Installation guide

124 Chapter 8. TCP Wrappers and xinetd
• EXIT — Logs the exit status or termination signal of the service. (log_on_success)
• HOST — Logs the remote host’s IP address. (log_on_failure and log_on_success)
• PID — Logs the process ID of the server receiving the request. (log_on_success)
• RECORD — Records information about the remote system in the case the service cannot be started.
Only particular services, such as login and finger, may use this option. (log_on_failure)
• USERID — Logs the remote user using the method defined in RFC 1413 for all multi-threaded
stream services. (log_on_failure and log_on_success)
Other options for /etc/xinetd.conf are available, such as per_source, which limits the maxi-
mum number of connections from a particular IP address to a specific service. See the man page for
xinetd for more information.
8.3.1.2. Files in the /etc/xinetd.d/ Directory
The files in the /etc/xinetd.d/ directory are read every time xinetd starts, due to the in-
cludedir /etc/xinetd.d/ statement at the bottom of /etc/xinetd.conf. These files, with
names such as finger, ipop3, and rlogin, correlate to the services controlled by xinetd.
The files in /etc/xinetd.d/ use the same conventions as /etc/xinetd.conf. The primary reason
they are stored in separate configuration files is to make it easier to add and remove a service from
xinetd without affecting other services.
To get an idea of how these files are structured, consider the wu-ftp file:
service ftp
{
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.ftpd
server_args = -l -a
log_on_success += DURATION USERID
log_on_failure += USERID
nice = 10
disable = yes
}
The first line defines the service’s name. The lines within the brackets contain settings that define how
this service is supposed to be started and used. The wu-ftp file states that the FTP service uses a
stream socket type (rather than dgram), the binary executable file to use, the arguments to pass to
the binary, the information to log in addition to the /etc/xinetd.conf settings, the priority with
which to run the service, and more.
The use of xinetd with a service also can serve as a basic level of protection from a Denial of
Service (DoS) attack. The max_load option takes a floating point value to set a CPU usage threshold
when no more connections for a particular service will be accepted, preventing certain services from
overwhelming the system. The cps option accepts an integer value to set a rate limit on the number
of connections available per second. Configuring this value to something low, such as 3, will help
prevent attackers from being able to flood your system with too many simultaneous requests for a
particular service.