‫ﺑﻪ ﻧﺎﻡ ﺧﺪﺍ‬
‫ﺩﺍﻧﺸﮑﺪﻩ ﻣﻬﻨﺪﺳﻲ ﮐﺎﻣﭙﻴﻮﺗﺮ‬
‫ﺍﻣﻨﻴﺖ ﺩﺍﺩﻩﻫﺎ ﻭ ﺷﺒﮑﻪ‬
‫ﺗﻤﺮﻳﻦ ﺳﺮﻱ ﭼﻬﺎﺭﻡ‬
‫‪ ٢٦‬ﺁﺫﺭ ‪٩١‬‬
‫ﺗﻮﺟﻪ ‪ :‬ﺑﺮﺍﻱ ﺁﮔﺎﻫﻲ ﺍﺯ ﻧﺤﻮﻩﻱ ﺗﺤﻮﻳﻞ ﭘﺎﺳﺦ ﺗﻤﺮﻳﻦﻫﺎ ﺑﻪ ﻓﺎﻳﻞ ‪ DeliveryGuide.pdf‬ﻣﺮﺍﺟﻌﻪ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫ﺩﻳﻮﺍﺭ ﺁﺗﺶ ‪pfSense‬‬
‫ﻫﺪﻑ ﺍﺯ ﻃﺮﺍﺣﻲ ﺍﻳﻦ ﺗﻤﺮﻳﻦ‪ ،‬ﺁﺷﻨﺎﻳﻲ ﻋﻤﻠﻲ ﺷﻤﺎ ﺑﺎ ﺑﺮﺧﻲ ﺍﺯ ﻗﺎﺑﻠﻴﺖﻫﺎﻱ ﺩﻳﻮﺍﺭﻫﺎﻱ ﺁﺗﺶ ﺍﺳﺖ ﮐﻪ ﺑﺮﺍﻱ ﺍﻳﻦ ﻣﻨﻈﻮﺭ ﺍﺯ ﻣﺴﻴﺮﻳﺎﺏ‪ ١‬ﻭ ﺩﻳﻮﺍﺭ ﺁﺗﺶ‬
‫‪ PfSense٢‬ﺍﺳﺘﻔﺎﺩﻩ ﺷﺪﻩ ﺍﺳﺖ‪ .‬ﻫﻤﭽﻨﻴﻦ ﺩﺭ ﺑﺨﺶﻫﺎﻳﻲ ﺍﺯ ﺍﻳﻦ ﺗﻤﺮﻳﻦ ﺑﺎ ﺷﺒﮑﻪ ﻫﺎﻱ ﻣﺠﺎﺯﻱ ﺷﺨﺼﻲ ﻭ ﻫﻤﭽﻨﻴﻦ ‪ IPSec‬ﻧﻴﺰ ﺁﺷﻨﺎ ﺧﻮﺍﻫﻴﺪ ﺷﺪ‪.‬‬
‫ﺩﻳﻮﺍﺭ ﺁﺗﺶ ‪ pfSense‬ﺑﻪ ﺻﻮﺭﺕ ﻧﺮﻡ ﺍﻓﺰﺍﺭﻱ ﻭ ﻣﺒﺘﻨﻲ ﺑﺮ ﺗﻮﺯﻳﻌﻲ ﺍﺯ ‪ FreeBSD‬ﺍﺳﺖ‪ .‬ﺑﺮﺍﻱ ﻧﺼﺐ ﻭ ﺷﺮﻭﻉ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﺍﻳﻦ ﺩﻳﻮﺍﺭ ﺁﺗﺶ ﻣﻲﺗﻮﺍﻥ‬
‫ﻣﺮﺍﺣﻞ ﺯﻳﺮ ﺭﺍ ﺍﻧﺠﺎﻡ ﺩﺍﺩ) ﺍﻳﻦ ﻣﺮﺍﺣﻞ ﭘﻴﺸﻨﻬﺎﺩﻱ ﺍﺳﺖ ﻭ ﻣﻲﺗﻮﺍﻧﻴﺪ ﺭﻭﺵ ﺩﻟﺨﻮﺍﻩ ﺧﻮﺩ ﺑﺮﺍﻱ ﻧﺼﺐ ﻭ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﺁﻥ ﺍﻧﺠﺎﻡ ﺩﻫﻴﺪ ﺑﺮﺍﻱ ﻣﺜﺎﻝ ﻣﻲﺗﻮﺍﻧﻴﺪ‬
‫ﺍﺯ ﺑﺮﻧﺎﻣﻪﻫﺎﻱ ﻣﺎﺷﻴﻦﻫﺎﻱ ﻣﺠﺎﺯﻱ ﺩﻳﮕﺮ ﺑﻪ ﺟﺰ ‪ VMWare‬ﺍﺳﺘﻔﺎﺩﻩ ﮐﻨﻴﺪ ﻭ ﻳﺎ ﺍﻳﻨﮑﻪ ﺑﻪ ﺻﻮﺭﺕ ﻓﻴﺰﻳﮑﻲ ﺍﻳﻦ ﺩﻳﻮﺍﺭﺁﺗﺶ ﺭﺍ ﻧﺼﺐ ﻧﻤﺎﻳﻴﺪ( ‪:‬‬
‫•‬
‫ﺍﺯ ﻟﻴﻨﮏ ﺯﻳﺮ ﺩﻳﻮﺍﺭﺁﺗﺶ ‪ PfSense‬ﺭﺍ ﺩﺍﻧﻠﻮﺩ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫‪http://mirror.nus.edu.sg/PfSense/downloads/PfSense-2.0.1-RELEASE-i386.iso.gz‬‬
‫•‬
‫ﺑﺮﻧﺎﻣﻪ ‪ VMWare‬ﺭﺍ ﺭﻭﻱ ﺳﻴﺴﺘﻢ ﺧﻮﺩ ﻧﺼﺐ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫‪Router‬‬
‫‪www.PfSense.org‬‬
‫‪1‬‬
‫‪2‬‬
‫•‬
‫ﻓﺎﻳﻞ ﺗﺼﻮﻳﺮ‪ ٣‬ﺩﺍﻧﻠﻮﺩ ﺷﺪﻩ ﺍﺯ ‪ PfSense‬ﺭﺍ ﺍﺯ ﺣﺎﻟﺖ ﻓﺸﺮﺩﻩ ﺷﺪﻩ ﺧﺎﺭﺝ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫•‬
‫ﺑﻪ ﺑﺮﻧﺎﻣﻪ ‪ VMWare‬ﺑﺎﺯﮔﺮﺩﻳﺪ ﺑﺎ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﻣﻨﻮﻱ ﻓﺎﻳﻞ ﺑﺨﺶ‪ ،‬ﻣﺎﺷﻴﻦ ﻣﺠﺎﺯﻱ ﺟﺪﻳﺪ‪ ،‬ﻳﮏ ﻣﺎﺷﻴﻦ ﻣﺠﺎﺯﻱ ‪ Typical‬ﺍﻳﺠﺎﺩ ﮐﻨﻴﺪ‪.‬‬
‫•‬
‫ﺗﺼﻮﻳﺮﻱ ﮐﻪ ﺍﺯ ﺣﺎﻟﺖ ﻓﺸﺮﺩﻩ ﺧﺎﺭﺝ ﺷﺪﻩ ﺍﺳﺖ ﺭﺍ ﺩﺭ ﺑﺨﺶ ‪ Installer Disk Image File‬ﻭﺍﺭﺩ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫•‬
‫ﺑﺎﻗﻲ ﺗﻨﻈﻴﻤﺎﺕ ﺭﺍ ﺑﻪ ﺻﻮﺭﺕ ﭘﻴﺶ ﻓﺮﺽ ﺑﺎﻗﻲ ﺑﮕﺬﺍﺭﻳﺪ‪.‬‬
‫•‬
‫ﻧﻮﻉ ﺷﺒﮑﻪ ﻣﺘﺼﻞ ﺷﺪﻩ ﺍﻳﻦ ﻣﺎﺷﻴﻦ ﻣﺠﺎﺯﻱ ﺭﺍ ﺑﻪ ‪ NAT‬ﺗﻐﻴﻴﺮ ﺩﻫﻴﺪ‪.‬‬
‫•‬
