Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Instalační příručka stáhnout pdf (Strana 121)

Chapter 9.

TCP Wrappers and xinetd

Controlling access to network services can be a challenge. Firewalls are useful for controlling access

in and out of a particular network, but they can be difﬁcult to conﬁgure. TCP wrappers and xinetd

control access to services by hostname and IP addresses. In addition, these tools also include logging

and utilization management capabilities that are easy to conﬁgure.

9.1. Purpose of TCP Wrappers

Many modern network services, such as SSH, Telnet, and FTP, make use of TCP wrappers, a program

that is designed to stand between an incoming request and the requested service. TCP wrappers is

installed by default with a server-class installation of Red Hat Linux, providing many advantages over

running a variety of different services, each with their own access control methods.

The idea behind TCP wrappers is that client requests to server applications are "wrapped" by an

authenticating service, allowing a greater degree of access control and logging of who is attempting

to use the service, rather than the usual method of direct client connections to a service.

The functionality behind TCP wrappers is provided by libwrap.a, a library that network services,

such as xinetd, sshd, and portmap, are compiled against. Additional network services, even net-

working programs you may write, can be compiled against libwrap.a to provide this functionality.

Red Hat Linux bundles the necessary TCP wrapper programs and library in the tcp_wrappers-

version RPM ﬁle.

9.1.1. TCP Wrapper Advantages

When a user attempts to gain client access to a network service that is using TCP wrappers, a small

wrapper program reports the name of the service requested and the client’s host information. The

wrapper program does not directly send any information back to the client, and after the access control

directives are satisﬁed, the wrapper is unloaded and frees any resources associated with it. The client

and the server can then resume actions without further wrapper intervention.

TCP wrappers provide two basic advantages over other network service control techniques:

• The connecting client is unaware that TCP wrappers are in use. Legitimate users will not notice

anything different, and attackers never receive any additional information about why their attempted

connections have failed.

• TCP wrappers operate in a manner that is separate from the applications the wrapper program

protects. This allows many applications to share a common set of conﬁguration ﬁles for simpler

management.

9.2. Host-Based Access Control Lists

Host-based access for services that use TCP wrappers is controlled by two ﬁles: hosts.allow and

hosts.deny. These ﬁles, located in the /etc directory, use a simple format to control access by

particular systems or users to certain services on a server.

The default rule is to allow anyone to access to the services if no rules are speciﬁed in either

hosts.allow or hosts.deny. Rules in hosts.allow take precedence over rules speciﬁed in

hosts.deny. Even if a rule speciﬁcally denying all access to a particular service is deﬁned in

hosts.deny, hosts speciﬁcally given access to the service in hosts.allow are allowed to access it.

1 2 ... 116 117 118 119 120 121 122 123 124 125 126 ... 281 282

Žádné komentáře

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Instalační příručka Strana 121