偐妋偐傔偰偔偩偝偄丅 gpgv 偼丄PGP 彁柤徹柧
幰偱偡丅偦傟偼 gnupg 偺堦晹偱偁傝丄 http://www.gnupg.org/download.html
<http://www.gnupg.org/download.html> 偵偁傝傑偡丅

NocatAuth 偺 tar 僼傽僀儖傪揥奐偡傞丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     tar xvzf NocatAuth-x.xx.tar.gz                                 劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

傕偟 NoCatAuth 傪 /usr/local/nocat 僨傿儗僋僩儕偵抲偒偨偔側偄側傜丄
Makefile 傪曇廤偟丄INST_PATH 傪偁側偨偑 NoCatAuth 傪忢挀偝偣偨偄僨傿儗
僋僩儕偵曄峏偟偰偔偩偝偄丅

師偵僎乕僩僂僃僀傪峔抸偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     cd NoCatAuth-x.xx                                              劆
劆     make gateway                                                   劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

/usr/local/nocat.conf 僼傽僀儖傪曇廤偟傑偡丅conf 僼傽僀儖偵昁梫側愝掕偵
偮偄偰偼丄徻偟偔偼 INSTALL 僪僉儏儊儞僩傪嶲徠偟偰偔偩偝偄丅椺偲側傞
conf 僼傽僀儖偼埲壓偺傛偆側姶偠偵側傝傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                                                                    劆
劆     ###### gateway.conf -- NoCatAuth Gateway Configuration.        劆
劆     #                                                              劆
劆     # Format of this file is: Directive Value, one per             劆
劆     # line. Trailing and leading whitespace is ignored. Any        劆
劆     # line beginning with a punctuation character is assumed to    劆
劆     # be a comment.                                                劆
劆                                                                    劆
劆     Verbosity       10                                             劆
劆     #we are behind a NAT so put the gateway in passive mode        劆
劆     GatewayMode     Passive                                        劆
劆     GatewayLog      /usr/local/nocat/nocat.log                     劆
劆     LoginTimeout    300                                            劆
劆                                                                    劆
劆     ######Open Portal settings.                                    劆
劆     HomePage        http://www.itlab.musc.edu/                     劆
劆     DocumentRoot    /usr/local/nocat/htdocs                        劆
劆     SplashForm      splash.html                                    劆
劆     ###### Active/Passive Portal settings.                         劆
劆     TrustedGroups Any                                              劆
劆     AuthServiceAddr egon.itlab.musc.edu                            劆
劆     AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login         劆
劆     LogoutURL       https://$AuthServiceAddr/forms/logout.html     劆
劆     ###### Other Common Gateway Options.                           劆
劆     AllowedWebHosts egon.itlab.musc.edu                            劆
劆     ResetCmd        initialize.fw                                  劆
劆     PermitCmd       access.fw permit $MAC $IP $Class               劆
劆     DenyCmd         access.fw deny $MAC $IP $Class                 劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱僎乕僩僂僃僀傪婲摦偱偒傞傛偆偵側傞偼偢偱偡丅壗偐栤戣偑敪惗偟偨傜
丄揥奐偟偨 NoCatAuth 僨傿儗僋僩儕偵偁傞 INSTALL 僪僉儏儊儞僩傪妋擣偟偰
偔偩偝偄丅埲壓偺僐儅儞僪偵傛傝丄僎乕僩僂僃僀傪婲摦偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     /usr/local/nocat/bin/gateway                                   劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.3. DHCP 僒乕僶愝掕

巹偼丄埲壓偺 dhcpd.conf 傪梡偄丄 DHCP 傪摫擖偟傑偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆   subnet 10.0.1.0 netmask 255.255.255.0 {                              劆
劆   # --- default gateway                                                劆
劆        option routers                  10.0.1.1;                       劆
劆        option subnet-mask              255.255.255.0;                  劆
劆        option broadcast-address        10.0.1.255;                     劆
劆                                                                        劆
劆        option domain-name-servers       10.0.1.1;                      劆
劆        range   10.0.1.3 10.0.1.254;                                    劆
劆        option time-offset              -5;     # Eastern Standard Time 劆
劆                                                                        劆
劆        default-lease-time 21600;                                       劆
劆        max-lease-time 43200;                                           劆
劆                                                                        劆
劆    }                                                                   劆
劆                                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

  DHCP 僒乕僶偼偙偺応崌丄岞奐僱僢僩偺僀儞僞僼僃乕僗偱偁傞丄eth1 懁偵懳
偟偰嶌摦偝偣傑偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆    /usr/sbin/dhcpd eth1                                            劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4. 擣徹庤朄偺愝掕

PAM 偵傛傞擣徹偲 NoCatAuth 擣徹僒乕價僗偵偮偄偰夝愢傪峴偄傑偡丅椉曽偲傕
椺偲偟偰 LDAP 傪棙梡偟傑偡丅LDAP 埲奜偺擣徹庤抜傕棙梡壜擻偱偡丅PAM 傗
NoCatAuth 偺僪僉儏儊儞僩傪撉傒丄暿偺擣徹庤抜傪棙梡偡傞偨傔偺庤弴傪棟夝
偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4.1. PAM LDAP

  慜偺僙僋僔儑儞偱弎傋偨傛偆偵丄巹偼擣徹偵 LDAP 傪巊梡偡傞傛偆僎乕僩僂
僃僀偺愝掕傪峴偄傑偟偨丅偟偐偟丄偁側偨偑偨偼 PAM 偑擣徹傪嫋梕偡傞偳偺曽
朄偱傕棙梡壜擻偱偡丅傕偭偲忣曬偑昁梫側傜偽丄 Section 2.4 傪嶲徠偔偩偝偄
丅

PAM LDAP 偱擣徹傪峴偆偨傔偵丄巹偼 OpenLDAP <http://www.openldap.org> 傪
僀儞僗僩乕儖偟丄/etc/ldap.conf 偵埲壓偺愝掕傪峴偄傑偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆     # Your LDAP server. Must be resolvable without using LDAP.     劆
劆     host itc.musc.edu                                              劆
劆                                                                    劆
劆     # The distinguished name of the search base.                   劆
劆     base dc=musc,dc=edu                                            劆
劆     ssl no                                                         劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

埲壓偵嫇偘傞僼傽僀儖偼丄LDAP 擣徹傪峴偆傛偆 PAM 傪愝掕偡傞偺偵巊梡偝傟
傑偟偨丅偙傟傜偺僼傽僀儖偼丄Red Hat 偺愝掕儐乕僥傿儕僥傿偵傛傝惗惉偝傟
傑偟偨丅

/etc/pam.d/system-auth 偑嶌惉偝傟丄埲壓偺傛偆側撪梕偵側傝傑偟偨丅
   
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆      #%PAM-1.0                                                                                                   劆
    劆      # This file is auto-generated.                                                                              劆
    劆      # User changes will be destroyed the next time authconfig is run.                                           劆
    劆      auth        required      /lib/security/pam_env.so                                                          劆
    劆      auth        sufficient    /lib/security/pam_unix.so likeauth nullok                                         劆
    劆      auth        sufficient    /lib/security/pam_ldap.so use_first_pass                                          劆
    劆      auth        required      /lib/security/pam_deny.so                                                         劆
    劆                                                                                                                  劆
    劆      account     required      /lib/security/pam_unix.so                                                         劆
    劆      account     [default=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/pam_ldap.so 劆
    劆                                                                                                                  劆
    劆      password    required      /lib/security/pam_cracklib.so retry=3                                             劆
    劆      password    sufficient    /lib/security/pam_unix.so nullok use_authtok                                      劆
    劆      password    sufficient    /lib/security/pam_ldap.so use_authtok                                             劆
    劆      password    required      /lib/security/pam_deny.so                                                         劆
    劆                                                                                                                  劆
    劆      session     required      /lib/security/pam_limits.so                                                       劆
    劆      session     required      /lib/security/pam_unix.so                                                         劆
    劆      session     optional      /lib/security/pam_ldap.so                                                         劆
    劆                                                                                                                  劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
傑偨丄埲壓偺 /etc/pam.d/sshd 僼傽僀儖偑嶌惉偝傟傑偟偨丅
   
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆       #%PAM-1.0                                                              劆
    劆       auth       required     /lib/security/pam_stack.so service=system-auth 劆
    劆       auth       required     /lib/security/pam_nologin.so                   劆
    劆       account    required     /lib/security/pam_stack.so service=system-auth 劆
    劆       password   required     /lib/security/pam_stack.so service=system-auth 劆
    劆       session    required     /lib/security/pam_stack.so service=system-auth 劆
    劆       #this line is added for firewall rule insertion upon login             劆
    劆       session    required     /lib/security/pam_iptables.so debug            劆
    劆       session    optional     /lib/security/pam_console.so                   劆
    劆                                                                              劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4.2. NoCatAuth 僒乕價僗

僎乕僩僂僃僀埲奜偺暿偺僒乕僶偵丄NoCatAuth 僒乕價僗傪僀儞僗僩乕儖偡傞偙
偲傪偍姪傔偟傑偡丅暿偺僒乕僶偑丄杔偺椺偵偍偄偰棙梡偝傟傑偟偨丅
NoCatAuth 僒乕價僗傪峔抸偡傞偵偼丄埲壓偺僜僼僩僂僃傾偑昁梫偵側傝傑偡丅

 1. SSL 偑桳岠壔偝傟偨僂僃僽僒乕僶丅SSL 徹柧彂偑搊榐偝傟偰偄傞偺偑朷傑
    偟偄丅巹偼丄Apache 偲 mod_ssl 偺慻傒崌傢偣傪巊梡偟傑偟偨丅
   
 2. Perl 5 (5.6 偐偦傟埲崀偑朷傑偟偄)
   
 3. Net::LDAP, Digest::MD5, DBI, 偦偟偰 DBD::MySQL perl 儌僕儏乕儖 (偦
    傟傜偼 CPAN 偐傜庢摼偟偰偔偩偝偄)丅昁梫側儌僕儏乕儖偼丄偳傫側擣徹庤
    抜傪棙梡偡傞偮傕傝偐偲偄偆偙偲偱曄傢偭偰偒傑偡丅杔偺椺偱偼丄擣徹庤
    抜偲偟偰 Net::LDAP 傪棙梡偟傑偟偨丅
   
 4. Gnu Privacy Guard (gnupg 1.0.6 偐偦傟埲崀)丅 http://www.gnupg.org/
    download.html 偱擖庤壜擻丅
   
僀儞僗僩乕儖偡傞偨傔偵丄tar 僼傽僀儖傪揥奐丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆    $ tar zvxf NoCatAuth-x.xx.tar.gz                                劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

NoCatAuth 偑忢挀偡傞僷僗傪曄峏偟偨偄応崌偼丄Makefile 傪曇廤偟丄
INST_PATH 傪婓朷偡傞僨傿儗僋僩儕偵曄峏偟偰偔偩偝偄丅

師偵丄 make authserv 僐儅儞僪傪幚峴偟傑偡丅偙傟偱丄/usr/local/nocat 偐
丄偁側偨偑 INST_PATH 偺抣傪曄峏偟偨偲偙傠偵偡傋偰偑僀儞僗僩乕儖偝傟傑偡
丅

偦偟偰 make pgpkey 傪幚峴偟傑偡丅弶婜愝掕偺傑傑偱丄戝掞偺梡搑偵巊偊傞偼
偢偱偡丅廳梫: 僷僗僼儗乕僘傪擖椡偟側偄偙偲! 擖椡偟偰偟傑偆偲丄擣徹僒乕
價僗偑儊僢僙乕僕傪埫崋壔偡傞偨傔偵懚嵼偟側偄 tty 偐傜僷僗僼儗乕僘傪撉傒
崬傕偆偲偟偰丄婏柇側儊僢僙乕僕傪弌椡偟偰偟傑偄傑偡丅

偁側偨偺娐嫬偵崌偆傛偆偵丄/usr/local/nocat/nocat.conf 傪曇廤偟偰偔偩偝
偄丅埲壓偵椺傪帵偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆    ###### authserv.conf -- NoCatAuth Authentication Service Configuration.                                                                                   劆
劆    #                                                                                                                                                         劆
劆    # Format of this file is: Directive Value, one per                                                                                                        劆
劆    #   line. Trailing and leading whitespace is ignored. Any                                                                                                 劆
劆    #   line beginning with a punctuation character is assumed to                                                                                             劆
劆    #   be a comment.                                                                                                                                         劆
劆                                                                                                                                                              劆
劆    Verbosity       10                                                                                                                                        劆
劆    HomePage        http://www.itlab.musc.edu/                                                                                                                劆
劆    DocumentRoot    /usr/local/nocat/htdocs                                                                                                                   劆
劆    # LDAP source                                                                                                                                             劆
劆    DataSource LDAP                                                                                                                                           劆
劆    LDAPHost authldap.musc.edu                                                                                                                                劆
劆    LDAPBase dc=musc,dc=edu                                                                                                                                   劆
劆                                                                                                                                                              劆
劆    UserTable       Member                                                                                                                                    劆
劆    UserIDField     User                                                                                                                                      劆
劆    UserPasswdField Pass                                                                                                                                      劆
劆    UserAuthField   Status                                                                                                                                    劆
劆    UserStampField  Created                                                                                                                                   劆
劆                                                                                                                                                              劆
劆    GroupTable      Network                                                                                                                                   劆
劆    GroupIDField    Network                                                                                                                                   劆
劆    GroupAdminField Admin                                                                                                                                     劆
劆    MinPasswdLength 8                                                                                                                                         劆
劆                                                                                                                                                              劆
劆    # LocalGateway -- If you run auth service on the same subnet                                                                                              劆
劆    #   (or host) as the gateway you need to specify the hostname                                                                                             劆
劆    #   of the gateway. Otherwise omit it.  (Requires Net::Netmask)                                                                                           劆
劆    #                                                                                                                                                         劆
劆    # LocalGateway    192.168.1.7                                                                                                                             劆
劆                                                                                                                                                              劆
劆    LoginForm       login.html                                                                                                                                劆
劆    LoginOKForm     login_ok.html                                                                                                                             劆
劆    FatalForm       fatal.html                                                                                                                                劆
劆    ExpiredForm     expired.html                                                                                                                              劆
劆    RenewForm       renew.html                                                                                                                                劆
劆    PassiveRenewForm renew_pasv.html                                                                                                                          劆
劆    RegisterForm    register.html                                                                                                                             劆
劆    RegisterOKForm  register_ok.html                                                                                                                          劆
劆    RegisterFields  Name URL Description                                                                                                                      劆
劆                                                                                                                                                              劆
劆    UpdateForm      update.html                                                                                                                               劆
劆    UpdateFields    URL Description                                                                                                                           劆
劆                                                                                                                                                              劆
劆    ###### Auth service user messages. Should be self-explanatory.                                                                                            劆
劆    #                                                                                                                                                         劆
劆    LoginGreeting   Greetings! Welcome to the Medical University of SC's Network.                                                                             劆
劆    LoginMissing    Please fill in all fields!                                                                                                                劆
劆    LoginBadUser    That e-mail address is unknown. Please try again.                                                                                         劆
劆    LoginBadPass    That e-mail and password do not match. Please try again.                                                                                  劆
劆    LoginBadStatus  Sorry, you are not a registered co-op member.                                                                                             劆
劆                                                                                                                                                              劆
劆    RegisterGreeting    Welcome! Please enter the following information to register.RegisterMissing     Name, E-mail, and password fields must be filled in.  劆
劆    RegisterUserExists  Sorry, that e-mail address is already taken. Are you already registered?                                                              劆
劆    RegisterBadUser     The e-mail address provided appears to be invalid. Did you spell it correctly?                                                        劆
劆    RegisterInvalidPass All passwords must be at least six characters long.                                                                                   劆
劆    RegisterPassNoMatch The passwords you provided do not match. Please try again.                                                                            劆
劆    RegisterSuccess     Congratulations, you have successfully registered.                                                                                    劆
劆                                                                                                                                                              劆
劆    UpdateGreeting      Enter your E-mail and password to update your info.                                                                                   劆
劆    UpdateBadUser       That e-mail address is unknown. Please try again.                                                                                     劆
劆    UpdateBadPass       That e-mail and password do not match. Please try again.                                                                              劆
劆    UpdateInvalidPass   New passwords must be at least eight characters long.                                                                                 劆
劆    UpdatePassNoMatch   The new passwords you provided do not match. Please try again.                                                                        劆
劆    UpdateSuccess       Congratulations, you have successfully updated your account.                                                                          劆
劆                                                                                                                                                              劆
劆                                                                                                                                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

/usr/local/nocat/pgp 偑僂僃僽僒乕僶偺儐乕僓偵強桳偝傟偰偄傞偐妋偐傔偰偔
偩偝偄(偮傑傝丄nobody 偐 www-data 偵側偭偰偄傞偐偳偆偐)丅

Apache 偺 httpd.conf 僼傽僀儖偵 etc/authserv.conf 傪捛壛偟偰偔偩偝偄丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆 Include /usr/local/nocat/etc/authserv.conf                         劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

  /usr/local/nocat/trustedkeys.pgp 傪僎乕僩僂僃僀偵僐僺乕偟偰偔偩偝偄丅
Apache 傪嵞婲摦偟丄帋偟偰傒偰偔偩偝偄丅傕偭偲懡偔偺忣曬偑昁梫側応崌偼丄
NoCatAuth 偺僪僉儏儊儞僩傪嶲徠偔偩偝偄丅僪僉儏儊儞僩偼丄NoCatAuth 傪揥
奐偟偨僨傿儗僋僩儕偺 docs/ 攝壓偵偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.5. DNS 偺愝掕

  巹偼丄Red Hat 7.1 偵偮偄偰偒偨僨僼僅儖僩僶乕僕儑儞偺 Bind 偲僉儍僢僔
儞僌僱乕儉僒乕僶 RPM 傪僀儞僗僩乕儖偟傑偟偨丅DHCP 僒乕僶偼丄岞奐僱僢僩
儚乕僋忋偺儅僔儞偑僱乕儉僒乕僶偲偟偰僎乕僩僂僃僀傪棙梡偡傞傛偆愝掕偟偰
偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

4. 擣徹僎乕僩僂僃僀偺棙梡

擣徹僎乕僩僂僃僀傪棙梡偡傞偨傔偵偼丄僋儔僀傾儞僩偵 DHCP 傪巊梡偡傞傛偆
偵愝掕偟偰偔偩偝偄丅偦偺儅僔儞偵 SSH 僋儔僀傾儞僩傪僀儞僗僩乕儖偟偰丄僎
乕僩僂僃僀偵 SSH 偱儘僌僀儞偟偰偔偩偝偄丅堦扷儘僌僀儞偡傟偽丄撪晹僱僢僩
儚乕僋偵傾僋僙僗偑峴偊傞傛偆偵側傝傑偡丅埲壓偼丄unix 儀乕僗偺僋儔僀傾儞
僩偵偍偗傞僙僢僔儑儞椺偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆 bash>ssh zornnh@10.0.1.1                                           劆
劆 zornnh's Password:                                                 劆
劆                                                                    劆
劆 gateway>                                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