‫ﻳﮏ ﻭﺍﺳﻂ ﺷﺒﮑﻪ ﺩﻳﮕﺮ ﺑﻪ ﺍﻳﻦ ﺷﺒﮑﻪ ﺑﻴﺎﻓﺰﺍﻳﻴﺪ‪) .‬ﮐﻠﻴﮏ ﺭﺍﺳﺖ ﺭﻭﻱ ﻧﺎﻡ ﻣﺎﺷﻴﻦ ﻣﺠﺎﺯﻱ‪ ،‬ﺗﻨﻈﻴﻤﺎﺕ‪ ،‬ﺍﻓﺰﻭﺩﻥ ﻭﺍﺳﻂ ﺷﺒﮑﻪ ﺟﺪﻳﺪ ﻭ ﺁﻥ ﺭﺍ‬
‫ﺑﻪ ﻳﮏ ﺷﺒﮑﻪ ‪ Host Only‬ﻣﺘﺼﻞ ﻧﻤﺎﻳﻴﺪ‪(.‬‬
‫•‬
‫ﺍﺟﺎﺯﻩ ﺑﺪﻫﻴﺪ ﮐﻪ ﺍﻳﻦ ﺳﻴﺴﺘﻢ ﻟﻮﺩ ﺷﻮﺩ ﻭ ﺩﺭ ﺻﻮﺭﺕ ﻧﻴﺎﺯ ﻧﺎﻡ ﻭﺍﺳﻂ ﺷﺒﮑﻪ ﺁﻥ ﺭﺍ ﻭﺍﺭﺩ ﻧﻤﺎﻳﻴﺪ‪ em0) .‬ﻭ ‪ em1‬ﺑﺮﺍﻱ ‪ WAN‬ﻭ ‪(LAN‬‬
‫•‬
‫ﻳﮏ ﺳﻴﺴﺘﻢ ﻋﺎﻣﻞ ﺩﻳﮕﺮ ﺑﻪ ﺩﻟﺨﻮﺍﻩ ﺧﻮﺩ ﺩﺭ ﻣﺤﻴﻂ ‪ VMWare‬ﻧﺼﺐ ﻧﻤﺎﻳﻴﺪ‪) .‬ﺑﺮﺍﻱ ﻣﺜﺎﻝ ﻭﻳﻨﺪﻭﺯ ﻳﺎ ﺍﻭﺑﻮﻧﺘﻮ ﻳﺎ ‪ ...‬ﻣﺎ ﺍﺯ ﺍﻳﻦ ﺑﻪ ﺑﻌﺪ ‪OS2‬‬
‫ﻣﻲﻧﺎﻣﻴﻢ(‬
‫•‬
‫ﺷﺒﮑﻪ ‪ OS2‬ﺭﺍ ﺑﻪ ﻫﻤﺎﻥ ﺷﺒﮑﻪ ‪ Host Only‬ﮐﻪ ‪ PfSense‬ﺭﺍ ﻣﺘﺼﻞ ﮐﺮﺩﻳﺪ ﻧﺼﺐ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫•‬
‫ﺣﺎﻝ ﺍﺯ ﻃﺮﻳﻖ ﻳﮏ ﻣﺮﻭﺭﮔﺮ ﺩﺭ ‪ OS2‬ﻣﻲﺗﻮﺍﻧﻴﺪ ﺑﻪ ‪ PfSense‬ﺩﺳﺘﺮﺳﻲ ﺩﺍﺷﺘﻪ ﺑﺎﺷﻴﺪ‬
‫•‬
‫‪ IP‬ﻣﺎﺷﻴﻦ ﻣﺠﺎﺯﻱ ‪ PfSense‬ﺭﺍ ﺩﺭ ﻣﺮﻭﺭﮔﺮ ‪ OS2‬ﻭﺍﺭﺩ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫•‬
‫ﺩﺭ ﺑﺨﺶ ﻧﺎﻡ ﮐﺎﺭﺑﺮﻱ ‪ admin‬ﻭ ﺩﺭ ﺑﺨﺶ ﺭﻣﺰ ﻋﺒﻮﺭ ‪ PfSense‬ﺭﺍ ﻭﺍﺭﺩ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫•‬
‫ﺍﺯ ﻣﻨﻮﻱ ‪ ،Interface‬ﺍﺯ ﺗﻨﻈﻴﻤﺎﺕ ﺩﺭﺳﺖ ﻫﺮ ﺩﻭ ﻭﺍﺳﻂ ﺍﻃﻤﻴﻨﺎﻥ ﺣﺎﺻﻞ ﻧﻤﺎﻳﻴﺪ‪.‬‬
