3. 網路配置檔案
3.1 /etc/hosts
#/etc/hosts
#檔案格式: IPaddress hostname aliases
#檔案功能: 提供主機名到IP地址的對應關係，建議將自己經常使用的主機
# 加入此檔案中，也可將沒有DNS記錄的機器加入到此檔案中，
# 這樣會方便網路應用
127.0.0.1 localhost localhost.localdomain
202.118.66.81 helius.dlut.edu.cn helius

3.2 /etc/resolv.conf
檔案功能：DNS客戶機配置檔案，設定DNS伺服器的IP地址及DNS域名
相關檔案：/etc/host.conf
檔案格式：
domainname 域名
search 域名
nameserver Primary_DNS_Server_IP_address
nameserver Second_DNS_Server_IP_address
其中domainname和search可同時存在，也可只有一個；nameserver可指定多個

示例檔案內容：
search dlut.edu.cn
nameserver 202.118.66.6

3.3 /etc/host.conf
功能：指定主機名查詢方法，通常指先查詢檔案/etc/hosts,找不到時再向DNS伺服器請求。
對於大多數使用者不用改動此檔案內容。

Linux: /etc/host.conf檔案內容
order hosts, bind
multi on
Soalris: /etc/nsswitch.conf 中的hosts項
hosts files, dns
3.4 /etc/HOSTNAME ( Linux Redhat 5.x Distribution)
功能：設定主機名，不同LINUX之間可能有所差別，請使用
egrep hostname /etc/rc.d/init.d/*
或
egrep hostname /etc/init.d/*
查詢相應版本上的主機名設定檔案及方法。

Linux Redhat 5.x對應檔案: /etc/sysconfig/network的HOSTNAME項。

3.5 /etc/inetd.conf

Internet 超級伺服器, 相關程式: /usr/sbin/inetd
相應服務:
telnet
ftp
pop3
r* rsh rcp rlogin (建議最好關閉r服務)
其他服務最好關掉

#
# inetd.conf This file describes the services that will be available
# through the INETD TCP/IP super server. To re-configure
# the running INETD process, edit this file, then send the
# INETD process a SIGHUP signal.
#
# Version: @(#)/etc/inetd.conf 3.10 05/27/93
#
# Authors: Original taken from BSD UNIX 4.3/TAHOE.
# Fred N. van Kempen, 
#
# Modified for Debian Linux by Ian A. Murdock 
#
# Modified for RHS Linux by Marc Ewing 
#
# 
#
# Echo, discard, daytime, and chargen are used primarily for testing.
#
# To re-read this file after changes, just do a 'killall -HUP inetd'
#
#echo stream tcp nowait root internal
#echo dgram udp wait root internal
#discard stream tcp nowait root internal
#discard dgram udp wait root internal
#daytime stream tcp nowait root internal
#daytime dgram udp wait root internal
#chargen stream tcp nowait root internal
#chargen dgram udp wait root internal
#
# These are standard services.
#
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a
telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
gopher stream tcp nowait root /usr/sbin/tcpd gn

# do not uncomment smtp unless you *really* know what you are doing.
# smtp is handled by the sendmail daemon now, not smtpd. It does NOT
# run from here, it is started at boot time from /etc/rc.d/rc#.d.
#smtp stream tcp nowait root /usr/bin/smtpd smtpd
#nntp stream tcp nowait root /usr/sbin/tcpd in.nntpd
#
# Shell, login, exec and talk are BSD protocols.
#
shell stream tcp nowait root /usr/sbin/tcpd in.rshd
login stream tcp nowait root /usr/sbin/tcpd in.rlogind
#exec stream tcp nowait root /usr/sbin/tcpd in.rexecd
talk dgram udp wait root /usr/sbin/tcpd in.talkd
ntalk dgram udp wait root /usr/sbin/tcpd in.ntalkd
#dtalk stream tcp waut nobody /usr/sbin/tcpd in.dtalkd
#
# Pop and imap mail services et al
#
pop-2 stream tcp nowait root /usr/sbin/tcpd ipop2d
pop-3 stream tcp nowait root /usr/sbin/tcpd ipop3d
imap stream tcp nowait root /usr/sbin/tcpd imapd
#
# The Internet UUCP service.
#
#uucp stream tcp nowait uucp /usr/sbin/tcpd /usr/lib/uucp/uucico -l
#
# Tftp service is provided primarily for booting. Most sites
# run this only on machines acting as "boot servers." Do not uncomment
# this unless you *need* it. 
#
#tftp dgram udp wait root /usr/sbin/tcpd in.tftpd
#bootps dgram udp wait root /usr/sbin/tcpd bootpd
#
# Finger, systat and netstat give out user information which may be
# valuable to potential "system crackers." Many sites choose to disable 
# some or all of these services to improve security.
#
# cfinger is for GNU finger, which is currently not in use in RHS Linux
#
finger stream tcp nowait root /usr/sbin/tcpd in.fingerd
#cfinger stream tcp nowait root /usr/sbin/tcpd in.cfingerd
#systat stream tcp nowait guest /usr/sbin/tcpd /bin/ps -auwwx
#netstat stream tcp nowait guest /usr/sbin/tcpd /bin/netstat -f inet
#
# Time service is used for clock syncronization.
#
time stream tcp nowait nobody /usr/sbin/tcpd in.timed
time dgram udp wait nobody /usr/sbin/tcpd in.timed
#
# Authentication
#
auth stream tcp nowait nobody /usr/sbin/in.identd in.identd -l -e -o
#
# End of inetd.conf

