<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
<!--	¬ß	CVS ¹öÀü Ç¥½ÃºÎºÐ ½ÃÀÛ										-->
<!-- $Id: Authentication-Gateway-HOWTO.sgml,v 1.1 2002/02/13 17:22:07 kss Exp $ -->
<!--	¬ß	CVS ¹öÀü Ç¥½ÃºÎºÐ ³¡										-->
<article lang="ko">
<articleinfo>

  <title>Authentication Gateway HOWTO</title>

  <author lang="en">
     <firstname>Zorn</firstname>
     <surname>Nathan </surname>
     <affiliation>
        <address>
           <email>zornnh (at) musc.edu</email>
        </address>
     </affiliation>
  </author>
  <othercredit role="translator">
	<firstname>æÚÞÈ</firstname>
	<surname>ÐÝí­ </surname>
     <affiliation>
     		<address>
		 				<email>kenji (at) rtlinux.pe.kr</email>
		 		</address>
		</affiliation>
  </othercredit>
<!--	¬ß	°»½Å ³»¿ª		-->

		<revhistory>
				<revision>
				<revnumber>0.01-kr</revnumber>
				<date>2001-02-08</date>
				<authorinitials>kenji</authorinitials>
				<revremark>
						0.03À» ±â¹ÝÀ¸·Î ¹ø¿ª
				</revremark>
		</revision>
   <revision>
       <revnumber>0.03</revnumber>
       <date>2001-12-06</date>
       <authorinitials>nhz</authorinitials>
   </revision>
   
   <revision>
       <revnumber>0.02</revnumber>
       <date>2001-09-28</date>
       <authorinitials>KET</authorinitials>
   </revision>

   <revision>
         <revnumber>0.01</revnumber>
         <date>2001-09-06</date>
         <authorinitials>nhz</authorinitials>
   </revision>
   <!-- Additional (*earlier*) revision histories go here -->
   </revhistory>

  <abstract>
    <indexterm>
      <primary></primary>
    </indexterm>

    <para>
		¹«¼± ³×Æ®¿öÅ©¿Í °ø°øÀå¼Ò¿¡¼­ÀÇ Á¢¼Ó, ÀÌ¸¦ Å×¸é µµ¼­°üÀÌ³ª ±â¼÷»ç °°Àº °÷¿¡¼­ÀÇ
		º¸¾È¿¡ ´ëÇÑ ¸¹Àº °ü½ÉÀÌ ÀÖ¾ú´Ù. ÇöÀç±îÁö ±¸ÇöµÈ º¸¾È¹æ¹ýÀ¸·Î´Â ÀÌ¿¡ ´ëÇÑ
		°ü½É°ú ºÎÇÕµÇÁö ¾Ê´Â´Ù. ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ »ç¿ëÇÏ´Â ¹æ¹ýÀÌ Á¦¾ÈµÇ°ï
		Çß´Ù. ÀÎÁõ°ÔÀÌÆ®¿þÀÌ´Â, »ç¿ëÀÚ°¡ ³×Æ®¿öÅ©¸¦ »ç¿ëÇÏ°íÀÚÀÚ ÇÒ °æ¿ì °­Á¦·Î
		ÀÎÁõÀ» ¹Þ°Ô ÇÔÀ¸·Î½á º¸¾È¿¡ ´ëÇÑ °ü½ÉÀ» °íÁ¶½ÃÅ°°íÀÚ ÇÏ´Â °ÍÀÌ´Ù.
    </para>
  </abstract>

 </articleinfo>


<!-- Section1: intro -->

 <sect1 id="intro">
   <title>¼­·Ð</title>

   <indexterm>
    <primary>security!introduction</primary>
   </indexterm>

  
  <para>
  ¹«¼± ³×Æ®¿öÅ©³ª °ø°øÀå¼Ò¿¡¼­ÀÇ ³×Æ®¿öÅ© Á¢¼ÓÀÇ °æ¿ì, ºñÀÎ°¡ µÈ »ç¿ëÀÚ°¡ 
  ¸Å¿ì ½±°Ô ³×Æ®¿öÅ©¿¡ Á¢¼ÓÇÒ ¼ö ÀÖÀ¸¸ç, ºñÀÎ°¡ »ç¿ëÀÚ´Â ½ÅÈ£¸¦ °üÂûÇÏ°í ±×
  ½ÅÈ£·ÎºÎÅÍ Á¢¼ÓÁ¤º¸¸¦ °¡·Î Ã§ ¼ö ÀÖ´Ù.
  ºñÀÎ°¡ »ç¿ëÀÚµéÀº °ø¿ëÅÍ¹Ì³Î¿¡ ÀÚ½ÅµéÀÇ ¸Ó½ÅÀ» ¿¬°áÇÏ°í ³×Æ®¿öÅ© Á¢¼ÓÀ»
  È¹µæÇÒ ¼ö ÀÖ´Ù. º¸¾ÈÀº WEP°ú °°Àº °÷¿¡ Àû¿ëÀÌ µÇ¾úÁö¸¸, AirSnort °°Àº Åø·Î
  ¶Õ¸± ¼ö ÀÖ´Ù.
  ÀÌ·¯ÇÑ ¹®Á¦¸¦ ÇØ°áÇÏ´Â ¹æ¹ý Áß ÇÑ°¡Áö´Â ¹«¼± º¸¾ÈÀåÄ¡¿¡ ÀÇÁ¸ÇÏÁö ¸»°í,
  ¹«¼± ³×Æ®¿öÅ© ¶Ç´Â °ø¿ë Á¢¼ÓÀå¼ÒÀÇ ¼±´Ü¿¡ ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ ¼³Ä¡ÇÏ¿©
  »ç¿ëÀÚµéÀÌ ³×Æ®¿öÅ©¸¦ »ç¿ëÇÏ±â Àü¿¡ °­Á¦ÀûÀ¸·Î ÀÎÁõÀ» ¹Þµµ·Ï ÇÏ´Â °ÍÀÌ´Ù.
  º» HOWTO¿¡¼­´Â ¸®´ª½º¸¦ ÀÌ¿ëÇÏ¿© ÀÌ¿Í °°Àº ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ ¼³Á¤ÇÏ´Â ¹æ¹ýÀ»  
  ±â¼úÇÏ°íÀÚ ÇÑ´Ù.
  
  </para>

<!-- Section2: copyright -->

  <sect2 id="copyright">
   <title>ÀúÀÛ±Ç Á¤º¸</title>

   <para>
    º» ¹®¼­ÀÇ ÀúÀÛ±ÇÀº Nathan Zorn¿¡°Ô ÀÖ´Ù. Free Software Fecundation¿¡¼­
		¾ð±ÞÇÏ´Â GNU Free Documentation License ¹öÀü 1.1 È¤Àº ±× ÀÌ»óÀÇ Á¶°ÇÇÏ¿¡¼­
		º¹»ç, Àç¹èÆ÷ ¶Ç´Â ¼öÁ¤À» Çã¶ôÇÑ´Ù.
		¶óÀÌ¼±½º´Â http://www.gnu.org/copyleft/fdl.html¿¡¼­ ±¸ÇÒ ¼ö ÀÖ´Ù.
   </para>

   <para>
    Áú¹®ÀÌ ÀÖ´Â ºÐµéÀº 
    <email>zornnh@musc.edu</email>·Î ¿¬¶ôÇÏ±â ¹Ù¶õ´Ù.
   </para>
  </sect2>

<!-- Section2: disclaimer -->

  <sect2 id="disclaimer">
   <title>Ã¥ÀÓ ÇÑ°è</title>

   <para>
		ÇÊÀÚ´Â ÀÌ ¹®¼­ÀÇ ³»¿ë¿¡ ´ëÇÑ ±× ¾î¶°ÇÑ Ã¥ÀÓµµ ¹Þ¾ÆµéÀÏ ¼ö ¾ø½À´Ï´Ù.
		º» ¹®¼­ÀÇ °³³ä, ¿¹Á¦ ±×¸®°í ±âÅ¸ ³»¿ë¿¡ ´ëÇÑ »ç¿ëÀº ¸ðµÎ ¿©·¯ºÐÀÇ
		Ã¥ÀÓÀÔ´Ï´Ù.
		ÀÌ °ÍÀÌ º» ¹®¼­ÀÇ °¡Àå ÃÖ½ÅÆÇÀÌ¶óµµ, ¿À·ù³ª Æ²¸° Á¡ÀÌ ÀÖÀ» °ÍÀÌ°í, ±×·Î
		ÀÎÇØ ¿©·¯ºÐÀÇ ½Ã½ºÅÛÀÌ ¼Õ»óÀ» ¹ÞÀ» ¼öµµ ÀÖ½À´Ï´Ù.
		¾Õ¼­ÀÇ °æ°í¸¦ ¸í½ÉÇÏ°í ½ÅÁßÇÏ°Ô ÁøÇàÇÏ±â¸¦ ¹Ù¶ó¸ç, ±×´ÙÁö ¹Ù¶÷Á÷ÇÏÁö ¾ÊÁö¸¸, 
		ÇÊÀÚ´Â ±× °á°ú¿¡ ´ëÇÑ Ã¥ÀÓÀ» ÁöÁö ¾Ê½À´Ï´Ù.
   </para>

   <para>
    Æ¯º°ÇÑ ¸í½Ã°¡ ¾ø´Â ÇÑ, ¸ðµç ÀúÀÛ±ÇÀº °¢°¢ÀÇ ¼ÒÀ¯ÀÚ¿¡°Ô ±Í¼ÓµÈ´Ù.
		º» ¹®¼­¿¡¼­ »ç¿ëÇÑ ¿ë¾î´Â ¾î¶°ÇÑ Æ®·¹ÀÌµå¸¶Å©³ª ¼­ºñ½º¸¶Å©ÀÇ À¯È¿¼º¿¡
		¿µÇâÀ» ÁÖÁö ¾Ê´Â´Ù.
   </para>

   <para>
		Æ¯Á¤ Á¦Ç° ¶Ç´Â »óÇ¥¿¡ ´ëÇÑ ¾ð±ÞÀº ÇÏÁö ¾Ê¾Ò½À´Ï´Ù.
   </para>

   <para>
		ÀÏ»óÁÖ±â·Î Àü¸éÀûÀÎ ¼³Ä¡¿Í ¹é¾÷ÇÏ±â Àü¿¡ ¿©·¯ºÐ ½Ã½ºÅÛÀÇ ¹é¾÷À» ¹Þ¾Æ ³õ±â¸¦ °­·ÂÈ÷
		±ÇÀ¯ÇÕ´Ï´Ù.
   </para>
  </sect2>