‫ﺣﺎﻝ ﻓﻌﺎﻟﻴﺖﻫﺎﻱ ﺯﻳﺮ ﺭﺍ ﺍﻧﺠﺎﻡ ﺩﻫﻴﺪ‪،‬‬
‫‪.۱‬‬
‫ﺍﺯ ﻓﻌﺎﻝ ﺑﻮﺩﻥ ‪ NAT‬ﺁﻥ ﺍﻃﻤﻴﻨﺎﻥ ﺣﺎﺻﻞ ﻧﻤﺎﻳﻴﺪ‪ ،‬ﺩﺭ ﺍﻳﻦ ﺻﻮﺭﺕ ﺍﮔﺮ ﺭﺍﻳﺎﻧﻪ ﺷﻤﺎ ﺑﻪ ﺍﻳﻨﺘﺮﻧﺖ ﺩﺳﺘﺮﺳﻲ ﺩﺍﺷﺘﻪ ﺑﺎﺷﺪ‪ ،‬ﺑﺎﻳﺪ ‪ OS2‬ﮐﻪ ﺩﺭ‬
‫‪ VMWare‬ﻧﺼﺐ ﮐﺮﺩﻩﺍﻳﺪ ﻫﻢ ﺑﻪ ﺍﻳﻨﺘﺮﻧﺖ ﺩﺳﺘﺮﺳﻲ ﺩﺍﺷﺘﻪ ﺑﺎﺷﺪ‪ ،‬ﺁﻥ ﺭﺍ ﺑﺮﺭﺳﻲ ﻧﻤﺎﻳﻴﺪ ﻭ ﺑﺎ ﺍﻧﺠﺎﻡ ﺩﺳﺘﻮﺭ ﺯﻳﺮ ﺍﺯ ﺁﻥ ﻣﻄﻤﺌﻦ ﺷﻮﻳﺪ‪) :‬ﺩﺭ‬
‫ﺻﻮﺭﺕ ﻋﺪﻡ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﻭﻳﻨﺪﻭﺯ ﺍﺯ ﺩﺳﺘﻮﺭ ‪ Traceroute‬ﺍﺳﺘﻔﺎﺩﻩ ﻧﻤﺎﻳﻴﺪ‪(.‬‬
‫‪Tracert -d 8.8.8.8‬‬
‫ﺩﺭ ﮔﺰﺍﺭﺵ ﺧﻮﺩ ﺧﺮﻭﺟﻲ ﺍﻳﻦ ﺩﺳﺘﻮﺭ ﻭ ﻫﻤﭽﻨﻴﻦ ﺑﺨﺸﻲ ﺍﺯ ‪ PfSense‬ﺭﺍ ﮐﻪ ﻣﺆﻳﺪ ﺍﻳﻦ ﺍﺗﻔﺎﻕ ﺍﺳﺖ ﺭﺍ ﻗﺮﺍﺭ ﺩﻫﻴﺪ‪) .‬ﺍﻳﻨﮑﻪ ﺩﺭ ﮐﺪﺍﻡ ﺑﺨﺶ‬
‫‪ PfSense‬ﭼﻨﻴﻦ ﺍﻃﻼﻋﺎﺗﻲ ﻧﻤﺎﻳﺶ ﺩﺍﺩﻩ ﻣﻲﺷﻮﺩ ﻫﻢ ﺑﺨﺸﻲ ﺍﺯ ﺗﻤﺮﻳﻦ ﺍﺳﺖ‪(.‬‬
‫‪ .۲‬ﺑﺎ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﺗﻨﻈﻴﻤﺎﺕ ﺩﻳﻮﺍﺭﺁﺗﺶ ‪ PfSense‬ﺩﺳﺘﺮﺳﻲ ﺍﻳﻦ ﺳﻴﺴﺘﻢ ﺭﺍ ﺑﻪ ﺍﻳﻨﺘﺮﻧﺖ ﺑﻪ ﺁﺩﺭﺱﻫﺎﻳﻲ ﮐﻪ ﺑﺎ ‪ ۲۱۳‬ﺷﺮﻭﻉ ﻣﻲﺷﻮﻧﺪ ﻣﺤﺪﻭﺩ‬
‫ﻧﻤﺎﻳﻴﻢ‪).‬ﺑﺮﺍﻱ ﻣﺜﺎﻝ ﺩﺭ ﻧﺘﻴﺠﻪ ﺍﻳﻦ ﻗﺎﻧﻮﻥ ﻧﻤﻲﺗﻮﺍﻥ ﺑﻪ ‪ ce.sharif.edu‬ﺩﺳﺘﺮﺳﻲ ﺩﺍﺷﺖ( )ﺗﺼﻮﻳﺮ ﺩﺳﺘﻮﺭ ﻫﺎﻱ ﺍﺳﺘﻔﺎﺩﻩ ﺷﺪﻩ ﺭﺍ ﺩﺭ ﮔﺰﺍﺭﺵ‬
‫ﺧﻮﺩ ﻗﺮﺍﺭ ﺩﻫﻴﺪ‪(.‬‬
