看到论坛里很多用户经常尝试各种安全软件产品，我感到虽然通过亲身体验来比较和选择适合自己的安全软件更加有针对性，但是难免比较耗时。由于诺顿的软件体积比较大，卸载也不是十分快捷，试用十分不便，因此从诺顿网络安全特警（Norton Internet Security，下文简称 NIS）的老用户角度出发写出这篇文章，希望能够帮助准备试用 NIS 的用户在安装前对 NIS 的产品特点和用户定位有一个大致的了解，更加有针对性的试用产品，降低测试产品的成本。
]]>
打10060，问，不安装有什么后果：
可能影响你的上网速度。
好，怎么下载
从www.qd.sd.cn 左上角下载
奥，找到了。可是，只有for windows的啊。我用的freebsd怎么办
。。。那你可以不用安装了
可是你不说不安装会影响速度么
你不安装没事。。不会影响速度的。。
]]>cd
wget http://www.aczoom.com/tools/blockhosts/BlockHosts-2.1.0.tar.gz
tar xvfz BlockHosts-2.1.0.tar.gz
cd cd BlockHosts-2.1.0
python setup.py install --force
nano /etc/blockhosts.cfg
修改
[...]
HOSTS_BLOCKFILE = "/etc/hosts.allow"
[...]
HOST_BLOCKLINE = ["ALL: ", " : deny"]
[...]
LOGFILES = [ "/var/log/auth.log", "/var/log/proftpd/proftpd.log", ]
[...]
COUNT_THRESHOLD = 3
[...]
AGE_THRESHOLD = 12
[...]
MAIL = True
[...]
NOTIFY_ADDRESS = 'root@localhost.localdomain'
[...]
SMTP_SERVER = "localhost"
SENDER_ADDRESS = 'BlockHosts <blockhosts-do-not-reply@localhost.localdomain>'
[...]
IPBLOCK = "iptables" [...]
In HOSTS_BLOCKFILE we can specify either /etc/hosts.allow or /etc/hosts.deny. It doesn't matter which one we choose. I'm using /etc/hosts.allow here. In the LOGFILES line we specify the log files that BlockHosts should look at. OpenSSH is logging failed login attempts to /var/log/auth.log, ProFTPd to /var/log/proftpd/proftpd.log. COUNT_THRESHOLD specifies the number of failed login attempts from the same host after which BlockHosts should block that host. AGE_THRESHOLD is the numer of hours after which blocked hosts get unblocked. IPBLOCK specifies if you'd like to block hosts with iptables or iproute in addition to adding these hosts to /etc/hosts.allow (or /etc/hosts.deny).
Next we must modify /etc/hosts.allow. First back up your current /etc/hosts.allow:
]]>cp /etc/hosts.allow /etc/hosts.allow_bak
nano /etc/hosts.allow
# hosts.allow This file describes the names of the hosts which are
# allowed to use the local INET services, as decided
# by the '/usr/sbin/tcpd' server.
#
# ----
# see "man 5 hosts_access" for details of the format of IP addresses,
#services, allow/deny options. Also see "man hosts_options"