<!-- Section2: newversions-->

  <sect2 id="newversions">
   <title>½Å ¹öÀü</title>

    <indexterm>
     <primary>(your index root)!news on</primary>
    </indexterm>

   <para>
    ÀÌ ¹®¼­´Â ÃÊ±â¹öÀüÀÌ´Ù.
   </para>

   <para>
    ÃÖ½Å ¹®¼­´Â <ulink
		url="http://www.itlab.musc.edu/~nathan/authentication_gateway/">http://www.itlab.musc.edu/~nathan/authentication_gateway/</ulink>¿¡
		ÀÖ´Ù.
		ÀÌ¿Í °ü·ÃµÈ HOWTO´Â <ulink url="http://www.linuxdoc.org/">Linux Documentation
    Project</ulink> È¨ÆäÀÌÁö¿¡µµ ÀÖ´Ù.
   </para>
   </sect2>
   
<!-- Section2: credits -->

  <sect2 id="credits">
   <title>Credits</title>
   <para>Jamin W. Collins</para>
   <para>Kristin E Thomas</para>
  </sect2>

   
<!-- Section2: feedback -->

  <sect2 id="feedback">
   <title>Feedback</title>

   <para>
		ÀÌ ¹®¼­¿¡ ÀÖ¾î¼­ °¡Àå È¯¿µ¹Þ´Â ºÎºÐÀÌ ¹Ù·Î ÇÇµå¹éÀÌ´Ù.
		¿©·¯ºÐµéÀÇ µµ¿òÀÌ ¾øÀÌ´Â ÀÌ ¹®¼­´Â Á¸ÀçÇÏÁöµµ ¸ø ÇÒ °ÍÀÌ´Ù.
		¿©·¯ºÐµéÀÇ Ãß°¡³»¿ë, ÀÇ°ß ¶Ç´Â ºñÆòÀ» ´ÙÀ½ email·Î º¸³»ÁÖ±â ¹Ù¶õ´Ù. :
    <email>zornnh@musc.edu</email>.
   </para>
   </sect2>

 </sect1>

<!-- Section1: intro: END -->


<!-- Section1: services  -->

 <sect1 id="services">
  <title>ÇÊ¿ä »çÇ×</title>

  <para>
  ÀÌ Àý¿¡¼­´Â ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¿¡ ÇÊ¿äÇÑ °ÍÀ» ¼³¸íÇÑ´Ù.
  </para>

    

  <sect2 id="netfilter">
   <title>Netfilter</title>

   
   <para>
   ÀÎÁõ°ÔÀÌÆ®¿þÀÌ´Â ¹æÈ­º®À» °ü¸®ÇÏ±â À§ÇØ Netfilter¿Í iptables¸¦ »ç¿ëÇÑ´Ù.
   <ulink
   url="http://netfilter.samba.org/unreliable-guides/packet-filtering-HOWTO/index.html">Netfilter
   HOWTO</ulink>¸¦ Âü°íÇÏ±â ¹Ù¶õ´Ù.
   </para>

   
  </sect2>



  <sect2 id="pamiptables">
   <title>PAM for Netfilter rules.</title>

   <para>
   Nathan ZornÀÌ ÀÛ¼ºÇÑ PAM(pluggable authentication module)Àº 
   <ulink
   url="http://www.itlab.musc.edu/~nathan/pam_iptables/">http://www.itlab.musc.edu/~nathan/pam_iptables</ulink>¿¡¼­
   ±¸ÇÒ  ¼ö ÀÖ´Ù.
   </para>

   
  </sect2>


  <sect2 id="dhcpd">
   <title>DHCP ¼­¹ö</title>

   <para>
		ÀÎÁõ°ÔÀÌÆ®¿þÀÌ´Â °ø¿ë ³×Æ®¿öÅ©¿¡ ´ëÇØ DHCP(dynamic host configuration
						protocol) ¼­¹ö·Î µ¿ÀÛÀ» ÇÏ°Ô µÇ¸ç, ÇÊÀÚ´Â 
    <ulink url="http://www.isc.org/products/DHCP/">ISC DHCP Server</ulink>¸¦
		»ç¿ëÇÑ´Ù. 
   </para>

   
  </sect2>

  <sect2 id="authentication">
    <title>ÀÎÁõ ¸ÞÄ¿´ÏÁò</title>

    <para>
		°ÔÀÌÆ®¿þÀÌ´Â ¾î¶°ÇÑ ¹æ¹ýÀÇ PAM ÀÎÁõÀÌ¶óµµ »ç¿ëÇÒ ¼ö ÀÖ´Ù.
		South Carolina ÀÇ°ú´ëÇÐ±³ÀÇ ÀÎÁõ ¸ÞÄ¿´ÏÁòÀº LDAPÀÌ´Ù.
		LDAP¸¦ ÀÎÁõ¹æ½ÄÀ¸·Î »ç¿ëÇÏ¿´±â ¶§¹®¿¡, °ÔÀÌÆ®¿þÀÌ ¹Ú½ºÀÇ pam ¸ðµâÀº
		LDAP¸¦ »ç¿ëÇÏµµ·Ï ¼³Á¤ÇÏ¿´´Ù.
		º¸´Ù ÀÚ¼¼ÇÑ Á¤º¸´Â <ulink
		url="http://www.padl.com/pam_ldap.html">http://www.padl.com/pam_ldap.html</ulink>¸¦
		Âü°íÇÏ±â ¹Ù¶õ´Ù.
		PAMÀº ´Ù¾çÇÑ ÀÎÁõ¹æ¹ýÀ» »ç¿ëÇÒ ¼ö ÀÖµµ·Ï ÇÑ´Ù. »ç¿ëÇÏ°íÀÚ ÇÏ´Â PAM ¸ðµâ¿¡
		´ëÇÑ ¹®¼­¸¦ Âü°íÇÏ±â ¹Ù¶ó¸ç, ´Ù¸¥ ¹æ¹ý¿¡ ´ëÇÑ Á¤º¸¸¦ ¾ò°íÀÚ ÇÏ´Â ºÐµéÀº
    <ulink url="http://www.kernel.org/pub/linux/libs/pam/modules.html">pam
		modules</ulink>¸¦ Âü°íÇÏ±â ¹Ù¶õ´Ù. 
    </para>
  </sect2>

