Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 128)

128 Chapter 9. TCP Wrappers and xinetd

point to another port number on the same system, redirect the request to different IP address on the

same machine, shift the request to a totally different system and port number, or any combination of

these options. In this way, a user connecting to certain service on a system may be rerouted to another

system with no disruption.

The xinetd daemon is able to accomplish this redirection by spawning a process that stays alive for

the duration of the connection between the requesting client machine and the host actually providing

the service, transferring data between the two systems.

The real strength of the bind and redirect options can be seen when they are used together. By

binding a service to a particular IP address on a system and then redirecting requests for this service

to a second machine that only the ﬁrst machine can see, you can use an internal system to provide

services for a totally different network. Alternatively, these options can be used to limit the exposure

of a particular service on a multihomed machine to a known IP address, as well as redirect any requests

for that service to another machine specially conﬁgured for that purpose.

For example, consider a system that is used as a ﬁrewall with this setting for its telnet service:

service telnet

{

socket_type = stream

wait = no

server = /usr/sbin/in.telnetd

log_on_success += DURATION USERID

log_on_failure += USERID

bind = 123.123.123.123

redirect = 10.0.1.13 21 23

}

The bind and redirect options in this ﬁle will ensure that the telnet service on the machine is bound

to the external IP address (123.123.123.123), the one facing the Internet. In addition, any requests for

telnet service sent to 123.123.123.123 will be redirected via a second network adapter to an internal IP

address (10.0.1.13) that only the ﬁrewall and internal systems can access. The ﬁrewall will then send

the communication between the two systems, and the connecting system will think it is connected to

123.123.123.123 when it is actually connected to a different machine.

This feature is particularly useful for users with broadband connections and only one ﬁxed IP address.

When using Network Address Translation (NAT), the systems behind the gateway machine, which

are using internal-only IP addresses, are not available from outside the gateway system. However,

when certain services controlled by xinetd are conﬁgured with the bind and redirect options, the

gateway machine can act as a type of proxy between outside systems and a particular internal machine

conﬁgured to provide the service. In addition, the various xinetd access control and logging options

are also available for additional protection, such as limiting the number of simultaneous connections

for the redirected service.

9.4. Additional Resources

Additional information concerning TCP wrappers and xinetd is available on system documentation

and on the Web.

9.4.1. Installed Documentation

The bundled documentation on your system is a good place to start looking for additional TCP Wrap-

pers, xinetd, and access control conﬁguration options.

1 2 ... 123 124 125 126 127 128 129 130 131 132 133 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 128

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE