From 7327a3eee642d3d7fa420a693c0353447f09176a Mon Sep 17 00:00:00 2001 From: Means Lee Date: Fri, 23 Feb 2018 20:07:04 +0800 Subject: [PATCH 1/5] fetch remote --- ... What Is Kali Linux, and Do You Need It.md | 74 ------------------- 1 file changed, 74 deletions(-) delete mode 100644 published/20180206 What Is Kali Linux, and Do You Need It.md diff --git a/published/20180206 What Is Kali Linux, and Do You Need It.md b/published/20180206 What Is Kali Linux, and Do You Need It.md deleted file mode 100644 index 5506807a6b..0000000000 --- a/published/20180206 What Is Kali Linux, and Do You Need It.md +++ /dev/null @@ -1,74 +0,0 @@ -Kali Linux 是什么，你需要它吗？ -====== - -![](https://www.maketecheasier.com/assets/uploads/2018/01/kl-feat.jpg) - -如果你听到一个 13 岁的黑客吹嘘他是多么的牛逼，是有可能的，因为有 Kali Linux 的存在。尽管有可能会被称为“脚本小子”，但是事实上，Kali 仍旧是安全专家手头的重要工具（或工具集）。 - -Kali 是一个基于 Debian 的 Linux 发行版。它的目标就是为了简单：在一个实用的工具包里尽可能多的包含渗透和审计工具。Kali 实现了这个目标。大多数做安全测试的开源工具都被囊括在内。 - -**相关** ： [4 个极好的为隐私和安全设计的 Linux 发行版][1] - -### 为什么是 Kali？ - -![Kali Linux Desktop][2] - -[Kali][3] 是由 [Offensive Security](https://www.offensive-security.com/) 公司开发和维护的。它在安全领域是一家知名的、值得信赖的公司，它甚至还有一些受人尊敬的认证，来对安全从业人员做资格认证。 - -Kali 也是一个简便的安全解决方案。Kali 并不要求你自己去维护一个 Linux 系统，或者你自己去收集软件和依赖项。它是一个“交钥匙工程”。所有这些繁杂的工作都不需要你去考虑，因此，你只需要专注于要审计的真实工作上，而不需要去考虑准备测试系统。 - -### 如何使用它？ - -Kali 是一个 Linux 发行版。与任何一个其它的 Linux 发行版一样，你可以将它永久安装到一个硬盘上。那样它会工作的更好，但是你不能将它作为一个日常使用的操作系统。因为它是为渗透测试构建的，这就是你使用它的全部理由。 - -最好是将 Kali 制作为自启动发行版。你可以将 Kali 刻录到一张 DVD 或者是制作到一个自启动 U 盘上来运行它。你没有必要在一个 Kali 上安装任何软件或者保存任何文件。你可以在需要测试一个系统时随时来启动它。它也有非常好的灵活性，可以让运行 Kali 的机器随时运行在想要测试的网络上。 - -### Kali 可以做什么？ - -Kali 里面有很多的安全工具而不是别的。这就是它能做的事。不管怎么说，Kali 就是一个安全工具。 - -![Kali Zenmap][4] - -它有像 NMap 和 Wireskark 这样的经典信息采集工具。 - -![Kali Linux Wireshark][5] - -Kali 也有面向 WiFi 的工具，像 Aircrack-ng、Kismet、以及 Pixie。 - -对于破解密码，它也有像 Hydra、Crunch、Hashcat、以及 John the Ripper 这样的工具。 - -![Kali Metasploit][6] - -还有更多的成套工具，包括 Metasploit 和 Burp Suite。 - -这些只是 Kali 缺省内置的一小部分安全工具。完整的了解这些工具需要很多的时间，但是，你可以清楚地看到许多非常流行的工具它都有。 - -### Kali 是为你准备的吗？ - -Kali 并不是为普通用户准备的。它并不是一个运行在你的笔记本电脑上的普通 Linux 发行版，而是一个很酷的“黑客操作系统“。如果你使用这个操作系统，那么你将会运行着一个缺乏安全保障的系统，因为 Kali 被设计为以 root 权限运行。它自身并不安全，并且它的配置也与普通的 Linux 发行版不一样。它是一个攻击型工具，而不是一个防御型工具。 - -Kali 并不是个玩具。你可以使用它内置的工具去做一些会产生真实伤害的危险的事（你懂的），那将给你带来很多真实的麻烦。对于一个未受到严格教育的用户来说，做一些严重违法的事情是很容易的，并且之后你就会发现自己被陷入很无助的境地。 - -说了这么多，但是，Kali 对于一个专业用户来说，它是一个极好的工具。如果你是一个网络管理员，想对你的网络做一个真实的测试，Kali 可以做到你所希望的一切事情。Kali 也有一些优秀的开发工具，用于去实时审计它们的应用程序。 - -当然，如果你正好有兴趣学习关于安全的知识，你可以在某些受控环境中去使用 Kali，它可以教你学习很多的非常优秀的知识。 - -Kali Linux 是许多优秀的安全工具的集合。对于专业用户来说，它有难以置信的好处，但是对于一些不怀好意的人来说，也可以产生很多大麻烦。小心地使用 Kali，充分利用它的巨大优势。如果不这样的话，你将在某个地方（你懂的）度过你的余生。 - --------------------------------------------------------------------------------- - -via: https://www.maketecheasier.com/what-is-kali-linux-and-do-you-need-it/ - -作者：[Nick Congleton][a] -译者：[qhwdw](https://github.com/qhwdw) -校对：[wxy](https://github.com/wxy) - -本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 - -[a]:https://www.maketecheasier.com/author/nickcongleton/ -[1]:https://www.maketecheasier.com/linux-distros-designed-for-privacy-security/ "4 Great Linux Distros Designed for Privacy and Security" -[2]:https://www.maketecheasier.com/assets/uploads/2018/01/kl-desktop.jpg "Kali Linux Desktop" -[3]:https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/ -[4]:https://www.maketecheasier.com/assets/uploads/2018/01/kl-zenmap.jpg "Kali Zenmap" -[5]:https://www.maketecheasier.com/assets/uploads/2018/01/kl-wireshark.jpg "Kali Linux Wireshark" -[6]:https://www.maketecheasier.com/assets/uploads/2018/01/kl-metasploit.jpg "Kali Metasploit" From cba55e2228808548948afcfb77a31b723a180976 Mon Sep 17 00:00:00 2001 From: leemeans <1808577072@qq.com> Date: Tue, 20 Mar 2018 10:56:05 +0800 Subject: [PATCH 2/5] Update 20180227 How to block local spoofed addresses using the Linux firewall.md nearly half --- ...ock local spoofed addresses using the Linux firewall.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md index 2ea760e636..cd3dddd934 100644 --- a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md +++ b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md @@ -1,20 +1,27 @@ leemeans translating How to block local spoofed addresses using the Linux firewall +如何使用Linux防火墙隔离局域网受欺骗地址 ====== ![](https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/EDU_UnspokenBlockers_1110_A.png?itok=x8A9mqVA) Attackers are finding sophisticated ways to penetrate even remote networks that are protected by intrusion detection and prevention systems. No IDS/IPS can halt or minimize attacks by hackers who are determined to take over your network. Improper configuration allows attackers to bypass all implemented network security measures. +即便是被入侵检测和隔离系统保护的远程网络，黑客们也在寻找精致的方法入侵。IDS/IPS是不能停止或者减少那些想要接管你的网络的黑客的攻击的。不恰当的配置允许攻击者绕过所有部署的安全措施。 In this article, I will explain how security engineers or system administrators can prevent these attacks. +在这篇文章中，我将会解释安全工程师或者系统管理员怎样可以避免这些攻击。 Almost all Linux distributions come with a built-in firewall to secure processes and applications running on the Linux host. Most firewalls are designed as IDS/IPS solutions, whose primary purpose is to detect and prevent malicious packets from gaining access to a network. +几乎所有的Linux发行版都带着一个内建的防火墙来保护运行在Linux宿主机上的进程和应用程序。大多数都按照IDS/IPS解决方案设计，这样的设计的主要目的是检测和避免恶意包获取网络的进入权。 A Linux firewall usually comes with two interfaces: iptables and ipchains. Most people refer to these interfaces as the "iptables firewall" or the "ipchains firewall." Both interfaces are designed as packet filters. Iptables acts as a stateful firewall, making decisions based on previous packets. Ipchains does not make decisions based on previous packets; hence, it is designed as a stateless firewall. +Linux防火墙通常带有两个接口：iptable和ipchain程序。大多数人将这些接口称作iptables防火墙或者ipchains防火墙。这两个接口都被设计成包过滤器。iptables是有状态防火墙，基于先前的包做出决定。 In this article, we will focus on the iptables firewall, which comes with kernel version 2.4 and beyond. +在这篇文章中，我们将会专注于内核2.4之后出现的iptables防火墙。 With the iptables firewall, you can create policies, or ordered sets of rules, which communicate to the kernel how it should treat specific classes of packets. Inside the kernel is the Netfilter framework. Netfilter is both a framework and the project name for the iptables firewall. As a framework, Netfilter allows iptables to hook functions designed to perform operations on packets. In a nutshell, iptables relies on the Netfilter framework to build firewall functionality such as filtering packet data. +有了iptables防火墙，你可以创建策略或者有序的规则集，规则集可以告诉内核如何对待特定的数据包。在内核中的是Netfilter框架。Netfilter既是框架也是iptables防火墙的工程名。作为一个框架，Netfilter允许iptables勾取被设计来操作数据包的函数。概括地说，iptables依靠Netfilter框架构筑诸如过滤数据包数据的功能。 Each iptables rule is applied to a chain within a table. An iptables chain is a collection of rules that are compared against packets with similar characteristics, while a table (such as nat or mangle) describes diverse categories of functionality. For instance, a mangle table alters packet data. Thus, specialized rules that alter packet data are applied to it, and filtering rules are applied to the filter table because the filter table filters packet data. From 725a14b4f31973ce69db9cc40b61c86b0599ce7a Mon Sep 17 00:00:00 2001 From: leemeans <1808577072@qq.com> Date: Sat, 24 Mar 2018 13:41:22 +0800 Subject: [PATCH 3/5] last chapter left --- ... block local spoofed addresses using the Linux firewall.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md index cd3dddd934..a699744e75 100644 --- a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md +++ b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md @@ -24,10 +24,14 @@ With the iptables firewall, you can create policies, or ordered sets of rules, w 有了iptables防火墙，你可以创建策略或者有序的规则集，规则集可以告诉内核如何对待特定的数据包。在内核中的是Netfilter框架。Netfilter既是框架也是iptables防火墙的工程名。作为一个框架，Netfilter允许iptables勾取被设计来操作数据包的函数。概括地说，iptables依靠Netfilter框架构筑诸如过滤数据包数据的功能。 Each iptables rule is applied to a chain within a table. An iptables chain is a collection of rules that are compared against packets with similar characteristics, while a table (such as nat or mangle) describes diverse categories of functionality. For instance, a mangle table alters packet data. Thus, specialized rules that alter packet data are applied to it, and filtering rules are applied to the filter table because the filter table filters packet data. +每个iptables规则都被应用到一个含表的链中。一个iptables链就是一个比较包中相似字符的规则的集合。而表(例如nat或者mangle)则描述不同的功能目录。例如，一个mangle表转化包数据。因此，特定的改变包数据的规则被应用到这里，而过滤规则被应用到filter表，因为filter表过滤包数据。 Iptables rules have a set of matches, along with a target, such as `Drop` or `Deny`, that instructs iptables what to do with a packet that conforms to the rule. Thus, without a target and a set of matches, iptables can’t effectively process packets. A target simply refers to a specific action to be taken if a packet matches a rule. Matches, on the other hand, must be met by every packet in order for iptables to process them. +iptables规则有一系列匹配，伴随着一个诸如`Drop`或者`Deny`的目标，这可以告诉iptables对一个包做什么符合规则。因此，没有一个目标和一系列匹配，iptables就不能有效地处理包。如果一个包匹配一条规则，一个目标简单地指向一个将要采取的特定措施。另一方面，为了让iptables处理，匹配必须被每个包满足吗。 + Now that we understand how the iptables firewall operates, let's look at how to use iptables firewall to detect and reject or drop spoofed addresses. +现在我们已经知道iptables防火墙如何工作，开始着眼于如何使用iptables防火墙检测并拒绝或丢弃被欺骗的地址吧。 ### Turning on source address verification From df180d06ce50dce935135c40f52c01ab448aa297 Mon Sep 17 00:00:00 2001 From: Means Lee Date: Sat, 24 Mar 2018 15:25:27 +0800 Subject: [PATCH 4/5] leemeans translated --- ...ofed addresses using the Linux firewall.md | 45 +++++++------------ 1 file changed, 17 insertions(+), 28 deletions(-) diff --git a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md index a699744e75..6c54c36164 100644 --- a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md +++ b/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md @@ -1,59 +1,49 @@ -leemeans translating -How to block local spoofed addresses using the Linux firewall 如何使用Linux防火墙隔离局域网受欺骗地址 ====== ![](https://opensource.com/sites/default/files/styles/image-full-size/public/lead-images/EDU_UnspokenBlockers_1110_A.png?itok=x8A9mqVA) -Attackers are finding sophisticated ways to penetrate even remote networks that are protected by intrusion detection and prevention systems. No IDS/IPS can halt or minimize attacks by hackers who are determined to take over your network. Improper configuration allows attackers to bypass all implemented network security measures. + 即便是被入侵检测和隔离系统保护的远程网络，黑客们也在寻找精致的方法入侵。IDS/IPS是不能停止或者减少那些想要接管你的网络的黑客的攻击的。不恰当的配置允许攻击者绕过所有部署的安全措施。 -In this article, I will explain how security engineers or system administrators can prevent these attacks. 在这篇文章中，我将会解释安全工程师或者系统管理员怎样可以避免这些攻击。 -Almost all Linux distributions come with a built-in firewall to secure processes and applications running on the Linux host. Most firewalls are designed as IDS/IPS solutions, whose primary purpose is to detect and prevent malicious packets from gaining access to a network. 几乎所有的Linux发行版都带着一个内建的防火墙来保护运行在Linux宿主机上的进程和应用程序。大多数都按照IDS/IPS解决方案设计，这样的设计的主要目的是检测和避免恶意包获取网络的进入权。 -A Linux firewall usually comes with two interfaces: iptables and ipchains. Most people refer to these interfaces as the "iptables firewall" or the "ipchains firewall." Both interfaces are designed as packet filters. Iptables acts as a stateful firewall, making decisions based on previous packets. Ipchains does not make decisions based on previous packets; hence, it is designed as a stateless firewall. Linux防火墙通常带有两个接口：iptable和ipchain程序。大多数人将这些接口称作iptables防火墙或者ipchains防火墙。这两个接口都被设计成包过滤器。iptables是有状态防火墙，基于先前的包做出决定。 -In this article, we will focus on the iptables firewall, which comes with kernel version 2.4 and beyond. 在这篇文章中，我们将会专注于内核2.4之后出现的iptables防火墙。 -With the iptables firewall, you can create policies, or ordered sets of rules, which communicate to the kernel how it should treat specific classes of packets. Inside the kernel is the Netfilter framework. Netfilter is both a framework and the project name for the iptables firewall. As a framework, Netfilter allows iptables to hook functions designed to perform operations on packets. In a nutshell, iptables relies on the Netfilter framework to build firewall functionality such as filtering packet data. 有了iptables防火墙，你可以创建策略或者有序的规则集，规则集可以告诉内核如何对待特定的数据包。在内核中的是Netfilter框架。Netfilter既是框架也是iptables防火墙的工程名。作为一个框架，Netfilter允许iptables勾取被设计来操作数据包的函数。概括地说，iptables依靠Netfilter框架构筑诸如过滤数据包数据的功能。 -Each iptables rule is applied to a chain within a table. An iptables chain is a collection of rules that are compared against packets with similar characteristics, while a table (such as nat or mangle) describes diverse categories of functionality. For instance, a mangle table alters packet data. Thus, specialized rules that alter packet data are applied to it, and filtering rules are applied to the filter table because the filter table filters packet data. 每个iptables规则都被应用到一个含表的链中。一个iptables链就是一个比较包中相似字符的规则的集合。而表(例如nat或者mangle)则描述不同的功能目录。例如，一个mangle表转化包数据。因此，特定的改变包数据的规则被应用到这里，而过滤规则被应用到filter表，因为filter表过滤包数据。 -Iptables rules have a set of matches, along with a target, such as `Drop` or `Deny`, that instructs iptables what to do with a packet that conforms to the rule. Thus, without a target and a set of matches, iptables can’t effectively process packets. A target simply refers to a specific action to be taken if a packet matches a rule. Matches, on the other hand, must be met by every packet in order for iptables to process them. iptables规则有一系列匹配，伴随着一个诸如`Drop`或者`Deny`的目标，这可以告诉iptables对一个包做什么符合规则。因此，没有一个目标和一系列匹配，iptables就不能有效地处理包。如果一个包匹配一条规则，一个目标简单地指向一个将要采取的特定措施。另一方面，为了让iptables处理，匹配必须被每个包满足吗。 -Now that we understand how the iptables firewall operates, let's look at how to use iptables firewall to detect and reject or drop spoofed addresses. 现在我们已经知道iptables防火墙如何工作，开始着眼于如何使用iptables防火墙检测并拒绝或丢弃被欺骗的地址吧。 -### Turning on source address verification +### 打开源地址验证 -The first step I, as a security engineer, take when I deal with spoofed addresses from remote hosts is to turn on source address verification in the kernel. +作为一个安全工程师，在处理远程主机被欺骗地址的时候，我采取的第一步是在内核打开源地址验证。 -Source address verification is a kernel-level feature that drops packets pretending to come from your network. It uses the reverse path filter method to check whether the source of the received packet is reachable through the interface it came in. +源地址验证是一种内核层级的特性，这种特性丢弃那些伪装成来自你的网络的包。这种特性使用反向路径过滤器方法来检查收到的包的源地址是否可以通过包到达的接口可以到达。(译注：到达的包的源地址应该可以从它到达的网络接口反向到达，只需反转源地址和目的地址就可以达到这样的效果) -To turn source address verification, utilize the simple shell script below instead of doing it manually: +利用下面简单的脚本可以打开源地址验证而不用手工操作： ``` #!/bin/sh -#author’s name: Michael K Aboagye +#作者: Michael K Aboagye -#purpose of program: to enable reverse path filtering +#程序目标: 打开反向路径过滤 -#date: 7/02/18 +#日期: 7/02/18 -#displays “enabling source address verification” on the screen +#在屏幕上显示 “enabling source address verification” echo -n "Enabling source address verification…" -#Overwrites the value 0 to 1 to enable source address verification +#将值0覆盖为1来打开源地址验证 echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter @@ -61,29 +51,28 @@ echo "completed" ``` -The preceding script, when executed, displays the message `Enabling source address verification` without appending a new line. The default value of the reverse path filter is 0.0, which means no source validation. Thus, the second line simply overwrites the default value 0 to 1. 1 means that the kernel will validate the source by confirming the reverse path. +先前的脚本在执行的时候只显示了`Enabling source address verification`这条信息而没有添加新行。默认的反向路径过滤的值是0，0表示没有源验证。因此，第二行简单地将默认值0覆盖为1。1表示内核将会通过确认反向路径来验证源(地址)。 -Finally, you can use the following command to drop or reject spoofed addresses from remote hosts by choosing either one of these targets: `DROP` or `REJECT`. However, I recommend using `DROP` for security reasons. +最后，你可以使用下面的命令通过选择`DROP`或者`REJECT`目标中的一个来丢弃或者拒绝来自远端主机的被欺骗地址。但是，处于安全原因的考虑，我建议使用`DROP`目标。 -Replace the “IP-address” placeholder with your own IP address, as shown below. Also, you must choose to use either `REJECT` or `DROP`; the two targets don’t work together. +像下面这样，用你自己的IP地址代替“IP-address” 占位符。另外，你必须选择使用`REJECT`或者`DROP`中的一个，这两个目标不能同时使用。 ``` -   iptables -A INPUT -i internal_interface -s IP_address -j REJECT / DROP   + iptables -A INPUT -i internal_interface -s IP_address -j REJECT / DROP -    iptables -A INPUT -i internal_interface -s 192.168.0.0/16  -j REJECT/ DROP + iptables -A INPUT -i internal_interface -s 192.168.0.0/16 -j REJECT/ DROP ``` -This article provides only the basics of how to prevent spoofing attacks from remote hosts using the iptables firewall. - +这篇文章只提供了如何使用iptables防火墙来避免远端欺骗攻击的基础(知识)。 -------------------------------------------------------------------------------- via: https://opensource.com/article/18/2/block-local-spoofed-addresses-using-linux-firewall 作者：[Michael Kwaku Aboagye][a] -译者：[译者ID](https://github.com/译者ID) +译者：[leemeans](https://github.com/leemeans) 校对：[校对者ID](https://github.com/校对者ID) 本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 From 2102a4dede86a037925044ab0b0bae81ffde5d94 Mon Sep 17 00:00:00 2001 From: "Xingyu.Wang" Date: Sun, 25 Mar 2018 09:38:08 +0800 Subject: [PATCH 5/5] Rename sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md to translated/tech/20180227 How to block local spoofed addresses using the Linux firewall.md --- ...w to block local spoofed addresses using the Linux firewall.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {sources => translated}/tech/20180227 How to block local spoofed addresses using the Linux firewall.md (100%) diff --git a/sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md b/translated/tech/20180227 How to block local spoofed addresses using the Linux firewall.md similarity index 100% rename from sources/tech/20180227 How to block local spoofed addresses using the Linux firewall.md rename to translated/tech/20180227 How to block local spoofed addresses using the Linux firewall.md