Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 124)

124 Chapter 9. TCP Wrappers and xinetd

Various expansions containing speciﬁc information about the client, server, and process involved are

available to the shell commands:

• %a — The client’s IP address.

• %A — The server’s IP address.

• %c — Various types of client information, such as the username and hostname, or the username and

IP address.

• %d — The daemon process name.

• %h — The client’s hostname (or IP address, if the hostname is unavailable).

• %H — The server’s hostname (or IP address, if the hostname is unavailable).

• %n — The client’s hostname. If unavailable, unknown is printed. If the client’s hostname and host

address do not match, paranoid is printed.

• %N — The server’s hostname. If unavailable, unknown is printed. If the server’s hostname and host

address do not match, paranoid is printed.

• %p — The daemon process ID.

• %s — Various types of server information, such as the daemon process and the host or IP address

of the server.

• %u — The client’s username. If unavailable, unknown is printed.

For a full examination of shell commands, as well as some additional access control examples, review

the hosts_access(5)man page.

Note

Special attention must be given to portmap when using it with host access control lists. Only IP

addresses or the ALL option should be used when specifying hosts to allow or deny, as host names

are not supported. In addition, changes to the host access control lists that concern portmap may

not take affect immediately.

As widely used services, such as NIS and NFS, depend on portmap to operate, be aware of these

limitations before depending on hosts.allow and hosts.deny to control access by certain hosts.

9.3. Access Control Using xinetd

The beneﬁts offered by TCP wrappers are ehnhanced when the libwrap.a library is used in con-

junction with xinetd, a super-daemon that provides additional access, logging, binding, redirection

and resource utilization control.

Red Hat Linux conﬁgures a variety of popular network services to be used with xinetd, including

FTP, IMAP, POP, and Telnet. When any of these services are accessed via their port numbers in

/etc/services, the xinetd daemon handles the request. Before bringing up the requested network

service by the correct user, xinetd ensures that the client host information meets the access control

rules, the number of instances of this service is under a particular threshold, and any other rules

speciﬁed for that service or all xinetd services are followed. Once the target service is brought up

for the connecting client, xinetd goes back to sleep, waiting for additional requests for the services

it manages.

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 124