linuxconf stream tcp wait root /bin/linuxconf linuxconf --http




3.6 inetd.conf相關檔案/etc/services(SYSV/BSD/LINUX相同)
基本不用編輯,linux自帶的已包含大部分服務, Solaris 可能需要增加(POP3),
參考相應的伺服器安裝說明，在此檔案中列出了所有可用的網路服務。

#
# services This file describes the various services that are
# available from the TCP/IP subsystem. It should be
# consulted instead of using the numbers in the ARPA
# include files, or, worse, just guessing them.
#
# Version: @(#)/etc/services 2.00 04/30/93
#
# Author: Fred N. van Kempen, 
#
# 檔案格式：服務名稱 埠號/協議 服務別名
tcpmux 1/tcp # rfc-1078
echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
netstat 15/tcp
qotd 17/tcp quote
chargen 19/tcp ttytst source
chargen 19/udp ttytst source
ftp-data 20/tcp
ftp 21/tcp
telnet 23/tcp
smtp 25/tcp mail
time 37/tcp timserver
time 37/udp timserver
rlp 39/udp resource # resource location
name 42/udp nameserver
whois 43/tcp nicname # usually to sri-nic
domain 53/tcp
domain 53/udp
mtp 57/tcp # deprecated
bootps 67/udp # bootp server
bootpc 68/udp # bootp client
tftp 69/udp
gopher 70/tcp # gopher server
rje 77/tcp
finger 79/tcp
http 80/tcp # www is used by some broken 
www 80/tcp # progs, http is more correct
link 87/tcp ttylink
kerberos 88/udp kdc # Kerberos authentication--udp
kerberos 88/tcp kdc # Kerberos authentication--tcp
supdup 95/tcp # BSD supdupd(8)
hostnames 101/tcp hostname # usually to sri-nic
iso-tsap 102/tcp
x400 103/tcp # ISO Mail
x400-snd 104/tcp
csnet-ns 105/tcp
pop-2 109/tcp # PostOffice V.2
pop-3 110/tcp # PostOffice V.3
pop 110/tcp # PostOffice V.3
sunrpc 111/tcp
sunrpc 111/tcp portmapper # RPC 4.0 portmapper UDP
sunrpc 111/udp
sunrpc 111/udp portmapper # RPC 4.0 portmapper TCP
auth 113/tcp ident # User Verification
sftp 115/tcp
uucp-path 117/tcp
nntp 119/tcp usenet # Network News Transfer
ntp 123/tcp # Network Time Protocol
ntp 123/udp # Network Time Protocol
netbios-ns 137/tcp nbns
netbios-ns 137/udp nbns
netbios-dgm 138/tcp nbdgm
netbios-dgm 138/udp nbdgm
netbios-ssn 139/tcp nbssn
imap 143/tcp # imap network mail protocol
NeWS 144/tcp news # Window System
snmp 161/udp
snmp-trap 162/udp
exec 512/tcp # BSD rexecd(8)
biff 512/udp comsat
login 513/tcp # BSD rlogind(8)
who 513/udp whod # BSD rwhod(8)
shell 514/tcp cmd # BSD rshd(8)
syslog 514/udp # BSD syslogd(8)
printer 515/tcp spooler # BSD lpd(8)
talk 517/udp # BSD talkd(8)
ntalk 518/udp # SunOS talkd(8)
efs 520/tcp # for LucasFilm
route 520/udp router routed # 521/udp too
timed 525/udp timeserver
tempo 526/tcp newdate
courier 530/tcp rpc # experimental
conference 531/tcp chat
netnews 532/tcp readnews
netwall 533/udp # -for emergency broadcasts
uucp 540/tcp uucpd # BSD uucpd(8) UUCP service
klogin 543/tcp # Kerberos authenticated rlogin
kshell 544/tcp cmd # and remote shell
new-rwho 550/udp new-who # experimental
remotefs 556/tcp rfs_server rfs # Brunhoff remote filesystem
rmonitor 560/udp rmonitord # experimental
monitor 561/udp # experimental
pcserver 600/tcp # ECD Integrated PC board srvr
mount 635/udp # NFS Mount Service
pcnfs 640/udp # PC-NFS DOS Authentication
bwnfs 650/udp # BW-NFS DOS Authentication
kerberos-adm 749/tcp # Kerberos 5 admin/changepw
kerberos-adm 749/udp # Kerberos 5 admin/changepw
kerberos-sec 750/udp # Kerberos authentication--udp
kerberos-sec 750/tcp # Kerberos authentication--tcp
kerberos_master 751/udp # Kerberos authentication
kerberos_master 751/tcp # Kerberos authentication
krb5_prop 754/tcp # Kerberos slave propagation
listen 1025/tcp listener RFS remote_file_sharing
nterm 1026/tcp remote_login network_terminal
kpop 1109/tcp # Pop with Kerberos
ingreslock 1524/tcp
tnet 1600/tcp # transputer net daemon
cfinger 2003/tcp # GNU finger
nfs 2049/udp # NFS File Service
eklogin 2105/tcp # Kerberos encrypted rlogin
krb524 4444/tcp # Kerberos 5 to 4 ticket xlator
irc 6667/tcp # Internet Relay Chat
dos 7000/tcp msdos