#
# permanent whitelist addresses - this should always be allowed access
ALL: 127.0.0.1 : allow
# ALL: 192.168.0. : allow
# permanent blacklist addresses - this should always be denied access
# ALL: 10. : deny
# ----------------------------------------
# next section is the blockhosts section - it will add/delete entries in
# between the two marker lines (#---- BlockHosts Additions)
#---- BlockHosts Additions
#---- BlockHosts Additions
# ----------------------------------------
# finally, the command to execute the blockhosts script, based on
# connection to particular service or services:
sshd: ALL: spawn /usr/bin/blockhosts.py --verbose --mail --iptables \
--echo "%c-%s" --check-ip "%h" >> /var/log/blockhosts.log 2>&1 & \
: allow
#---
# add --iproute to enable null-routing, or add --iptables to enable packet
# filtering, which blocks all network communication from blocked hosts
#---
# remove >> /var/log/blockhosts.log 2>&1 if no logging to blockhosts.log
# is needed - without this, it will still log to syslog (minimally)
#sshd: ALL: spawn /usr/bin/blockhosts.py --verbose --echo "%c-%s" & : allow
#---
# above commands will use default config file - /etc/blockhosts.cfg, edit
# it as needed to specify local configuration options
# See "man hosts.allow" for info on %c and %s identifiers
# for non-verbose, with identification, to syslog only (/var/log/messages),
# triggered on any service (using ALL as first word):
#ALL: ALL: spawn /usr/bin/blockhosts.py --echo "%c-%s" & : allow
#----
# To test hosts.allow, and to find out exact names of SSH/FTP services,
# add this line to the beginning of hosts.allow, use ssh/ftp to connect
# to your server, and then look at the log (/var/log/messages or
# blockhosts.log) to see the name of the invoked service.
# IMPORTANT: after your test is done, remove this line from hosts.allow!
# Otherwise everyone will always have access.
#ALL : ALL: spawn (/usr/bin/blockhosts.py --verbose --echo "%c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow
# -------------------------------------------------------------------------
The most important part is this one:
sshd: ALL: spawn /usr/bin/blockhosts.py --verbose --mail --iptables \
--echo "%c-%s" --check-ip "%h" >> /var/log/blockhosts.log 2>&1 & \
: allow
Now whenever someone tries to log in using SSH, /usr/bin/blockhosts.py is started, checks the log files that we specified in /etc/blockhosts.cfg, and blocks all hosts with more than COUNT_THRESHOLD failed login attempts by adding them to /etc/hosts.allow and by using iptables (which will totally block these hosts from accessing your system). All actions will be logged to /var/log/blockhosts.log.
Now we need to initialize BlockHosts. First, we do this with the --dry-run option to see if there are no errors:
blockhosts.py --dry-run --verbose
The output could look like this:
server2:/var/log# blockhosts.py --dry-run --verbose
blockhosts 2.0.5 started: 2007-09-05 16:31:10 CEST
... load blockfile: /etc/hosts.allow
... found both markers, count of hosts being watched: 0
no logoffsets found, will read from beginning in logfile: /var/log/auth.log
... loading log file, offset: /var/log/auth.log 0
no logoffsets found, will read from beginning in logfile: /var/log/proftpd/proftpd.log
... loading log file, offset: /var/log/proftpd/proftpd.log 0
... will discard all host entries older than 2007-09-05 04:31:10 CEST
... updates: counts: hosts to block: 0; hosts being watched: 0
#---- BlockHosts Additions
#bh: logfile: /var/log/auth.log
#bh: offset: 2643
#bh: first line:Jun 28 20:35:51 server2 login[2087]: (pam_unix) session opened for user root by (uid=0)#bh: logfile: /var/log/proftpd/proftpd.log
#bh: offset: 1308
#bh: first line:Sep 05 16:04:34 server2.example.com proftpd[2355] server2.example.com: error setting IPV6_V6ONLY: Protocol not available#---- BlockHosts Additions
# ----------------------------------------
# finally, the command to execute the blockhosts script, based on
# connection to particular service or services:sshd, proftpd, vsftpd: ALL: spawn /usr/bin/blockhosts.py --verbose --mail \
--echo "%c-%s" --check-ip "%h" >> /var/log/blockhosts.log 2>&1 & \
: allow#---
# add --iproute to enable null-routing, or add --iptables to enable packet
# filtering, which blocks all network communication from blocked hosts
#---
# remove >> /var/log/blockhosts.log 2>&1 if no logging to blockhosts.log
# is needed - without this, it will still log to syslog (minimally)
#sshd: ALL: spawn /usr/bin/blockhosts.py --verbose --echo "%c-%s" & : allow
#---
# above commands will use default config file - /etc/blockhosts.cfg, edit
# it as needed to specify local configuration options# See "man hosts.allow" for info on %c and %s identifiers
# for non-verbose, with identification, to syslog only (/var/log/messages),
# triggered on any service (using ALL as first word):
#ALL: ALL: spawn /usr/bin/blockhosts.py --echo "%c-%s" & : allow
#----
# To test hosts.allow, and to find out exact names of SSH/FTP services,
# add this line to the beginning of hosts.allow, use ssh/ftp to connect
# to your server, and then look at the log (/var/log/messages or
# blockhosts.log) to see the name of the invoked service.
# IMPORTANT: after your test is done, remove this line from hosts.allow!
# Otherwise everyone will always have access.
#ALL : ALL: spawn (/usr/bin/blockhosts.py --verbose --echo "%c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow# -------------------------------------------------------------------------
Commands (tentative) to run for ip null-route blocking:
... no email to send.
server2:/var/log#
Looks ok (apart from the IPv6 error which you can ignore), so we can run it without the --dry-run option:
blockhosts.py --verbose
This should look like this:
server2:/var/log# blockhosts.py --verbose
blockhosts 2.0.5 started: 2007-09-05 16:33:24 CEST
... load blockfile: /etc/hosts.allow
... found both markers, count of hosts being watched: 0
... loading log file, offset: /var/log/auth.log 2643
... loading log file, offset: /var/log/proftpd/proftpd.log 1308
... will discard all host entries older than 2007-09-05 04:33:24 CEST
... updates: counts: hosts to block: 0; hosts being watched: 0
... created user-defined chain blockhosts
... creating jump from INPUT to blockhosts chain
... no email to send.
server2:/var/log#
BlockHosts is now ready to check for failed SSH logins, but not for failed ProFTPd logins because Debian's ProFTPd doesn't check /etc/hosts.allow and /etc/hosts.deny, which means BlockHosts isn't invoked when someone tries to log in to ProFTPd (of course, if someone has COUNT_THRESHOLD or more failed log in attempts on ProFTPD and then tries to log in to OpenSSH, he will be blocked, because OpenSSH uses /etc/hosts.allow which then invokes BlockHosts which finds the failed login attempts to ProFTPd; but if someone tries to log in to ProFTPd only, there's no way to catch him with the current setup). To block non-TCP_WRAPPERS services, we will create a cron job that starts BlockHosts every five minutes (for example).
To block hosts from non-TCP_WRAPPERS services such as Debian's ProFTPd, you can run
blockhosts.py --iptables --verbose
on the command line. Of course, you don't want to do this every few minutes, therefore we create a cron job for this.
First we create a little wrapper script for /usr/bin/blockhosts.py:
vi /usr/local/sbin/blockhosts
#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
The purpose of this wrapper script is to pass the correct PATH to the /usr/bin/blockhosts.py script; if we use /usr/bin/blockhosts.py directly in the cron job, we will get errors saying that iptables could not be found.
Of course, we must make /usr/local/sbin/blockhosts executable:
chmod 700 /usr/local/sbin/blockhosts
Then, we create a cron job like this:
crontab -e
]]>*/5 * * * * /usr/local/sbin/blockhosts &> /dev/null
The remote host decided to shrink the TCP window size without negotiating such with your Linux box. The message is of the informational level, meaning Linux doesn't like what it is seeing but will cope with it and carry on.
大致意思是说:这是一段一般性提示信息,说明远程主机在未经Linux主机"同意"就收缩了TCP window size,虽然Linux主机不喜欢这类举动,但是仍将继续处理这类请求.
这是一种解释,也就是这类信息可能并非危险.
另外一段解释来自Debian的邮件列表,首先回复者引用了一段源代码说明错误的来源:
>>From /usr/src/linux/net/ipv4/tcp_timer.c:
if (tp->snd_wnd == 0 && !sk->dead &&
!((1<<sk->state)&(TCPF_SYN_SENT|TCPF_SYN_RECV))) {
/* Receiver dastardly shrinks window. Our retransmits
* become zero probes, but we should not timeout this
* connection. If the socket is an orphan, time it out,
* we cannot allow such beasts to hang infinitely.
*/
#ifdef TCP_DEBUG
if (net_ratelimit())
printk(KERN_DEBUG "TCP: Treason uncloaked! Peer
%u.%u.%u.%u:%u/%u shrinks window %u:%u. Repaired.\n",
NIPQUAD(sk->daddr), htons(sk->dport), sk->num,
tp->snd_una, tp->snd_nxt);
#endif
具体的解释是:
So it appears that someone is running some sort of "tar-pit" system that is
designed to keep sockets in a bad state and run you out of kernel memory.I suspect that this ties in with the spam blocking things we recently
discussed. Maybe you should tell your ISP that they are to blame for such
actions being done to you and that they should "give you face" (I think that
was the term you used) by closing their open relays.
作者认为这可能和tar-pit攻击相关.并且建议联系ISP提供解决方案.
还有如下的解释:
The reason Linux is printing such messages is because your client guy is shrinking the TCP Window to 0, and the server has something to retransmit. There is something seriously wrong with your client's stack. Which Stack/OS are you using on he client side, and which browser?
That could explain your browser showing some html tags as the server fails to send the whole page across and based on what browser you are using it is failing to parse it out.
意思是,这类错误也可能是客户端Stack错误引起的.
另一段同样引用了源代码的解释似乎直指了问题的本质:
> Treason uncloaked! Peer [IP address]:515/1022 shrinks window
> 3957222360:3957222379. Repaired.
> Our researches so far indicate the problem may be a buggy TCP stack
> in the client, that is in the DP301P+. But we still do not know
> exactly what caused the problem, nor how to prevent it happening
> again.
That comes from the kernel tcp code below. Looks like the DLink has
returned information yielding a transmit window smaller than it
previously did; specifically it returned a window of zero plus an ack
of up to byte 3957222360, thus indicating that it can accept nothing
after that byte. Previously it had sent some ack+wnd values
indicating that it would accept up to byte 3957222379.
The Linux side is now supposed to send a packet every now and then
forever until the returned window is nonzero. It does.
However, the dlink is apparently not responding in a timely manner.
Any response would either open the window or update the rcv timestamp
such that the thing will retransmit forever. It may be responding
very slowly, or just not responding at all.
The kernel prints the message after it expected but did not see a
response to the probe packet it sent to check for a nonzero window.
The kernel implements exponential backoff retransmissions until it
hasn't seen any response in 2m, then it will bail and close the
connection. This is reasonable. It's unclear from your report if the
connections are failing outright or just sometimes having to
retransmit a probe against a peer that shrank the window.
这段解释极为详尽.就此作结.
