|
 |
推荐文章 |
|
|
|
|
|
|
|
|
|
|
configure TCP Wrappers in Solaris 9 |
|
Q. How do I configure TCP Wrappers in Solaris 9 OE?
A. Within Solaris 9 OE, TCP Wrappers (or libwrap in Solaris) are pre-compiled into secure shell (/usr/bin/sshd). Thus to use libwrap explicitly with Solaris Secure Shell, simply create either /etc/hosts.allow or /etc/hosts.deny and edit accordingly. Using TCP Wrappers for other services requires additional steps.
For Solaris Secure Shell or TCP services to use TCP Wrappers, simply create either /etc/hosts.allow or /etc/host.deny. Then insert desired entries using the format "<daemon_list> : <client_list> : <shell_command>". The following are some of the possible valid entries :
sshd: all
in.telnetd: ALL
in.ftpd : 192.168.1.2
#in.rlogin : 10.0.0.
By default, only the first entry ("sshd") works since TCP Wrappers are pre-compiled into Solaris Secure Shell. The subsequent TCP service entries will work only after modifying /etc/default/inetd and then running "# kill -HUP <PID_inetd>". Specifically, uncomment the following pre-defined variable and set its value to "YES". Do the following:
#ENABLE_TCP=NO <-- the default entry
ENABLE_TCP=YES <-- the modified entry; change to this
From the command line:
# pgrep inetd
# kill -HUP <PID_inetd>
It is not necessary to restart the secure shell server or -HUP inetd after modifying /etc/hosts.allow or /etc/hosts.deny. Only enabling or disabling entries in /etc/default/inetd requires a -HUP on inetd. Simply edit the applicable file, save and test.
To test, simply attempt a localhost connection using the applicable service. For instance, assume that the entries listed above exist in /etc/hosts.deny and that /etc/default/inetd has been modified to: "ENABLE_TCP=YES". And be sure to set the host's domain name and IP address to the values configured in the test box. Then perform the following tests to ensure secure shell and TCP service restrictions are set properly:
Note: For the following, replace 'user' with a valid UNIX account user name. Replace 'hostname' with the host name.
# /usr/bin/ssh -l user hostname <-- should fail for everyone
# /usr/bin/telnet -l user hostname <-- should fail for everyone
# /usr/bin/ftp hostname <-- should fail for the specified IP only, not other machines
# /usr/bin/rlogin -l user hostname <-- should succeed for any address since 'in.rlogind' entry is commented out
Be aware that /etc/hosts.allow is processed prior to /etc/hosts.deny. Thus with the entry "sshd: ALL" in both the /etc/hosts.deny and /etc/hosts.allow, secure shell access will be granted to everyone.
For more information on TCP Wrapper configuration, read /etc/default/inetd and the man pages for hosts_access (# man -s4 hosts_access). To get details on Solaris Secure Shell, refer to Infodoc 50465 and Secure Remote Access with the Solaris[tm] 9 Operating Environment.
|
|
|
|
|
|
特别声明： 本站除部分特别声明禁止转载的专稿外的其他文章可以自由转载，但请务必注明出处和原始作者。文章版权归文章原始作者所有。对于被本站转载文章的个人和网站，我们表示深深的谢意。如果本站转载的文章有版权问题请联系编辑人员，我们尽快予以更正。 |
|
|
|
|
|
责任编辑： 原点 |
投稿作者： 本站收集 |
|
|
信息来源： 网络 |
录入时间： 2005-4-19 |
|
|
|
| |
|
设为首页
加入收藏
总编信箱
投稿或申请专栏请先 [登 陆]