  <sect2 id="dnsserver">
    <title>DNS ¼­¹ö</title>
    
    <para>
		°ø¿ë ³×Æ®¿öÅ©¿¡ ÀÖ¾î¼­ °ÔÀÌÆ®¿þÀÌ ¹Ú½º´Â DNS ¼­¹ö·Îµµ µ¿ÀÛÇÑ´Ù.
    ÇÊÀÚ´Â <ulink url="http://www.isc.org/products/BIND/">Bind</ulink>¸¦
		¼³Ä¡ÇßÀ¸¸ç, ÀÌ¸¦ Ä³½³ ³×ÀÓ¼­¹ö·Î ¼³Á¤ÇÏ¿´´Ù.
		·¹µåÇÞ ÆÐÅ°Áö¿¡ ´Þ·Á¿À´Â caching-nameserver RPM ÆÐÅ°Áö¸¦ »ç¿ëÇÏ¿´´Ù. 
 </para>
 </sect2>
 </sect1>




<sect1 id="setup">
  <title>°ÔÀÌÆ®¿þÀÌ ¼­ºñ½º ¼³Á¤</title>

    <para>
		ÀÌ ÀýÀº ÀÎÁõ°ÔÀÌÆ®¿þÀÌÀÇ °¢ ´Ü°èº° ¼³Á¤¹æ¹ýÀ» ±â¼úÇÑ´Ù.
		»ç¿ëµÈ ¿¹´Â ¼­ºê³Ý 10.0.1.0ÀÇ ºñ°øÀÎ ip¸¦ ´ë»óÀ¸·Î ÇÏ¿´À¸¸ç, 
		eth0´Â ³»ºÎ³×Æ®¿öÅ©¿Í ¿¬°áµÈ NICÀÌ°í, °ø¿ë ³×Æ®¿öÅ©¿Í ¿¬°áµÈ ÀåÄ¡´Â
		eth1ÀÌ´Ù. eth1¿¡ ´ëÇÏ¿© »ç¿ëµÈ IP ÁÖ¼Ò´Â 10.0.1.1ÀÌÁö¸¸, ¿©·¯ºÐµéÀÇ È¯°æ¿¡  
		µû¶ó ÀûÀýÈ÷ ¼³Á¤ÇÏ±â ¹Ù¶õ´Ù.
		°ÔÀÌÆ®¿þÀÌ ¹Ú½º·Î ·¹µåÇÞ 7.1ÀÌ »ç¿ëÇß±â ¶§¹®¿¡, ¿¹Á¦ÀÇ »ó´ç ºÎºÐÀº
		·¹µåÇÞÀ» Áß½ÉÀ¸·Î ¼³¸íÇÏ¿´´Ù.
    </para>

  

  <sect2 id="netfiltersetup">
   <title>Netfilter ¼³Ä¡</title>

    
   <para>
   netfilter¸¦ ¼³Ä¡ÇÏ±â À§ÇØ¼­´Â Ä¿³ÎÀÌ ³ÝÇÊÅÍ¸¦ Áö¿øÇÏµµ·Ï ¹Ýµå½Ã »õ·Î
   ÄÄÆÄÀÏÇØ¾ßÇÑ´Ù. Ä¿³ÎÀ» ±¸¼ºÇÏ°í »õ·Î ÄÄÆÄÀÏÇÏ´Â ¹æ¹ýÀº 
   <ulink
   url="http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html">Kernel-HOWTO</ulink>¸¦
   Âü°íÇÏ±â ¹Ù¶õ´Ù.
   </para>
   <para>
   ´ÙÀ½Àº ÇÊÀÚÀÇ Ä¿³Î ±¸¼ºÁß ÀÏºÎ¸¦ º¸ÀÎ °ÍÀÌ´Ù.
   <screen>
   #
   # Networking options
   #
   CONFIG_PACKET=y
   # CONFIG_PACKET_MMAP is not set
   # CONFIG_NETLINK is not set
   CONFIG_NETFILTER=y
   CONFIG_NETFILTER_DEBUG=y
   CONFIG_FILTER=y
   CONFIG_UNIX=y
   CONFIG_INET=y
   CONFIG_IP_MULTICAST=y
   # CONFIG_IP_ADVANCED_ROUTER is not set
   # CONFIG_IP_PNP is not set
   # CONFIG_NET_IPIP is not set
   # CONFIG_NET_IPGRE is not set
   # CONFIG_IP_MROUTE is not set
   # CONFIG_INET_ECN is not set
   # CONFIG_SYN_COOKIES is not set


