Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 127)

Chapter 9. TCP Wrappers and xinetd 127

two ﬁles, /etc/hosts.allow and /etc/hosts.deny, each service’s ﬁle in /etc/xinetd.d can

contain access control rules based on the hosts that will be allowed to use that service.

The following options are supported in the xinetd ﬁles to control host access:

• only_from — Allows the hosts speciﬁed to use the service.

• no_access — Blocks these hosts from using this service.

• access_times — Speciﬁes the time range when a particular service may be used. The time range

must be stated in a HH:MM-HH:MM format using 24-hour notation.

The only_from and no_access options can use a list of IP addresses or host names, or you can

specify an entire network. Like TCP wrappers, combining xinetd access control with the proper

logging conﬁguration for that service, you can not only block the request but also record every attempt

to access it.

For example, the following /etc/xinetd.d/telnet ﬁle can be used to block telnet access to a

system by a particular network group and restrict the overall time range that even legitimate users can

service telnet

{

disable = no

flags = REUSE

socket_type = stream

wait = no

user = root

server = /usr/sbin/in.telnetd

log_on_failure += USERID

no_access = 10.0.1.0/24

log_on_success += PID HOST EXIT

access_times = 09:45-16:15

}

In this example, when any system from the 10.0.1.0/24 subnet, such as 10.0.1.2, tries to telnet

into the boo host, they will receive a message stating Connection closed by foreign host.

In addition, their login attempt is logged in /var/log/secure:

May 15 17:35:47 boo xinetd[16188]: START: telnet pid=16191 from=10.0.1.2

May 15 17:38:49 boo xinetd[16252]: START: telnet pid=16256 from=10.0.1.2

May 15 17:38:49 boo xinetd[16256]: FAIL: telnet address from=10.0.1.2

May 15 17:38:49 booxinetd[16252]: EXIT: telnet status=0 pid=16256

9.3.1.4. Binding and Port Redirection

The service conﬁguration ﬁles for xinetd also support binding the service to a particular IP address

and redirecting incoming requests for that service to another IP address, hostname, or port.

Binding, controlled with the bind option in the service conﬁguration ﬁles, speciﬁcally links the ser-

vice to a particular IP address in use with the system, only allowing requests that use that IP address

to access the service. This is particularly useful for systems with multiple network adapters and using

multiple IP addresses, such as machines being used as ﬁrewalls, with one network adapter facing the

Internet and the other connected to an internal network. Attackers attempting to connect for a speciﬁc

service, such as telnet or FTP, via the Internet connection may be blocked from connecting to the

service while internal users may connect to the service via the NIC connected to the internal network.

The redirect option, which accepts an IP address or hostname followed by a port number, tells the

service to redirect any requests for this service to the speciﬁed location. This feature can be used to

1 2 ... 122 123 124 125 126 127 128 129 130 131 132 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 127

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE