编译64位deiban内核,安装Layer 7过滤软件

编译64位deiban内核,安装Layer 7过滤软件

作者:Xliu
Msn:[email protected]



首先从debian的官方网站下载ISO镜像,下载地址:http://www.debian.org/distrib/。官方网站上有各种不同CPU架构的安装镜像下载,其中标识i386就是我们常用的32位系统镜像,IA64是专用于安腾64位处理器,本文所要使用的是64位系统,就选择标识为amd64的镜像。需要注意的是,amd64架构不是单指AMD的64位处理器,也包括支持INTEL EMT64技术的处理器(如现在流行的酷睿系列处理器)。镜像也分为DVD和CD两种,建议有条件的话,还是下载DVD的,毕竟包含的软件多。一般来说只需下载第一张镜像光盘就可以了,这次实验下载的镜像卷标为debian-501-amd64-DVD-1.iso
接下来刻盘安装,安装过程就不说了,网上教程很多,系统安装完成后,配置好IP,配置好SSH服务。
然后打开putty(一个用来登录远程服务器的工具),通过SSH登录debian服务器,输入root帐号、密码,登录成功。如下图。(图片1)


接下来要更改apt源、准备内核和过滤工具的源代码。
cd /etc/apt
cp sources.list sources.list.bak
在sources.list中修改apt源列表,
nano sources.list
可以用删除键把里面所用的字符完全删除,接着输入apt的源,在中国大陆目前还是163的源最快最稳定,强烈建议使用。163是门户网站中第一个为开源软件提供镜像的公司。在这里顺便感谢下163。感谢为开源事业所做出的贡献。
deb http://mirrors.163.com/debian lenny main non-free contrib
deb-src http://mirrors.163.com/debian lenny main non-free contrib

(图片2)

完成后,按ctrl+o敲下回车保存,再按ctrl+x退出。
输入apt-get update更新源列表

(图片3)

更新完成,安装编译所需的工具:
apt-get install zip
apt-get install bzip2
 apt-get install make
 apt-get install debhelper
 apt-get install kernel-package
 apt-get install libncurses5-dev
 apt-get install fakeroot

接下来该下载内核和过滤工具的源代码,为了方便管理,新建目录
mkdir /usr/src/kernels
内核和过滤工具的源代码就放在kernels目录。进入kernels目录
cd /usr/src/kernels

(图片4)

用wget命令下载内核和过滤工具的源代码
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.28.10.tar.bz2
wget ftp://ftp.netfilter.org/pub/iptables/iptables-1.4.2.tar.bz2
wget http://nchc.dl.sourceforge.net/sourceforge/l7-filter/netfilter-layer7-v2.21.tar.gz
wget http://nchc.dl.sourceforge.net/sourceforge/l7-filter/l7-protocols-2009-05-10.tar.gz
用ls命令查看下,应该可以看到下载完的软件包
(图片5)

解压以上文件:
tar -jxvf linux-2.6.28.10.tar.bz2; tar -zxvf l7-protocols-2009-05-10.tar.gz; tar -zxvf netfilter-layer7-v2.21.tar.gz; tar -jxvf iptables-1.4.2.tar.bz2

为了方便,做一个符号链接,并进入新内核源代码目录:
ln -s linux-2.6.28.10 linux
cd linux

为内核源代码打下layer7的补丁
patch -p1 < ../netfilter-layer7-v2.21/kernel-2.6.25-2.6.28-layer7-2.21.patch

(图片6)

