Installation guide

122 Chapter 8. TCP Wrappers and xinetd
special file or email an administrator. Below is an example of a booby trap in the hosts.deny file
which will write a log line containing the date and client information every time a host from the the
IP range 10.0.1.0 to 10.0.1.255 attempts to connect via Telnet:
in.telnetd: 10.0.1.: spawn (/bin/echo ‘date‘ %c >> /var/log/telnet.log) &
Another feature of using shell commands is support for expansions. Expansions provide the com-
mand with information about the client, server, and process involved. Below is a list of supported
expansions:
• %a — The client’s IP address.
• %A — The server’s IP address.
• %c — Supplies a variety of client information, such as the username and hostname, or the username
and IP address.
• %d — The daemon process name.
• %h — The client’s hostname (or IP address, if the hostname is unavailable).
• %H — The server’s hostname (or IP address, if the hostname is unavailable).
• %n — The client’s hostname. If unavailable, unknown is printed. If the client’s hostname and host
address do not match, paranoid is printed.
• %N — The server’s hostname. If unavailable, unknown is printed. If the server’s hostname and host
address do not match, paranoid is printed.
• %p — The daemon process ID.
• %s — Various types of server information, such as the daemon process and the host or IP address
of the server.
• %u — The client’s username. If unavailable, unknown is printed.
For a full explanation of available shell commands, as well as some additional access control exam-
ples, review see the man page for hosts_access.
Note
Special attention must be given to portmap when host access control lists. Only IP addresses or
the ALL option should be used when specifying hosts to allow or deny, as host names are not sup-
ported. In addition, changes to the host access control lists that concern portmap may not take affect
immediately.
As widely used services, such as NIS and NFS, depend on portmap to operate, be aware of these
limitations before depending on hosts.allow and hosts.deny to control access.
8.3. Access Control Using xinetd
The benefits offered by TCP wrappers are enhanced when the libwrap.a library is used in conjunc-
tion with xinetd, a super-daemon that provides additional access, logging, binding, redirection and
resource utilization control.
Red Hat Linux configures a variety of popular network services to be used with xinetd, including
FTP, IMAP, POP, and Telnet. When any of these services are accessed via their port numbers in
/etc/services, the xinetd daemon handles the request. Before bringing up the requested network
service, xinetd ensures that the client host information meets the access control rules, the number of