User guide

Additional Resources
65
socket_type = stream
wait = no
server = /usr/kerberos/sbin/telnetd
log_on_success += DURATION USERID
log_on_failure += USERID
bind = 123.123.123.123
redirect = 10.0.1.13 23
}
The bind and redirect options in this file ensure that the Telnet service on the machine is bound to
the external IP address (123.123.123.123), the one facing the Internet. In addition, any requests for
Telnet service sent to 123.123.123.123 are redirected via a second network adapter to an internal
IP address (10.0.1.13) that only the firewall and internal systems can access. The firewall then
sends the communication between the two systems, and the connecting system thinks it is connected
to 123.123.123.123 when it is actually connected to a different machine.
This feature is particularly useful for users with broadband connections and only one fixed IP address.
When using Network Address Translation (NAT), the systems behind the gateway machine, which
are using internal-only IP addresses, are not available from outside the gateway system. However,
when certain services controlled by xinetd are configured with the bind and redirect options,
the gateway machine can act as a proxy between outside systems and a particular internal machine
configured to provide the service. In addition, the various xinetd access control and logging options
are also available for additional protection.
2.3.4.3.4. Resource Management Options
The xinetd daemon can add a basic level of protection from Denial of Service (DoS) attacks. The
following is a list of directives which can aid in limiting the effectiveness of such attacks:
• per_source — Defines the maximum number of instances for a service per source IP address. It
accepts only integers as an argument and can be used in both xinetd.conf and in the service-
specific configuration files in the xinetd.d/ directory.
• cps — Defines the maximum number of connections per second. This directive takes two integer
arguments separated by white space. The first argument is the maximum number of connections
allowed to the service per second. The second argument is the number of seconds that xinetd
must wait before re-enabling the service. It accepts only integers as arguments and can be used in
either the xinetd.conf file or the service-specific configuration files in the xinetd.d/ directory.
• max_load — Defines the CPU usage or load average threshold for a service. It accepts a floating
point number argument.
The load average is a rough measure of how many processes are active at a given time. See the
uptime, who, and procinfo commands for more information about load average.
There are more resource management options available for xinetd. Refer to the xinetd.conf man
page for more information.
2.3.5. Additional Resources
More information about TCP Wrappers and xinetd is available from system documentation and on
the Internet.
2.3.5.1. Installed TCP Wrappers Documentation
The documentation on your system is a good place to start looking for additional configuration options
for TCP Wrappers, xinetd, and access control.