Installation guide

Chapter 8. TCP Wrappers and xinetd 125
8.3.1.3. Access Control within xinetd
Users of xinetd services can choose to use the TCP wrapper host access control files
(/etc/hosts.allow and /etc/hosts.deny), provide access control via the xinetd
configuration files, or a mixture of both. Information concerning the use of TCP wrapper host access
control files can be found in Section 8.2. This section will discuss using xinetd to control access to
services.
Note
Unlike TCP wrapper host access control files, any changes to xinetd configuration files require a
restart of the xinetd service to go into affect.
The xinetd host access control available through its various configuration files is different from the
method used by TCP wrappers. While TCP wrappers places all of the access configuration within
two files, /etc/hosts.allow and /etc/hosts.deny, each service’s file in /etc/xinetd.d can
contain access control rules based on the hosts that will be allowed to use that service.
The following options are supported in the xinetd files to control host access:
• only_from — Allows the hosts specified to use the service.
• no_access — Blocks these hosts from using this service.
• access_times — Specifies the time range when a particular service may be used. The time range
must be stated in a HH:MM-HH:MM format using 24-hour notation.
The only_from and no_access options can use a list of IP addresses or host names, or can specify
an entire network. Like TCP wrappers, combining xinetd access control with the proper logging
configuration for that service, you can not only block the request but also record every attempt to
access it.
For example, the following /etc/xinetd.d/telnet file can be used to block telnet access to a
system by a particular network group and restrict the overall time range that even legitimate users can
log in:
service telnet
{
disable = no
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
no_access = 10.0.1.0/24
log_on_success += PID HOST EXIT
access_times = 09:45-16:15
}
In this example, when any system from the 10.0.1.0/24 subnet, such as 10.0.1.2, tries to telnet
into the server, they will receive a message stating Connection closed by foreign host. In
addition, their login attempt is logged in /var/log/secure:
May 15 17:35:47 boo xinetd[16188]: START: telnet pid=16191 from=10.0.1.2
May 15 17:38:49 boo xinetd[16252]: START: telnet pid=16256 from=10.0.1.2
May 15 17:38:49 boo xinetd[16256]: FAIL: telnet address from=10.0.1.2
May 15 17:38:49 boo xinetd[16252]: EXIT: telnet status=0 pid=16256