Securing Linux: Part 2
The only issue out here is about configuring the inetd daemon to accept the
connection and pass on the connection to the particular service.
Edit the /etc/inetd.conf and comment out the services that you wouldn't
want running on your machine. The inetd daemon also allows you to restrict
connections made to the inetd server through two main files located on your
/etc directory. These files are /etc/hosts.allow and /etc/hosts.deny.
This mechanism of exhibiting control over the process of administering the
connections to the various services is what is known as TCP WRAPPERS.
Through these two files on your system you can control access to all the
services that run.
Before making any changes take a backup of both of the files. Now, edit the
file /etc/hosts.deny in your favourite text editor and delete all the
entries. Add the following to the file.
ALL:ALL
Close the file and save the changes to hard disk. Having done this you have
disabled access to all the services that you run through your inetd daemon.
If you would like to know about the failed connection attempts to your
machine then change the above entry to the following.
ALL:ALL:/bin/mail -s "%s connection attempt from %c" freeos@localhost
Close and save the file. What we have done is asked the inetd daemon to
monitor for any failed connection attempts to the servers that we are
running through the inetd daemon. In case any failed attempts are made, a
mail is sent to "freeos@localhost" with the name of the service to which
the connection was made and the IP address from which the connection
originated.
Let's now learn how to enable services to specific daemons. Edit the file
/etc/hosts.allow in your favourite text editor and the following line to
your file.
in.telnetd: 192.168.1.
in.ftpd: freeos.linuxlinks.com, mydom.yahoo.com
Though these entries are pretty obvious lets quickly go through each one of
them. The first entry is for the "in.telnetd" server, which is the telnet
server. The IP address range 192.168.1. allows any IP addresses from
192.168.1.1 - 192.168.1.255 to connect to the telnet server on this
machine. Similar to this is the next entry, the only difference being that
the restrictions apply to the "in.ftpd", the FTP server. Machines, which
are allowed connections to the FTP server, have been explicitly mentioned
out here. Thus we have firewalled the services that run through the inetd
- « first
- ‹ previous
- of 6
- next ›
- last »