Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 123)

Chapter 9. TCP Wrappers and xinetd 123

Caution

The KNOWN, UNKNOWN, and PARANOID wildcards should be used very carefully, as a disruption in name

resolution may make prevent legitimate users from gaining access to a network service.

The access control language also contains a powerful operator, EXCEPT, which allows separate lists to

be combined within the same rule line. When EXCEPT is used between two lists, the ﬁrst list applies

unless an entry from the second list matches an entity covered by the ﬁrst list. EXCEPT can be used

with daemon or client lists. Consider the following hosts.allow example:

# all domain.com hosts are allowed to connect

# to all services except cracker.domain.com

ALL: .domain.com EXCEPT cracker.domain.com

# 123.123.123.* addresses can use all services except FTP

ALL EXCEPT in.ftpd: 123.123.123.

Note

Organizationally, it usually makes more sense to use EXCEPT operators sparingly, choosing instead to

place the exceptions to the rule in the other access control ﬁle. This allows all administrators to quickly

scan the appropriate ﬁles to see what hosts should be allowed or denied access to which services,

without having to work through various EXCEPT operators and work out the appropriate logic.

The best way to manage access control with hosts.allow and hosts.deny is to use the two ﬁles to-

gether to achieve the desired results. Users that wish to prevent any hosts other than speciﬁc ones from

accessing services usually place ALL: ALL in hosts.deny. Then, they place lines in hosts.allow,

such as portmap, in.telnetd: 10.0.1.24 or in.ftpd: 10.0.1. EXCEPT 10.0.1.1, to se-

lectively let certain hosts in.

Alternatively, some administrators allow anyone to use network services except for speciﬁc hosts. In

this case, nothing is placed in hosts.allow and any necessary restrictions are placed in

hosts.deny, such as in.fingerd: 192.168.0.2.

Warning

Be very careful about using hostnames and domain names in both access control ﬁles, especially

hosts.deny. Various tricks could be used by an attacker to circumvent rules specifying them by

name. In addition, if your system selectively allows access based on hostname and domain name

information, any disruption in DNS service would prevent even authorized users from using network

services.

Using IP addresses whenever possible can prevent many problems when constructing access control

rules, especially those that deny access.

Beyond simply allowing or denying access to services for certain hosts, the access control language

also supports the use of shell commands when that rule is utilized. These shell commands are most

commonly used with deny rules to set up booby traps, which usually trigger actions that log informa-

tion about failed attempts to a special ﬁle or email an administrator. This is an example of a booby trap

located in the hosts.deny ﬁle which will write a log line containing the date and client information

every time a host from the 10.0.1.0 to 10.0.1.255 range attempts to connect via Telnet:

in.telnetd: 10.0.1.: spawn (/bin/echo ‘date‘ %c >> /var/log/telnet.log) &

1 2 ... 118 119 120 121 122 123 124 125 126 127 128 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 123