GateKeeperへのフィルタ管理機能の追加

(1)

GateKeeper

2008MI234

!#"%$

1

&('*),+ -.0/

web

1*2436587:9<;>=>2@?<ACBEDGFHJILKMN OEP 2QCRS;UTWVXYIGZ[]\6^`_GaYbUcLVXedLf4[ /eg cih8jklDGm:n]c>TSop<d6qrsGt4uiZevLZ[]\6^ wxyez /eg cL{@|s@IGZ }~*L*0QW5 cL4

[4][2]

c8]2BE2Se2

(

: /

GK)

/80 5BcL@:eD]*\6^

2

¡¢l£¥¤ _Sc6¦4§ z / wxy §S¨©]*\@QW5:cLª@rlDU«*¬ *\6^ wxy § z / _Sc

GK

dL{YIGZ>H][]\:_:s6c>§ev \S:2:=L®]2>5ls g c>:2:=L®]2>5*DGFHJIGZ /

GK

D ¯° *\±i²³;l´ED °µ *\6^ w]x]y § z / ¯4° C\i¶:·`c*±8²`;%´¹¸4º³cW»]¼s ]2]=i®42@5eDUF0HYISK]±W²C;Y´½ci*³D*¾ilsILZ / ¿:ÀLÁ =60:4CDUÂ:Ã*<\S^ ¿:ÀiÁ =60:*Ys z / ÄlÅ §*d

GK

§8F]H%ISK ¿:ÀiÁ =@dW:Æ0ÇJDLÈCÉZ :2:=L®]2>5Ê@§W@%I /6g c6ËÌlDGFHJIGZ

GK

c ¯ ° DL*\6^ :2:=L®]2>5Ê@§ ¿ÀUÁ =i:2:=DG@%IGZ / [8n>Í TYÎWc<Ï<ÐLt ¿4ÀiÁ =]D °]µ I>KÑ³Di0IiZ /*Ò:Ó Ô *\:_:s6d4ÏeÕ /

GK

cLFH³D8Ö6×edW*\:_:sT§ev \6^Ø8Ù z

C++

NÚÛÜ4Ý@;WÛDUH][ /

postgresql

c6Þß³ÜW9:àÜ O s@IGZ

libpq

DGáH0*\6^

3

âYã%äåæ¢%çYè wxy §SÂÃ]*\@QW5*Dé]*\8K8ê0d / ] \:ëSc:DU«*¬W*\6^

•

:2:=ìíH*c>:2:=L®]2>5:c °µ

•

:2:=L®]2>58*MîSï5CI / :2:=L®]2>5*D ¯° \@NÚÛÜS

• SSLCommander

4c:±i²³;l´ðÂÃ

3.1

ñ0ò0óiô]òõ8öW÷ø 424=W®*25lù ¿ BGúûMd

postgresql[1]

D6F:H4 \S^

Commander

T ¿4ÀSÁ =]D

GK

d>¸4º4³\@üed>H ý e\

13

c6þ¾idLÃeÿZ / ]2]=@c

1

{

1

cÇ s@IGZ>H][]\U@ÆÇs:2*2 ]c

15

cUþæ¾SDæÐ ^ ]2e2 z /

SSL

lD6H4[]K ¯0°

[4]

§ ¿0À6Á =:D °:µ I>Küec / °:µ DLm*C\0Kê*c<ë@c§ \6^@@ÆÇ<d z

PC

c:2*2 eD*d / qCD É0\8K8ê0d! 8dM Á<¿" ®lACB$#%'& /'() d6ÆÇ DGÈ+*%I /eg a,Sa<D.- §/10l\*sG[lÐ32lD4si\6^

3.2

457689öW÷ø

GK

z /

SSLCommander

d*Ï@uWZ ¯0° e\4_]sGT§ v0\S^

SSL

î]Ü@9eM³;YB: YDSHe[*KS4s<;= 5 B Ñ%bLcSr>e§ ¿:ÀiÁ = ¯]° D0î0Ü>5:§*\

SSL

î:Ü 9:M4;lB? 'ec@@ z

run

A]ùAC´ / ¿ÀUÁ =D ¯° \8c z

accessFilter

A]ùAC´d+BDCUa0Z[]\6^ E

1

FHGJI7K

SSLCommander

3.3

ñ0ò0óiô]òõL:öMNOP *2<2+ z

SSL

`DLHe[]K'42³27 CD6F:H4 \6^@ÆÇ z /*g c:2*2 eDi:2:=L®]2>5Ê0c6Ë ÌsRQ'SYIGZ / '@ËÌs@IGZWÈ+*]*\6^UT È z /*g c ¿ÀUÁ =>dVS*\S:2:=iTW¸XCUae\YZ4c /

GK

D[ \ C^]0Z[]\

PC

c0Ú82+_ Á =S9@Ñ`b3`a:*\6^

3.4

bcdfeEög+h+ij k <QW5:c:±i²³;l´d6Ã*ÿ@Z / 00c@@lDL*\ ±i²³;l´EDÂÃ]*\6^

• ADD

±²%;æ´6D>HC[<K:ü³c / e*`ec+lmD :2:=L®]2>5:c>:2:=DGFHJIGZn'm^

•

o'mecL@ÆÇ<c ¿ÀUÁ =>c>:2:=iÑ`b ¿ÀUÁ =D °µ *\

BAC

±i²³;l´EDÂÃ0^

•

î]Ü@9eM³;YB:pe§]e2*=>®e25ecqr%D7s't<§lv \ /

SHOW

±i²³;l´c6ÂÃ0^

•

o!m%c ¿CÀ@Á =<D0`2l=0®`245CÊeÑ¥bu!veY\

DDEL

±i²³;l´c6ÂÃ0^

•

e2*=>®<25ec ¿4ÀSÁ =domwx<§yzD8ÑeÉ Z / *8T{|}<É³bEa4K>Ñ*D@îÜW9:M4;lB?p]§ cJ~'lDL*\