# End of services.
linuxconf 98/tcp # added by linuxconf RPM

3.7 /etc/hosts.allow /etc/hosts.deny (Linux下,或使用了tcpd, 參考inetd.conf)

/etc/hosts.allow 設定允許使用inetd服務的機器，如: All:202.118即允許所有來自
202.118.x.x的請求
/etc/hosts.deny 設定不允許使用inetd的機器

這兩個檔案的設定順序請參考線上文件：
man tcpd
man hosts.allow
man hosts.deny

Internet 網路服務訪問控制檔案,

對於安全性要求較高的伺服器建議採用xinetd替代inetd,
xinetd debian自帶,其他的可以用原始碼進行編譯安裝

3.8 /etc/networks /etc/netmasks

列出路由所需要的網路地址,相關命令/usr/sbin/route，當然也可以不使用這兩個
檔案，在維護路由表時可直接使用IP地址及網路遮蔽位。

Example:
/etc/networks
dlrin 202.199.128.0
/etc/netmasks
202.199.128.0 255.255.240.0
加入靜態路由表項:


+---------------+ DDN
| Cisco 2511 +<-------------->DLMU 202.118.64.0/255.255.255.0
| +<-------------->DLNA 210.47.192.0/255.255.240.0
+-------+-------+
| 202.118.66.254
| 202.118.66.16
+-------+-------+ +-------------+ +-----------+
| Switch/HUB +-------+網路中心 +-----+ LAN Router+
+-------+-------+ +-------------+ +------+----+
| |
|
| 202.118.68.0/255.255.252.0
| +--------------+
+--------------+ 202.118.66.81+ (測試機器)
| +--------------+
|
|
| 202.118.66.1(Default Router)
+-------+-------+
| 路由器 +
+-------+-------+
|202.112.30.65/255.255.255.252
| DDN 
| PPP
|
|202.112.30.66/255.255.255.252
Cernet/Internet



(1) 202.118.66.81(Helius) <-> 202.118.66.18 (peony)

202.118.066.081
255.255.255.0 And
-------------------
202.118.066.0 網路地址 在同一個ip網路段

IP Address <-> MAC(Media Access Address)
202.118.66.18 08:00:20:96:01:6A 
202.118.66.81 00:80:C8:4C:6A:D0 
202.118.66.1 00:60:5C:F3:FF:75 

202.118.66.81 -> 202.118.66.18
乙太網的資料包:

08:00:20:96:01:6A + 00:80:C8:4C:6A:D0 + ip資料

(2) 202.118.66.81 -> 202.112.0.36
不在同一個ip段, 通過間接傳送(通過路由器).
[

[email protected] hbwork]$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
202.118.66.0 0.0.0.0 255.255.255.0 U 1500 0 0 eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 3584 0 0 lo
0.0.0.0 202.118.66.1 0.0.0.0 UG 1500 0 0 eth0 
^^^^^^^
Default Router


(3) 加入靜態路由
相關命令：/usr/sbin/route或 /sbin/route

linux下需要加入自己網路的路由表項
/sbin/route add -net 202.118.66.0 netmask 255.255.255.0 eth0

/sbin/route add -net 202.199.128.0 netmask 255.255.240.0 gw 202.118.66.254
Or:
/sbin/route add -net dlrin gw 202.118.66.254
Or:
/sbin/route add -net dlrin gw dlrin-gw
/sbin/route add default gw 202.118.66.1



9. /etc/passwd
使用者口令檔案
10. /etc/shadow (如果有此檔案,系統支援shadow機制)
$ls -l /etc/shadow
-rwx------ root .... /etc/shadow

11. /etc/fstab
File System Table

#裝置名 MountPoint Filesystem Type 載入選項 ... fsck標誌
/dev/hda1 / ext2 defaults 1 1
/dev/hda6 /home ext2 defaults 1 2
/dev/hda3 /usr ext2 defaults 1 2
/dev/hda5 /var ext2 defaults 1 2
/dev/hda2 swap swap defaults 0 0
/dev/fd0 /mnt/floppy auto sync,user,noauto,nosuid,nodev,unhide 0
0
/dev/cdrom /mnt/cdrom auto user,noauto,nosuid,nodev,ro 0 0
none /proc proc defaults 0 0 

Solairs下對應檔案: /etc/vfstab

12. /etc/exports

NFS(Network File System) Server 輸出檔案系統表, 最好不使用NFS. 

nfs相關程序: 
Solaris: mountd , nfsiod
/etc/init.d/nfs.server
Linux: 核心支援nfs, /proc/filesystem, 也可以通過載入modules實現,

13./etc/defaultrouter (Solaris 2.x)
內容為Default Router的ip地址,
在linux下:
Redhat 5.x: /etc/sysconfig/network
GATEWAY=202.118.66.1
GATEWAYDEV=eth0 
Debian: /etc/init.d/network
#! /bin/sh
ifconfig lo 127.0.0.1
route add -net 127.0.0.0
IPADDR=202.118.66.88
NETMASK=255.255.255.0
NETWORK=202.118.66.0
BROADCAST=202.118.66.255
GATEWAY=202.118.66.1
ifconfig eth0 $ netmask $ broadcast $
route add -net $
[ "$" ] && route add default gw $ metric 1 

14. /etc/bashrc /etc/csh.cshrc /etc/profile
/etc/bashrc BASH(Bourne Again Shell) RunTime Command 
Shell Script 用的最多

系統使用者預設的環境設定, PATH, umask, TERM Type
/etc/csh.cshrc CSH Runtime COmmand 


15. /etc/ftpaccess 
FTP訪問控制檔案, 檔案位置可變 , 通過
#egrep ftp /etc/inetd.conf
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a 
^^^^^^
ftp伺服器守護程序檔名
#which in.ftpd
/usr/sbin/in.ftpd
#strings /usr/sbin/in.ftpd |egrep ftpaccess
/etc/ftpaccess 

相關配置在ftp伺服器配置中講述。

16. /etc/ftpusers
不允許ftp的使用者列表,一般包括root, uucp, bin等

17. /etc/ftpconvions /etc/ftpgroups 
FTP伺服器配置檔案

18. /etc/group 使用者組檔案


19. /etc/sendmail.cf (Linux) Sendmail(EMAIL伺服器)配置檔案
/etc/sendmail.cw 本地主機名
主機名: gingko.dlut.edu.cn
希望接收:

[email protected]
[email protected]
[email protected]
/etdc/aliases 郵件別名檔案
/etc/aliases.db 郵件別名二進位制資料檔案, 用newaliases建立
/etc/sendmail.hf sendmail 幫助檔案, 
$telnet mailserver 25
Trying 202.118.66.8...
Connected to gingko.
Escape character is '^]'.
220 gingko.dlut.edu.cn ESMTP Sendmail 8.9.1/8.9.1; Tue, 2 Feb 1999 10:41:20 +080
0 (CST) 
HELP
214-This is Sendmail version 8.9.1
214-Topics:
214- HELO EHLO MAIL RCPT DATA
214- RSET NOOP QUIT HELP VRFY
214- EXPN VERB ETRN DSN
214-For more info use "HELP ".
214-To report bugs in the implementation send email to
214-

