|
|
|
There is an optional security file associated with inetd that allows
you to control which nodes have access to the Internet Services available on
your system. The inetd security file will prevent inetd from
starting a service unless the node making the request has permission to do so.
Individual entries in the inetd security file determine which nodes are
allowed or disallowed for a particular service.
The inetd security file is not the only security provided for Internet
Services. It constitutes an extra layer of security in addition to the normal
checks done by the services themselves. If the inetd security file does
not exist, if a remote service is not listed in the security file, or if it is
listed but it is not followed by the allow or deny key word,
all remote hosts can attempt to use it. Such an attempt will succeed if it
passes the security checks imposed by the requested service.
If inetd refuses a connection for security reasons, and inetd
connection logging is enabled, a message is sent to the console indicating that
there was an unsuccessful connection attempt.
Creating and Linking inetd Security File
You may already have a security file for inetd installed on your
system. If you know that you have such a file, and it is accessible by the POSIX
file name /usr/adm/inetd.sec you may skip these steps.
If not, follow the steps below to create the file and link to it. If you have
such a file, but are unsure whether or not it is linked, perform step 2 only.
- Create your own inetd security file by using the COPY
command to rename the sample file. Enter:
:COPY INSECSMP.NET.SYS TO INETDSEC.NET.SYS
- Create a symbolic link from /usr/adm/inetd.sec in the POSIX
name space to INETDSEC.NET.SYS. Enter:
:NEWLINK /usr/adm/inetd.sec, INETDSEC.NET.SYS
- Check the security provisions of the file and change them, if necessary.
Hewlett-Packard recommends that only MANAGER.SYS has write access
to INETDSEC.NET.SYS, and write and purge access to
/usr/adm/inetd.sec.
Updating inetd Security File
Each line in the inetd security file contains a service name, a
permission field, and the IP addresses or domain names of the
hosts and networks allowed to use that service on your host system. You can open
the file to view the current security restraints or to change them. To do so:
- Open the security file with an MPE text editor. The contents will resemble
the following:
# The lines in the file contain a service name, permission field and
# the Internet addresses or names of the hosts and/or networks
# allowed to use that service in the local machine.
# The form for each entry in this file is:
#
# <service name> <allow/deny> <host/network addresses, host/network names>
#
# For example:
#
# telnet allow 10.3-5 192.34.56.5 ahost anetwork
#
# The above entry allows the following hosts to attempt to access your
# system using telnet:
# hosts in subnets 3 through 5 in network 10,
# the host with Internet Address of 192.34.56.5,
# the host by the name of "ahost",
# all the hosts in the network "anetwork"
#
# tftp deny 192.23.4.3
#
# The tftp entry denies host 192.23.4.3 to access your system using tftp
#
# Hosts and network names must be official names, not aliases.
# See the Configuring and Installing Internet Services Manual for more
# information.
The word allow or deny in the second column determines whether
the list of remote hosts in the next field to the right has access to the
specified service. If there is more than one line for a service, regardless of
whether a statement indicates allow or deny, the inetd
server ignores all but the last line.
-
Make any necessary editing changes. Refer to the following three sections,
"Editing Tips", "Using Wildcard Characters" and "Using Range Character"
for more information.
-
Save your file and exit the editor.
Editing Tips
When you edit the inetd security file, remember the following points:
- To "comment out" a line, begin column 1 with a pound symbol
(#). To enable a security provision that has been
commented out, delete the pound symbol and any blank
spaces preceding the service name.
-
Enter the real service name, not the alias, of a valid service in the
inetd configuration file.
-
Separate the IP addresses and domain names by a white space. You may
enter any mix of addresses and names. For example, the following entry
denies Telnet access to host hp22.cup.hp.com, any
hosts on the network named "testlan," and the host with IP address
192.54.24.5:
telnet deny hp22.cup.hp.com testlan 192.54.24.5
-
To continue an entry on the next line, place a slash (/)
at the end of the line to be continued. The Internet
daemon will ignore a slash that appears in the middle of the line,
continue reading to the end, and ignore the next line. In this case, it
will probably misinterpret the entry and you will see an error
message.
Using Wildcard Characters
You may use wildcard characters (*) in any of the fields of the address
to specify permissions for a group of hosts or networks. This makes it more
convenient to specify an entire network, since you will not need to specify each
host in that network. The following sample entry, for example, allows all hosts
with network addresses starting with a 10, as well as the single host whose
address is 192.54.24.5 to use Telnet:
telnet allow 10.* 192.54.24.5
You cannot use the wildcard character in combination with other integers in one
part of an address field. For example, this entry in the inetd security
file will generate an error message because the second field includes a
5 followed by the * character:
tftp deny 10.5*
Either integers or the wildcard character is allowed in one part
of an address field.
Using Range Character
You may use the range indicator (-) in any of the fields of the address
to specify which hosts or networks in a group are exempted from the permission
assignment. This makes it more convenient to allow or deny a service for a
subnet within the network you specify. The following sample entry, for example,
denies hosts in subnets 3 through 5 of network 10 access to Telnet.
Note that the wildcard character * at the end of the address lets you
avoid specifying the individual hosts within the subnet.
telnet deny 10.3-5.*
|
