O'Reilly - Practical UNIX & Internet Sec... 7015KB

22.3.5 Advanced tcpwrapper Options
Instead of specifying a particular shell command that should be executed when a (daemon, host) line is matched, tcpwrapper allows
you to specify a rich set of options. To use options, you compile the tcpwrapper program with the option -DPROCESS_OPTIONS. If
you compile with -DPROCESS_OPTIONS, you must change the files /etc/hosts.allow and /etc/hosts.deny files to reflect that change;
the format of these files when tcpwrapper is compiled with -DPROCESS_OPTIONS is incompatible with the format of the files
when tcpwrapper is compiled without the options.
If you do compile with -DPROCESS_OPTIONS, the new format of the /etc/hosts.allow and /etc/hosts.deny becomes:
daemon_list : client_host_list : option : option ...
Because you may have more than one option on a line, if you need to place a colon (:) within the option, you must protect it with a
backslash (\).
The options allow you considerable flexibility in handling a variety of conditions. They also somewhat obsolete the need to have
separate /etc/hosts.allow and /etc/hosts.deny files, as the words "allow" and "deny" are now option keywords (making it possible to
deny a specific pair (daemon, client) in the /etc/hosts.allow file, or vice versa). Although you should check tcpwrapper's
documentation for a current list of options, most of them are included in Table 22.3
Table 22.3: Advanced Options for tcpwrapper When Compiled with -DPROCESS_OPTIONS
Option Effect
allow Allows the connection.
deny Denies the connection.
Options for dealing with sub-shells:
nice nn Changes the priority of the process to nn. Use numbers such as +4 or +8 to reduce the amount of CPU
time allocated to network services.
setenv name value Sets the environment variable name to value for the daemon.
spawn shell_command Runs the shell_command. The streams stdin, stdout, and stderr are connected to /dev/null to avoid
conflict with any communications with the client.
twist shell_command Runs the shell_command. The streams stdin, stdout, and stderr are connected to the remote client. This
allows you to run a server process other than the one specified in the file /etc/inetd.conf. (Note: Will not
work with some UDP services.)
umask nnn Specifies the umask that should be used for sub-shells. Specify it in octal.
user username Assume the privileges of username. (Note: tcpwrapper must be running as root for this option to work.)
user username.groupname Assume the privileges of username and set the current group to be groupname.
Options for dealing with the network connection:
banners /some/directory/ Specifies a directory that contains banner files. If a filename is found in the banner directory that has the
same name as the network server (such as telnetd), the contents of the banner file are sent to the client
before the TCP connection is turned over to the server. This process allows you to send clients messages,
for example, informing them that unauthorized use of your computer is prohibited.
keepalive Causes the UNIX kernel to periodically send a message to a client process; if the message cannot be
sent, the connection is automatically broken.
linger seconds Specifies how long the UNIX kernel should spend trying to send a message to the remote client after the
server closes the connection.
rfc931 [timeout in seconds] Specifies that the ident protocol should be used to attempt to determine the username of the person
running the client program on the remote computer. The timeout, if specified, is the number of seconds
that tcpwrapper should spend waiting for this information.
.
[Chapter 22] 22.3 tcpwrapper
Don't be afraid of using these so-called "advanced" options: they actually allow you to have simpler configurations than the
/etc/hosts.allow and /etc/hosts.deny files.
NOTE: The following examples use DNS hostnames for clarity. For added security, use IP addresses instead.
Suppose you wish to allow all connections to your computer, except those from the computers in the domain pirate.net, with this
very simple /etc/hosts.allow file; specify:
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch22_03.htm (5 of 9) [2002-04-12 10:45:59]