[email protected]
214-For local information send email to Postmaster at your site.
214 End of HELP info 

以上目錄結構是Linux的目錄結構, Solaris 2.x目錄結構是:
/etc/mail/sendmail.cf
/etc/mail/sendmail.cw
/etc/mail/sendmail.hf
/etc/mail/aliases
/etc/mail/aliases.db 

20. /etc/issue 系統進站提示資訊(主控臺用) 
/etc/issue.net telnet時顯示資訊( strings in.telnetd |egrep issue)
/etc/motd 使用者進入系統後的提示資訊

21. /etc/named.boot
DNS(BIND 4.9.x) 啟動檔案
示例檔案:(Caching Only Server)
directory /etc/namedb

primary 0.0.127.in-addr.arpa named.local
cache . root.cache

其中root.cache 檔案可通過dig得到:

dig @ns.internic.net . ns > /etc/namedb/root.cache

named.local檔案內容如下:

@ IN SOA localhost. root.localhost. (
1999020301
10800
3600
86400
86400 )

IN NS localhost.

1 IN PTR localhost.
/etc/named.conf
DNS(BIND 8.1.x) 啟動檔案
(在Redhat 5.2下可用/usr/doc/bind-8.1.2/named-bootconf.pl將bind 4.9.x
的named.boot檔案轉換為bind8的named.conf檔案格式, 執行過程如下:
/usr/doc/bind-8.1.2/named-bootconf.pl /etc/named.boot > /etc/named.conf)



22. /etc/host.equiv
$HOME/.rhosts
R*(rlogin, rsh , rcp, rexec)服務信任主機
格式:
主機名(FQDN) 使用者列表

23. /etc/ld.so.conf (LINUX)
動態連結庫檔案目錄列表, 相應命令ldconfig

$LD_LIBRARY_PATH Solaris 下相應的環境變數

用ldd 列出相應檔案所使用的動態連結庫
/etc/default[119]ldd /usr/ucb/ls
libc.so.1 => /usr/lib/libc.so.1
libdl.so.1 => /usr/lib/libdl.so.1 

*修改過此檔案之後請使用命令ldconfig重新生成目錄列表及連線庫檔案列表。

24. /etc/pam.d/login ( Linux Redhat)
auth required /lib/security/pam_securetty.so 
/etc/securetty (Linux Redhat, Debian)
root可登入的終端裝置列表, tty[1-8] 為主控臺上的裝置,
ttyp* (LINUX)遠端登入終端(TELNET)裝置

/etc/default/login (Solaris)
# If CONSOLE is set, root can only login on that device.
# Comment this line out to allow remote login by root.
#
CONSOLE=/dev/console 
註釋掉相應的記錄即可允許超級使用者root從遠端主機telnet登入


/etc/login.defs Linux Debian 登入控制檔案


25. Linux Loader /etc/lilo.conf
多重啟動檔案, 
**** 修改完此檔案後一定需要執行lilo, 
**** 重新編譯安裝新的linux kernel修改此檔案並執行lilo

26. /etc/syslog.conf 
syslogd configuration file, 

27. /etc/smb.conf
SAMBA 伺服器配置檔案,將linux的檔案系統與Windows 9x/NT共享
28. /etc/nologin
系統在要關機時不希望使用者登入進來，就產生此檔案，此檔案內容為顯示給使用者的有
關拒絕連線的資訊，使用者此時就不能進入系統。當系統重新啟動時如果有此檔案，則
機器啟動後任何使用者不能使用系統，此時可考慮從軟盤或光碟引導刪除此檔案，然後
再重新啟動系統。

29. /etc/security
設定那些終端可以讓root登入，一般情況下設定為只有console上的使用者可能用root.

注：Redhat下使用了PAM機制，相應的檔案為/etc/securetty. 

30. /etc/X11/*
XFree86配置檔案。

31. /etc/shells
使用者可以使用的shell列表，如果強行修改/etc/passwd檔案，也可以使用不在列表中
的shell程式，但對於shell不在此列表中的使用者將無法使用FTP連線本系統。

32. /etc/mtab
系統在啟動時建立的資訊檔案，內容為已經mount的檔案系統，此檔案內容是動態更
新的，參考/proc/mounts。