Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 126)

126 Chapter 9. TCP Wrappers and xinetd

9.3.1.2. Files in the /etc/xinetd.d Directory

The various ﬁles in the /etc/xinetd.d directory are read every time xinetd starts, due to the

includedir /etc/xinetd.d statement at the bottom of /etc/xinetd.conf. These ﬁles, with

names such as finger, ipop3, and rlogin, relate to the various services controlled by xinetd.

The ﬁles in /etc/xinetd.d use the same conventions and options as what is seen in

/etc/xinetd.conf. The primary reason they are in separate conﬁguration ﬁles, one for each

service, is to make it easier to add and remove services from the domain of xinetd without affecting

its other services.

To get an idea of how these ﬁles are structured, consider the wu-ftp ﬁle:

service ftp

{

socket_type = stream

wait = no

user = root

server = /usr/sbin/in.ftpd

server_args = -l -a

log_on_success += DURATION USERID

log_on_failure += USERID

nice = 10

disable = yes

}

The ﬁrst line deﬁnes the service’s name that is being conﬁgured. Then, the lines within the brackets

contain a variety of different settings that deﬁne how this service is supposed to be started and used.

The wu-ftp ﬁle states that the FTP service uses a streaming socket type (rather than dgram), the

binary executable ﬁle to use, the arguments to pass to the binary, the information to log in addition to

the /etc/xinetd.conf settings, the priority with which to run the service, and more.

The use of xinetd with a particular service also can serve as a basic level of protection from a

Denial of Service (DoS) attack. The max_load option takes a ﬂoating point value to set a CPU

usage threshold when no more connections for a particular service will be accepted, preventing certain

services from overwhelming the system. The cps option accepts an integer value to set a rate limit on

the number of connections available per second. Conﬁguring this value to something low, such as 3,

will help prevent attackers from being able to ﬂood your system with too many simultaneous requests

for a particular service.

9.3.1.3. Access Control within xinetd

Users of xinetd services can choose to use the TCP wrapper host access control ﬁles (hosts.allow

and hosts.deny), provide access control via the xinetd conﬁguration ﬁles, or a mixture of both.

Information concerning the use of TCP wrapper host access control ﬁles can be found in Section 9.2.

This section will discuss using xinetd to control access to the services it controls.

Note

Unlike TCP wrapper host access control ﬁles, any changes to xinetd conﬁguration ﬁles require a

restart of the xinetd service, as well as a restart of any service affected by the change, to go into

affect.

The xinetd host access control available through its various conﬁguration ﬁles is different from the

method used by TCP wrappers. While TCP wrappers places all of the access conﬁguration within

1 2 ... 121 122 123 124 125 126 127 128 129 130 131 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 126

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE