Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 30)

/etc/hosts.allow, where specific services are listed, along with the specific host addresses allowed to

access these services. While hostnames can be used here, use of hostnames opens the limited possibility for

name spoofing.

Tcpwrappers is commonly used to protect services that are started via inetd (or xinetd). But also any program

that has been compiled with libwrap support, can take advantage of it. Just don't assume that all programs

have built in libwrap support −− they do not. In fact, most probably don't. So we will only use it in our

examples here to protect services start via inetd. And then rely on our packet filtering firewall, or other

mechanism, to protect non−(x)inetd services.

Below is a small snippet from a typical inetd.conf file:

# Pop and imap mail services et al

#pop−2 stream tcp nowait root /usr/sbin/tcpd ipop2d

#pop−3 stream tcp nowait root /usr/sbin/tcpd ipop3d

#imap stream tcp nowait root /usr/sbin/tcpd imapd

The second to last column is the tcpwrappers daemon −− /usr/sbin/tcpd. Immediately after is the daemon it

is protecting. In this case, POP and IMAP mail servers. Your distro probably has already done this part for

you. For the few applications that have built−in support for tcpwrappers via the libwrap library, specifying

the daemon as above is not necessary.

We will use the same principles here: default policy is to deny everything, then open holes to allow the

minimal amount of traffic necessary.

So now with your text editor, su to root and open /etc/hosts.deny. If it does not exist, then create it. It

is just a plain text file. We want the following line:

ALL: ALL

If it is there already, fine. If not, add it in and then save and close file. Easy enough. "ALL" is one of the

keywords that tcpwrappers understands. The format is $SERVICE_NAME : $WHO, so we are denying all

connections to all services here. At least all services that are using tcpwrappers. Remember, this will

primarily be inetd services. See man 5 hosts_access for details on the syntax of these files. Note the

"5" there!

Now let's open up just the services we need, as restrictively as we can, with a brief example:

ALL: 127.0.0.1

sshd,ipop3d: 192.168.1.

sshd: .myworkplace.com, hostess.mymomshouse.com

The first line allows all "localhost" connections. You will need this. The second allows connections to the

sshd and ipop3d services from IP addresses that start with 192.168.1., in this case the private address

range for our hypothetical home LAN. Note the trailing ".". It's important. The third line allows connections

Security Quick−Start HOWTO for Red Hat Linux

5.3. Tcpwrappers (libwrap) 27

1 2 ... 25 26 27 28 29 30 31 32 33 34 35 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 30