Pick a Free OS

User login

Navigation

Securing Linux: Part 2

The only issue out here is about configuring the inetd daemon to accept the

connection and pass on the connection to the particular service.

Edit the /etc/inetd.conf and comment out the services that you wouldn't

want running on your machine. The inetd daemon also allows you to restrict

connections made to the inetd server through two main files located on your

/etc directory. These files are /etc/hosts.allow and /etc/hosts.deny.

This mechanism of exhibiting control over the process of administering the

connections to the various services is what is known as TCP WRAPPERS.

Through these two files on your system you can control access to all the

services that run.

Before making any changes take a backup of both of the files. Now, edit the

file /etc/hosts.deny in your favourite text editor and delete all the

entries. Add the following to the file.

ALL:ALL

Close the file and save the changes to hard disk. Having done this you have

disabled access to all the services that you run through your inetd daemon.

If you would like to know about the failed connection attempts to your

machine then change the above entry to the following.

ALL:ALL:/bin/mail -s "%s connection attempt from %c" freeos@localhost

Close and save the file. What we have done is asked the inetd daemon to

monitor for any failed connection attempts to the servers that we are

running through the inetd daemon. In case any failed attempts are made, a

mail is sent to "freeos@localhost" with the name of the service to which

the connection was made and the IP address from which the connection

originated.

Let's now learn how to enable services to specific daemons. Edit the file

/etc/hosts.allow in your favourite text editor and the following line to

your file.

in.telnetd: 192.168.1.

in.ftpd: freeos.linuxlinks.com, mydom.yahoo.com

Though these entries are pretty obvious lets quickly go through each one of

them. The first entry is for the "in.telnetd" server, which is the telnet

server. The IP address range 192.168.1. allows any IP addresses from

192.168.1.1 - 192.168.1.255 to connect to the telnet server on this

machine. Similar to this is the next entry, the only difference being that

the restrictions apply to the "in.ftpd", the FTP server. Machines, which

are allowed connections to the FTP server, have been explicitly mentioned

out here. Thus we have firewalled the services that run through the inetd