‫‪ .۳‬ﺩﺳﺘﺮﺳﻲ ﺑﻪ ﺗﻤﺎﻣﻲ ﺳﺎﻳﺖﻫﺎ ﺑﻪ ﺟﺰ ﺁﺩﺭﺱﻫﺎﻳﻲ ﮐﻪ ﺑﺎ ‪ ۲۱۳‬ﺷﺮﻭﻉ ﻣﻲﺷﻮﻧﺪ ﻣﺤﺪﻭﺩ ﺷﻮﺩ‪.‬‬
‫‪ .۴‬ﺑﺴﺘﻪ ﻫﺎﻱ ‪ ping‬ﺍﺭﺳﺎﻝ ﺷﻮﻧﺪ‪ ،‬ﻭﻟﻲ ﭘﺎﺳﺦ ﺁﻥﻫﺎ ﺍﺯ ﺩﻳﻮﺍﺭﺁﺗﺶ ﺭﺩ ﻧﺸﻮﻧﺪ‪.‬‬
‫)ﺍﻣﺘﻴﺎﺯﻱ( ﻗﺪﻡ ﺑﻌﺪﻱ ﮐﻪ ﺑﺎﻳﺪ ﺑﺮﺩﺍﺷﺘﻪ ﺷﻮﺩ ﺍﻳﻦ ﺍﺳﺖ ﮐﻪ ﺍﻣﮑﺎﻥ ﺑﺮﻗﺮﺍﺭﻱ ﺍﺭﺗﺒﺎﻁ ‪ PPTP VPN‬ﺑﻪ ﺁﻥ ﺭﺍ ﺑﺮﻗﺮﺍﺭ ﮐﻨﻴﺪ‪) .‬ﺑﺮﺍﻱ ﺍﻣﺘﺤﺎﻥ ﺍﻳﻦ ﺑﺨﺶ ﺍﺯ‬
‫ﺳﻴﺴﺘﻢ ﻋﺎﻣﻞ ﺍﺻﻠﻲ ﺷﻤﺎ ﺑﻪ ﺁﻥ ﺍﺭﺗﺒﺎﻁ ‪ VPN‬ﺑﺮﻗﺮﺍﺭ ﺑﺎﻳﺪ ﺑﺸﻮﺩ‪ ،‬ﺩﻗﺖ ﮐﻨﻴﺪ ﮐﻪ ﺷﺎﻳﺪ ﻧﻴﺎﺯ ﺑﺎﺷﺪ ﮐﻪ ﺗﻐﻴﻴﺮﺍﺗﻲ ﺩﺭ ‪ rule‬ﻫﺎﻱ ﺩﻳﻮﺍﺭﺁﺗﺶ ﺍﻧﺠﺎﻡ ﺩﻫﻴﺪ‪.‬‬
‫ﺩﺭ ﺻﻮﺭﺗﻲ ﮐﻪ ﺩﺭ ﺑﺮﻗﺮﺍﺭ ﺁﻥ ﻣﺸﮑﻠﻲ ﻭﺟﻮﺩ ﺩﺍﺭﺩ‪ ،‬ﺍﺯ ﻣﺴﺘﻨﺪﺳﺎﺯﻱﻫﺎﻳﻲ ﮐﻪ ﺑﺮﺍﻱ ﺍﻳﻦ ﺩﻳﻮﺍﺭﺁﺗﺶ ﺩﺭ ﺍﻳﻨﺘﺮﻧﺖ ﻭﺟﻮﺩ ﺩﺍﺭﺩ ﺍﺳﺘﻔﺎﺩﻩ ﻧﻤﺎﻳﻴﺪ(‬
‫‪Image File‬‬
‫‪3‬‬
‫ﺩﺭ ﺁﺧﺮ ﻫﻢ ﺑﻪ ﺑﺨﺶ ﺗﻨﻈﻴﻤﺎﺕ ‪ VPN->IPSEC->Tunnels‬ﺑﺮﻭﻳﺪ‪ ،‬ﺳﭙﺲ ﺭﻭﻱ ﻗﺴﻤﺖ ﺍﺿﺎﻓﻪ ﮐﺮﺩﻥ ﻳﮏ ‪ Entry‬ﮐﻠﻴﮏ ﮐﺮﺩﻩ ﻭ ﺳﭙﺲ ﺷﺮﺡ‬
‫ﮐﻮﺗﺎﻫﻲ ﺩﺭ ﻣﻮﺭﺩ ﻫﺮ ﻳﮏ ﺍﺯ ﺗﻨﻈﻴﻤﺎﺕ ﺍﻳﻦ ﺑﺨﺶ ﺑﻨﻮﻳﺴﻴﺪ)ﺩﺭ ﺣﺪﻱ ﺑﻨﻮﻳﺴﻴﺪ ﮐﻪ ﺩﺭ ﺭﻭﺯ ﺍﺭﺍﺋﻪ‪ ،‬ﺑﺎﻋﺚ ﻳﺎﺩﺁﻭﺭﻱ ﺁﻥ ﺷﻮﺩ‪ ،‬ﮐﺎﻓﻲ ﺍﺳﺖ‪(.‬‬
‫ﺑﺨﺶ ﺍﻣﺘﻴﺎﺯﻱ ‪ -۲‬ﺍﻧﺠﺎﻡ ﺗﻨﻈﻴﻤﺎﺕ ﻭ ﻳﺎ ﺭﺍﻩ ﺍﻧﺪﺍﺯﻱ ﻫﺮ ﮐﺪﺍﻡ ﺍﺯ ﺑﺨﺶﻫﺎﻳﻲ ﮐﻪ ﺟﺰﺋﻲ ﺍﺯ ﺍﻳﻦ ﺗﻤﺮﻳﻦ ﻧﻴﺴﺖ‪ ،‬ﻧﻤﺮﻩ ﺍﺿﺎﻓﻲ ﺩﺍﺭﺩ‪ .‬ﺑﺮﺍﻱ ﻣﺜﺎﻝ‪:‬‬
‫•‬
‫ﺍﻧﺠﺎﻡ ﺗﻨﻈﻴﻤﺎﺕ ﻳﮏ ﺍﺭﺗﺒﺎﻁ ﻭﻱ ﭘﻲ ﺍﻥ ‪) l2tp/ipsec‬ﺁﻳﺎ ﺍﺻﻼ ﺍﻣﮑﺎﻥ ﭘﺬﻳﺮ ﺍﺳﺖ؟(‬
‫•‬
‫•‬
‫‪Traffic Shaper‬‬
‫ﻭ ﻳﺎ ﻫﺮ ﺑﺨﺶ ﻣﻮﺭﺩ ﻋﻼﻗﻪ ﺩﻳﮕﺮ ﻣﺘﻨﺎﺳﺐ ﺑﺎ ﺣﺠﻢ ﮐﺎﺭ‬
‫ﮐﻨﺘﺮﻝ ﺩﺳﺘﺮﺳﻲ‬
‫ﺩﺭ ﺍﻳﻦ ﻗﺴﻤﺖ ﺍﺯ ﻣﻔﺎﻫﻴﻢ ﻣﺨﺘﻠﻒ ﻣﺮﺑﻮﻁ ﺑﻪ ﮐﻨﺘﺮﻝ ﺩﺳﺘﺮﺳﻲ ﺳﻮﺍﻻﺗﻲ ﻣﻄﺮﺡ ﺷﺪﻩ ﺍﺳﺖ‪.‬‬
‫‪.۱‬‬
‫ﺣﺴﺎﻡ ﻣﻲﺗﻮﺍﻧﺪ ﻓﺎﻳﻞ ‪ x‬ﺭﺍ ﺑﺨﻮﺍﻧﺪ ﻭ ﺑﻨﻮﻳﺴﺪ‪ ،‬ﻓﺎﻳﻞ ‪ y‬ﺭﺍ ﺑﺨﻮﺍﻧﺪ ﻭ ﻓﺎﻳﻞ ‪ z‬ﺭﺍ ﺍﺟﺮﺍ ﮐﻨﺪ‪ .‬ﻋﻠﻲ ﻣﻲﺗﻮﺍﻧﺪ ﻓﺎﻳﻞ ‪ x‬ﺭﺍ ﺑﺨﻮﺍﻧﺪ ‪ ،‬ﻓﺎﻳﻞ ‪ y‬ﺭﺍ ﺑﺨﻮﺍﻧﺪ‬
‫ﻭ ﺑﻨﻮﻳﺴﺪ ﻭ ﺑﻪ ﻓﺎﻳﻞ ‪ z‬ﺩﺳﺘﺮﺳﻲ ﻧﺪﺍﺭﺩ‪.‬‬
‫‪٤‬‬
‫‪ .a‬ﻳﮏ ﻟﻴﺴﺖ ﮐﻨﺘﺮﻝ ﺩﺳﺘﺮﺳﻲ ﺑﺮﺍﻱ ﺍﻳﻦ ﻣﻮﻗﻌﻴﺖ ﺑﻨﻮﻳﺴﻴﺪ ﻭ ﺑﻴﺎﻥ ﮐﻨﻴﺪ ﮐﻪ ﺍﻳﻦ ﻟﻴﺴﺖ ﺑﺎ ﭼﻪ ﺷﻲ ﺩﺭ ﺍﺭﺗﺒﺎﻁ ﺍﺳﺖ ‪.‬‬
‫‪ .b‬ﻳﮏ ﻟﻴﺴﺖ ﺗﻮﺍﻧﺎﻳﻲ‪ ٥‬ﺑﺮﺍﻱ ﺍﻳﻦ ﻣﻮﻗﻌﻴﺖ ﺑﻨﻮﻳﺴﻴﺪ ﻭ ﺑﻴﺎﻥ ﮐﻨﻴﺪ ﮐﻪ ﻫﺮ ﻟﻴﺴﺖ ﺑﺎ ﭼﻪ ﭼﻴﺰﻱ ﺩﺭ ﺍﺭﺗﺒﺎﻁ ﺍﺳﺖ ‪.‬‬
‫‪.۲‬‬
‫ﻓﺮﺽ ﮐﻨﻴﺪ ﺳﻴﺴﺘﻤﻲ ﺑﺮﺍﻱ ﻣﻘﺎﺑﻠﻪ ﺑﺎ ﺗﺮﻭﺟﺎﻥ ﻫﺎ ﺍﺯ ﻟﻴﺴﺖ ﺗﻮﺍﻧﺎﻳﻲ ﺍﺳﺘﻔﺎﺩﻩ ﻣﻲﮐﻨﺪ‪.‬‬
‫‪ .a‬ﺑﻪ ﻃﻮﺭ ﮐﻠﻲ ﺁﻳﺎ ﻟﻴﺴﺖ ﺗﻮﺍﻧﺎﻳﻲ ﺩﺭ ﻣﻘﺎﻳﺴﻪ ﺑﺎ ﻟﻴﺴﺖ ﮐﻨﺘﺮﻝ ﺩﺳﺘﺮﺳﻲ ﻣﺤﺎﻓﻈﺖ ﺑﻴﺸﺘﺮﻱ ﺩﺭ ﻗﺒﺎﻝ ﺗﺮﻭﺟﺎﻥ ﻫﺎ ﺍﻳﺠﺎﺩ ﻣﻲﮐﻨﺪ؟‬
‫ﻓﺮﺽ ﮐﻨﻴﺪ ﻟﻴﺴﺖ ﻗﺎﺑﻠﻴﺖ ﺍﺯ ﻧﻈﺮ ﺗﺌﻮﺭﻱ ﺑﺎ ﻟﻴﺴﺖ ﮐﻨﺘﺮﻝ ﺩﺳﺘﺮﺳﻲ ﻣﻌﺎﺩﻝ ﺍﺳﺖ‪.‬‬
‫‪.b‬‬