  儘僌僀儞偟偨忬懺偱偁傞尷傝丄傾僋僙僗偑壜擻偱偡丅儘僌傾僂僩偟偰偟傑偆
偲丄傾僋僙僗偱偒側偔側傝傑偡丅

  擣徹僎乕僩僂僃僀偵 NoCatAuth 傪僀儞僗僩乕儖偟偰棙梡偡傞偵偼丄僋儔僀傾
儞僩婡偑 DHCP 傪棙梡偡傞傛偆偵愝掕偟偰偔偩偝偄丅 Mozilla 側偳偺僂僃僽僽
儔僂僓傪僀儞僗僩乕儖偟偰偔偩偝偄丅偦偟偰偦偺僂僃僽僽儔僂僓傪婲摦偟偰偔
偩偝偄丅僽儔僂僓偼丄擣徹夋柺偵儕僟僀儗僋僩偝傟傞偼偢偱偡丅

Figure 1. Nocat 偺儘僌僀儞

[nocat_auth]

儐乕僓柤偲僷僗儚乕僪傪擖椡偡傞偲丄億僢僾傾僢僾僗僋儕乕儞偑尰傢傟傑偡丅
偦偙偵偼偁側偨偑僱僢僩儚乕僋偵擣徹偝傟偨偙偲丄擣徹偝傟偨忬懺傪曐偮偵偼
偦偺僂傿儞僪僂傪奐偄偨傑傑偵偟偰偍偔偙偲丄偑愢柧偝傟偰偄傞偼偢偱偡丅僙
僢僔儑儞傪廔椆偡傞偵偼儘僌傾僂僩傪僋儕僢僋偡傞偐丄偦偺僂傿儞僪僂傪暵偠
傑偡丅

Figure 2. 擣徹僂傿儞僪僂

[nocat_auth]

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5. 廔傢傝偵

 丒 偙偺暥彂偱帵偝傟傞僙僉儏儕僥傿庤朄偼丄柍慄僱僢僩儚乕僋僐儈儏僯僥傿
    偵傛傝採嫙偝傟傞僙僉儏儕僥傿偵埶懚偟傑偣傫丅柍慄僱僢僩儚乕僋慡懱偑
    埨慡偱側偔偰傕丄傑偨偦偺柍慄僱僢僩儚乕僋偑偁側偨偺娗棟壓偵側偔偰傕
    偒偪傫偲婡擻偟傑偡丅
   
 丒 僎乕僩僂僃僀偼丄僩儔僼傿僢僋傪埫崋壔偟傑偣傫丅偦偺攚屻偵偁傞僱僢僩
    儚乕僋傊偺傾僋僙僗傪嫋壜偡傞偩偗偱偡丅傕偟埫崋壔傕擣徹傕昁梫側傜偽
    丄VPN 傪棙梡偡傋偒偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

6. 捛壛偺忣曬尮

 丒 NASA 偵偍偗傞擣徹僎乕僩僂僃僀偺幚憰偵偮偄偰愢柧偟偨暥彂 <http://
    www.nas.nasa.gov/Groups/Networks/Projects/Wireless/index.html>丅
   
 丒 傾儖僶乕僞戝妛偵偍偄偰擣徹僎乕僩僂僃僀傪嶌惉偟偨曽朄傪婰弎偟偨敀彂
    <http://www.ualberta.ca/~beck/authgw.html>丅
   
 丒 Nocat.net <http://nocat.net> 偵偼丄柍慄僱僢僩儚乕僋梡偺擣徹僎乕僩僂
    僃僀偑偁傝傑偡丅偙偺僜僼僩僂僃傾偼丄僂僃僽儀乕僗偺僋儔僀傾儞僩偵側
    傝傑偡丅
   