   #   IP: Netfilter Configuration
   #   
   CONFIG_IP_NF_CONNTRACK=y
   CONFIG_IP_NF_FTP=y
   CONFIG_IP_NF_IPTABLES=y
   CONFIG_IP_NF_MATCH_LIMIT=y
   CONFIG_IP_NF_MATCH_MAC=y
   CONFIG_IP_NF_MATCH_MARK=y
   CONFIG_IP_NF_MATCH_MULTIPORT=y
   CONFIG_IP_NF_MATCH_TOS=y
   CONFIG_IP_NF_MATCH_TCPMSS=y
   CONFIG_IP_NF_MATCH_STATE=y
   CONFIG_IP_NF_MATCH_UNCLEAN=y
   CONFIG_IP_NF_MATCH_OWNER=y
   CONFIG_IP_NF_FILTER=y
   CONFIG_IP_NF_TARGET_REJECT=y
   CONFIG_IP_NF_TARGET_MIRROR=y
   CONFIG_IP_NF_NAT=y
   CONFIG_IP_NF_NAT_NEEDED=y
   CONFIG_IP_NF_TARGET_MASQUERADE=y
   CONFIG_IP_NF_TARGET_REDIRECT=y
   CONFIG_IP_NF_NAT_FTP=y
   CONFIG_IP_NF_MANGLE=y
   CONFIG_IP_NF_TARGET_TOS=y
   CONFIG_IP_NF_TARGET_MARK=y
   CONFIG_IP_NF_TARGET_LOG=y
   CONFIG_IP_NF_TARGET_TCPMSS=y
   </screen>
   </para>
   <para>
   iptables¸¦ ¼³Ä¡ÇØ¾ßÇÏ¸ç, ¹èÆ÷¹ÝÀÇ ÆÐÅ°Áö·Î ¼³Ä¡ÇÏ°Å³ª ¼Ò½º·Î ¼³Ä¡¸¦ ÇØµµ
   ¹«¹æÇÏ´Ù.
   ÀÏ´Ü À§ÀÇ ¿É¼ÇÀ¸·Î »õ·Î¿î Ä¿³ÎÀ» ÄÄÆÄÀÏÇÏ°í iptables¸¦ ¼³Ä¡ÇÑ ÈÄ, 
   ÇÊÀÚ´Â ´ÙÀ½À» ¹æÈ­º® ±âº»·ê·Î ¼³Á¤ÇÏ¿´´Ù.
   </para>

   <screen>
   iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   iptables -A INPUT -i eth0 -m state --state NEW, INVALID -j DROP
   iptables -A FORWARD -i eth0 -m state --state NEW, INVALID -j DROP
   iptables -I FORWARD -o eth0 -j DROP
   iptables -I FORWARD -s 10.0.1.0/24 -d 10.0.1.1 -j ACCEPT
   </screen>

   <para>
   ¼­¹ö°¡ ºÎÆÃÇÒ ¶§ À§ÀÇ ½ºÅ©¸³Æ®°¡ µ¿ÀÛÇÏµµ·Ï ÇÏ·Á¸é init ½ºÅ©¸³Æ®¿¡ À§ÀÇ
   ¸í·ÉÀ» Æ÷ÇÔ½ÃÄÑµµ µÈ´Ù.
   ·êÀÌ Ãß°¡ µÇ¾ú´ÂÁö È®ÀÎÇÏ·Á¸é ´ÙÀ½°ú °°Àº ¸í·ÉÀ» ½ÇÇà½ÃÅ°¸é µÈ´Ù:
   </para>

   <screen>
   iptables -v -t nat -L
   iptables -v -t filter -L
   </screen>
   
   <para>
   ÀÌ·¯ÇÑ ·êÀ» ÀúÀåÇÏ°íÀÚ ÇÒ °æ¿ì, ÇÊÀÚ´Â ·¹µåÇÞÀÇ init ½ºÅ©¸³Æ®¸¦ »ç¿ëÇß´Ù.
   </para>
 
   <screen>
   /etc/init.d/iptables save
   /etc/init.d/iptables restart
   </screen>

   <para>
   ·êÀÌ Ãß°¡µÇ¾úÀ¸¸é, ´ÙÀ½°ú °°Àº ¸í·ÉÀ» ¼öÇàÇÏ¿© IP forwardingÀ» °¡´ÉÇÏ°Ô
   ÇÑ´Ù.
   </para>

   <screen>
   echo 1 > /proc/sys/net/ipv4/ip_forward
   </screen>

   <para>
   ¸Ó½ÅÀÌ ¸®ºÎÆÃÇÒ ¶§ ip forwardingÀÌ °¡´ÉÇÏµµ·Ï ÇÏ·Á¸é,  
		<filename>/etc/sysctl.conf</filename>¿¡ ´ÙÀ½ ¶óÀÎÀ» Ãß°¡ÇÏ¸é µÈ´Ù.
   </para>

   <screen>
   net.ipv4.ip_forward = 1
   </screen>

   <para>
   ÀÌÁ¦ °ÔÀÌÆ®¿þÀÌ ¹Ú½º´Â NAT¸¦ ÇÒ ¼ö ÀÖÁö¸¸, °ø¿ë ³×Æ®¿öÅ© ³»ºÎ¿Í
   °ÔÀÌÆ®¿þÀÌ·Î ÇâÇÏ¿©
   µé¾î¿À´Â forwarding ÆÐÅ¶À» Á¦¿ÜÇÑ ¸ðµç forwarding ÆÐÅ¶À» ¹ö¸±
   °ÍÀÌ´Ù(DROP).
   </para>   
   
  </sect2>

  <sect2 id="pamiptablessetup">
   <title>PAM iptables Module</title>

   <para>
   ¹æÈ­º® ·êÀ» Ãß°¡ÇÏ´Â PAM ¼¼¼Ç ¸ðµâ·Î, ÀÎÁõµÈ Å¬¶óÀÌ¾ðÆ®¿¡ ´ëÇÏ¿©
   forwardingÀ» Çã¿ëÇÏ±â À§ÇØ ÇÊ¿äÇÏ´Ù.
   ÀÌ¸¦ ¼³Á¤ÇÏ°íÀÚ ÇÏ´Â °æ¿ì´Â ´Ü¼øÈ÷ <ulink
   url="ftp://ftp.itlab.musc.edu/pub/pam_iptables.tar.gz">¼Ò½º</ulink>¸¦
   ±¸ÇÏ¿© ´ÙÀ½ ¸í·ÉÀ» ÀÌ¿ëÇÏ¿© ÄÄÆÄÀÏÇÏ¸é µÈ´Ù.
   </para>

   <screen>
   gcc -fPIC -c pam_iptables.c
   ld -x --shared -o pam_iptables.so pam_iptables.o
   </screen>

   <para>
   ÀÌÁ¦ <filename>pam_iptables.so</filename>°ú
   <filename>pam_iptables.o</filename>ÀÌ¶ó°í ÇÏ´Â ¹ÙÀÌ³Ê¸® ÆÄÀÏÀÌ »ý°åÀ»
   °ÍÀÌ´Ù.
   <filename>pam_iptables.so</filename>À»
   <filename>/lib/security/pam_iptables.so</filename>À¸·Î º¹»çÇÏ±â ¹Ù¶õ´Ù.
   </para>

   <screen>
   cp pam_iptables.so /lib/security/pam_iptables.so
   </screen>

   <para>
   °ÔÀÌÆ®¿þÀÌ¿¡ ´ëÇÏ¿© ÀÎÁõ Å¬¶óÀÌ¾ðÆ®·Î ¼±ÅÃµÈ °ÍÀº sshÀÌ°í µû¶ó¼­ ÇÊÀÚ´Â
   ´ÙÀ½ ¶óÀÎÀ» <filename>/etc/pam.d/sshd</filename>¿¡ Ãß°¡ÇÏ¿´´Ù.
   </para>

   <screen>
   session    required     /lib/security/pam_iptables.so 
   </screen>

   <para>
   ÀÌÁ¦´Â, »ç¿ëÀÚ°¡ ssh¸¦ ÀÌ¿ëÇÏ¿© ·Î±×ÀÎÇÒ °æ¿ì, ¹æÈ­º® ·êÀÌ Ãß°¡µÉ °ÍÀÌ´Ù.
   </para>

   <para>
   pam_iptables¿¡ ´ëÇÑ ±âº» ÀÎÅÍÆäÀÌ½º´Â eth0ÀÌÁö¸¸, ÀÎÅÍÆäÀÌ½º ÆÄ¶ó¹ÌÅÍ¸¦
   Ãß°¡ÇÏ¿© ±âº»¼³Á¤°ªÀ» º¯°æÇÒ ¼ö ÀÖ´Ù.
   </para>
 
   <screen>
   session required /lib/security/pam_iptables.so interface=eth1
   </screen>

   <para>
   ÀÌ °æ¿ì´Â ¿ÜºÎ ³×Æ®¿öÅ©¿Í ¿¬°áµÈ ÀÎÅÍÆäÀÌ½º ÀÌ¸§ÀÌ eth0°¡ ¾Æ´Ñ °æ¿ì¿¡¸¸
   ÇÊ¿äÇÏ´Ù.
   </para>

   <para>
   pam_iptables ¸ðµâÀÌ Àß µ¿ÀÛÇÏ°í ÀÖ´Â Áö È®ÀÎÇÏ·Á¸é ´ÙÀ½°ú °°Àº ´Ü°è¸¦
   ¼öÇàÇÏ¸é µÈ´Ù.
   </para>

   <orderedlist>
   		<listitem>
      <para>ssh¸¦ ÀÌ¿ëÇÏ¿© °ÔÀÌÆ®¿þÀÌ ¹Ú½º¿¡ ·Î±×ÀÎ ÇÑ´Ù.</para>
		</listitem>
    <listitem>
     <para>`<command>iptables -L</command>'À» ÀÌ¿ëÇÏ¿© ·êÀÌ Ãß°¡ µÇ¾ú´ÂÁö È®ÀÎ ÇÑ´Ù.</para>
    </listitem>
    <listitem>
     <para>·êÀÌ Á¦°ÅµÇµµ·Ï ÇÏ±âÀ§ÇØ °ÔÀÌÆ®¿þÀÌ ¹Ú½º·ÎºÎÅÍ ·Î±×¾Æ¿ô ÇÑ´Ù.</para>
    </listitem>
   </orderedlist>
   
  </sect2>


  <sect2 id="dhcpdsetup">
   <title>DHCP Server ¼³Á¤</title>

   <para>ÇÊÀÚ´Â ´ÙÀ½°ú °°Àº <filename>dhcpd.conf</filename> ÆÄÀÏÀ» ÀÌ¿ëÇÏ¿© DHCP¸¦ ¼³Á¤ÇÏ¿´´Ù.
   </para>

    <screen>
   subnet 10.0.1.0 netmask 255.255.255.0 {
   # --- default gateway
        option routers                  10.0.1.1;
        option subnet-mask              255.255.255.0;
        option broadcast-address        10.0.1.255;

        option domain-name-servers       10.0.1.1;      
        range   10.0.1.3 10.0.1.254;
        option time-offset              -5;     # Eastern Standard Time

        default-lease-time 21600;
        max-lease-time 43200;

