configure TCP Wrappers in Solaris 9

王朝other·作者佚名  2006-11-24
窄屏简体版  字體: |||超大  

Q. How do I configure TCP Wrappers in Solaris 9 OE?

A. Within Solaris 9 OE, TCP Wrappers (or libwrap in Solaris) are pre-compiled into secure shell (/usr/bin/sshd). Thus to use libwrap explicitly with Solaris Secure Shell, simply create either /etc/hosts.allow or /etc/hosts.deny and edit accordingly. Using TCP Wrappers for other services requires additional steps.

For Solaris Secure Shell or TCP services to use TCP Wrappers, simply create either /etc/hosts.allow or /etc/host.deny. Then insert desired entries using the format "<daemon_list> : <client_list> : <shell_command>". The following are some of the possible valid entries :

sshd: all

in.telnetd: ALL

in.ftpd : 192.168.1.2

#in.rlogin : 10.0.0.

By default, only the first entry ("sshd") works since TCP Wrappers are pre-compiled into Solaris Secure Shell. The subsequent TCP service entries will work only after modifying /etc/default/inetd and then running "# kill -HUP <PID_inetd>". Specifically, uncomment the following pre-defined variable and set its value to "YES". Do the following:

#ENABLE_TCP=NO <-- the default entry

ENABLE_TCP=YES <-- the modified entry; change to this

From the command line:

# pgrep inetd

# kill -HUP <PID_inetd>

It is not necessary to restart the secure shell server or -HUP inetd after modifying /etc/hosts.allow or /etc/hosts.deny. Only enabling or disabling entries in /etc/default/inetd requires a -HUP on inetd. Simply edit the applicable file, save and test.

To test, simply attempt a localhost connection using the applicable service. For instance, assume that the entries listed above exist in /etc/hosts.deny and that /etc/default/inetd has been modified to: "ENABLE_TCP=YES". And be sure to set the host's domain name and IP address to the values configured in the test box. Then perform the following tests to ensure secure shell and TCP service restrictions are set properly:

Note: For the following, replace 'user' with a valid UNIX account user name. Replace 'hostname' with the host name.

# /usr/bin/ssh -l user hostname <-- should fail for everyone

# /usr/bin/telnet -l user hostname <-- should fail for everyone

# /usr/bin/ftp hostname <-- should fail for the specified IP only, not other machines

# /usr/bin/rlogin -l user hostname <-- should succeed for any address since 'in.rlogind' entry is commented out

Be aware that /etc/hosts.allow is processed prior to /etc/hosts.deny. Thus with the entry "sshd: ALL" in both the /etc/hosts.deny and /etc/hosts.allow, secure shell access will be granted to everyone.

For more information on TCP Wrapper configuration, read /etc/default/inetd and the man pages for hosts_access (# man -s4 hosts_access). To get details on Solaris Secure Shell, refer to Infodoc 50465 and Secure Remote Access with the Solaris[tm] 9 Operating Environment.

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航