九年义务教育三年制初级中学教科书---英语---第一册（上）》
1994年10月第2版，1996年1月第2次印刷
关于初中英语课本的误区，我一直觉得Miss Gao和Jim Green他爸有一腿，然后LiLei在第一次去Jim他家见到Jim的妹妹Kate Green的时候就心怀不轨```反正我一直特讨厌李雷，觉得此男猥琐虚伪的要命。还有Jim家貌似很有钱的样子，回英国过圣诞节做飞机，家里还有苹果树 ```对了又想起来一个证据，有一次他们好像学农去摘苹果，韩美美爬在梯子上，Jim就很紧张的在下面喊Be careful！
可是韩美美长了一副那种妇女干部的样子，我也不太喜欢。Lucy和Lily里面我比较喜欢Lily。总觉得lily比较单纯，不像lucy那么有心机。（事实证明是我比较有心机```初中英语课本能联想这么多```）
想起来还是很令人回味的。还记得有篇课文是问个老太太的年龄，她最后的那句话语音像妖精。
记得 偶当时汗死 她说的是 it is a secret
比较诡异的还有那个什么Uncle Wang，创造了一个什么可以飞的自行车，还有一个合成词叫什么来着？觉得他真是科学怪人。。。最最诡异的是有一个电话号码，6098724，是一个对话里面的，我一直记着，而且脱口就出。。。结果不幸在天涯看到竟然有人和我一样对这个号码念念不忘。。。
脱口而出的还有：How are you? Fine, thank you ,and you? I'm fine too. 我这个土人一直到现在见了人还老忍不住来这一套```觉得不这样简直没法外国人展开交流```印象比较深的还有李雷和jim玩飞盘那次，jim把李雷的头给砸了，当时觉得jim是成心这么做的，因为这个事情发生在借尺子事件没多久之后。
我无比惊喜的发现，竟然狂多人都跟我曾经有过共识，就是Jim喜欢Han Meimei，LiLei也喜欢Han Meimie，但是Lucy喜欢Lilei。我的证据就是有一课，我记得很清楚，“Can I borrow your ruler?”韩美美和李雷坐在第一排，韩美美问李雷借尺子，然后Jim在后面看着他们，眼神十分诡异，就是夹杂着嫉妒，羡慕阴险的目光```然后他旁边坐着Lucy，低着头，我当时觉得是因为Lucy不愿意看到面前的这一幕，因为是女生，不可能象Jim这么感情外露的```所以委屈的低下头```我当时还和我同桌讨论了半天。
Li Lei，Han Meimei，和Jim Green缠绵悱恻的爱情故事
这多少让80年代生人有无限的遐思，初中时代的美好回忆又如画卷般展现在了我的眼前。在回忆往昔的时候，我总是很惊叹人民教育出版社的叔叔阿姨们还有那位专到中国来编英语教材的Alexander先生，怎么会起了几个如此经典的名字，让几千万甚至上亿的中国学生反复传诵至今。
读初中时已然有了点朦胧的男女意识，从那时的观点看来，我就觉得英语课本讲述的就是一个缠绵悱恻的爱情故事：HanMeimei是一个美丽大方聪明漂亮的女孩子，而LiLei和Jim，一中一洋；一个帅气活泼，一个潇洒不羁；少女情怀，谁人可知，据我分析小Han是有可能对LiLei芳心暗许了，而另一方面Jim对韩MM又情根深重，无法自拔。
这是有实例为证的：当年韩MM课外劳动摘苹果，和树下的李帅哥眉来眼去有点得意忘形了，此时被冷落一边的Jim大叫一声：“Be careful！”由此，关爱之情可见一斑。而韩MM除了简单报以“Thank you”之外，居然又自得其乐地跟李帅哥开始了聊天……
事情的发展峰回路转，初一下学期，班上转来了两位可爱的加拿大双胞胎——Lucy和Lily，LiLei从此移情别恋，离开了韩MM。综观整个初一下学期，课本上的对话确实以LiLei和双胞胎为主角的居多。此时的韩MM，方才发现了在身边已然默默注视自己有一个学期之久的Jim，从此二人携手走向了幸福的未来```
感谢岁月，感谢生活，也感谢人的记忆，能让我们总记得一些美好的过去，忘掉当下的一些不快，并能走向幸福的未来（就像Han Meimei和Jim一样）```
Li Lei 和 Jim Green的故事
LiLei，被翻译成李雷，中国男孩，平头短发，喜穿浅色T恤，一看就是那种正统的中国式好学生。不过他并不是那种死板的书呆子，他很喜欢玩，记得有一课里，他拿着球去玩，反而是Jim没做完功课，被关在家里。这种动静结合的性格，使得他在哪儿都吃香，既能和LinTao这样好学的人成为莫逆，也能和 Jim这样好动的人成为死party。
Jim Green，全名是James Allen Green,被翻译成吉姆．格林（詹姆斯．艾伦．格林），在中国生活的英国孩子，一头棕色的卷发，喜欢穿深色的T恤，给人的印象是有活力、聪明，但是有些马虎，时常犯些小错误。
这一中一英两个男孩，就是这六本英文课本最主要的角色了。那么，他们中，谁是最大的男主角呢？我一直是比较欣赏Li Lei的（或许也是因为他是中国人？），和很多同学一样认为他是第一男主角。
