sysctl 一个错误问题的解决
来源:互联网 发布:女生看见男生笑 知乎 编辑:程序博客网 时间:2024/05/22 05:57
笔者在RHEL6.3中执行sysctl -p的时候发现输出出现以下错误
- # sysctl -p
- net.ipv4.ip_forward = 0
- net.ipv4.conf.default.rp_filter = 1
- net.ipv4.conf.default.accept_source_route = 0
- kernel.sysrq = 0
- kernel.core_uses_pid = 1
- net.ipv4.tcp_syncookies = 1
- error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
- error: "net.bridge.bridge-nf-call-iptables" is an unknown key
- error: "net.bridge.bridge-nf-call-arptables" is an unknown key
- kernel.msgmnb = 65536
- kernel.msgmax = 65536
- kernel.shmmax = 68719476736
- kernel.shmall = 4294967296
经过Google大神点击打开链接后来找到的了原因所在,原来以下3个参数依赖于bridge模块,该模块如果没有加载则会现上面的输出错误
- error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
- error: "net.bridge.bridge-nf-call-iptables" is an unknown key
- error: "net.bridge.bridge-nf-call-arptables" is an unknown key
加载模块测试,发现问题解决
- # modprobe bridge
- # sysctl -p
- net.ipv4.ip_forward = 0
- net.ipv4.conf.default.rp_filter = 1
- net.ipv4.conf.default.accept_source_route = 0
- kernel.sysrq = 0
- kernel.core_uses_pid = 1
- net.ipv4.tcp_syncookies = 1
- net.bridge.bridge-nf-call-ip6tables = 0
- net.bridge.bridge-nf-call-iptables = 0
- net.bridge.bridge-nf-call-arptables = 0
- kernel.msgmnb = 65536
- kernel.msgmax = 65536
- kernel.shmmax = 68719476736
- kernel.shmall = 4294967296
有人可能会好奇这三个值得意义所在,我在红帽官网找到了相关说明点击打开链接
以下大致的意思主要说使用以上3个选项阻止桥接流量获得通过主机iptables规则,Netfilter是默认情况下启用了桥梁,如果不阻止会导致严重的混乱
netfilter is currently enabled on bridges by default. This means, for example, that IP packets that are forwarded across the bridge are filtered by the iptables FORWARD rules.In practice, this can lead to serious confusion where someone creates a bridge and finds that some traffic isn't being forwarded across the bridge. Because it's so unexpected that IP firewall rules apply to frames on a bridge, it can take quite some time to figure out what's going on.The libvirt wiki has this advice: http://wiki.libvirt.org/page/Networking#Fedora.2FRHEL_Bridging The final step is to configure iptables to allow all traffic to be forwarded across the bridge # echo "-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT" > \ /etc/sysconfig/iptables-forward-bridged # lokkit --custom-rules=ipv4:filter:/etc/sysconfig/iptables-forward-bridged # service libvirtd reload Alternatively, you can prevent bridged traffic getting pushed through the host's iptables rules. In /etc/sysctl.conf add # cat >> /etc/sysctl.conf <<EOF net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0 EOF # sysctl -p /etc/sysctl.confIt sucks that people have to do this, especially since it's a very rare user who would be using iptables on a bridge for something useful.I posted a patch to netdev which would have allowed us to disable it by default in our kernel builds: http://patchwork.ozlabs.org/patch/29319/The conclusion seems to be an agreement that distros should disable this, but using sysctl.conf insteadIn the thread Herbert describes a security issue with the current default: I still think the risk with bridging is higher, especially in the presence of virtualisation. Consider the scenario where you have to VMs on the one host, each with a dedicated bridge with the intention that neither should know anything about the other's traffic. With conntrack running as part of bridging, the traffic can now cross over which is a serious security hole.and goes on to say: FWIW I don't really care what we have as the default for bridge netfilter. I just want to make sure that people who do have bridge netfilter (and in particular, conntrack + bridge) active on their machines are aware of the security implications. Otherwise we'd be negligent. As you said distros can change the default regardless of what the kernel does.In summary, I think we should add the following to sysctl.conf: net.bridge.bridge-nf-call-ip6tables = 0 net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0
转载地址: http://blog.csdn.net/kumu_linux/article/details/8591819
- sysctl 一个错误问题的解决
- 关于RHEL6.3 sysctl 一个错误问题的解决
- 关于CentOs sysctl -p 一个错误问题的解决
- sysctl -p net.bridge.bridge-nf-call-ip6tables" is an unknown key 问题的解决。。
- 解决一个错误封禁的问题的过程和思路
- 执行sysctl -p时报net.bridge.bridge-nf-call-ip6tables is an unknown key错误的解决
- VS2005一个错误的解决
- Nhibernate一个错误的解决
- 一个lighthttpd 错误的解决
- 一个连接错误的解决
- 数据库连接错误问题的解决
- 解决错误界面的问题
- 解决pom错误的问题
- 一个优化的很不错的sysctl.conf配置分享
- 一个奇怪的tomcat错误的解决
- freemarker下的一个错误的解决
- 一个算法问题的解决
- 一个小问题的解决
- 2013年2月22日VC++学习笔记
- SSH Secure Shell Client显示乱码解决方法
- 匈牙利命名法和类型系统
- MFC编程AfxBeginThread与CreateThread使用对比
- Eclipse Console 加大显示的行数,禁止弹出
- sysctl 一个错误问题的解决
- jQuery验证控件jquery.validate.js使用说明+中文API
- CAS 资料
- 网购火车票反思:搜索该提供啥保障?
- 程序崩溃,但暂停的位置不在错误发生的行的解决方法
- Linux下的XAMPP基本配置技巧(设置虚拟主机、添加FTP账户等)
- 有关TCP和UDP 粘包 消息保护边界
- UltraEdit绝佳的替代品:Notepad++ 加 MadEdit
- 云热点产品及服务用户使用手册