‫ﺧﺎﺻﻴﺖ ﺍﺭﺙ ﺑﺮﻱ ﺩﺭ ﻓﺮﺍﻳﻨﺪ‪ ٦‬ﺟﺪﻳﺪ ﺭﺍ ﻧﻈﺮ ﺑﮕﻴﺮﻳﺪ‪ .‬ﺍﮔﺮ ﻓﺮﺍﻳﻨﺪ ﺍﻳﺠﺎﺩ ﮐﻨﻨﺪﻩ ﻱ ﻗﺎﺑﻠﻴﺖﻫﺎﻳﻲ ﺭﺍ ﮐﻪ ﻓﺮﺍﻳﻨﺪ ﺍﻳﺠﺎﺩ ﺷﺪﻩ ﺩﺭ ﺍﺑﺘﺪﺍ‬
‫ﺑﻪ ﺍﺭﺙ ﻣﻲﺑﺮﺩ ﮐﻨﺘﺮﻝ ﮐﻨﺪ‪ ،‬ﺩﺭ ﭼﻪ ﺻﻮﺭﺕ ﻓﺮﺍﻳﻨﺪ ﺍﻳﺠﺎﺩ ﮐﻨﻨﺪﻩ ﻣﻲﺗﻮﺍﻧﺪ ﺟﻠﻮﻱ ﺁﺳﻴﺐﻫﺎﻱ ﺣﺎﺻﻞ ﺍﺯ ﺗﺮﻭﺟﺎﻥ ﺭﺍ ﺑﮕﻴﺮﺩ؟‬
‫‪.c‬‬
‫ﺁﻳﺎ ﻟﻴﺴﺖ ﺗﻮﺍﻧﺎﻳﻲ ﻣﻲﺗﻮﺍﻧﺪ ﺟﻠﻮﻱ ﺍﻧﻮﺍﻉ ﺗﺮﻭﺟﺎﻥ ﻫﺎ ﺭﺍ ﺑﮕﻴﺮﺩ؟ ﻳﺎ ﻧﺸﺎﻥ ﺩﻫﻴﺪ ﮐﻪ ﻣﻲﺗﻮﺍﻧﺪ ﻳﺎ ﻣﺜﺎﻟﻲ ﺍﺭﺍﺋﻪ ﮐﻨﻴﺪ ﮐﻪ ﻟﻴﺴﺖ‬
‫ﺗﻮﺍﻧﺎﻳﻲ ﻧﻤﻲﺗﻮﺍﻧﺪ ﺟﻠﻮﻱ ﺁﻥ ﺭﺍ ﺑﮕﻴﺮﺩ‪.‬‬
‫‪.۳‬‬
‫ﺑﺎ ﻓﺮﺽ ﺭﺩﻩ ﻫﺎﻱ ﺍﻣﻨﻴﺘﻲ ﺧﻴﻠﻲ ﺳﺮﻱ ‪،‬ﺳﺮﻱ ‪ ،‬ﻣﺤﺮﻣﺎﻧﻪ ﻭ ﺑﺪﻭﻥ ﻃﺒﻘﻪ ﺑﻨﺪﻱ ) ﺑﻪ ﺗﺮﺗﻴﺐ ﺍﺯ ﺑﺎﻻﺗﺮﻳﻦ ﺑﻪ ﭘﺎﻳﻴﻦﺗﺮﻳﻦ( ﻭ ﺭﺳﺘﻪ ﻫﺎﻱ ‪B ، A‬‬
‫ﻭ ‪ C‬ﻭ ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ ﻣﺪﻝ ‪ BLP‬ﺑﻴﺎﻥ ﮐﻨﻴﺪ ﮐﻪ ﮐﺪﺍﻣﻴﮏ ﺍﺯ ﺩﺳﺘﺮﺳﻲﻫﺎﻱ ﺯﻳﺮ ﻗﺒﻮﻝ ﻭ ﮐﺪﺍﻣﻴﮏ ﺭﺩ ﻣﻲﺷﻮﻧﺪ‪.‬‬
‫‪ .a‬ﻋﻠﻲ ﺩﺳﺘﺮﺳﻲ )ﺧﻴﻠﻲ ﺳﺮﻱ ‪ ({A,C} ،‬ﺭﺍ ﺩﺍﺭﺩ ﻭ ﻣﻲﺧﻮﺍﻫﺪ ﺑﻪ ﺳﻨﺪﻱ ﺑﺎ ﺳﻄﺢ )ﺳﺮﻱ‪ ( {C} ،‬ﺩﺳﺘﺮﺳﻲ ﭘﻴﺪﺍ ﮐﻨﺪ‪.‬‬
‫‪ .b‬ﺣﺴﺎﻡ ﺩﺳﺘﺮﺳﻲ )ﻣﺤﺮﻣﺎﻧﻪ ‪ ({C} ،‬ﺭﺍ ﺩﺍﺭﺩ ﻭ ﻣﻲﺧﻮﺍﻫﺪ ﺑﻪ ﺳﻨﺪﻱ ﺑﺎ ﺳﻄﺢ )ﻣﺤﺮﻣﺎﻧﻪ‪ ( {B} ،‬ﺩﺳﺘﺮﺳﻲ ﭘﻴﺪﺍ ﮐﻨﺪ‪.‬‬
‫‪.c‬‬
‫ﻳﺪﺍﻟﻪ ﺩﺳﺘﺮﺳﻲ )ﺳﺮﻱ ‪ ({C} ،‬ﺭﺍ ﺩﺍﺭﺩ ﻭ ﻣﻲﺧﻮﺍﻫﺪ ﺑﻪ ﺳﻨﺪﻱ ﺑﺎ ﺳﻄﺢ )ﻣﺤﺮﻣﺎﻧﻪ‪ ( {C} ،‬ﺩﺳﺘﺮﺳﻲ ﭘﻴﺪﺍ ﮐﻨﺪ‪.‬‬