后来，我做了一件极其无聊的事——统计了六本书里每个人出现的次数！
最终结果，Jim的出现次数略高于Li Lei。呵呵，这毕竟是英语课本，就承认Jim的第一男主角地位吧。
7+8：
统计的数据我现在没有，不过我还能记得最前面的那些孩子。最重要的七个同学组成了第一集团：
Jim Green
Li Lei
Han Meimei
Kate Green
Lucy King
Lily King
Ann Read
接下来的第二集团是八位同学：
Lin Tao
Wei Hua
Ling Feng
Sam
Bill
Bruce
Mary
Tom Read
说明一下，Tom的出镜率很低，但是出来的时候文章一般都比较长，何况他是Ann的兄弟，第一册第一张彩页上露脸的人，所以放第二集团不过份。
说一下第一册第一张彩页吧，我总觉得这有一种英雄排座次的作用。上面有四幅图，三幅是三个家族：Green家族（英国人）、King家族（美国人）、Read家族（加拿大人），每幅都是父母和两个孩子一共四人。第一幅图则是五人：Li Lei、Han Meimei和LinTao，外加老师Miss Gao（Gao Hui）和Uncle Wang。在这张彩页上，第一集团的七人全部在。
Green家族在书中风光无限，露脸机会最多，而且鸡犬升天，连鹦鹉Polly和小猫Mimi（这可是中国猫）都能频频上镜。
相比之下，Read家族就比较惨了，只有一个Ann撑场面，Tom身为彩页上九个孩子之一，在书中几乎消失，真是够郁闷的。
重要人物：
Han Meimei
如果说谁是第一男主角还存在争议的话，第一女主角就当仁不让的是Han Meimei。这个齐耳短发的中国女孩，文雅温和，智慧善良，几乎是所有女性美德的化身。在书中，她更像是一个姐姐的身份，帮助同学们排忧解难。
很多人都觉得，Li Lei和Han Meimei天生一对。然而我经过统计发现，其实HanMeimei和Jim一起出现的时候更多，尤其是后期。想想也是，排除国际友谊因素，Han Meimei和LiLei的性格是相似的，而跟Jim却是互补的，更适合在一起。
Kate
Kate Green，Jim的妹妹。和哥哥一样，Kate也是昵称，全称是Catherine（凯瑟琳）。同样是一头棕色卷发（不知怎么，Jim和Kate总让我想起哈里．波特中的罗恩和金妮，Han Meimei则让我想起赫敏）。
Kate很活泼可爱，后来戏份也越来越多。我奇怪为啥她不和同年龄的小朋友们玩，要和大几岁的哥哥的朋友们玩。
Lucy and Lily
可爱的双胞胎姐妹，来自美国。两个人长得一模一样（美工偷懒，哈）。开始的时候，两人都是同时出现，不过到后来，编者有意扩大她们之间的区别，也经常会单独出镜。
Ann
Ann是加拿大人，一头金色长发，标准的西方血统。她和Jim、Lilei他们不在一个班，但是和Han Meimei是好朋友，另外她还有一个中国好朋友Chen Hua（女孩）。
Ann在书中最重头的一次出场是她的生日，重要人物几乎全部出场参加。从此我知道了Fried Chicken，Fish and Chips这两种食物。不过当时没有概念，直到我们家乡出现了肯德鸡……
Lin Tao
作为在彩页上出现的人物，LinTao还是很重要的，不过不知为什么他在很长一段时间内都不出现，硬是被挤到了第二集团。作为书中唯一的眼镜男孩（大人不算），LinTao长着一副睿智的知识分子模样。不过，不要以为他很文弱，初三课本中，他可是参加了运动会接力跑的冠军成员。
Sam and Bill
这两个是Jim的死party，沾了不少光。他们三个在一起，1班的体育水平就能提高一个台阶啊。没说的，都是调皮鬼。
Wei Hua
Han Meimei的好朋友。我发现L、H、J、A四巨头都有各自的好朋友。Wei Hua又是一个热情贤淑型中国女孩，不过感觉不如Han Meimei成熟。
Ling Feng
跟其他中国孩子相比，Ling Feng显得比较成熟而独立。后期他出现的次数很多，但我最记得的还是他第一次出现时候被Jim的飞盘砸中了脑袋……
Bruce
澳大利亚男孩，因为在中国看到下雪的圣诞节而欣喜不已。之后他还有多次露面，最有趣的就是和一大群人去猴岛旅游了。
Mary
很晚才出来，又是一个西方式长发美人。我似乎记得她姓Smith。
其他人……
除了以上15人之外，还有一些让人记住的同学。比如MaLili，初一初二她都出现了，而且都是喊“起立”的那一个。看来，她就是1班里学号1号的学生了。还有Sun Huimin、Li Ming、LiuMing、Fang Xiaoling、Bob White……等等。
现在想起来，仿佛他们就是我们当初的同学一样……
记得最后一课（澳大利亚的那座大石头山）结束后，结束框里就简简单单一句话：Goodbye everyone，Goodluck！我学到这里不禁热泪盈眶……
]]>安装了win2008 chs版本，发现IIS的默认主页已经变成了这个：）
]]>