COUNT

±i²³;l´c6ÂÃ0^ _GaYbUc@@lDÂÃ]*\WÊ@§$<Kd

DataBaseMan-ager

sG[lÐLîÜS5*D °µ *\6^

1

(2)

:2:=L®]2>5:c6ËÌ4Ñ`b*]D1l'm:*\Sü:c d z / ë8u4s>ëYIU[i*]D ]

MOST

/ Ä³Å §:cSí]§]*\

TOTAL

/ #>Æ'}<É³bEa4K7| <c [><]d8³\

MEDIAN

/ ÑYbR>³ê*\

AVERAGE

c

4

=S9:N0DUH ý *\6^

_Sc

4

=S9:N@clD]%'&CD

ADD

±i²³;l´ ¸ º4c6*c4§W¸0º*\:_:s6d4ÏeÕ / :2:=L®]2>5 *MîSï5CI / CUa0Z[]\GËÌs Ñ`b *]D1l'm:*\:_:sT§ev8\6^

4

ç "! NÚÛÜS:c \ ° 5Bc6$#*dV*IGZB % \i^>#&$'ld z

Ubuntu10.04(32bit OS)

D>9l;L5 B2 Á ILK

PC

DGáHJI / ( xy) §*+fq@c@?<ACB ,

2]î-`Ý.0/U2*=@2

GINE[3]

DLHe[Z>#&"'JD1

2 ILKi^ E

2

346578:9<;= E Ä |*c]5 B§ z / Â]Ã<§@<%s :I>K*±8²`;%´ T>æI@? \ ° I / ::<*DAeÿ0Z:[*\8Ñ<DB 4³\i^ C cDFEILT>"BCdCia]Z:[e\>Ñ³D / î0Ü@94Me;YB$p / 1*2G*2p / :2:=L®]2>5p]§IHCDÂluiZIB' YILKi^

ADD|4|IN|192.168.1.1|255.255.255.255|192.168.

2.1|255.255.255.255|ANY|0|0|TOTAL|1.0|0|1

Êec:±i²³;l´EDAYILK<s>_ / * z

DELAY

T'nm CWaCK8^0`ÜA:2<=02Ñæb /

1.0msec

cIJKCT

192.168.1.1

Ñ%b

192.168.2.1

³cW]@L*d+"MeC\*_ ssGt]\6^ <üed6JFK³T+"MUCSa*Z][<\8ÑCD / ?`AJB , 2*î@ 5¥BNL`sPO0Q@Ï4Ð6d

iperf

DUF0HYISK

TCP

04§B *\6^

Attacker : iperf -c 192.168.2.1

---Client connecting to 192.168.2.1, TCP port 50

01 TCP window size: 16.0 KByte (default)

---[108] local 192.168.1.1 port 50421 connected

with 192.168.2.1 port 5001

[ ID] Interval

Transfer

Bandwidth

[108]

0.0-10.0 sec

560 KBytes

458 Kbits/s

ec

Server : iperf -s

---Server listening on TCP port 5001

TCP window size:

85.3 KByte (default)

---[

9] local 192.168.2.1 port 5001 connected w

ith 192.168.1.1 port 50421

[ ID] Interval

Transfer

Bandwidth

[

9]

0.0-10.0 sec

560 KBytes

458 kbits/s

ec

>p%sR % / ST]T6UWVWZ[]\8K8ê / >%I? *8T CUa0Z[]\:_:sTIX]Ñ4\6^ Å K /g cY

3

=S9:N@c d4Ï>\

ADD

±i²³; ´ / %I?¹%ILK /

BACK

/

SHOW

/

COUNT

/

DDEL

±i²³;l´ [Z@aCë<>p<d \ ° IGZ[]\:_:sSD[B' YILKi^

5

\^]`_C+ wxy § z /

GK

d 5BEDG@]*\S:2:=L®]2 5:c6s:2:=L®]2>5*DGFHJILK6*]Da]4NÚ ÛÜS*DÂÃ%ILKi^`_Ga4d4Ï8uiZ /

Commander

cL: c6]]d µb ILKi^ Ä eccds@IGZ /

IDS

e<cfgCDh \ dyi]*\ QW5*D j / h \ d ¿ÀUÁ = O ;WÛ Á 2 Á D ° µ *\U:eDÂÃ]*\:_:s§<ÏeÕlkme@t:QW5*D[1 2 *\:_:sTFnU·C\*soÿ]\6^ prqtsvu

[1] Joshua D. Drake: Postgresql :Welcome

http://www.postgresql.org/(accessed Apr.2011).

[2]

(2006).

[3]

X-4?eA³B , 2î[1 2 cKWê0c

GINE

cL@:]c6ÂÃ / % / x[ ËÌ xy ËÌ

(2010).

[4]

$ - ::<]Q@50:4d*É]\

TCP

ïJA QlRW;Wc q^0$s h@jet O 2B M0î>ï5>]4c 0 /F % /F x @ 0:Ë0Ì x:y$ ËÌ