‫‪ .d‬ﻳﻌﻘﻮﺏ ﺩﺳﺘﺮﺳﻲ )ﺧﻴﻠﻲ ﺳﺮﻱ ‪ ({A,C} ،‬ﺭﺍ ﺩﺍﺭﺩ ﻭ ﻣﻲﺧﻮﺍﻫﺪ ﺑﻪ ﺳﻨﺪﻱ ﺑﺎ ﺳﻄﺢ )ﻣﺤﺮﻣﺎﻧﻪ‪ ( {A} ،‬ﺩﺳﺘﺮﺳﻲ ﭘﻴﺪﺍ ﮐﻨﺪ‪.‬‬
‫‪ .e‬ﻣﻘﺪﺍﺩ ﻫﻴﭻ ﺩﺳﺘﺮﺳﻲ ﻧﺪﺍﺭﺩ ) ﺩﺭ ﺭﺩﻩ ﺑﺪﻭﻥ ﻃﺒﻘﻪ ﺑﻨﺪﻱ ﻗﺮﺍﺭ ﺩﺍﺭﺩ( ﻣﻲﺧﻮﺍﻫﺪ ﺑﻪ ﺳﻨﺪﻱ ﺑﺎ ﺳﻄﺢ )ﻣﺤﺮﻣﺎﻧﻪ‪ ( {B} ،‬ﺩﺳﺘﺮﺳﻲ‬
‫ﭘﻴﺪﺍ ﮐﻨﺪ‪.‬‬
‫‪4‬‬
‫‪Access control List‬‬
‫‪Capability list‬‬
‫‪6‬‬
‫‪Process‬‬
‫‪5‬‬
‫‪.۴‬‬
‫ﻳﮏ ﺳﻴﺴﺘﻢ ﺍﺯ ﺭﻭﺵ ‪ Biba‬ﺍﺳﺘﻔﺎﺩﻩ ﻣﻲﮐﻨﺪ‪ .‬ﻳﮏ ﻭﻳﺮﻭﺱ ﺩﺭ ﺷﺮﺍﻳﻂ ﺯﻳﺮ ﭼﮕﻮﻧﻪ ﻣﻲﺗﻮﺍﻧﺪ ﭘﺨﺶ ﺷﻮﺩ‬
‫‪ .a‬ﻭﻳﺮﻭﺱ ﺩﺭ ﻗﺴﻤﺘﻲ ﺑﺎ ﺳﻄﺢ ﺻﺤﺘﻲ ‪ low‬ﻗﺮﺍﺭ ﺩﺍﺭﺩ ) ﻗﺴﻤﺘﻲ ﮐﻪ ﻫﻤﻪﻱ ﻗﺴﻤﺖﻫﺎ ﺑﺮ ﺁﻥ ﺗﻔﻮﻕ ﺩﺍﺭﻧﺪ(‬
‫‪ .b‬ﻭﻳﺮﻭﺱ ﺩﺭ ﻗﺴﻤﺘﻲ ﺑﺎ ﺳﻄﺢ ﺻﺤﺘﻲ ‪ high‬ﻗﺮﺍﺭ ﺩﺍﺭﺩ ) ﻗﺴﻤﺘﻲ ﮐﻪ ﺑﺮ ﻫﻤﻪﻱ ﻗﺴﻤﺖﻫﺎﻱ ﺩﻳﮕﺮ ﺗﻔﻮﻕ ﺩﺍﺭﺩ(‬
‫ﺑﺎ ﺗﻮﺟﻪ ﺑﻪ ﺍﻳﻨﮑﻪ ﺣﺠﻢ ﮔﺰﺍﺭﺵﻫﺎﻱ ﺷﻤﺎ‪ ،‬ﺑﻪ ﺩﻟﻴﻞ ﻭﺟﻮﺩ ﻋﮑﺲﻫﺎ ﺍﺯ ﻣﺮﺍﺣﻞ ﺍﻧﺠﺎﻡ ﮐﺎﺭ‪ ،‬ﺯﻳﺎﺩ ﺍﺳﺖ ﺍﺯ ﺍﺭﺳﺎﻝ ﮔﺰﺍﺭﺵﻫﺎ ﺑﻪ ‪ TA‬ﻫﺎ ﺧﻮﺩﺩﺍﺭﻱ ﮐﻨﻴﺪ ﻭ‬
‫ﻓﻘﻂ ﻣﻘﺪﺍﺭ ﺩﺭﻫﻢﺳﺎﺯﻱ ‪ MD5‬ﻳﺎ ‪ SHA1‬ﺁﻧﻬﺎ ﺭﺍ ﺍﺭﺳﺎﻝ ﻧﻤﺎﻳﻴﺪ ﻭ ﮔﺰﺍﺭﺵﻫﺎ ﻫﻨﮕﺎﻡ ﺗﺤﻮﻳﻞ ﺣﻀﻮﺭﻱ ﺍﺯ ﺷﻤﺎ ﺗﺤﻮﻳﻞ ﮔﺮﻓﺘﻪ ﻣﻲﺷﻮﻧﺪ‪) .‬ﺍﻳﻦ‬
‫ﺑﺨﺶ ﺗﻤﺮﻳﻦ ﻫﻢ ﺍﺟﺒﺎﺭﻱ ﺍﺳﺖ ﻭ ﺍﺧﺘﻴﺎﺭﻱ ﻧﻤﻲﺑﺎﺷﺪ(‬