O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 22] 22.4 SOCKS
Obviously, token expansions that require that sockd look up a value in a database (such as %A, %S, and %Z) will take longer to
execute than token expansions that merely report an IP or port number (such as %a, %s and %z).
This example command runs finger to determine the users on a particular computer, and then sends the results to the root account of
the computer that is running sockd:
/usr/ucb/finger @%A | /bin/mailx -s 'SOCKS: rejected %u@%A' root
22.4.6.1 #NO_IDENTD and #BAD_ID
In addition to the pattern matching described above, sockd allows you to specify rules that will match any computer contacting the
sockd daemon which is not running the ident protocol, or for which the username returned by the ident protocol is different from the
username provided in the initial sockd contact. These lines have the form:
#NO_IDENTD: command
#BAD_ID: command
22.4.6.2 Example /etc/sockd.conf configuration files
Here are some example lines from an /etc/sockd.conf configuration file. The configuration file is designed to protect an organization
that has placed a set of UNIX workstations on IP subnet 204.99.90.
deny
204.99.90.0 255.255.255.0 204.99.90.0 255.255.255.0
This initial rule disallows access to the internal network from internal computers using SOCKS. (Why tie up the SOCKS
server if you don't need to?)
allow
0.0.0.0 0.0.0.0 204.99.90.100 255.255.255.255 eq 25
Allows connections to port 25 (SMTP) of the machine 204.99.90.100. This allows incoming electronic mail to that network.
allow
204.99.90.100 255.255.255.255 0.0.0.0 0.0.0.0 eq 25
Allows outgoing connections from the machine 204.99.90.100 to port 25 of any computer on the Internet. This rule allows the
organization to send mail to outside computers.
allow
deny
204.99.90.0 255.255.255.0 0.0.0.0 0.0.0.0
Allows outgoing connections from any host on subnet 204.99.90 to any computer on the Internet. If you have this rule, the
previous rule is unnecessary.
0.0.0.0 0.0.0.0 204.99.90.255 255.255.255.000 eq 23 : \
safe_finger @%A |/bin/mailx -s 'Telnet denied from %U/%A' root
This rather complex rule denies any attempted login to the organization's internal network. In addition to stopping the logins, it also
does a finger of the computer from where the attempt is coming and sends email to the root account of the computer running sockd.
If the remote machine is running the ident protocol, the username will be sent as well.
deny
NOTE: Do not use reverse finger for logging contacts on the finger port (port 79). Otherwise, a loop may result, with
two sockd daemons continually attempting to finger each other until they are manually shut down or the disks fill up.
0.0.0.0 0.0.0.0 204.99.90.0 255.255.255.0
Denies all other connections to the subnet 204.99.99. Strictly speaking, this rule is not necessary, as a connection that does not
specifically match the "allow" rules above will be rejected.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch22_04.htm (6 of 8) [2002-04-12 10:45:45]