    } 
    </screen>

    <para>¼­¹ö´Â °ø¿ë ³×Æ®¿öÅ©¿Í ¿¬°áµÈ eth1À» ÀÌ¿ëÇÏ¿© µ¿ÀÛÇÏ¿´´Ù.
    </para>

    <screen>
    /usr/sbin/dhcpd eth1
    </screen>

   </sect2>
 
   <sect2 id="authenticationsetup">
   <title>ÀÎÁõ¹æ¹ý ¼³Á¤</title>

   <para>
   ¾Õ Àý¿¡¼­µµ ¼³¸íÇÏ¿´Áö¸¸, ÇÊÀÚ´Â ÀÎÁõÀ¸·Î LDAP¸¦ »ç¿ëÇÏµµ·Ï °ÔÀÌÆ®¿þÀÌ¸¦
   ¼³Á¤ÇÏ¿´´Ù.
   ÇÏÁö¸¸, ¿©·¯ºÐµéÀº PAMÀÌ Çã¿ëÇÏ´Â ¾î¶°ÇÑ ÀÎÁõ¹æ¹ýÀ» »ç¿ëÇØµµ ¹«¹æÇÏ´Ù.
   ´õ ¸¹Àº Á¤º¸¸¦ ¾òÀ¸·Á¸é <xref linkend="authentication">¸¦ º¸±â ¹Ù¶õ´Ù.
   </para>
   
   <para>
   PAM LDAPÀ¸·Î ÀÎÁõÀ» ±¸ÇöÇÏ±â À§ÇÏ¿©, ÇÊÀÚ´Â 
   <ulink url="http://www.openldap.org">OpenLDAP</ulink>À» ¼³Ä¡ÇÏ°í 
   <filename>/etc/ldap.conf</filename>¿¡ ´ÙÀ½°ú °°Àº ³»¿ëÀ¸·Î ±¸¼ºÇÏ¿´´Ù.
   </para>

   <screen>
   # Your LDAP server. Must be resolvable without using LDAP.
   host itc.musc.edu

   # The distinguished name of the search base.
   base dc=musc,dc=edu
   ssl no
   </screen>
   
   <para>
   ´ÙÀ½¿¡ º¸ÀÌ´Â ÆÄÀÏÀº LDAP ÀÎÁõÀ» ÇÏµµ·Ï PAMÀ» ±¸¼ºÇÏ±â À§ÇØ
   »ç¿ëÇÏ¿´À¸¸ç, ÀÌ ÆÄÀÏµéÀº ·¹µåÇÞÀÇ configuration À¯Æ¿¸®Æ¼·Î »ý¼ºµÈ
   °ÍÀÌ´Ù.
   </para>

   <variablelist>
    <varlistentry><term><filename>/etc/pam.d/system-auth</filename> ´ÙÀ½°ú
		°°ÀÌ »ý¼ºµÈ´Ù.</term>
     <listitem>
      <para><screen>
   #%PAM-1.0
   # This file is auto-generated.
   # User changes will be destroyed the next time authconfig is run.
   auth        required      /lib/security/pam_env.so
   auth        sufficient    /lib/security/pam_unix.so likeauth nullok
   auth        sufficient    /lib/security/pam_ldap.so use_first_pass
   auth        required      /lib/security/pam_deny.so

   account     required      /lib/security/pam_unix.so
   account     [default=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/pam_ldap.so

   password    required      /lib/security/pam_cracklib.so retry=3
   password    sufficient    /lib/security/pam_unix.so nullok use_authtok
   password    sufficient    /lib/security/pam_ldap.so use_authtok
   password    required      /lib/security/pam_deny.so

   session     required      /lib/security/pam_limits.so
   session     required      /lib/security/pam_unix.so
   session     optional      /lib/security/pam_ldap.so
       </screen>
       </para>
     </listitem>
    </varlistentry>
    <varlistentry><term>´ÙÀ½°ú °°Àº
    <filename>/etc/pam.d/sshd</filename> ÆÄÀÏÀÌ »ý¼ºµÈ´Ù.</term>
     <listitem><para>
       <screen>
   #%PAM-1.0
   auth       required     /lib/security/pam_stack.so service=system-auth
   auth       required     /lib/security/pam_nologin.so
   account    required     /lib/security/pam_stack.so service=system-auth
   password   required     /lib/security/pam_stack.so service=system-auth
   session    required     /lib/security/pam_stack.so service=system-auth
   #this line is added for firewall rule insertion upon login
   session    required     /lib/security/pam_iptables.so debug
   session    optional     /lib/security/pam_console.so
      </screen>
      </para>
     </listitem>
    </varlistentry>
   </variablelist>
  </sect2>

  <sect2 id="dnssetup">
   <title>DNS ¼³Á¤</title>
    
   <para>
   ·¹µåÇÞ 7.1¿¡ Æ÷ÇÔµÈ BIND¸¦ ¼³Ä¡Çß°í, caching-nameserver RPMÀ» °°ÀÌ
   ¼³Ä¡Çß´Ù. DHCP ¼­¹ö´Â °ø¿ë ³×Æ®¿öÅ©»óÀÇ ¸Ó½®µéÀÌ °ÔÀÌÆ®¿þÀÌ ¹Ú½º¸¦
   ³×ÀÓ¼­¹ö·Î »ç¿ëÇÏµµ·Ï ¾Ë¸®´Â ¿ªÇÒÀ» ÇÑ´Ù.
   </para>
  