 丒 Horatio: Authenticated Network Access <http://www.cs.utexas.edu/
    users/mcguire/software/horatio/> 偼丄僼傽僀儎僂僅乕儖梡擣徹僣乕儖偱
    偡丅棙梡偺慜採忦審: 惓婯偺儐乕僓偼儔僢僾僩僢僾儅僔儞傗偦偺懠偺儌僶
    僀儖抂枛傪僱僢僩儚乕僋偵偮側偛偆偲偡傞偑丄僙僉儏儕僥傿偺偨傔丄惓婯
    偺儐乕僓偑撪晹偺丄埨慡側僱僢僩儚乕僋偵傾僋僙僗偡傞偺傪杊偓丄堦斒偺
    僀儞僞乕僱僢僩傪埆梡偡傞偺傪杊偖昁梫偑偁傞応崌丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7. 幙栤偲摎偊

偙偙偼丄捀偄偨幙栤偺偆偪丄懡偔偺恖払偑摨偠傛偆偵媈栤傪書偔偩傠偆偲巚傢
傟傞傕偺傪廤傔偰偄偔応強偱偡丅杮摉偵懡偔偺僼傿乕僪僶僢僋傪捀偗偨側傜丄
杮棃偺堄枴偺FAQ偵偟偰偄偒傑偡丅

 1. 側偤丄iptables 偺儖乕儖偼丄僋儔僀傾儞僩偑 telnet 僂傿儞僪僂傪暵偠偨
    偲偒偵僼儔僢僔儏偟側偄偺偱偟傚偆偐? 僋儔僀傾儞僩偑 telnet 僙僢僔儑
    儞傪儘僌傾僂僩偟偨応崌傕丄iptables 偺儖乕儖偼婡擻偟傑偡丅 SSH 偺応
    崌偩偲丄SSH 僂傿儞僪僂偑暵偠傞応崌偱傕丄 iptables 偺儖乕儖偼僼儔僢
    僔儏偝傟傑偡丅
   
    巹偼丄偙偺栤戣偵懳偡傞揔愗側摎偊傗夝寛嶔傪峫偊晅偄偰偄傑偣傫丅 Logu
    偑丄偙偺栤戣傪夝寛偡傞 pam_iptables 傗偦偺懠偺僣乕儖偺廋惓傪峷專偟
    偰偔傟傑偟偨丅偙傟傜偺僣乕儖偼丄 contrib <http://www.itlab.musc.edu
    /~nathan/pam_iptables/contrib> 僨傿儗僋僩儕偵 pam_iptables 偲堦弿偵
    抲偄偰偁傝傑偡丅
   
 2. IE6 偩偲 NoCat 偑壗偐偍偐偟偔偁傝傑偣傫? 擣徹偼峴偭偰偄傞傛偆偱偡偑
    丄僼傽僀儎僂僅乕儖偺儖乕儖傪彂偐側偄偺偱偡丅
   
    NoCat 偑弌偡 HTML 偵師偺儊僞僞僌偑娷傑傟偰偄傞偙偲傪妋偐傔偰偔偩偝
    偄: < meta http-equiv="Refresh" content="$redirect" />
   
    偙偺儊僞僞僌傪娷傓傋偒 HTML 僼傽僀儖偼丄 login_ok.html, renew.html,
    偦偟偰 renew_pasv.html 偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

8. 擔杮岅栿偵偮偄偰

擔杮岅栿偼 Linux Japanese FAQ Project 偑峴偄傑偟偨丅東栿偵娭偡傞偛堄尒
偼 JF 僾儘僕僃僋僩 <JF@linux.or.jp> 埗偵楢棈偟偰偔偩偝偄丅

0.06j

東栿:
   
    yomoyomo <ymgrtq@ma.neweb.ne.jp>
   
峑惓:
   
     仩 office 偝傫 <office@ukky.net>
       
     仩 嵅栰晲弐偝傫 <kgh12351@nifty.ne.jp>
       
     仩 崅嫶慡偝傫 <arms405@jade.dti.ne.jp>
       
     仩 憗愳恗偝傫 <cz@hykw.tv>
       
     仩 悈尨暥偝傫 <mizuhara@acm.org>
       