接下来进入关键的步骤,为内核选择layer7及相关的模块;
make menuconfig
让新内核读取旧内核的配置:
在出现的菜单选项中选中“Load an Alternate Configuration File”,输入旧内核配置文件的路径/boot/config-2.6.26-2-amd64,然后确认,开始选择内核模块
选项如下:
General setup --->[*] Prompt for development and/or incomplete code/drivers
Networking --->
Networking options --->[*] Network packet filtering framework (Netfilter) --->
Core Netfilter Configuration --->
<M> Netfilter connection tracking support
-*- Connection tracking flow accounting
-*- Connection mark tracking support[*] Connection tracking security mark support[*] Connection tracking events (EXPERIMENTAL)
<M> SCTP protocol connection tracking support (EXPERIMENTAL)
<M> UDP-Lite protocol connection tracking support (EXPERIMENTAL)
<M> Amanda backup protocol support
<M> FTP protocol support
<M> H.323 protocol support (EXPERIMENTAL)
<M> IRC protocol support
<M> NetBIOS name service protocol support (EXPERIMENTAL)
<M> PPtP protocol support
<M> SANE protocol support (EXPERIMENTAL)
<M> SIP protocol support (EXPERIMENTAL)
<M> TFTP protocol support
<M> Connection tracking netlink interface (EXPERIMENTAL)
{M} Netfilter Xtables support (required for ip_tables)
<M> "CLASSIFY" target support
<M> "CONNMARK" target support
<M> "DSCP" target support
<M> "MARK" target support
<M> "NFQUEUE" target Support
<M> "NFLOG" target support
<M> "NOTRACK" target support
<M> "TRACE" target support
<M> "TRACE" target support
<M> "SECMARK" target support
<M> "CONNSECMARK" target support
<M> "TCPMSS" target support
<M> "comment" match support
<M> "connbytes" per-connection counter match support
<M> "connlimit" match support"
<M> "connmark" connection mark match support
<M> "conntrack" connection tracking match support
<M> "DCCP" protocol match support
<M> "DCCP" protocol match support
<M> "DSCP" match support
<M> "ESP" match support
<M> "helper" match support
<M> "length" match support
<M> "limit" match support
<M> "mac" address match support
<M> "mark" match support
<M> IPsec "policy" match support
<M> Multiple port match support
<M> "physdev" match support
<M> "pkttype" packet type match support
<M> "quota" match support
<M> "realm" match support
<M> "sctp" protocol match support (EXPERIMENTAL)
<M> "state" match support
<M> "layer7" match support[*] Layer 7 debugging output
<M> "statistic" match support
<M> "string" match support
<M> "tcpmss" match support
<M> "time" match support
<M> "u32" match support
<M> "hashlimit" match support
IP: Netfilter Configuration --->
<M> IPv4 connection tracking support (required for NAT)[*] proc/sysctl compatibility with old connection tracking (NEW
<M> IP Userspace queueing via NETLINK (OBSOLETE)
<M> IP tables support (required for filtering/masq/NAT)
<M> IP range match support
<M> TOS match support
<M> recent match support
<M> ECN match support
<M> AH match support
<M> TTL match support
<M> Owner match support
<M> address type match support
<M> Packet filtering
<M> REJECT target support
<M> LOG target support
<M> ULOG target support
<M> Full NAT (NEW)
<M> MASQUERADE target support
<M> REDIRECT target support
<M> NETMAP target support
<M> SAME target support (OBSOLETE)
<M> Basic SNMP-ALG support (EXPERIMENTAL)
<M> Packet mangling
<M> TOS target support

建议把Core Netfilter Configuration和IP: Netfilter Configuration的所有选项都选中。注意,刚开始时,我一直找不到:<M> "layer7" match support 和[*] Layer 7 debugging output 这两个模块,浪费了很多时间,后来发现是因为这两个模块是属于:<> Netfilter connection tracking support 这个模块,因此得先选择<M> Netfilter connection tracking support 这样下面才有Layer7及相关模块,在内核选项建议把你所有的网卡驱动选中[*],其中time模块就是可以通过iptables可以控制上网的时间等功能,就是时间控制的模块!

一步一步的"EXIT"后,会提示你是否保存刚才的选择更改结果,我们选“YES”!

清除源码树并复原 kernel-package 参数
#make-kpkg clean

然后进行编译并生成.deb的包,以供安装时使用:
fakeroot make-kpkg --append_to_version -adm64 --initrd --revision=2.6.28.10 kernel_image modules_image
下面系统就可以编译内核了,这是一个漫长的过程,在我机器上用了一个小时才编译完成。


(图片7)

退回kernels目录:
cd ..
安装新的内核:
dpkg -i linux-image-2.6.28.10-adm64_2.6.28.10_amd64.deb

(图片8)

这时,会将新内核安装到相应的位置,同时会在/boot/grub/menu.lst增加新内核的条目

为iptables打补丁,并安装之
cd iptables-1.4.2
cp ../netfilter-layer7-v2.21/iptables-1.4.1.1-for-kernel-2.6.20forward/libxt_layer7.* extensions/
./configure --with-ksource=/usr/src/kernels/linux
make
make install
安装通讯定义档
cd /usr/src/kernels/l7-protocols-2009-05-10
make install

(图片9)
看执行的结果就知道,它在做什么了!

这样新的内核都弄好了,iptables也装好了,重启计算机:
shutdown -r now
启动完成后,用命令查看新内核与iptalbes是否安装成功:
uname -a;iptables -V
(图片10)

再测试layer7是否可用:
iptables -m layer7 --help
(图片11)

如果出现上面的信息就说明layer已经可以正常工具了。到这一步就算大功告成了。


附:阻挡qq.bt.msn通讯的命令
iptables -t mangle -I PREROUTING -m layer7 --l7proto msnmessenger -j DROP (禁止msn)
iptables -t mangle -I PREROUTING -m layer7 --l7proto bittorrent -j DROP (禁止bt)
iptables -t mangle -I PREROUTING -m layer7 --l7proto qq -j DROP (禁止QQ通讯)


在写作本文的过程中,参考了以下两篇文章,在这里向两位作者表示感谢。
http://blog.csdn.net/zubin006/archive/2008/08/03/2760600.aspx
http://ms.ntcb.edu.tw/~steven/article/kernel-layer7-filter.htm
上传的缩略图
       

       

   
 
 
 
 

补上图片~!
上传的缩略图
   

你可能感兴趣的:(64位)