  </sect2>
 </sect1>

 <sect1 id="usage">
 <title>ÀÎÁõ°ÔÀÌÆ®¿þÀÌ »ç¿ë</title>
 <para>
 ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ »ç¿ëÇÏ±â À§ÇØ¼­´Â, ¿©·¯ºÐµéÀÇ Å¬¶óÀÌ¾ðÆ® ¸Ó½®ÀÌ DHCP¸¦ 
 »ç¿ëÇÏµµ·Ï ¼³Á¤ÇØ¾ßÇÑ´Ù. °¢°¢ÀÇ ¸Ó½®¿¡ ssh Å¬¶óÀÌ¾ðÆ®¸¦ ¼³Ä¡ÇÏ°í
 °ÔÀÌÆ®¿þÀÌ·Î ssh Á¢¼ÓÀ» ÇÑ´Ù.
 ÀÏ´Ü ·Î±×ÀÎ µÇ¸é, ³»ºÎ ³×Æ®¿öÅ©¿¡ Á¢±ÙÇÒ ¼ö ÀÖ°Ô µÈ´Ù.
 ´ÙÀ½ ¿¹´Â À¯´Ð½º ±â¹ÝÀÇ Å¬¶óÀÌ¾ðÆ®¿¡ ´ëÇÑ ¼¼¼ÇÀÌ´Ù.
 </para>

 <screen>
 bash>ssh zornnh@10.0.1.1
 zornnh's Password:
 
 gateway>
 </screen>

 <para>
 ¿©·¯ºÐµéÀÌ ·Î±×ÀÎÇØ ÀÖ´Â ÇÑ, Á¢±Ù±ÇÇÑÀº °è¼Ó À¯ÁöµÉ °ÍÀÌ´Ù. ¸¸ÀÏ
 ·Î±×¾Æ¿ôÇÏ¸é, Á¢±Ù ±ÇÇÑÀ» ÀÒ°Ô µÈ´Ù. 
 </para>

 </sect1>

<!-- Section1: resources: END -->

 <sect1 id="remarks">
  <title>°á·Ð</title>
  
   <indexterm>
    <primary>(your index root)!conclusion</primary>
   </indexterm>

  <itemizedlist>
   <listitem><para>
   º» HOWTO¿¡¼­ ¼Ò°³ÇÑ º¸¾È¹æ¹ýÀº ¹«¼±³×Æ®¿öÅ© Ä¿¹Â´ÏÆ¼¿¡¼­ Á¦°øÇÏ´Â
   º¸¾È¹æ¹ý¿¡ ÀÇÁ¸ÇÏÁö ¾Ê´Â´Ù. ÀÌ´Â ÀüÃ¼ ³×Æ®¿öÅ©°¡ ºÒ¾ÈÀüÇÏ°í ¿©·¯ºÐÀÇ
   ³×Æ®¿öÅ© ¿ÜºÎ¿¡ Á¸ÀçÇÑ´Ù°í °¡Á¤ÇÑ´Ù.
   </para>
   </listitem>
   <listitem><para>
   °ÔÀÌÆ®¿þÀÌ´Â Àü¼Ûµ¥ÀÌÅÍ¸¦ ¾ÏÈ£È­ÇÏÁö ¾Ê°í, ´ÜÁö °ÔÀÌÆ®¿þÀÌ µÚÂÊ¿¡ ÀÖ´Â
   »ç¿ëÀÚ°¡ ³×Æ®¿öÅ©¿¡ Á¢±ÙÇÒ ¼ö ÀÖµµ·Ï ¸¸ ÇÑ´Ù. ¾ÏÈ£È­ ¹× ÀÎÁõÀÌ ¿ä±¸µÇ´Â
   »óÈ²ÀÌ¶ó¸é VPNÀ» »ç¿ëÇÏ´Â °ÍÀÌ ÁÁ´Ù.
   </para>
   </listitem>
  </itemizedlist>

 </sect1>

<!-- Section1: remarks: END -->


<!-- Section1: resources -->

<sect1 id="resource">
  <title>º°µµÀÇ ¸®¼Ò½º</title>
  <itemizedlist>
   <listitem>
    <para>NASA¿¡¼­ ±¸ÇöÇÑ ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ ¼³¸íÇÑ  <ulink
    url="http://www.nas.nasa.gov/Groups/Networks/Projects/Wireless/index.html">¹®¼­</ulink>.
    </para>
   </listitem>
   <listitem>
    <para>
    University of Alberta¿¡¼­ ÀÎÁõ°ÔÀÌÆ®¿þÀÌ¸¦ °³¹ßÇÑ ¹æ¹ýÀ» ±â¼úÇÑ
		<ulink url="http://www.ualberta.ca/~beck/authgw.html">¹é¼­</ulink>.
    </para>
   </listitem>
  </itemizedlist>
</sect1>

<!-- Section1: faq -->

 <sect1 id="faq">
  <title>Áú¹®°ú ´äº¯</title>

   <indexterm>
    <primary>(your index root)!FAQ</primary>
   </indexterm>
   <indexterm>
    <primary>(your index root)!frequently asked questions</primary>
   </indexterm>

  <para>
   ÇÊÀÚ »ý°¢¿¡ ´Ù¸¥ »ç¶÷µéÀÌ ±Ã±ÝÇØ ÇÒ ¸¸ÇÑ °¡Àå Æò¹üÇÑ Áú¹®À» ¸ð¾Æ ³õÀº °Í¿¡
   ºÒ°úÇÏ´Ù.
   ÇÊÀÚ¿¡°Ô ´õ ¸¹Àº ÇÇµå¹éÀ» ÁÖ½Ã¸é, ÀÌ ÀýÀ» ³¡³»ÁÖ´Â FAQ·Î ¸¸µé¾î º¸°Ú½À´Ï´Ù.
  </para>

 </sect1>

<!-- Section1: faq: END -->

</article>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-namecase-general:t
sgml-general-insert-case:lower
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:nil
sgml-parent-document:nil
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->




